Function at 0x14009a070
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0xc8]
cmp dword [rbx + 8], 0
je 0x14009a4b5
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x14009a4b5
cmp byte [rbx + 0x28], 0
jne 0x14009a4b5
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x14009a4b5
mov rax, qword [rsi]
mov qword [rbp + 0x17], rax
lock inc dword [rax]
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x67]
call fcn.140097980
nop
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x29]
call fcn.140097700
mov rsi, rax
mov rbx, qword [rdi + 0xc8]
xor r12d, r12d
cmp dword [rbx + 8], r12d
je 0x14009a12e
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x14009a12e
cmp byte [rbx + 0x28], r12b
jne 0x14009a12e
lea rcx, [rbx + 0x10]
call fcn.140097670
mov rbx, rax
jmp 0x14009a131
mov rbx, r12
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.14000b320
mov rdx, rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, r12
test eax, eax
cmove rbx, qword [rbp - 9]
mov rcx, qword [rbp - 0x29]
lock dec dword [rcx]
jne 0x14009a177
mov rcx, qword [rbp - 0x29]
call fcn.14000ade0
test rbx, rbx
je 0x14009a1ba
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0xf]
call fcn.140097ee0
nop
mov rcx, rax
call fcn.14000b320
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rax, qword [rbp + 0xf]
lock dec dword [rax]
jne 0x14009a1b1
mov rcx, qword [rbp + 0xf]
call fcn.14000ade0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi + 0xc8]
cmp dword [rbx + 8], 0
je 0x14009a1e9
lea rcx, [rbx + 0x10]
call fcn.140097670
test rax, rax
je 0x14009a1e9
cmp byte [rbx + 0x28], 0
jne 0x14009a1e9
lea rcx, [rbx + 0x10]
call fcn.140097670
mov rbx, rax
jmp 0x14009a1ec
mov rbx, r12
mov qword [rbp - 0x19], r12
lea rcx, [rbp + 0x67]
call fcn.14000b320
mov rdx, rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009a4a1
mov r14, qword [rbp - 0x19]
test r14, r14
je 0x14009a4a1
mov rcx, r14
call fcn.140099e00
mov r11, qword [rbp + 0x67]
cmp dword [r11 + 8], 0
jne 0x14009a3e6
mov r8d, 1
mov rdx, r14
lea rcx, [rbp + 0x7f]
call fcn.1400995c0
nop
mov rax, qword [rbp + 0x7f]
mov r13, r12
mov ecx, dword [rax + 0xc]
sub ecx, dword [rax + 8]
test ecx, ecx
jle 0x14009a397
nop dword [rax + rax]
movsxd rcx, dword [rax + 8]
add rcx, r13
mov rax, qword [rax + rcx*8 + 0x18]
mov qword [rbp + 0x77], rax
lock inc dword [rax]
lea rcx, [rbp + 0x77]
call fcn.14000b320
mov rdx, rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14009a36c
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.140097780
nop
lea rdx, [rbp - 0x39]
mov rcx, rax
call fcn.140009fd0
mov rdi, rax
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x77]
call fcn.140009fd0
mov rbx, rax
mov rcx, qword [rdi]
mov edx, dword [rcx]
cmp edx, 1
jne 0x14009a2e2
mov rdx, qword [rdi]
lea rcx, [rdx + 0x18]
cmp qword [rdx + 0x10], rcx
je 0x14009a2f0
mov rcx, qword [rdi]
mov edx, dword [rcx + 8]
mov rcx, rdi
call fcn.140005410
mov rax, qword [rdi]
mov rdi, qword [rax + 0x10]
mov rax, qword [rbx]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x14009a30e
mov rcx, qword [rbx]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x14009a31c
mov rax, qword [rbx]
mov edx, dword [rax + 8]
mov rcx, rbx
call fcn.140005410
mov rax, qword [rbx]
mov r8, rdi
mov rdx, qword [rax + 0x10]
lea rcx, [0x140d9a6b0]
call fcn.140015780
nop
mov rax, qword [rbp + 7]
lock dec dword [rax]
jne 0x14009a346
mov rcx, qword [rbp + 7]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x39]
lock dec dword [rax]
jne 0x14009a359
mov rcx, qword [rbp - 0x39]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x31]
lock dec dword [rax]
jne 0x14009a36c
mov rcx, qword [rbp - 0x31]
call fcn.14000ade0
nop
mov rax, qword [rbp + 0x77]
lock dec dword [rax]
jne 0x14009a37e
mov rcx, qword [rbp + 0x77]
call fcn.14000ade0
inc r12d
inc r13
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rax + 0xc]
sub ecx, dword [rax + 8]
cmp r12d, ecx
jl 0x14009a270
lock dec dword [rax]
jne 0x14009a497
mov r12, qword [rbp + 0x7f]
movsxd rax, dword [r12 + 0xc]
lea rbx, [r12 + rax*8 + 0x18]
movsxd rax, dword [r12 + 8]
lea rdi, [r12 + rax*8 + 0x18]
cmp rdi, rbx
je 0x14009a3d9
nop dword [rax]
sub rbx, 8
mov rdx, qword [rbx]
lock dec dword [rdx]
jne 0x14009a3d4
mov rcx, qword [rbx]
call fcn.14000ade0
cmp rbx, rdi
jne 0x14009a3c0
mov rcx, r12
call fcn.140004d80
jmp 0x14009a497
lea rcx, [rbp + 0x67]
call fcn.14000b320
mov rbx, rax
mov rcx, rdi
call fcn.140097830
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14009a497
mov edx, eax
lea rcx, [rbp - 1]
call fcn.140097780
nop
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.140009fd0
mov rbx, rax
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x67]
call fcn.140009fd0
mov rdi, rax
mov rcx, rbx
call fcn.1400036d0
mov rbx, rax
mov rcx, rdi
call fcn.1400036d0
mov rdx, rax
mov r8, rbx
lea rcx, [0x140d9a680]
call fcn.140015780
nop
mov rax, qword [rbp - 0x21]
lock dec dword [rax]
jne 0x14009a472
mov rcx, qword [rbp - 0x21]
call fcn.140004d80
nop
mov rax, qword [rbp - 0x11]
lock dec dword [rax]
jne 0x14009a485
mov rcx, qword [rbp - 0x11]
call fcn.140004d80
nop
mov rax, qword [rbp - 1]
lock dec dword [rax]
jne 0x14009a497
mov rcx, qword [rbp - 1]
call fcn.14000ade0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x67]
lock dec dword [rax]
jne 0x14009a4c2
mov rcx, qword [rbp + 0x67]
call fcn.14000ade0
jmp 0x14009a4c2
mov edx, 1
mov rcx, rdi
call fcn.14005a4c0
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret