Function at 0x140009ca0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rbp + 0x17], rax
movsd xmm0, qword [str.___t_n]
xor esi, esi
movzx eax, word [0x140013470]
mov rbx, r8
and qword [rsp + 0x50], rsi
mov r13, rcx
movsd qword [rbp - 0x49], xmm0
xor r9d, r9d
movups xmm0, xmmword [0x140012b70]
xor r8d, r8d
mov word [rbp - 0x41], ax
lea edx, [rsi + 1]
xor ecx, ecx
movdqu xmmword [0x140016748], xmm0
mov edi, 0x80070057
xor r15d, r15d
xor r12d, r12d
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rbp - 0x49]
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000a1d6
mov r8d, 0xb
lea rdx, str._Embedding
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140009d70
lea r14d, [rax + 1]
jmp 0x140009e7b
mov r8d, 0xb
lea rdx, [0x140013490]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140009e75
mov r8d, 0xb
lea rdx, str._REGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140009e75
mov r8d, 0xd
lea rdx, [0x1400134c0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140009e6d
mov r8d, 0xd
lea rdx, str._UNREGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140009e6d
mov r8d, 7
lea rdx, str._CLSID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140009e35
lea rcx, [rbx + 0xe]
lea rdx, [0x140016748]
call qword [sym.imp.ole32.dll_CLSIDFromString]
nop dword [rax + rax]
jmp 0x140009e7b
mov r8d, 5
lea rdx, str._PID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140009e7b
lea rcx, [rbx + 0xa]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [0x140016608], eax
jmp 0x140009e7b
mov r12d, 1
jmp 0x140009e7b
mov r15d, 1
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rbp - 0x49]
inc esi
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140009d47
lea ebx, [rax + 1]
cmp esi, ebx
je 0x140009ed4
cmp esi, 2
jne 0x14000a1d6
mov rax, qword [0x140016748]
cmp rax, qword [0x140012b70]
jne 0x140009ed4
mov rax, qword [0x140016750]
cmp rax, qword [0x140012b78]
je 0x14000a1d6
xor esi, esi
test r12d, r12d
je 0x14000a010
movups xmm0, xmmword [0x140012cd0]
lea rax, [rsp + 0x58]
mov ebx, 0xf003f
movups xmm1, xmmword [0x140012be0]
mov r14, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.CLSID
xor r8d, r8d
mov rcx, r14
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
mov edi, reloc.iertutil.dll_Ordinal_39
test eax, eax
jne 0x140009f73
mov r8d, edi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rbp - 0x79]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AppID
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140009fdb
mov r8d, edi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x140009ffd
test esi, esi
jne 0x140009fea
xor edi, edi
jmp 0x14000a1d6
movzx edi, si
or edi, 0x80070000
test esi, esi
cmovle edi, esi
jmp 0x14000a1d6
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x14000a1d6
test r15d, r15d
je 0x14000a050
movups xmm0, xmmword [0x140012cd0]
lea rdx, [rbp - 0x59]
movups xmm1, xmmword [0x140012be0]
lea rcx, [rbp - 0x69]
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call fcn.14000a208
mov edi, eax
test eax, eax
js 0x14000a1d6
call fcn.14000a6a0
mov edi, eax
jmp 0x14000a1d6
test r14d, r14d
je 0x14000a1d6
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x140016708], rax
test rax, rax
je 0x14000a1bc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000a1a7
mov edx, ebx
mov rcx, r13
call fcn.14000c868
test eax, eax
je 0x14000a19b
mov qword [rsp + 0x40], rsi
or r14, 0xffffffffffffffff
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov edx, r14d
xor ecx, ecx
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000a167
call fcn.140001818
mov edi, eax
test eax, eax
js 0x14000a167
xor r8d, r8d
lea rcx, str.user32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000a145
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x14000a136
call qword [0x140012988]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call fcn.140008488
mov rcx, qword [0x140016708]
or edx, 0xffffffff
mov edi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
call fcn.140001940
mov rcx, qword [0x140016038]
cmp rcx, r14
je 0x14000a186
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
nop dword [rax + rax]
mov qword [0x140016038], r14
mov rax, qword [0x140016798]
test rax, rax
cmovne rax, r14
mov qword [0x140016798], rax
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
mov rcx, qword [0x140016708]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14000a1d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000f1e0
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret