Function at 0x140014a30
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21a0]
mov eax, 0x22a0
call fcn.14002ef70
sub rsp, rax
mov r15, rdx
mov r14, rcx
xor eax, eax
mov r12d, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rax
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
cmp word [r15], 0x7d
je 0x140015737
nop dword [rax]
nop word [rax + rax]
mov r13d, 1
lea rdx, str.Delete
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
lea rdx, str.ForceRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140014ad4
test esi, esi
jne 0x140014d38
mov rbx, r15
nop word [rax + rax]
mov rdi, qword [r14]
movzx edx, word [rdi]
mov ecx, edx
sub ecx, 9
je 0x140014afc
sub ecx, r13d
je 0x140014afc
sub ecx, 3
je 0x140014afc
cmp ecx, 0x13
jne 0x140014b0a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140014ae0
xor r8d, r8d
cmp r8w, dx
je 0x140015732
mov eax, 0x27
cmp ax, dx
jne 0x140014bf0
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
xor edi, edi
cmp di, word [rax]
je 0x140014bce
nop dword [rax]
mov ecx, 0x27
cmp cx, word [rax]
jne 0x140014b5d
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov ecx, 0x27
cmp cx, word [rax]
jne 0x140014bce
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140014b79
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [r14], rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x140014bc0
sub rdi, rbx
mov ecx, edx
nop
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x140014bb0
mov rax, qword [r14]
xor edi, edi
cmp di, word [rax]
jne 0x140014b40
mov rax, qword [r14]
cmp di, word [rax]
je 0x140015732
mov word [rbx], di
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
xor r8d, r8d
jmp 0x140014c63
movzx ecx, dx
sub ecx, 9
je 0x140014c5f
sub ecx, r13d
je 0x140014c5f
sub ecx, 3
je 0x140014c5f
cmp ecx, 0x13
je 0x140014c5f
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x140014c50
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x140014c40
mov rdi, qword [r14]
movzx edx, word [rdi]
xor r8d, r8d
cmp r8w, dx
jne 0x140014bf0
mov word [rbx], r8w
mov edi, dword [rbp + 0x21f8]
test edi, edi
je 0x140014d38
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x78], r8d
mov qword [rbp - 0x80], r8
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x140014cb2
nop dword [rax + rax]
cmp ax, 0x5c
je 0x140014ca9
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140014c90
jmp 0x140014cb2
test rcx, rcx
jne 0x140015732
lea rbx, [0x1401c1dc0]
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140014d03
add rbx, 8
lea rax, str.RegDeleteKeyTransactedW
cmp rbx, rax
jl 0x140014cc0
mov rax, qword [rbp + 0x21f0]
mov qword [rsp + 0x70], rax
xor eax, eax
mov dword [rsp + 0x78], eax
mov qword [rbp - 0x80], rax
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140014500
test esi, esi
jne 0x140014d38
mov rdx, r15
mov rcx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
mov rdx, r15
mov rcx, r14
call fcn.140014450
mov ebx, eax
test eax, eax
js 0x140015737
xor esi, esi
jmp 0x14001543f
lea rdx, str.NoRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jne 0x140014ecf
mov r13d, esi
mov rbx, r15
nop dword [rax + rax]
mov rdi, qword [r14]
movzx edx, word [rdi]
mov ecx, edx
sub ecx, 9
je 0x140014d7c
sub ecx, 1
je 0x140014d7c
sub ecx, 3
je 0x140014d7c
cmp ecx, 0x13
jne 0x140014d8a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140014d60
cmp si, dx
je 0x140015732
mov eax, 0x27
cmp ax, dx
jne 0x140014e60
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
cmp si, word [rax]
je 0x140014e3d
mov edi, 0x27
cmp di, word [rax]
jne 0x140014dce
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x140014e3d
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140014dea
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [r14], rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x140014e31
sub rdi, rbx
mov ecx, edx
movzx eax, word [rbx + rdi]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140014e20
mov rax, qword [r14]
cmp si, word [rax]
jne 0x140014db6
mov rax, qword [r14]
cmp si, word [rax]
je 0x140015732
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140014ecf
movzx ecx, dx
sub ecx, 9
je 0x140014ecc
sub ecx, 1
je 0x140014ecc
sub ecx, 3
je 0x140014ecc
cmp ecx, 0x13
je 0x140014ecc
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x140014ec1
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rbx + rdi]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140014eb0
mov rdi, qword [r14]
movzx edx, word [rdi]
cmp si, dx
jne 0x140014e60
mov word [rbx], si
lea rdx, [0x1401c1ca0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400152c6
lea rbx, [rbp + 0x1a0]
nop
mov rdi, qword [r14]
movzx ecx, word [rdi]
mov edx, ecx
sub edx, 9
je 0x140014f0c
sub edx, 1
je 0x140014f0c
sub edx, 3
je 0x140014f0c
cmp edx, 0x13
jne 0x140014f1a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140014ef0
cmp si, cx
je 0x140015732
mov eax, 0x27
cmp ax, cx
jne 0x140014ff4
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
cmp si, word [rax]
je 0x140014fda
nop word [rax + rax]
mov rcx, qword [r14]
mov edi, 0x27
cmp di, word [rcx]
jne 0x140014f68
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x140014fda
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140014f84
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [r14], rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
mov rcx, rax
sub rcx, rdi
sar rcx, 1
lea rax, [rcx + 1]
lea rax, [rbx + rax*2]
lea r8, [rbp + 0x21a0]
cmp rax, r8
jae 0x140015732
test ecx, ecx
jle 0x140014fd1
sub rdi, rbx
mov ecx, ecx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140014fc0
cmp si, word [rdx]
jne 0x140014f50
mov rcx, qword [r14]
cmp si, word [rcx]
je 0x140015732
mov word [rbx], si
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x14001506f
movzx ecx, cx
sub ecx, 9
je 0x14001506c
sub ecx, 1
je 0x14001506c
sub ecx, 3
je 0x14001506c
cmp ecx, 0x13
je 0x14001506c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
mov rcx, rax
sub rcx, rdi
sar rcx, 1
lea rax, [rcx + 1]
lea rax, [rbx + rax*2]
lea r8, [rbp + 0x21a0]
cmp rax, r8
jae 0x140015732
test ecx, ecx
jle 0x140015061
sub rdi, rbx
mov ecx, ecx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140015050
mov rdi, rdx
movzx ecx, word [rdx]
cmp si, cx
jne 0x140014ff4
mov word [rbx], si
mov rbx, r15
mov rdi, qword [r14]
movzx edx, word [rdi]
mov ecx, edx
sub ecx, 9
je 0x14001508e
sub ecx, 1
je 0x14001508e
sub ecx, 3
je 0x14001508e
cmp ecx, 0x13
jne 0x14001509c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140015072
cmp si, dx
je 0x140015732
mov eax, 0x27
cmp ax, dx
jne 0x140015180
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
cmp si, word [rax]
je 0x14001515d
nop dword [rax + rax]
mov edi, 0x27
cmp di, word [rax]
jne 0x1400150e8
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x14001515d
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140015104
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [r14], rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x140015151
sub rdi, rbx
mov ecx, edx
nop word [rax + rax]
movzx eax, word [rbx + rdi]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140015140
mov rax, qword [r14]
cmp si, word [rax]
jne 0x1400150d0
mov rax, qword [r14]
cmp si, word [rax]
je 0x140015732
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x1400151ef
movzx ecx, dx
sub ecx, 9
je 0x1400151ec
sub ecx, 1
je 0x1400151ec
sub ecx, 3
je 0x1400151ec
cmp ecx, 0x13
je 0x1400151ec
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x140015732
test edx, edx
jle 0x1400151e1
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400151d0
mov rdi, qword [r14]
movzx edx, word [rdi]
cmp si, dx
jne 0x140015180
mov word [rbx], si
cmp word [r15], 0x3d
jne 0x140015732
mov edi, dword [rbp + 0x21f8]
test edi, edi
je 0x140015236
mov rax, qword [rbp + 0x21f0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], esi
mov qword [rbp - 0x80], rsi
mov r9, r15
lea r8, [rbp + 0x1a0]
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140013e60
mov ebx, eax
jmp 0x140015437
cmp dword [rbp + 0x2200], 0
jne 0x1400152ac
test r13d, r13d
je 0x1400152ac
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x21f0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdi, rsi
test eax, eax
cmove rdi, qword [rsp + 0x50]
mov ecx, esi
cmovne ecx, eax
test ecx, ecx
jne 0x140015710
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x14001570e
test rdi, rdi
je 0x1400152ac
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r15
mov rcx, r14
call fcn.140014450
mov ebx, eax
test eax, eax
js 0x140015737
jmp 0x140015701
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x1400152f4
cmp ax, 0x5c
je 0x1400152eb
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x1400152d2
jmp 0x1400152f4
test rcx, rcx
jne 0x140015732
mov edi, dword [rbp + 0x21f8]
test edi, edi
je 0x14001549f
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r15
mov rbx, qword [rbp + 0x21f0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001534f
mov eax, esi
test r12, r12
je 0x140015341
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], esi
test eax, eax
je 0x140015406
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001539d
mov eax, esi
test r12, r12
je 0x14001538f
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], esi
test eax, eax
je 0x140015406
mov qword [rsp + 0x50], rsi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400153fe
mov eax, esi
test r12, r12
je 0x1400153f0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], esi
test eax, eax
jne 0x140015727
mov rdx, r15
mov rcx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
cmp word [r15], 0x3d
jne 0x14001543f
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140013e60
mov ebx, eax
test eax, eax
js 0x140015737
cmp word [r15], 0x7b
jne 0x140015701
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x140015451
cmp rax, 1
jne 0x140015701
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.140014a30
mov ebx, eax
test eax, eax
js 0x140015737
mov rdx, r15
mov rcx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
jmp 0x140015701
mov ebx, dword [rbp + 0x2200]
test ebx, ebx
jne 0x1400154f9
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp + 0x21f0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400154f7
mov edi, esi
test r12, r12
je 0x1400154e9
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], esi
jmp 0x1400154fe
mov edi, 2
mov esi, 1
test edi, edi
cmove esi, ebx
mov r9, 0xffffffffffffffff
mov r8, r15
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.14003c218
test eax, eax
je 0x140015548
cmp eax, 0xc
je 0x140015762
cmp eax, 0x16
je 0x140015778
cmp eax, 0x22
je 0x140015778
cmp eax, 0x50
jne 0x14001576d
mov rdx, r15
mov rcx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
mov rdx, r15
mov rcx, r14
call fcn.140014450
mov ebx, eax
test eax, eax
js 0x140015737
cmp word [r15], 0x7b
jne 0x1400155c9
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x140015580
cmp rax, 1
jne 0x1400155c9
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.140014a30
mov ebx, eax
test eax, eax
jns 0x1400155b4
test esi, esi
je 0x140015737
mov rdx, r15
mov rcx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
js 0x140015737
cmp edi, 2
je 0x140015701
test edi, edi
je 0x1400155f1
cmp dword [rbp + 0x2200], 0
jne 0x140015701
mov ecx, edi
call fcn.140014870
mov ebx, eax
jmp 0x140015737
cmp dword [rbp + 0x2200], 0
je 0x140015651
mov rdx, r12
call fcn.140014690
test eax, eax
je 0x140015651
lea rdi, [0x1401c1dc0]
nop dword [rax]
mov rdx, qword [rdi]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140015701
add rdi, 8
lea rax, str.RegDeleteKeyTransactedW
cmp rdi, rax
jl 0x140015610
test r13d, r13d
je 0x140015701
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call fcn.140014500
jmp 0x140015701
mov rdx, r12
call fcn.140014690
mov edi, eax
xor esi, esi
mov eax, esi
test r12, r12
je 0x140015675
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
test eax, eax
jne 0x140015727
test r13d, r13d
je 0x140015701
test edi, edi
jne 0x140015701
cmp byte [0x143e6a428], dil
jne 0x1400156d5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400156c5
lea rdx, [0x1401c1e58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x143e6a420], rax
mov byte [0x143e6a428], 1
jmp 0x1400156dc
mov rax, qword [0x143e6a420]
mov byte [0x143e6a428], 1
jmp 0x1400156dc
mov rax, qword [0x143e6a420]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x21f0]
test rax, rax
je 0x1400156f6
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1400156fd
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test eax, eax
jne 0x140015727
cmp word [r15], 0x7d
jne 0x140014aa0
jmp 0x140015737
mov ecx, eax
call fcn.140014870
mov ebx, eax
test rdi, rdi
je 0x140015737
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140015737
mov ecx, eax
call fcn.140014870
mov ebx, eax
jmp 0x140015737
mov ebx, 0x80020009
test r12, r12
je 0x140015745
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x22e0]
add rsp, 0x22a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140014420
int3
mov ecx, 0x80004005
call fcn.140014420
int3
mov ecx, 0x80070057
call fcn.140014420
int3