Function at 0x14001bb50
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
xor r13d, r13d
mov ecx, dword [rcx + 8]
mov r12d, r9d
mov qword [rax + 8], r13
mov r14d, r8d
mov qword [rax + 0x10], r13
mov rbp, rdx
call fcn.14001e7f8
mov ecx, dword [rsp + 0x80]
mov rdi, rax
call fcn.14001e7f8
mov ecx, r14d
mov rbx, rax
call fcn.14001f694
mov r8, qword [rsi + 0x88]
mov r9, rax
mov qword [rsp + 0x28], rdi
mov edx, 0x20000173
lea edi, [r13 + 2]
mov qword [rsp + 0x20], rbx
mov ecx, edi
call fcn.140009b38
test rbp, rbp
je 0x14001bc22
mov r8d, r14d
lea rdx, str.Resume
mov rcx, rbp
call fcn.14006b6a4
mov ebx, eax
test eax, eax
jns 0x14001bbf2
lea rax, str.Failed_to_write_Resume_value.
mov edx, 0x4f5
jmp 0x14001bdfa
mov r8d, r13d
lea rdx, str.Installed
cmp r12d, edi
mov rcx, rbp
sete r8b
call fcn.14006b6a4
mov ebx, eax
test eax, eax
jns 0x14001bc22
lea rax, str.Failed_to_write_Installed_value.
mov edx, 0x4f9
jmp 0x14001bdfa
cmp r14d, 1
je 0x14001bc36
cmp dword [rsp + 0x80], r13d
je 0x14001bd12
cmp dword [rsi + 8], r13d
jne 0x14001bd12
mov r8, qword [rsi + 0x90]
lea rax, str.burn.runonce
lea r9, str.burn.clean.room
mov qword [rsp + 0x20], rax
lea rdx, str.__ls____ls___ls
lea rcx, [rsp + 0x68]
call fcn.1400031dc
mov ebx, eax
test eax, eax
jns 0x14001bc82
lea rax, str.Failed_to_format_resume_command_line_for_RunOnce.
mov edx, 0x505
jmp 0x14001bdfa
mov rcx, qword [rsi + 0x80]
lea r9, [rsp + 0x60]
mov r8d, 0x20006
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.140069d80
mov ebx, eax
test eax, eax
jns 0x14001bcb7
lea rax, str.Failed_to_create_run_key.
mov edx, 0x509
jmp 0x14001bdfa
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x60]
call fcn.14006b748
mov ebx, eax
test eax, eax
jns 0x14001bce1
lea rax, str.Failed_to_write_run_key_value.
mov edx, 0x50c
jmp 0x14001bdfa
mov r8, qword [rsi + 0x98]
lea rdx, str.BundleResumeCommandLine
mov rcx, rbp
call fcn.14006b748
mov ebx, eax
test eax, eax
jns 0x14001be1b
lea rax, str.Failed_to_write_resume_command_line_value.
mov edx, 0x50f
jmp 0x14001bdfa
mov rcx, qword [rsi + 0x80]
lea r9, [rsp + 0x60]
mov r8d, 0x20006
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.14006a66c
mov ebx, eax
add eax, 0x7ff8fffe
cmp eax, 1
jbe 0x14001bda1
test ebx, ebx
jns 0x14001bd51
lea rax, str.Failed_to_open_run_key.
mov edx, 0x51a
jmp 0x14001bdfa
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
cmove eax, r13d
test eax, eax
je 0x14001bda4
movzx ebx, ax
lea rcx, str.d:_awixwix_src_burnengine_registration.cpp
or ebx, 0x80070000
mov edi, 0x521
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.Failed_to_delete_run_key_value.
jmp 0x14001bdf8
mov ebx, r13d
test rbp, rbp
je 0x14001be1b
lea rdx, str.BundleResumeCommandLine
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
cmove eax, r13d
test eax, eax
je 0x14001be1b
movzx ebx, ax
lea rcx, str.d:_awixwix_src_burnengine_registration.cpp
or ebx, 0x80070000
mov edi, 0x52b
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.Failed_to_delete_resume_command_line_value.
mov edx, edi
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_src_burnengine_registration.cpp
mov r9d, 0x100
mov dword [rsp + 0x20], ebx
mov r8d, 5
call fcn.1400012b4
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001be2a
call fcn.140004278
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001be3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret