Function at 0x14003054c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xab8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0xaa0], rax
mov rbp, r9
mov rbx, r8
mov qword [rsp + 0x50], rbx
mov rsi, rdx
mov qword [rsp + 0x58], rcx
lea r8, str.CRegistryUninstaller::RegDelete____n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
xor edi, edi
mov byte [rsp + 0x90], dil
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x91]
call fcn.1400988d0
mov byte [rsp + 0x2a0], dil
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rsp + 0x2a1]
call fcn.1400988d0
xor r11d, r11d
test rbx, rbx
setne r11b
test r11d, r11d
jne 0x140030617
lea ebx, [rdi + 0x57]
mov ecx, ebx
call fcn.14004d8f0
mov r9, rax
lea r8, str.RegDelete
lea rdx, str._s_failed_returning__s_n
lea rcx, [0x14010f570]
call fcn.14004b7ec
mov eax, ebx
jmp 0x140030c6a
mov r9, rbx
lea r8, str.CRegistryUninstaller::RegDelete_..__s__.._
mov edx, 0x80
lea rcx, [0x14010f570]
call fcn.140001000
mov r9d, 0x103
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
cmp eax, 0x103
je 0x140030942
movsx ecx, byte [rsp + 0x90]
call fcn.14009a8b0
test eax, eax
je 0x140030942
cmp ebx, 5
jne 0x140030679
inc edi
jmp 0x1400308df
test ebx, ebx
jne 0x140030925
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
lea r8, [0x1400c63b8]
mov edx, 0x800
lea rcx, [rsp + 0x2a0]
call fcn.14009841c
lea rdx, [rsp + 0x2a0]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
call fcn.14002dba4
inc dword [rbx + 0x98]
mov r10d, dword [rbx + 0x98]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140030710
mov eax, dword [rbx + 0xa0]
imul eax, eax, 0x64
xor edx, edx
div dword [rbx + 0xa4]
mov r9d, eax
mov r8d, dword [rbx + 0x9c]
inc r8d
lea eax, [r10 + r10*4]
add eax, eax
xor edx, edx
div r8d
lea edx, [rax + r9]
mov r8d, 1
call fcn.14002d4bc
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.1400990e0
mov qword [rsp + 0x88], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x80], 0
mov byte [rsp + 0x70], 0
mov rax, qword [rbp]
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test eax, eax
je 0x1400307ed
lea r9, [rsp + 0x2a0]
lea r8, str.Deleting_key__s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
call fcn.14002ffb0
test eax, eax
je 0x1400308ca
mov ecx, 2
call fcn.14003ff90
lea rcx, [rsp + 0x68]
call fcn.14004d614
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae r9, qword [rsp + 0x70]
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r8, str._s__when_RegDeleteSubKey___s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
inc edi
jmp 0x1400308ca
and qword [rsp + 0x48], 0
and dword [rsp + 0x28], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.14004e070
cmp eax, 5
jne 0x140030840
inc edi
cmp qword [rsp + 0x88], 0x10
jb 0x1400308df
mov rcx, qword [rsp + 0x70]
call fcn.14006127c
jmp 0x1400308df
test eax, eax
je 0x1400308a0
lea rcx, [rsp + 0x68]
call fcn.14004d614
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae r9, qword [rsp + 0x70]
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r8, str._s__when_RegOpenKeyEx___s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
inc edi
cmp qword [rsp + 0x88], 0x10
jb 0x1400308df
mov rcx, qword [rsp + 0x70]
call fcn.14006127c
jmp 0x1400308df
mov r9, rbp
lea r8, [rsp + 0x2a0]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.14003054c
mov ebx, eax
test eax, eax
jne 0x140030907
mov rcx, qword [rsp + 0x48]
call fcn.14004e608
inc edi
cmp qword [rsp + 0x88], 0x10
jb 0x1400308df
mov rcx, qword [rsp + 0x70]
call fcn.14006127c
mov r9d, 0x103
lea r8, [rsp + 0x90]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
cmp eax, 0x103
jne 0x140030658
jmp 0x140030942
cmp qword [rsp + 0x88], 0x10
jb 0x140030c50
mov rcx, qword [rsp + 0x70]
call fcn.14006127c
jmp 0x140030c50
lea r8, str.Error_enumerating_keys_n
mov edx, 8
lea rcx, [0x14010f570]
call fcn.140001000
jmp 0x140030c50
xor edi, edi
mov byte [rsp + 0x1a0], dil
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x1a1]
call fcn.1400988d0
mov dword [rsp + 0x48], 0x103
mov dword [rsp + 0x44], 0x100
mov byte [rsp + 0x90], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x90]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test eax, eax
je 0x140030b0f
sub eax, 0xea
jne 0x140030c2f
mov ecx, dword [rsp + 0x44]
inc ecx
call fcn.140061284
mov rbx, rax
test rax, rax
je 0x140030c03
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x90]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x140030c03
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.1400990e0
mov r11, qword [rbp]
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, rbp
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x140030a7e
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.14003035c
test eax, eax
jne 0x140030b00
mov rcx, rbx
call fcn.14006127c
jmp 0x140030961
cmp dword [rsp + 0x40], 1
jne 0x140030b00
mov edx, dword [rsp + 0x44]
inc edx
mov rcx, rbx
call fcn.1400990e0
mov r11, qword [rbp]
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x140030b00
mov qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x90]
lea r8, str.Signal_to_remove_due_to__s__type___d__value___s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.14003035c
test eax, eax
jne 0x140030b00
mov rcx, rbx
call fcn.14006127c
jmp 0x140030961
mov rcx, rbx
call fcn.14006127c
inc edi
jmp 0x140030961
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.1400990e0
mov r11, qword [rbp]
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, rbp
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x140030b62
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.14003035c
test eax, eax
je 0x140030961
jmp 0x140030bfc
cmp dword [rsp + 0x40], 1
jne 0x140030bfc
mov eax, dword [rsp + 0x44]
mov byte [rsp + rax + 0x1a0], 0
mov edx, 0x100
lea rcx, [rsp + 0x1a0]
call fcn.1400990e0
mov r11, qword [rbp]
lea r8, [rsp + 0x1a0]
mov rdx, rsi
mov rcx, rbp
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x140030bfc
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x90]
lea r8, str.Signal_to_remove_due_to__s__type___d__value___s_n
mov edx, 0x20
lea rcx, [0x14010f570]
call fcn.140001000
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.14003035c
test eax, eax
je 0x140030961
inc edi
jmp 0x140030961
lea r8, str.Cannot_set_RegEnumValue__n
mov edx, 8
lea rcx, [0x14010f570]
call fcn.140001000
test rbx, rbx
je 0x140030c28
mov rcx, rbx
call fcn.14006127c
mov ebx, 1
jmp 0x140030c50
cmp eax, 0x19
je 0x140030c4e
lea r8, str.Cannot_enumerate_value_n
mov edx, 8
lea rcx, [0x14010f570]
call fcn.140001000
jmp 0x140030c50
xor ebx, ebx
lea r8, str.CRegistryUninstaller::RegDelete____n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
mov eax, ebx
mov rcx, qword [rsp + 0xaa0]
xor rcx, rsp
call fcn.140061100
add rsp, 0xab8
pop rdi
pop rsi
pop rbp
pop rbx
ret