Function at 0x14003ac88
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rdx
mov rdi, rcx
and qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.14003af18
mov ebx, eax
test eax, eax
je 0x14003ad2d
call fcn.140016c38
mov rdi, rax
cmp dword [rax], 3
jbe 0x14003ad17
mov rcx, rsi
call fcn.1400101b0
mov qword [rbp - 0x40], rax
mov dword [rbp + 0x30], ebx
lea rax, str.Could_not_open_the_registry_key
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005ddbf]
mov rcx, rdi
call fcn.14000fc18
test ebx, ebx
jle 0x14003adb0
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14003adb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rax, [rbp - 0x18]
mov qword [rbp - 0x40], rax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14003ad49
mov rdx, qword [rdi]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
nop dword [rax + rax]
test al, al
jne 0x14003adc0
call fcn.140016c38
mov rbx, rax
cmp dword [rax], 3
jbe 0x14003ada2
mov rcx, rdi
call fcn.1400101b0
mov qword [rbp + 0x30], rax
lea rax, str.Could_not_create_a_UNICODE_STRING_to_hold_valueName
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005dece]
mov rcx, rbx
call fcn.140012440
lea rcx, [rbp - 0x40]
call fcn.14003aa04
mov ebx, 0x80070057
lea rcx, [rbp + 0x38]
call fcn.14001a150
mov eax, ebx
jmp 0x14003aed8
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003ae6a
cmp eax, 0xc0000034
je 0x14003ae6a
call fcn.140016c38
mov r14, rax
cmp dword [rax], 3
jbe 0x14003ae4f
mov rcx, rsi
call fcn.1400101b0
mov qword [rbp - 0x38], rax
mov rcx, rdi
call fcn.1400101b0
mov qword [rbp - 0x30], rax
mov dword [rbp + 0x30], ebx
lea rax, str.Failed_to_delete_registry_value
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005de53]
mov rcx, r14
call fcn.140002c04
lea rcx, [rbp - 0x40]
call fcn.14003aa04
lea rcx, [rbp + 0x38]
call fcn.14001a150
bts ebx, 0x1c
jmp 0x14003adb9
call fcn.140016c38
mov rbx, rax
cmp dword [rax], 4
jbe 0x14003aec4
mov rcx, rsi
call fcn.1400101b0
mov qword [rbp + 0x30], rax
mov rcx, rdi
call fcn.1400101b0
mov qword [rbp - 0x28], rax
lea rax, str.Delete_registry_value
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005de94]
mov rcx, rbx
call fcn.14000189c
lea rcx, [rbp - 0x40]
call fcn.14003aa04
lea rcx, [rbp + 0x38]
call fcn.14001a150
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret