Function at 0x14000b04c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140018018]
xor rax, rsp
mov qword [rbp + 0x17], rax
movsd xmm0, qword [str.___t_n]
xor esi, esi
movzx eax, word [0x140014550]
mov rbx, r8
and qword [rsp + 0x50], rsi
mov r13, rcx
movsd qword [rbp - 0x49], xmm0
xor r9d, r9d
movups xmm0, xmmword [0x140013c40]
xor r8d, r8d
mov word [rbp - 0x41], ax
lea edx, [rsi + 1]
xor ecx, ecx
movdqu xmmword [0x1400187b8], xmm0
mov edi, 0x80070057
xor r15d, r15d
xor r12d, r12d
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rbp - 0x49]
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b589
mov r8d, 0xb
lea rdx, str._Embedding
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000b11c
lea r14d, [rax + 1]
jmp 0x14000b227
mov r8d, 0xb
lea rdx, [0x140014570]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b221
mov r8d, 0xb
lea rdx, str._REGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b221
mov r8d, 0xd
lea rdx, [0x1400145a0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b219
mov r8d, 0xd
lea rdx, str._UNREGSERVER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000b219
mov r8d, 7
lea rdx, str._CLSID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000b1e1
lea rcx, [rbx + 0xe]
lea rdx, [0x1400187b8]
call qword [sym.imp.ole32.dll_CLSIDFromString]
nop dword [rax + rax]
jmp 0x14000b227
mov r8d, 5
lea rdx, str._PID:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000b227
lea rcx, [rbx + 0xa]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [0x140018658], eax
jmp 0x14000b227
mov r12d, 1
jmp 0x14000b227
mov r15d, 1
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rbp - 0x49]
inc esi
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000b0f3
lea ebx, [rax + 1]
cmp esi, ebx
je 0x14000b280
cmp esi, 2
jne 0x14000b589
mov rax, qword [0x1400187b8]
cmp rax, qword [0x140013c40]
jne 0x14000b280
mov rax, qword [0x1400187c0]
cmp rax, qword [0x140013c48]
je 0x14000b589
xor esi, esi
test r12d, r12d
je 0x14000b3b4
movups xmm0, xmmword [0x140013da0]
lea rax, [rsp + 0x58]
mov ebx, 0xf003f
movups xmm1, xmmword [0x140013cb0]
mov r15, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.CLSID
xor r8d, r8d
mov rcx, r15
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
lea r14d, [rsi + 0x27]
mov edi, eax
test eax, eax
jne 0x14000b31e
mov r8d, r14d
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rbp - 0x79]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AppID
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000b386
mov r8d, r14d
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
lea rdx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000b3a3
test edi, edi
jne 0x14000b395
mov edi, esi
jmp 0x14000b589
jle 0x14000b589
movzx edi, di
jmp 0x14000b583
jg 0x14000b3ac
mov edi, ebx
jmp 0x14000b589
movzx edi, bx
jmp 0x14000b583
test r15d, r15d
je 0x14000b3f4
movups xmm0, xmmword [0x140013da0]
lea rdx, [rbp - 0x59]
movups xmm1, xmmword [0x140013cb0]
lea rcx, [rbp - 0x69]
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x69], xmm1
call fcn.14000aafc
mov edi, eax
test eax, eax
js 0x14000b589
call fcn.14000af94
mov edi, eax
jmp 0x14000b589
test r14d, r14d
je 0x14000b589
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x140018778], rax
test rax, rax
je 0x14000b56e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000b559
mov edx, ebx
mov rcx, r13
call fcn.14000d74c
test eax, eax
je 0x14000b54d
mov qword [rsp + 0x40], rsi
or r14, 0xffffffffffffffff
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov edx, r14d
xor ecx, ecx
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000b519
call fcn.14000238c
mov edi, eax
test eax, eax
js 0x14000b519
xor r8d, r8d
lea rcx, str.user32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b4f7
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x14000b4e8
movabs r10, 0xd30527475e523070
call qword [0x1400139c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
call fcn.140007180
mov rcx, qword [0x140018778]
or edx, 0xffffffff
mov edi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
call fcn.140002554
mov rcx, qword [0x140018038]
cmp rcx, r14
je 0x14000b538
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
nop dword [rax + rax]
mov qword [0x140018038], r14
mov rax, qword [0x140018808]
test rax, rax
cmovne rax, r14
mov qword [0x140018808], rax
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
mov rcx, qword [0x140018778]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14000b589
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14000b589
movzx edi, ax
or edi, 0x80070000
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001580
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret