Function at 0x14002f700
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1400fc3f8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x68], rsi
test rdx, rdx
je 0x14002fc09
mov eax, dword [0x1400cece0]
cmp dword [rcx], eax
jne 0x14002f776
mov eax, dword [0x1400cece4]
cmp dword [rcx + 4], eax
jne 0x14002f776
mov eax, dword [0x1400cece8]
cmp dword [rcx + 8], eax
jne 0x14002f776
mov eax, dword [0x1400cecec]
cmp dword [rcx + 0xc], eax
je 0x14002fc09
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c6370]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400ced10]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14002fc09
mov ecx, dword [rbx]
test ecx, ecx
je 0x14002f81b
nop dword [rax + rax]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
lea r9, [rbp - 0x80]
mov r8d, 1
mov rdx, rdi
test r14d, r14d
je 0x14002f7f4
cmp ecx, r8d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x14002f7e0
mov rax, qword [rax + 0x28]
jmp 0x14002f7e4
mov rax, qword [rax + 0x38]
call qword [case.0x14005f7f8.0]
test eax, eax
js 0x14002fc0b
jmp 0x14002f811
cmp ecx, 1
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x14002f807
mov rax, qword [rax + 0x30]
jmp 0x14002f80b
mov rax, qword [rax + 0x40]
call qword [case.0x14005f7f8.0]
add rbx, 0x10
mov ecx, dword [rbx]
test ecx, ecx
jne 0x14002f7b0
test r14d, r14d
jne 0x14002fc0d
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x14002f845
lea eax, [r14 + 0xd]
jmp 0x14002fc0b
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092ed4
test eax, eax
je 0x14002f882
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092e5c
test eax, eax
je 0x14002f8bf
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092e5c
test eax, eax
je 0x14002f8fc
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
mov rbx, rsi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f937
mov eax, esi
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x14002fa13
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14002f991
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x14002fa13
cmp dword [rsp + 0x60], edi
jne 0x14002fa13
cmp byte [0x140101020], dil
jne 0x14002f9e7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f9d7
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140101018], rax
mov byte [0x140101020], 1
jmp 0x14002f9ee
mov rax, qword [0x140101018]
mov byte [0x140101020], 1
jmp 0x14002f9ee
mov rax, qword [0x140101018]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x14002fa0c
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14005f7f8.0]
jmp 0x14002fa13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092ed4
test eax, eax
je 0x14002fa50
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092e5c
test eax, eax
je 0x14002fa8d
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.140092e5c
test eax, eax
je 0x14002faca
cmp eax, 0xc
je 0x14002fc4e
cmp eax, 0x16
je 0x14002fc64
cmp eax, 0x22
je 0x14002fc64
cmp eax, 0x50
jne 0x14002fc59
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002fb0c
mov eax, esi
test rbx, rbx
je 0x14002fb07
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
test eax, eax
jne 0x14002fbec
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14002fb66
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x14002fbfa
cmp dword [rsp + 0x60], edi
jne 0x14002fbec
cmp byte [0x140101020], dil
jne 0x14002fbc0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002fbb0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140101018], rax
mov byte [0x140101020], 1
jmp 0x14002fbc7
mov rax, qword [0x140101018]
mov byte [0x140101020], 1
jmp 0x14002fbc7
mov rax, qword [0x140101018]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x14002fbe5
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14005f7f8.0]
jmp 0x14002fbec
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test rbx, rbx
je 0x14002fbfa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002fc0d
mov eax, esi
mov esi, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002fc25
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14005f7f8.0]
nop
mov eax, esi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14008a6c0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400214a0
int3
mov ecx, 0x80004005
call fcn.1400214a0
int3
mov ecx, 0x80070057
call fcn.1400214a0
int3