Function at 0x140051970
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2398
call fcn.140082e00
sub rsp, rax
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rsp + 0x2380], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051a1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xf0], eax
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xf0]
jmp 0x140052667
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7d
je 0x14005264b
mov dword [rsp + 0x48], 1
mov rdx, qword [str.Delete]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140051a5e
mov dword [rsp + 0x80], 1
jmp 0x140051a69
mov dword [rsp + 0x80], 0
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x88], eax
mov rdx, qword [str.ForceRemove]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140051a9e
cmp dword [rsp + 0x88], 0
je 0x140051d11
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051ac3
jmp 0x14005264b
cmp dword [rsp + 0x23b8], 0
je 0x140051d11
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x108], 0
cmp qword [rsp + 0x70], 0
jne 0x140051b23
mov qword [rsp + 0x110], 0
jmp 0x140051b74
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
test eax, eax
je 0x140051b64
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
mov ecx, 0x5c
movzx ecx, cx
cmp eax, ecx
jne 0x140051b52
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x108], rax
jmp 0x140051b64
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x70], rax
jmp 0x140051b23
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
je 0x140051bae
mov dword [rsp + 0xf4], 0x80020009
lea rcx, [rsp + 0x98]
call fcn.14002d920
nop
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xf4]
jmp 0x140052667
mov dword [rsp + 0x4c], 0
jmp 0x140051bc2
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0xc
jge 0x140051bfa
movsxd rax, dword [rsp + 0x4c]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140051bf8
mov dword [rsp + 0x84], 0
jmp 0x140051c05
jmp 0x140051bb8
mov dword [rsp + 0x84], 1
cmp dword [rsp + 0x84], 0
je 0x140051c84
xor eax, eax
test eax, eax
jne 0x140051c0f
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rdx, qword [rsp + 0x23a8]
lea rcx, [rsp + 0x98]
call fcn.1400510d0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
cmp dword [rsp + 0x88], 0
je 0x140051d04
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051cc0
lea rcx, [rsp + 0x98]
call fcn.14002d920
jmp 0x14005264b
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400531b0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051cf2
lea rcx, [rsp + 0x98]
call fcn.14002d920
jmp 0x14005264b
lea rcx, [rsp + 0x98]
call fcn.14002d920
jmp 0x1400525bf
lea rcx, [rsp + 0x98]
call fcn.14002d920
mov rdx, qword [str.NoRemove]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140051d57
mov dword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051d57
jmp 0x14005264b
mov rdx, qword [0x140093378]
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14005200d
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051d99
jmp 0x14005264b
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140051dbe
jmp 0x14005264b
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x3d
je 0x140051def
mov dword [rsp + 0xf8], 0x80020009
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xf8]
jmp 0x140052667
cmp dword [rsp + 0x23b8], 0
je 0x140051f03
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
xor eax, eax
test eax, eax
jne 0x140051e20
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov r9, qword [rsp + 0x23a8]
lea r8, [rsp + 0x380]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x23a0]
call fcn.14004db30
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
cmp dword [rsp + 0x40], 0
jge 0x140051edf
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xfc], eax
lea rcx, [rsp + 0xb0]
call fcn.14002d920
nop
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xfc]
jmp 0x140052667
lea rcx, [rsp + 0xb0]
call fcn.14002d920
jmp 0x1400525bf
cmp dword [rsp + 0x23c0], 0
jne 0x140051fe3
cmp dword [rsp + 0x48], 0
je 0x140051fe3
mov qword [rsp + 0x128], 0
mov dword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x128]
call fcn.14002e680
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140051fb7
xor eax, eax
test eax, eax
jne 0x140051f68
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140051fb5
cmp dword [rsp + 0x44], 2
je 0x140051fb5
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x128]
call fcn.14002d920
jmp 0x14005264b
jmp 0x140051fd6
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x128]
call fcn.14002d920
jmp 0x14005264b
lea rcx, [rsp + 0x128]
call fcn.14002d920
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400531b0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052008
jmp 0x14005264b
jmp 0x140051a1c
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x118], 0
cmp qword [rsp + 0x78], 0
jne 0x14005203c
mov qword [rsp + 0x120], 0
jmp 0x14005208d
mov rax, qword [rsp + 0x78]
movzx eax, word [rax]
test eax, eax
je 0x14005207d
mov rax, qword [rsp + 0x78]
movzx eax, word [rax]
mov ecx, 0x5c
movzx ecx, cx
cmp eax, ecx
jne 0x14005206b
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x118], rax
jmp 0x14005207d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x78], rax
jmp 0x14005203c
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x1400520b9
mov dword [rsp + 0x100], 0x80020009
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0x100]
jmp 0x140052667
cmp dword [rsp + 0x23b8], 0
je 0x1400521f8
mov r9d, 0x2001f
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x58]
call fcn.14002e680
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140052191
mov r9d, 0x20019
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x58]
call fcn.14002e680
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140052191
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x58]
call fcn.14004e970
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140052191
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0x104], eax
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0x104]
jmp 0x140052667
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400521b6
jmp 0x14005264b
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x3d
jne 0x1400521f3
mov r9, qword [rsp + 0x23a8]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x23a0]
call fcn.14004db30
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400521f3
jmp 0x14005264b
jmp 0x1400525bf
cmp dword [rsp + 0x23c0], 0
jne 0x140052228
mov r9d, 0x20019
mov r8, qword [rsp + 0x23a8]
mov rdx, qword [rsp + 0x23b0]
lea rcx, [rsp + 0x58]
call fcn.14002e680
mov dword [rsp + 0x44], eax
jmp 0x140052230
mov dword [rsp + 0x44], 2
cmp dword [rsp + 0x44], 0
je 0x140052242
mov dword [rsp + 0x23c0], 1
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x23a8]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, eax
call fcn.140020e30
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052290
jmp 0x14005264b
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400531b0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400522b5
jmp 0x14005264b
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x140052349
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 1
jne 0x140052349
mov eax, dword [rsp + 0x23c0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x23b8]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140051970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052324
cmp dword [rsp + 0x23c0], 0
jne 0x140052324
jmp 0x14005264b
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052349
jmp 0x14005264b
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x23c0], eax
cmp dword [rsp + 0x44], 2
jne 0x140052363
jmp 0x140051a1c
cmp dword [rsp + 0x44], 0
je 0x14005238d
cmp dword [rsp + 0x23c0], 0
je 0x14005237b
jmp 0x140051a1c
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0x40], eax
jmp 0x14005264b
cmp dword [rsp + 0x23c0], 0
je 0x140052440
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x140], rax
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x23a0]
call fcn.14004fcb0
test eax, eax
je 0x140052440
mov dword [rsp + 0x50], 0
jmp 0x1400523d5
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xc
jge 0x14005240d
movsxd rax, dword [rsp + 0x50]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14005240b
mov dword [rsp + 0x8c], 0
jmp 0x140052418
jmp 0x1400523cb
mov dword [rsp + 0x8c], 1
cmp dword [rsp + 0x8c], 0
je 0x14005243b
cmp dword [rsp + 0x48], 0
je 0x14005243b
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x58]
call fcn.1400510d0
jmp 0x140051a1c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x23a0]
call fcn.14004fcb0
mov dword [rsp + 0xe8], eax
mov dword [rsp + 0x90], 0
cmp qword [rsp + 0x58], 0
je 0x140052497
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400524d7
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0xe4], eax
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xe4]
jmp 0x140052667
cmp dword [rsp + 0x48], 0
je 0x1400525bf
cmp dword [rsp + 0xe8], 0
jne 0x1400525bf
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
xor eax, eax
test eax, eax
jne 0x140052513
mov rax, qword [rsp + 0x23b0]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0xc8]
call fcn.14004ebf0
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
cmp dword [rsp + 0x44], 0
je 0x1400525b2
mov ecx, dword [rsp + 0x44]
call fcn.14004e7e0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0xc8]
call fcn.14002d920
jmp 0x14005264b
lea rcx, [rsp + 0xc8]
call fcn.14002d920
cmp dword [rsp + 0x23b8], 0
je 0x140052646
mov rax, qword [rsp + 0x23a8]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x140052646
mov rcx, qword [rsp + 0x23a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
cmp rax, 1
jne 0x140052646
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x23b8]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.140051970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052624
jmp 0x14005264b
mov rdx, qword [rsp + 0x23a8]
mov rcx, qword [rsp + 0x23a0]
call fcn.1400506e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140052646
jmp 0x14005264b
jmp 0x140051a1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xec], eax
lea rcx, [rsp + 0x58]
call fcn.14002d920
mov eax, dword [rsp + 0xec]
mov rcx, qword [rsp + 0x2380]
xor rcx, rsp
call fcn.140082550
add rsp, 0x2398
ret