Function at 0x14000ad70
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rdi, rcx
call fcn.14003c3f0
mov rcx, rax
xor esi, esi
mov edx, esi
test rax, rax
setne dl
test edx, edx
jne 0x14000ada8
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r12, [0x1400eeb50]
mov rbp, r12
shr rbp, 0x10
jne 0x14000ade9
movzx ebx, r12w
mov ecx, ebx
call fcn.14003c170
test rax, rax
je 0x14000adf7
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400060c0
jmp 0x14000adf7
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.140006560
nop
call fcn.14003c3f0
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ae16
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x88], rax
test rbp, rbp
jne 0x14000ae55
movzx ebx, r12w
mov ecx, ebx
call fcn.14003c170
test rax, rax
je 0x14000ae66
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400060c0
jmp 0x14000ae66
mov rdx, r12
lea rcx, [rsp + 0x88]
call fcn.140006560
nop
call fcn.14003c3f0
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000ae85
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
test rbp, rbp
jne 0x14000aec4
movzx ebx, r12w
mov ecx, ebx
call fcn.14003c170
test rax, rax
je 0x14000aed5
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400060c0
jmp 0x14000aed5
mov rdx, r12
lea rcx, [rsp + 0x80]
call fcn.140006560
nop
or ebx, 0xffffffff
cmp dword [rdi + 0x3b0e8], 0
jne 0x14000aeea
cmp dword [rdi + 0x3b0f0], 0
je 0x14000af09
cmp dword [rdi + 0x3b0fc], 0
je 0x14000af09
cmp dword [rdi + 0x1b8], 0
je 0x14000af09
mov rcx, rdi
call fcn.14000aa20
jmp 0x14000b179
call fcn.14003c3f0
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x14000af27
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rdx, str.MicrosoftWindowsCurrentVersionRun
test rdx, 0xffffffffffff0000
jne 0x14000af67
movzx esi, dx
mov ecx, esi
call fcn.14003c170
test rax, rax
je 0x14000af72
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400060c0
jmp 0x14000af72
lea rcx, [rsp + 0x28]
call fcn.140006560
nop
lea rdx, [rdi + 0x198]
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140006b70
lea r8, [rsp + 0x78]
mov rdx, qword [rax]
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
sete sil
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000afc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000afe2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
je 0x14000b179
lea rdx, str.Rtlupd
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
lea rdx, str.Rtlupd64
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
lea rdx, str.Rtkupd
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
lea rdx, str.Rtkupd64
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
lea rdx, str.Rtaupd
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
lea rdx, str.Rtaupd64
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000b07f
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000b179
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi + 0x3b0f4], 0
jne 0x14000b15e
mov ecx, 0x87
call fcn.14003c170
test rax, rax
je 0x14000b0c0
mov r8d, 0x87
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400060c0
test eax, eax
jne 0x14000b0d4
lea rdx, str.You_must_restart_your_computer_before_the_new_settings_will_take_effect.
lea rcx, [rsp + 0x88]
call fcn.140006560
mov ecx, 0x88
call fcn.14003c170
test rax, rax
je 0x14000b0fd
mov r8d, 0x88
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400060c0
test eax, eax
jne 0x14000b111
lea rdx, str.Do_you_want_to_restart_your_computer_now__
lea rcx, [rsp + 0x80]
call fcn.140006560
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
lea rdx, str._s_n_s
lea rcx, [rsp + 0x20]
call fcn.140006f70
mov r9d, 0x34
lea r8, str.Realtek_Audio
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140001a70
cmp eax, 6
jne 0x14000b179
mov ecx, 1
mov dword [0x1404301bc], ecx
jmp 0x14000b179
mov eax, dword [0x1404301bc]
mov ecx, 1
cmp dword [rdi + 0x3b0f8], 0
cmovne eax, ecx
mov dword [0x1404301bc], eax
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000b19d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000b1c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14000b1df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret