Function at 0x4af838
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x22d0
call fcn.006e5e00
sub rsp, rax
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + 0x22f8], rbx
mov rbp, rdx
mov rax, rcx
xor ecx, ecx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], ecx
mov ecx, dword [rsp + 0x2310]
mov dword [rsp + 0x90], ecx
mov rcx, rax
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jge 0x4af8a2
jmp 0x4b0221
cmp word [rbp], 0x7d
je 0x4b0211
mov eax, 1
mov dword [rsp + 0x68], eax
lea rdx, str.Delete
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
mov esi, edi
cmp eax, edi
sete sil
lea rdx, str.ForceRemove
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x4af8ec
cmp esi, edi
je 0x4afa08
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
cmp dword [rsp + 0x2308], edx
je 0x4afa06
mov qword [rsp + 0x80], rdx
mov dword [rsp + 0x88], edx
mov rcx, rbp
movzx eax, word [rbp]
cmp ax, dx
je 0x4af954
cmp ax, 0x5c
je 0x4af94b
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
xor edx, edx
cmp ax, dx
jne 0x4af930
jmp 0x4af954
cmp rcx, rdx
jne 0x4b010d
lea rdi, str.AppID
mov rdx, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4af9b5
add rdi, 8
lea rax, str.HKCR
cmp rdi, rax
jl 0x4af95b
mov rax, qword [rsp + 0x2300]
mov qword [rsp + 0x80], rax
xor edi, edi
mov dword [rsp + 0x88], edi
mov rdx, rbp
lea rcx, [rsp + 0x80]
call fcn.004af4f0
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x88], edi
jmp 0x4af9b7
xor edi, edi
cmp esi, edi
je 0x4af9fd
mov rdx, rbp
mov rsi, qword [rsp + 0x22f0]
mov rcx, rsi
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
mov rdx, rbp
mov rcx, rsi
call fcn.004af470
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
mov dword [rsp + 0x88], edx
jmp 0x4afd30
mov dword [rsp + 0x88], edi
jmp 0x4afa08
xor edi, edi
lea rdx, str.NoRemove
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x4afa40
mov esi, edi
mov dword [rsp + 0x68], edi
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
jmp 0x4afa46
mov esi, dword [rsp + 0x68]
jmp 0x4afa48
xor edi, edi
lea rdx, [0x00799ee0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x4afba1
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
cmp word [rbp], 0x3d
jne 0x4b016e
cmp dword [rsp + 0x2308], edx
je 0x4afb12
mov rax, qword [rsp + 0x2300]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], edx
mov r9, rbp
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0x98]
mov rsi, qword [rsp + 0x22f0]
mov rcx, rsi
call fcn.004aefd4
mov edi, eax
xor edx, edx
mov qword [rsp + 0x98], rdx
mov dword [rsp + 0xa0], edx
cmp eax, edx
jl 0x4b0125
mov dword [rsp + 0xa0], edx
jmp 0x4afd30
cmp dword [rsp + 0x2310], edx
jne 0x4afb80
cmp esi, edx
je 0x4afb80
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
jne 0x4b015e
mov rsi, qword [rsp + 0x60]
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x4afb72
cmp eax, 2
jne 0x4b013a
cmp rsi, rdi
je 0x4afb80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af470
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
jmp 0x4b00f8
mov rcx, rbp
movzx eax, word [rbp]
xor esi, esi
cmp ax, si
je 0x4afbd1
cmp ax, 0x5c
je 0x4afbc8
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
cmp ax, si
jne 0x4afbaf
jmp 0x4afbd1
cmp rcx, rsi
jne 0x4b0186
cmp dword [rsp + 0x2308], esi
je 0x4afd95
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbp
mov rdi, qword [rsp + 0x2300]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4afc34
mov eax, esi
cmp rbx, rsi
je 0x4afc1e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], esi
cmp eax, esi
je 0x4afceb
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4afc7e
mov eax, esi
cmp rbx, rsi
je 0x4afc6c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], esi
cmp eax, esi
je 0x4afceb
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x4b019e
mov eax, esi
cmp rbx, rsi
je 0x4afcd5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], esi
cmp eax, esi
jne 0x4b019e
mov rdx, rbp
mov rsi, qword [rsp + 0x22f0]
mov rcx, rsi
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
cmp word [rbp], 0x3d
jne 0x4afd30
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.004aefd4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
cmp word [rbp], 0x7b
jne 0x4b00f8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x4b00f6
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x2308]
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.004af838
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
mov rdx, rbp
mov rcx, rsi
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
jmp 0x4b00f8
mov edi, dword [rsp + 0x2310]
cmp edi, esi
jne 0x4afdf5
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x4afdfc
mov esi, eax
cmp rbx, rax
je 0x4afde5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], eax
jmp 0x4afdfc
mov esi, 2
xor eax, eax
cmp esi, eax
mov eax, 1
cmovne edi, eax
mov dword [rsp + 0x2310], edi
or r9, 0xffffffffffffffff
mov r8, rbp
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.006a6c68
xor ecx, ecx
cmp eax, ecx
je 0x4afe50
cmp eax, 0xc
je 0x4b01cf
cmp eax, 0x16
je 0x4b01c4
cmp eax, 0x22
je 0x4b01c4
cmp eax, 0x50
jne 0x4b01b9
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af470
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
cmp word [rbp], 0x7b
jne 0x4afef7
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x4afef5
mov eax, dword [rsp + 0x2310]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af838
mov edi, eax
xor edx, edx
cmp eax, edx
jge 0x4afed7
cmp dword [rsp + 0x2310], edx
je 0x4b0211
mov rdx, rbp
mov rcx, qword [rsp + 0x22f0]
call fcn.004af6b4
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x4b0211
jmp 0x4afef7
xor edx, edx
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2310], eax
cmp esi, 2
je 0x4b00f8
cmp esi, edx
je 0x4aff1f
cmp eax, edx
je 0x4b01da
jmp 0x4b00f8
cmp eax, edx
je 0x4affd3
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
jne 0x4affd3
mov eax, edx
cmp dword [rsp + 0x60], edx
seta al
cmp eax, edx
je 0x4affd3
lea rsi, str.AppID
mov rdx, qword [rsi]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x4b00f8
add rsi, 8
lea rax, str.HKCR
cmp rsi, rax
jl 0x4aff83
mov eax, dword [rsp + 0x68]
cmp eax, edx
je 0x4b00f8
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
call fcn.004af4f0
xor edx, edx
jmp 0x4b00f8
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
je 0x4b001f
mov esi, edx
jmp 0x4b0029
mov esi, edx
cmp dword [rsp + 0x60], edx
seta sil
mov eax, edx
cmp rbx, rdx
je 0x4b0043
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rbx, rdx
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x78], edx
cmp eax, edx
jne 0x4b01f4
mov eax, dword [rsp + 0x68]
cmp eax, edx
je 0x4b00f8
cmp esi, edx
jne 0x4b00f8
cmp byte [0x008bb5a8], dl
jne 0x4b00ae
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
cmp rax, rdx
je 0x4b009a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x008bb5b0], rax
xor edx, edx
jmp 0x4b00a1
mov rax, qword [0x008bb5b0]
mov ecx, 1
mov byte [0x008bb5a8], cl
jmp 0x4b00b5
mov rax, qword [0x008bb5b0]
cmp rax, rdx
je 0x4b00d4
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x2300]
call rax
jmp 0x4b00ea
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edx, edx
cmp eax, edx
jne 0x4b01e7
jmp 0x4b00f8
xor edx, edx
cmp word [rbp], 0x7d
je 0x4b0211
mov eax, 1
jmp 0x4af8b2
cmp rbx, rdx
je 0x4b011b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4b0221
cmp rbx, rdx
je 0x4b0133
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4b0221
mov ecx, eax
call fcn.004af6a4
mov edi, eax
xor edx, edx
cmp rsi, rdx
je 0x4b0211
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
jmp 0x4b0211
mov ecx, eax
call fcn.004af6a4
mov edi, eax
xor edx, edx
jmp 0x4b0211
cmp rbx, rdx
je 0x4b017c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4b0221
cmp rbx, rsi
je 0x4b0194
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x4b0221
mov ecx, eax
call fcn.004af6a4
mov edi, eax
cmp rbx, rsi
je 0x4b01b5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4b0221
mov ecx, 0x80004005
call fcn.00401c88
int3
mov ecx, 0x80070057
call fcn.00401c88
int3
mov ecx, 0x8007000e
call fcn.00401c88
int3
mov ecx, esi
call fcn.004af6a4
mov edi, eax
xor edx, edx
jmp 0x4b0211
mov ecx, eax
call fcn.004af6a4
mov edi, eax
xor edx, edx
jmp 0x4b0211
mov ecx, eax
call fcn.004af6a4
mov edi, eax
xor eax, eax
cmp rbx, rax
je 0x4b020d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4b0221
cmp rbx, rdx
je 0x4b021f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x22f8]
add rsp, 0x22d0
pop rdi
pop rsi
pop rbp
ret