Function at 0x140006110
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1400dc3e8]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r14d, r8d
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rsp + 0x68], r15
test rdx, rdx
je 0x1400065e5
mov eax, dword [0x1400ace70]
cmp dword [rcx], eax
jne 0x14000618b
mov eax, dword [0x1400ace74]
cmp dword [rcx + 4], eax
jne 0x14000618b
mov eax, dword [0x1400ace78]
cmp dword [rcx + 8], eax
jne 0x14000618b
mov eax, dword [0x1400ace7c]
cmp dword [rcx + 0xc], eax
je 0x1400065e5
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ae468]
mov r12d, 1
mov r8d, r12d
xor edx, edx
lea rcx, [0x1400ace60]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400065e5
jmp 0x140006223
mov rax, qword [rsi + 8]
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x78], xmm0
lea r9, [rbp - 0x78]
mov r8d, r12d
mov rdx, rbx
test r14d, r14d
je 0x140006202
cmp ecx, r12d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x1400061ec
mov rax, qword [rax + 0x28]
jmp 0x1400061f0
mov rax, qword [rax + 0x38]
call qword [case.0x14006f593.0]
mov edi, eax
test eax, eax
js 0x1400065e8
jmp 0x14000621f
cmp ecx, r12d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x140006215
mov rax, qword [rax + 0x30]
jmp 0x140006219
mov rax, qword [rax + 0x40]
call qword [case.0x14006f593.0]
add rsi, 0x10
mov ecx, dword [rsi]
test ecx, ecx
jne 0x1400061be
test r14d, r14d
jne 0x1400065e5
lea r8d, [rcx + 0x40]
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x140006252
lea edi, [rax + 0xd]
jmp 0x1400065e8
lea r8, str.CLSID_
mov ebx, 0x80
mov edx, ebx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea esi, [rbx - 0x74]
lea r14d, [rbx - 0x6a]
test eax, eax
je 0x140006298
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
lea r8, [rbp + 0xa0]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x1400062d3
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
lea r8, str.Required_Categories
mov rdx, rbx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x14000630e
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x60], r15d
mov r9d, 0x20019
lea r8, [rbp - 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x70]
call fcn.140005e54
test eax, eax
jne 0x140006423
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14000639d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], r15d
test rdi, rdi
jne 0x14000641e
cmp dword [rsp + 0x60], r15d
jne 0x14000641e
cmp byte [0x1400e7510], r15b
jne 0x1400063f2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400063e2
lea rdx, [0x1400ad190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e74d8], rax
jmp 0x1400063e9
mov rax, qword [0x1400e74d8]
mov byte [0x1400e7510], r12b
jmp 0x1400063f9
mov rax, qword [0x1400e74d8]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x140006417
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14006f593.0]
jmp 0x14000641e
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov ebx, 0x80
lea r8, str.CLSID_
mov rdx, rbx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
je 0x14000645e
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
lea r8, [rbp + 0xa0]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x140006499
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
lea r8, str.Implemented_Categories
mov rdx, rbx
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
je 0x1400064d4
cmp eax, esi
je 0x14000662d
cmp eax, r14d
je 0x140006643
cmp eax, 0x22
je 0x140006643
cmp eax, 0x50
jne 0x140006638
mov r9d, 0x20019
lea r8, [rbp - 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x70]
call fcn.140005e54
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x1400065ca
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14000654e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
test rdi, rdi
jne 0x1400065ca
cmp dword [rsp + 0x60], r15d
jne 0x1400065ca
cmp byte [0x1400e7510], r15b
jne 0x14000659e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000658e
lea rdx, [0x1400ad190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e74d8], rax
jmp 0x140006595
mov rax, qword [0x1400e74d8]
mov byte [0x1400e7510], r12b
jmp 0x1400065a5
mov rax, qword [0x1400e74d8]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x1400065c3
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14006f593.0]
jmp 0x1400065ca
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test rbx, rbx
je 0x1400065d8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r15d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140006600
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14006f593.0]
nop
mov eax, edi
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140092030
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140005c3c
int3
mov ecx, 0x80004005
call fcn.140005c3c
int3
mov ecx, 0x80070057
call fcn.140005c3c
int3