Function at 0x140007140
Capabilities:
Delete registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x11c8
call fcn.140009d60
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1130], xmm6
mov qword [rbp + 0x1128], 0xfffffffffffffffe
mov dword [rbp + 0x1104], r9d
mov qword [rbp + 0x1120], r8
mov r12, rdx
mov r14, rcx
xor eax, eax
mov qword [rbp + 0x1108], rax
mov dword [rbp + 0x1110], 0
mov qword [rbp + 0x1118], rax
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x140007c77
xorps xmm6, xmm6
cmp byte [r12], 0x7d
je 0x140007c77
mov rcx, r12
lea rdx, str.Delete
mov rsi, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rsi
mov r15d, eax
test eax, eax
sete bl
mov rcx, r12
lea rdx, str.ForceRemove
call rsi
test eax, eax
sete cl
xor cl, bl
or eax, r15d
setne al
test cl, cl
jne 0x1400071ff
test al, al
jne 0x140007317
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x140007c77
cmp dword [rbp + 0x1104], 0
je 0x140007317
xor eax, eax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0
mov qword [rbp - 0x10], rax
mov cl, byte [r12]
test cl, cl
lea rbx, str.AppID
mov rsi, qword [sym.imp.USER32.dll_CharNextA]
je 0x140007260
mov rax, r12
cmp cl, 0x5c
je 0x1400072d8
mov rcx, rax
call rsi
mov cl, byte [rax]
test cl, cl
jne 0x14000724c
xor edi, edi
mov rdx, qword [rbx + rdi*8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400072a7
inc rdi
cmp rdi, 0xc
jne 0x140007262
mov rax, qword [rbp + 0x1120]
mov qword [rbp - 0x20], rax
xor edi, edi
mov dword [rbp - 0x18], edi
mov qword [rbp - 0x10], rdi
lea rcx, [rbp - 0x20]
mov rdx, r12
call fcn.14000817c
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x18], edi
mov qword [rbp - 0x10], rdi
xor edi, edi
test r15d, r15d
jne 0x1400072ee
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x1400072e9
mov rcx, r14
mov rdx, r12
call fcn.140008336
mov r13d, eax
mov edi, eax
sar edi, 0x1f
add edi, 4
jmp 0x1400072ee
mov dword [rbp + 0x1100], 0x80020009
mov edi, 1
jmp 0x1400072ee
mov edi, 3
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140007305
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], 0
test edi, edi
je 0x140007317
cmp edi, 4
je 0x14000786d
jmp 0x14000765d
mov rcx, r12
lea rdx, str.NoRemove
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rdi
mov esi, 1
test eax, eax
jne 0x140007352
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
xor esi, esi
test eax, eax
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
js 0x140007c77
mov rcx, r12
lea rdx, [0x140026190]
call rdi
test eax, eax
je 0x140007423
test r12, r12
mov rdi, qword [sym.imp.USER32.dll_CharNextA]
je 0x140007391
mov cl, byte [r12]
test cl, cl
je 0x140007391
mov rax, r12
cmp cl, 0x5c
je 0x140007c71
mov rcx, rax
call rdi
mov cl, byte [rax]
test cl, cl
jne 0x14000737d
cmp dword [rbp + 0x1104], 0
je 0x1400074c2
mov qword [rbp - 0x20], 0
mov rsi, qword [rbp + 0x1118]
test rsi, rsi
je 0x140007567
cmp qword [rsi], 0
je 0x140007561
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140007591
mov rcx, rax
lea rdx, str.RegOpenKeyTransactedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007591
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x2001f
call rax
jmp 0x140007589
mov rcx, r14
lea rdx, [rbp - 0x20]
call fcn.140006f9e
mov r13d, eax
mov edi, 3
test eax, eax
js 0x14000765d
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x14000765d
cmp byte [r12], 0x3d
jne 0x14000764e
cmp dword [rbp + 0x1104], 0
je 0x1400078d2
mov rax, qword [rbp + 0x1120]
mov qword [rbp + 0x10e8], rax
mov dword [rbp + 0x10f0], 0
mov qword [rbp + 0x10f8], 0
mov rcx, r14
lea rdx, [rbp + 0x10e8]
lea r8, [rbp - 0x20]
mov r9, r12
call fcn.1400083e0
mov r13d, eax
test eax, eax
jns 0x14000786d
mov edi, 1
mov dword [rbp + 0x1100], r13d
jmp 0x14000765d
mov r15d, 2
mov edi, dword [rbp + 0x11b0]
test edi, edi
jne 0x1400079a6
mov qword [rbp - 0x20], 0
mov rdi, qword [rbp + 0x1118]
test rdi, rdi
je 0x140007935
cmp qword [rdi], 0
je 0x14000792f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15d, 1
test rax, rax
je 0x1400079a0
mov rcx, rax
lea rdx, str.RegOpenKeyTransactedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400079a0
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x20019
call rax
jmp 0x140007957
cmp dword [rsi + 8], 0
je 0x140007591
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007616
mov qword [rbp - 0x20], 0
mov rsi, qword [rbp + 0x1118]
test rsi, rsi
je 0x140007679
cmp qword [rsi], 0
je 0x140007673
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400076a3
mov rcx, rax
lea rdx, str.RegOpenKeyTransactedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400076a3
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x20019
call rax
jmp 0x14000769b
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x14000777d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x1108], rcx
mov dword [rbp + 0x1110], 0
test eax, eax
jne 0x140007591
jmp 0x14000782f
mov edi, 1
mov dword [rbp + 0x1100], 0x80020009
test edi, edi
je 0x1400071b4
cmp edi, 2
je 0x1400071b4
jmp 0x140007cb2
cmp dword [rsi + 8], 0
je 0x1400076a3
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007749
mov qword [rbp - 0x20], 0
mov rdi, qword [rbp + 0x1118]
test rdi, rdi
je 0x1400077a1
cmp qword [rdi], 0
je 0x140007797
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, 1
test rax, rax
je 0x140007cca
mov rcx, rax
lea rdx, str.RegCreateKeyTransactedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007cca
mov rcx, qword [rdi]
xor edx, edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x10e8]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call rax
jmp 0x1400077e5
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x14000777d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x1108], rcx
mov dword [rbp + 0x1110], 0
test eax, eax
jne 0x1400076a3
jmp 0x14000782f
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x1108], rax
mov dword [rbp + 0x1110], 0
jmp 0x14000782f
cmp dword [rdi + 8], 0
je 0x140007cc5
lea rax, [rbp + 0x10e8]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test eax, eax
jne 0x140007cca
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x140007810
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov qword [rbp + 0x1108], 0
jmp 0x140007812
xor esi, esi
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x1108], rax
mov dword [rbp + 0x1110], 0
test esi, esi
jne 0x140007cca
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x140007c77
mov al, byte [r12]
cmp al, 0x3d
jne 0x140007871
mov rcx, r14
lea rdx, [rbp + 0x1108]
xor r8d, r8d
mov r9, r12
call fcn.1400083e0
mov r13d, eax
test eax, eax
js 0x140007c77
mov al, byte [r12]
cmp al, 0x7b
jne 0x1400071b4
mov rcx, r12
call fcn.14000fb10
cmp rax, 1
jne 0x1400071b4
mov r8, qword [rbp + 0x1108]
mov dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r12
mov r9d, dword [rbp + 0x1104]
call fcn.140007140
mov r13d, eax
test eax, eax
js 0x140007c77
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
jns 0x1400071b4
jmp 0x140007c77
cmp dword [rbp + 0x11b0], 0
setne al
test esi, esi
sete cl
or cl, al
jne 0x140007c56
mov qword [rbp + 0x10e8], 0
lea rax, [rbp + 0x10e8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x1120]
xor edx, edx
xor r8d, r8d
mov r9d, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007c09
mov ecx, eax
call fcn.140008cde
mov r13d, eax
jmp 0x14000765d
cmp dword [rdi + 8], 0
je 0x14000799a
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x1120]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r15d, eax
test eax, eax
jne 0x1400079a0
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x140007980
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, eax
mov qword [rbp + 0x1108], 0
jmp 0x140007983
xor r15d, r15d
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x1108], rax
mov dword [rbp + 0x1110], 0
jmp 0x1400079a0
mov r15d, 1
mov edi, dword [rbp + 0x11b0]
test r15d, r15d
mov eax, 1
cmovne edi, eax
mov edx, 0x104
lea rcx, [rbp + 0xfe0]
mov r8, r12
mov r9, 0xffffffffffffffff
call fcn.14000f4e0
cmp eax, 0x15
jle 0x1400079db
cmp eax, 0x50
je 0x1400079e3
jmp 0x140007d00
test eax, eax
jne 0x140007d18
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x140007c77
mov rcx, r14
mov rdx, r12
call fcn.140008336
mov r13d, eax
test eax, eax
js 0x140007c77
cmp byte [r12], 0x7b
jne 0x140007a6c
mov rcx, r12
call fcn.14000fb10
cmp rax, 1
jne 0x140007a6c
mov r8, qword [rbp + 0x1108]
mov dword [rsp + 0x20], edi
mov rcx, r14
mov rdx, r12
xor r9d, r9d
call fcn.140007140
mov r13d, eax
test eax, eax
setns al
test edi, edi
setne cl
test cl, al
jne 0x140007a56
xor cl, al
je 0x140007c77
mov rcx, r14
mov rdx, r12
call fcn.140006f9e
mov r13d, eax
test eax, eax
js 0x140007c77
cmp r15d, 2
je 0x1400071b4
test r15d, r15d
je 0x140007a8d
cmp dword [rbp + 0x11b0], 0
jne 0x1400071b4
jmp 0x140007cc0
cmp dword [rbp + 0x11b0], 0
je 0x140007b2f
mov rcx, qword [rbp + 0x1108]
xor edi, edi
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x58], rdi
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
setne al
cmp dword [rbp - 0x20], edi
sete cl
test al, cl
jne 0x140007b2f
xor al, cl
jne 0x140007b2f
xor edi, edi
lea rbx, str.AppID
mov rdx, qword [rbx + rdi*8]
lea rcx, [rbp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400071b4
inc rdi
cmp rdi, 0xc
jne 0x140007aed
test esi, esi
je 0x1400071b4
lea rcx, [rbp + 0x1108]
lea rdx, [rbp + 0xfe0]
call fcn.14000817c
jmp 0x1400071b4
mov rcx, qword [rbp + 0x1108]
xor edi, edi
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x58], rdi
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
sete r15b
cmp dword [rbp - 0x20], edi
setne dil
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x140007ba3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x1108], 0
mov dword [rbp + 0x1110], 0
test eax, eax
je 0x140007bad
jmp 0x140007cd6
mov dword [rbp + 0x1110], 0
xor dil, r15b
not dil
and dil, r15b
test esi, esi
sete al
test al, dil
jne 0x1400071b4
xor al, dil
jne 0x1400071b4
mov rax, qword [rbp + 0x1120]
mov qword [rbp - 0x20], rax
xor esi, esi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0xfe0]
call fcn.140008d12
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
test eax, eax
je 0x1400071b4
jmp 0x140007cda
mov rsi, qword [rbp + 0x10e8]
mov rcx, rsi
lea rdx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, eax
mov edx, 0xffffffff
xor ecx, edx
or ecx, 2
cmp ecx, edx
je 0x140007c3e
mov ecx, eax
call fcn.140008cde
mov r13d, eax
mov edi, 3
jmp 0x140007c40
xor edi, edi
test rsi, rsi
je 0x140007c4e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000765d
mov rcx, r14
mov rdx, r12
call fcn.140008336
mov r13d, eax
mov edi, eax
shr edi, 0x1f
or edi, 2
jmp 0x14000765d
mov r13d, 0x80020009
mov rcx, qword [rbp + 0x1108]
test rcx, rcx
je 0x140007c94
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x1108], 0
mov eax, r13d
movaps xmm6, xmmword [rbp + 0x1130]
add rsp, 0x11c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp edi, 3
je 0x140007c77
mov r13d, dword [rbp + 0x1100]
jmp 0x140007c77
mov ecx, r15d
jmp 0x140007ccc
mov esi, 1
mov ecx, esi
call fcn.140008cde
mov r13d, eax
jmp 0x140007c77
mov ecx, eax
jmp 0x140007ccc
mov ecx, eax
call fcn.140008cde
mov r13d, eax
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140007c77
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], 0
jmp 0x140007c77
cmp eax, 0x16
je 0x140007d0a
cmp eax, 0x22
jne 0x140007d2b
mov ecx, 0x80070057
call fcn.140006587
sub rsp, 0x20
cmp eax, 0xc
jne 0x140007d2b
mov ecx, 0x8007000e
call fcn.140006587
sub rsp, 0x20
mov ecx, 0x80004005
call fcn.140006587
sub rsp, 0x20
nop
mov qword [rsp + 0x10], rdx
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rdx + 0x80]
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140007d72
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], 0
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret