Function at 0x140005808
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f8
lea rbp, [rsp + 0x60]
mov rax, qword [0x1400153a0]
xor rax, rbp
mov qword [rbp + 0x280], rax
mov dword [rbp + 8], r9d
mov qword [rbp + 0x10], r8
mov r14, rdx
mov r12, rcx
xor eax, eax
mov ebx, eax
mov qword [rbp + 0x60], rax
mov esi, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov r13d, eax
mov dword [rbp + 0x18], 1
mov eax, dword [rbp + 0x300]
mov dword [rbp + 0x38], eax
call fcn.140004b44
mov edi, eax
test eax, eax
jns 0x140005879
jmp 0x1400061a2
cmp word [r14], 0x7d
je 0x140005af8
lea rdx, str.Delete
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
xor edi, edi
mov r15d, edi
test eax, eax
sete r15b
lea rdx, str.ForceRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400058c8
test r15d, r15d
je 0x140005994
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
xor edi, edi
cmp dword [rbp + 8], edi
je 0x140005994
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rcx, r14
movzx eax, word [r14]
jmp 0x140005915
cmp ax, 0x5c
je 0x14000591c
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x1400058fd
jmp 0x140005925
test rcx, rcx
jne 0x14000600f
lea rdi, str.CLSID
mov rdx, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140005966
add rdi, 8
lea rax, [0x140010600]
cmp rdi, rax
jl 0x14000592c
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.140005138
xor edi, edi
test r15d, r15d
je 0x140005994
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140006042
mov rdx, r14
mov rcx, r12
call fcn.140006800
mov edi, eax
jmp 0x140005fad
lea rdx, str.NoRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x1400059c8
mov dword [rbp + 0x18], edi
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
xor edi, edi
lea rdx, [0x1400111d0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x140005b12
lea rdx, [rbp + 0x70]
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005af8
cmp word [r14], 0x3d
jne 0x1400060a1
xor edi, edi
cmp dword [rbp + 8], edi
je 0x140005a71
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov byte [rsp + 0x20], dil
mov r9, r14
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x20]
mov rcx, r12
call fcn.140002b64
mov edi, eax
test eax, eax
jns 0x140005fb5
test rsi, rsi
je 0x140005a6c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x140006059
cmp dword [rbp + 0x300], ecx
jne 0x140005ae3
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000608d
mov r15, qword [rbp]
lea rdx, [rbp + 0x70]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov edi, eax
test eax, 0xfffffffd
jne 0x140006063
test r15, r15
je 0x140005ae3
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, r14
mov rcx, r12
call fcn.140006800
mov edi, eax
test eax, eax
jns 0x140005879
test rsi, rsi
je 0x140005b0d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000619b
mov rcx, r14
movzx eax, word [r14]
jmp 0x140005b33
cmp ax, 0x5c
je 0x140005b3a
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140005b1b
jmp 0x140005b43
test rcx, rcx
jne 0x1400060d4
cmp dword [rbp + 8], edi
je 0x140005cd7
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r14
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x140005ba6
mov eax, r15d
test rsi, rsi
je 0x140005b96
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005c64
mov qword [rbp], r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005bf5
mov eax, r15d
test rsi, rsi
je 0x140005be9
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005c64
mov qword [rbp], r15
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006104
mov eax, r15d
test rsi, rsi
je 0x140005c54
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
jne 0x140006104
movzx eax, word [r14]
sub ax, 0x4c
mov ecx, 0xffdf
test cx, ax
jne 0x140005c9b
lea rdx, str.LocalServer32
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
movzx r15d, r15b
test eax, eax
mov eax, 1
cmove r15d, eax
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
cmp word [r14], 0x3d
jne 0x140005fb5
mov byte [rsp + 0x20], r15b
mov r9, r14
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.140002b64
jmp 0x140005fab
mov r15d, dword [rbp + 0x300]
test r15d, r15d
jne 0x140005d40
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005d32
mov eax, edi
test rsi, rsi
je 0x140005d26
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005d40
mov eax, 1
mov r15d, eax
mov dword [rbp + 0x300], eax
test r13, r13
jne 0x140005d9b
mov ecx, 0x208
call fcn.140006d50
test al, al
je 0x140005d69
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea r13, [rsp + 0x60]
mov eax, dword [r13]
jmp 0x140005d92
mov ecx, 0x218
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x140005d84
mov r13, rdi
jmp 0x140005d92
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 0x60], rax
lea r13, [rax + 0x10]
test r13, r13
je 0x140006134
mov r8d, 0x104
mov rdx, r14
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
test r15d, r15d
jne 0x140005e17
mov dword [rbp], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
js 0x140005e07
cmp dword [rbp], edi
ja 0x140005e17
mov rdx, rsi
call fcn.1400042ac
test eax, eax
je 0x140005f46
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
mov rdx, r14
mov rcx, r12
call fcn.140006800
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005af8
cmp word [r14], 0x7b
jne 0x140005e94
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.140005808
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005af8
test r15d, r15d
je 0x140005e9d
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x300], eax
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
jmp 0x140005ae3
test r15d, r15d
jne 0x140005879
mov dword [rbp], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
js 0x140005f3b
cmp dword [rbp], ecx
jbe 0x140005f3b
lea rdi, str.CLSID
mov rdx, qword [rdi]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140005f2b
add rdi, 8
lea rax, [0x140010600]
cmp rdi, rax
jl 0x140005ef5
mov rdx, r13
lea rcx, [rbp + 0x40]
call fcn.140005138
mov rsi, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r12
call fcn.140004b44
jmp 0x140005aee
test r15d, r15d
jne 0x140005879
xor edi, edi
test rsi, rsi
je 0x140005f69
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, rdi
mov qword [rbp + 0x40], rdi
test eax, eax
jne 0x140006169
cmp dword [rbp + 0x18], edi
je 0x140005f8b
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov rdx, r13
lea rcx, [rbp + 0x20]
call fcn.140004198
nop
mov rdx, r14
mov rcx, r12
call fcn.140004b44
mov edi, eax
test eax, eax
js 0x140005af8
mov rdx, r14
mov rcx, r12
call fcn.140006800
mov edi, eax
test eax, eax
js 0x140005af8
mov ecx, dword [rbp + 8]
xor edx, edx
test ecx, ecx
je 0x140005879
cmp word [r14], 0x7b
jne 0x140005879
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], dx
jne 0x140005fd1
mov edx, 1
cmp rax, rdx
jne 0x140005879
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.140005808
mov edi, eax
test eax, eax
js 0x140005af8
jmp 0x140005f2b
test rsi, rsi
je 0x140006024
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x140006038
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140006026
jmp 0x140006182
jmp 0x140005af8
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140006047
jmp 0x1400061a0
test eax, eax
jle 0x140006070
movzx edi, ax
or edi, 0x80070000
test r15, r15
je 0x140005af8
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140005af8
jle 0x140005af8
movzx edi, ax
or edi, 0x80070000
jmp 0x140005af8
test rsi, rsi
je 0x1400060b6
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x1400060ca
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400060b8
jmp 0x140006182
test rsi, rsi
je 0x1400060e9
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x1400060fd
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400060eb
jmp 0x140006182
test rsi, rsi
je 0x140006119
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000612d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000611b
jmp 0x140006182
test rsi, rsi
je 0x140006149
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000615d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000614b
mov eax, 0x8007000e
jmp 0x1400061a2
jmp 0x14000617d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000616b
mov eax, 0x80020009
jmp 0x1400061a2
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140006189
mov eax, edi
mov rcx, qword [rbp + 0x280]
xor rcx, rbp
call fcn.140001820
lea rsp, [rbp + 0x298]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret