Function at 0x140028b20
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140028c3b
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140028c27
test rax, rax
je 0x140028c1f
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140127458]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputManagerBase::DeleteMyTsfHotKey
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140028c34
mov rcx, rbx
call fcn.1400bd2dc
xor al, al
jmp 0x140028f50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r15
mov word [rsp + 0x78], r15w
lea r8d, [r15 + 0x2a]
lea rdx, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
lea rcx, [rsp + 0x78]
call fcn.140006900
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x78]
call fcn.1400ba4e0
nop
cmp qword [rbp - 0x70], 8
jb 0x140028c9d
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r15
mov word [rsp + 0x78], r15w
mov r14, qword [rsp + 0x48]
mov rbx, r14
mov rsi, qword [rsp + 0x50]
cmp r14, rsi
je 0x140028ef7
nop word [rax + rax]
mov word [rbp - 0x20], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x1e]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x208
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r15
mov word [rsp + 0x78], r15w
mov r8d, 5
lea rdx, str.CLSID
lea rcx, [rsp + 0x78]
call fcn.140006900
nop
cmp qword [rbx + 0x18], 8
jb 0x140028d2c
mov rdx, qword [rbx]
jmp 0x140028d2f
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140028d94
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
cmp qword [rbp - 0x70], 8
jb 0x140028dab
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r15
mov word [rsp + 0x78], r15w
test dil, dil
je 0x140028eea
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r15
mov word [rbp - 0x68], r15w
cmp word [rbp - 0x20], 0
jne 0x140028deb
mov r8, r15
jmp 0x140028dfe
lea rax, [rbp - 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140028df3
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x68]
call fcn.140006900
nop
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r15
mov word [rbp - 0x48], r15w
mov r8d, 0x26
lea rdx, str.0055AAB0_EACB_46DB_9BB4_1B97FC046D02
lea rcx, [rbp - 0x48]
call fcn.140006900
nop
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x68], rcx
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
cmp rax, rcx
cmovae r8, rdx
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
mov r8, qword [r8]
call fcn.140061440
test eax, eax
sete dil
cmp qword [rbp - 0x30], 8
jb 0x140028e99
mov rcx, qword [rbp - 0x48]
call fcn.1400bd20c
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r15
mov word [rbp - 0x48], r15w
cmp qword [rbp - 0x50], 8
jb 0x140028eba
mov rcx, qword [rbp - 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r15
mov word [rbp - 0x68], r15w
test dil, dil
je 0x140028eea
cmp qword [rbx + 0x18], 8
jb 0x140028edc
mov rdx, qword [rbx]
jmp 0x140028edf
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rbx, 0x20
cmp rbx, rsi
jne 0x140028cd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x140028f4e
mov rbx, r14
cmp r14, rsi
je 0x140028f38
cmp qword [rbx + 0x18], 8
jb 0x140028f1f
mov rcx, qword [rbx]
call fcn.1400bd20c
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r15
mov word [rbx], r15w
add rbx, 0x20
cmp rbx, rsi
jne 0x140028f10
mov rcx, r14
call fcn.1400bd20c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov al, 1
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret