Function at 0x14004e440
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, r9
mov rsi, r8
mov rbx, rdx
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e493
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e4c4
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e4f5
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e526
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.140069504
mov r15, qword [rax + 8]
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e560
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
or r12, 0xffffffffffffffff
test rsi, rsi
je 0x14004e5b9
test rsi, 0xffffffffffff0000
jne 0x14004e5a5
movzx edi, si
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14004e5cc
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003a40
jmp 0x14004e5cc
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004e5bb
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140003c40
nop
mov r8d, 5
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.140003710
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x30]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004e645
cmp dword [rdi + 0x10], 0
jl 0x14004e636
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004e636
call fcn.1400031e0
mov rbp, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004e62b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14004e645
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004e669
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e688
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
test rsi, rsi
je 0x14004e6dd
test rsi, 0xffffffffffff0000
jne 0x14004e6c9
movzx edi, si
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14004e6f0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140003a40
jmp 0x14004e6f0
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004e6df
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140003c40
nop
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e70f
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r14, qword [rsp + 0x68]
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [r14 - 8], 0
jl 0x14004e74c
cmp rax, qword [r14 - 0x18]
jne 0x14004e74c
lea rdi, [r14 - 0x18]
lock add dword [r14 - 8], 1
jmp 0x14004e78d
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [r14 - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x14004e769
call fcn.1400019f0
int3
mov eax, dword [r14 - 0x10]
mov dword [rdi + 8], eax
mov eax, dword [r14 - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, r14
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.140080540
lea rax, [rdi + 0x18]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140027420
call fcn.140015a10
mov ebp, eax
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e7d1
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
test rbx, rbx
je 0x14004e826
test rbx, 0xffffffffffff0000
jne 0x14004e812
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14004e839
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140003a40
jmp 0x14004e839
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004e828
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140003c40
nop
cmp ebp, 2
je 0x14004ece3
cmp ebp, 3
je 0x14004ece3
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004e86a
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x38], rdi
test rbx, rbx
je 0x14004e8c4
test rbx, 0xffffffffffff0000
jne 0x14004e8b0
movzx esi, bx
mov ecx, esi
call fcn.1400696b8
test rax, rax
je 0x14004e8db
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003a40
mov rdi, qword [rsp + 0x38]
jmp 0x14004e8db
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004e8c6
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003c40
mov rdi, qword [rsp + 0x38]
cmp dword [rdi - 0x10], 0
jle 0x14004eaea
mov dx, 0x5c
mov rcx, rdi
call fcn.1400804a0
test rax, rax
je 0x14004eaea
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14004eaea
mov r8d, dword [rdi - 0x10]
add r8d, 0xffffffff
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.140003710
nop
mov r8, rax
lea rdx, [r15 + 0x5d8]
lea rcx, [rsp + 0x90]
call fcn.140003ec0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x20]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004e999
cmp dword [rdi + 0x10], 0
jl 0x14004e98a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004e98a
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004e97f
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14004e999
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004e9be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004e9df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x5d8]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x28]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004ea42
cmp dword [rdi + 0x10], 0
jl 0x14004ea34
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004ea34
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ea29
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x14004ea42
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140003c40
mov rdi, qword [rsp + 0x20]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.1400222b0
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dx, 0x5c
mov rcx, rdi
call fcn.140080890
test rax, rax
jne 0x14004ea7c
mov eax, r12d
jmp 0x14004ea82
sub rax, rdi
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400038a0
nop
mov rdi, qword [rsp + 0x80]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004eac5
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ecb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004ecb9
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004eb09
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x14004eb5e
test rbx, 0xffffffffffff0000
jne 0x14004eb4a
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14004eb71
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003a40
jmp 0x14004eb71
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004eb60
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003c40
nop
lea rdx, [r15 + 0x5d0]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x88]
call fcn.140003ec0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x20]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004ebeb
cmp dword [rdi + 0x10], 0
jl 0x14004ebdc
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004ebdc
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ebd1
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14004ebeb
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ec10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ec31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x5d8]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x28]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004ec94
cmp dword [rdi + 0x10], 0
jl 0x14004ec86
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004ec86
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ec7b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x14004ec94
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140003c40
mov rdi, qword [rsp + 0x20]
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.1400222b0
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f091
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004f091
lea rdx, [0x1400a8300]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400807e0
test eax, eax
je 0x14004ed2e
lea rdx, [0x1400a8300]
mov rcx, rdi
call fcn.1400807e0
test eax, eax
je 0x14004ed21
mov rdx, qword [r15 + 0x580]
mov rcx, r13
call fcn.14002cc30
test eax, eax
jns 0x14004ed2e
mov rcx, rsi
call fcn.14002a160
jmp 0x14004f091
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004ed4d
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rbx, rbx
je 0x14004eda2
test rbx, 0xffffffffffff0000
jne 0x14004ed8e
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14004edb5
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003a40
jmp 0x14004edb5
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14004eda4
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140003c40
nop
lea rdx, [r15 + 0x5d0]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x98]
call fcn.140003ec0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x20]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004ee2f
cmp dword [rdi + 0x10], 0
jl 0x14004ee20
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004ee20
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ee15
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14004ee2f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ee54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ee75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x5d8]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x28]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004eed8
cmp dword [rdi + 0x10], 0
jl 0x14004eeca
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004eeca
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004eebf
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x14004eed8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140003c40
mov rdx, qword [r15 + 0x5f0]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x40]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x14004ef40
cmp dword [rbx + 0x10], 0
jl 0x14004ef2d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ef2d
call fcn.1400031e0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ef22
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x40], rdi
jmp 0x14004ef40
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003c40
mov rdi, qword [rsp + 0x40]
mov rdx, qword [r15 + 0x5e8]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x48]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x14004efad
cmp dword [rsi + 0x10], 0
jl 0x14004ef9a
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14004ef9a
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004ef8a
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x40]
jmp 0x14004efad
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140003c40
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.1400222b0
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004f072
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004f022
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004f046
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004f072
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdx, rbp
mov rcx, 0xffffffff80000001
call fcn.1400222b0
mov rdx, rbp
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004f0e6
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004f0e6
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14004f10f
cmp rax, qword [rdi - 0x18]
jne 0x14004f10f
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x14004f14d
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14004f12b
call fcn.1400019f0
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.140080540
lea rax, [rbx + 0x18]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.140025ad0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f189
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f1ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r14 - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f1ca
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f1ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f20e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f230
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004f252
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14004f273
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret