Function at 0x140004dac
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21c8]
mov eax, 0x22c8
call fcn.140151e90
sub rsp, rax
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0x21b0], rax
mov dword [rsp + 0x64], r9d
mov r15, r8
mov qword [rsp + 0x68], r8
mov rsi, rdx
mov r12, rcx
xor eax, eax
mov edi, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
call fcn.1400042cc
mov ebx, eax
test eax, eax
jns 0x140004e12
jmp 0x1400054b7
cmp word [rsi], 0x7d
je 0x1400054a1
mov r13d, 1
lea rdx, str.Delete
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
xor ebx, ebx
mov r14d, ebx
test eax, eax
sete r14b
lea rdx, str.ForceRemove
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004e66
test r14d, r14d
je 0x140004f43
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
cmp dword [rsp + 0x64], edx
je 0x140004f41
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rdx
mov rcx, rsi
movzx eax, word [rsi]
jmp 0x140004eb5
cmp ax, 0x5c
je 0x140004ebc
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140004e9d
jmp 0x140004ec5
test rcx, rcx
jne 0x14000550f
lea rbx, str.AppID
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004f04
add rbx, 8
lea rax, [0x140155940]
cmp rbx, rax
jl 0x140004ecc
mov qword [rsp + 0x70], r15
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1400048b8
xor ebx, ebx
test r14d, r14d
je 0x140004f43
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
test eax, eax
js 0x1400054a1
mov rdx, rsi
mov rcx, r12
call fcn.140005774
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
mov r14d, dword [rsp + 0x64]
jmp 0x140005185
xor ebx, ebx
lea rdx, str.NoRemove
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x140004f75
mov r13d, ebx
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
test eax, eax
js 0x1400054a1
lea rdx, [0x140157d78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x1400050bf
lea rdx, [rbp + 0x1b0]
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
test eax, eax
js 0x1400054a1
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
cmp word [rsi], 0x3d
jne 0x14000550f
mov r14d, dword [rsp + 0x64]
test r14d, r14d
je 0x14000500d
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x70], r15
mov r9, rsi
lea r8, [rbp + 0x1b0]
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.140002f5c
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
jmp 0x140005185
cmp dword [rbp + 0x2230], edx
jne 0x1400050a5
test r13d, r13d
je 0x1400050a5
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rdx
mov r9d, 0x20006
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400044cc
test eax, eax
jne 0x1400054fa
mov r14, qword [rsp + 0x70]
test r14, r14
jne 0x140005070
lea r8, str.m_hKey___0
mov edx, 0x1544
lea rcx, str.onecoreexternal_sdkinc_atlmfc_atlbase.h
call fcn.14008ac24
lea rdx, [rbp + 0x1b0]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x1400054db
test r14, r14
je 0x1400050a5
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, rsi
mov rcx, r12
call fcn.140005774
mov ebx, eax
test eax, eax
js 0x1400054a1
jmp 0x140004e12
mov rcx, rsi
movzx eax, word [rsi]
jmp 0x1400050df
cmp ax, 0x5c
je 0x1400050e6
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x1400050c7
jmp 0x1400050ef
test rcx, rcx
jne 0x14000550f
mov r14d, dword [rsp + 0x64]
test r14d, r14d
je 0x1400051d5
mov r9d, 0x2001f
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.1400044cc
test eax, eax
je 0x140005146
mov r9d, 0x20019
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.1400044cc
test eax, eax
je 0x140005146
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.1400038cc
test eax, eax
jne 0x14000552a
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
xor edx, edx
test eax, eax
js 0x140005545
cmp word [rsi], 0x3d
jne 0x140005181
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov rcx, r12
call fcn.140002f5c
mov ebx, eax
xor edx, edx
test eax, eax
js 0x140005545
mov rdi, qword [rbp - 0x78]
cmp word [rsi], 0x7b
jne 0x140004e12
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], dx
jne 0x140005193
cmp rax, 1
jne 0x140004e12
mov dword [rsp + 0x20], edx
mov r9d, r14d
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call fcn.140004dac
mov ebx, eax
test eax, eax
js 0x1400054a1
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
jmp 0x1400050b0
mov ebx, dword [rbp + 0x2230]
test ebx, ebx
jne 0x1400051fd
mov r9d, 0x20019
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.1400044cc
mov r14d, eax
mov rdi, qword [rbp - 0x78]
jmp 0x140005203
mov r14d, 2
mov r15d, 1
test r14d, r14d
cmove r15d, ebx
or r9, 0xffffffffffffffff
mov r8, rsi
mov edx, 0x104
lea rcx, [rbp - 0x60]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
test eax, eax
je 0x140005254
cmp eax, 0xc
je 0x140005562
cmp eax, 0x16
je 0x140005578
cmp eax, 0x22
je 0x140005578
cmp eax, 0x50
jne 0x14000556d
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
test eax, eax
js 0x1400054a1
mov rdx, rsi
mov rcx, r12
call fcn.140005774
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
cmp word [rsi], 0x7b
jne 0x1400052d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], dx
jne 0x14000528a
cmp rax, 1
jne 0x1400052d5
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call fcn.140004dac
mov ebx, eax
test eax, eax
jns 0x1400052be
test r15d, r15d
je 0x1400054a1
mov rdx, rsi
mov rcx, r12
call fcn.1400042cc
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400054a1
cmp r14d, 2
je 0x1400052ec
test r14d, r14d
je 0x1400052f6
cmp dword [rbp + 0x2230], edx
je 0x14000554e
mov r15, qword [rsp + 0x68]
jmp 0x140004e12
cmp dword [rbp + 0x2230], edx
je 0x14000536a
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
je 0x1400053d7
lea r8, [0x140157b84]
mov edx, 0x429
lea rcx, str.onecoreexternal_sdkinc_atlmfc_statreg.h
call fcn.14008ac24
xor edx, edx
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
je 0x14000542e
lea r8, [0x140157b84]
mov edx, 0x429
lea rcx, str.onecoreexternal_sdkinc_atlmfc_statreg.h
call fcn.14008ac24
xor edx, edx
mov r14d, edx
jmp 0x140005439
cmp dword [rsp + 0x60], edx
jbe 0x14000536a
lea r14, str.AppID
mov rdx, qword [r14]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400052ec
add r14, 8
lea rax, [0x140155940]
cmp r14, rax
jl 0x1400053e4
test r13d, r13d
je 0x1400052ec
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400048b8
mov rdi, qword [rbp - 0x78]
jmp 0x1400052ec
mov r14d, edx
cmp dword [rsp + 0x60], edx
seta r14b
test rdi, rdi
je 0x14000545d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor edx, edx
mov edi, edx
mov qword [rbp - 0x78], rdx
test eax, eax
jne 0x140005556
test r13d, r13d
je 0x1400052ec
mov r15, qword [rsp + 0x68]
test r14d, r14d
jne 0x140004e12
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x70], r15
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.140003f20
test eax, eax
je 0x140004e12
mov ecx, eax
call fcn.1400036fc
mov ebx, eax
test rdi, rdi
je 0x1400054b5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x21b0]
xor rcx, rsp
call fcn.140001d90
add rsp, 0x22c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.1400036fc
mov ebx, eax
test r14, r14
je 0x1400054a1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400054a1
mov ecx, eax
call fcn.1400036fc
mov ebx, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400054a1
jmp 0x1400054ec
test rdi, rdi
je 0x140005523
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, 0x80020009
jmp 0x1400054b7
mov ecx, eax
call fcn.1400036fc
mov ebx, eax
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400054b5
jmp 0x1400054a9
mov rdi, qword [rbp - 0x78]
jmp 0x1400054a1
mov ecx, r14d
jmp 0x14000549a
mov ecx, eax
call fcn.1400036fc
jmp 0x140004e0d
mov ecx, 0x8007000e
call fcn.140003714
int3
mov ecx, 0x80004005
call fcn.140003714
int3
mov ecx, 0x80070057
call fcn.140003714
int3