Function at 0x140010c80
Capabilities:
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x78], rbx
mov rax, qword [0x14017b278]
xor rax, rbp
mov qword [rbp + 0x10], rax
xor ebx, ebx
mov qword [rbp + 8], 6
mov qword [rbp], rbx
mov r12, r8
mov r15, rdx
mov r13, rcx
mov esi, ebx
mov edi, ebx
test rdx, rdx
je 0x140010e19
cmp bx, word [rdx]
je 0x140010e19
mov qword [rsp + 0x38], rbx
lea r9d, [rbx - 1]
mov qword [rsp + 0x30], rbx
lea ecx, [rbx + 3]
mov r8, rdx
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x140010d10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140010ffe
xor ecx, ecx
movsxd rbx, r14d
lea rax, [rbx + 0x10]
cmp rax, rbx
cmova rcx, rax
test rcx, rcx
je 0x140010e73
cmp rcx, 0x400
ja 0x140010d67
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x140010d45
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140087b20
sub rsp, rax
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x140010e73
mov dword [rsi], 0xcccc
jmp 0x140010d7a
call fcn.14009fb80
mov rsi, rax
test rax, rax
je 0x140010d7e
mov dword [rax], 0xdddd
add rsi, 0x10
test rsi, rsi
je 0x140010e73
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.14009b2d0
xor eax, eax
mov r8, r15
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov qword [rsp + 0x20], rax
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140010e07
cmp r14d, eax
jge 0x140010dce
mov ebx, 0xea
jmp 0x140010fd5
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.14009b2d0
xor ebx, ebx
mov r8, r15
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r14d
lea r9d, [rbx - 1]
mov qword [rsp + 0x20], rsi
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140010e19
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140010fd5
xor ebx, ebx
test r12, r12
je 0x140010f85
cmp bx, word [r12]
je 0x140010f85
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
mov r8, r12
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
test eax, eax
jne 0x140010e7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r15d, r15d
mov ebx, eax
mov r14d, r15d
test eax, eax
jne 0x140010fd0
jmp 0x140010e80
mov ebx, SafeArrayGetDim
jmp 0x140010ffe
xor r15d, r15d
movsxd rbx, r14d
mov rcx, r15
lea rax, [rbx + 0x10]
cmp rax, rbx
cmova rcx, rax
test rcx, rcx
je 0x140011035
cmp rcx, 0x400
ja 0x140010ed8
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x140010eb6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140087b20
sub rsp, rax
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x140011038
mov dword [rdi], 0xcccc
jmp 0x140010eeb
call fcn.14009fb80
mov rdi, rax
test rax, rax
je 0x140010eef
mov dword [rax], 0xdddd
add rdi, 0x10
test rdi, rdi
je 0x140011038
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14009b2d0
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r15d
mov r8, r12
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140010f79
cmp r14d, eax
jge 0x140010f40
mov ebx, 0xea
jmp 0x140010fd0
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14009b2d0
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov r9d, 0xffffffff
mov dword [rsp + 0x28], r14d
mov r8, r12
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140010f85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140010fd0
cmp dword [rbp + 8], 6
je 0x140010f9a
mov rcx, qword [rbp]
test rcx, rcx
je 0x140010f9a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 8], eax
mov ebx, eax
test eax, eax
jne 0x140010fd0
mov rcx, qword [rbp]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, eax
test rsi, rsi
je 0x140010fe7
cmp dword [rsi - 0x10], 0xdddd
lea rcx, [rsi - 0x10]
jne 0x140010fe7
call fcn.14009f768
test rdi, rdi
je 0x140010ffe
cmp dword [rdi - 0x10], 0xdddd
lea rcx, [rdi - 0x10]
jne 0x140010ffe
call fcn.14009f768
cmp dword [rbp + 8], 6
je 0x140011013
mov rcx, qword [rbp]
test rcx, rcx
je 0x140011013
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.140086e90
mov rbx, qword [rbp + 0x78]
lea rsp, [rbp + 0x20]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdi, r15
mov ebx, SafeArrayGetDim
jmp 0x140010fd0
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14001485f
mov eax, 0x3f2
ret
jmp 0x140010c80