Function at 0x14000ae8c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140017018]
xor rax, rsp
mov qword [rbp + 0x17], rax
movsd xmm0, qword [str.___t_n]
xor esi, esi
movzx eax, word [0x140014520]
mov rbx, r8
and qword [rsp + 0x50], rsi
mov r13, rcx
movsd qword [rbp - 0x49], xmm0
xor r9d, r9d
movups xmm0, xmmword [0x140013c20]
xor r8d, r8d
mov word [rbp - 0x41], ax
lea edx, [rsi + 1]
xor ecx, ecx
movdqu xmmword [0x1400177a0], xmm0
mov edi, 0x80070057
xor r15d, r15d
xor r12d, r12d
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rbp - 0x49]
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b3c9
mov r8d, 0xb
lea rdx, str._Embedding
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000af5c
lea r14d, [rax + 1]
jmp 0x14000b067
mov r8d, 0xb
lea rdx, [0x140014540]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b061
mov r8d, 0xb
lea rdx, str._REGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b061
mov r8d, 0xd
lea rdx, [0x140014570]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b059
mov r8d, 0xd
lea rdx, str._UNREGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b059
mov r8d, 7
lea rdx, str._CLSID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000b021
lea rcx, [rbx + 0xe]
lea rdx, [0x1400177a0]
call qword [sym.imp.ole32.dll_CLSIDFromString]
nop dword [rax + rax]
jmp 0x14000b067
mov r8d, 5
lea rdx, str._PID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000b067
lea rcx, [rbx + 0xa]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [0x140017658], eax
jmp 0x14000b067
mov r12d, 1
jmp 0x14000b067
mov r15d, 1
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rbp - 0x49]
inc esi
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000af33
lea ebx, [rax + 1]
cmp esi, ebx
je 0x14000b0c0
cmp esi, 2
jne 0x14000b3c9
mov rax, qword [0x1400177a0]
cmp rax, qword [0x140013c20]
jne 0x14000b0c0
mov rax, qword [0x1400177a8]
cmp rax, qword [0x140013c28]
je 0x14000b3c9
xor esi, esi
test r12d, r12d
je 0x14000b1f4
movups xmm0, xmmword [0x140013d80]
lea rax, [rsp + 0x58]
mov ebx, 0xf003f
movups xmm1, xmmword [0x140013c90]
mov r15, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.CLSID
xor r8d, r8d
mov rcx, r15
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
lea r14d, [rsi + 0x27]
mov edi, eax
test eax, eax
jne 0x14000b15e
mov r8d, r14d
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rbp - 0x79]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AppID
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000b1c6
mov r8d, r14d
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000b1e3
test edi, edi
jne 0x14000b1d5
mov edi, esi
jmp 0x14000b3c9
jle 0x14000b3c9
movzx edi, di
jmp 0x14000b3c3
jg 0x14000b1ec
mov edi, ebx
jmp 0x14000b3c9
movzx edi, bx
jmp 0x14000b3c3
test r15d, r15d
je 0x14000b234
movups xmm0, xmmword [0x140013d80]
lea rdx, [rbp - 0x59]
movups xmm1, xmmword [0x140013c90]
lea rcx, [rbp - 0x69]
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call fcn.14000a93c
mov edi, eax
test eax, eax
js 0x14000b3c9
call fcn.14000add4
mov edi, eax
jmp 0x14000b3c9
test r14d, r14d
je 0x14000b3c9
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x140017760], rax
test rax, rax
je 0x14000b3ae
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000b399
mov edx, ebx
mov rcx, r13
call fcn.14000d57c
test eax, eax
je 0x14000b38d
mov qword [rsp + 0x40], rsi
or r14, 0xffffffffffffffff
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov edx, r14d
xor ecx, ecx
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000b359
call fcn.14000236c
mov edi, eax
test eax, eax
js 0x14000b359
xor r8d, r8d
lea rcx, str.user32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b337
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x14000b328
movabs r10, 0xd30527475e523070
call qword [0x1400139b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call fcn.140007140
mov rcx, qword [0x140017760]
or edx, 0xffffffff
mov edi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
call fcn.14000252c
mov rcx, qword [0x140017038]
cmp rcx, r14
je 0x14000b378
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
nop dword [rax + rax]
mov qword [0x140017038], r14
mov rax, qword [0x1400177f0]
test rax, rax
cmovne rax, r14
mov qword [0x1400177f0], rax
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
mov rcx, qword [0x140017760]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14000b3c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14000b3c9
movzx edi, ax
or edi, 0x80070000
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001560
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret