Function at 0x100020bdc
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8e0
mov rax, qword [0x100036110]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
xor r14d, r14d
mov ebx, 0x3fe
lea rcx, [r11 - 0x836]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
mov word [r11 - 0x838], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4d2]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x4d0], r14w
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], r14d
mov r13d, r14d
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x50], r14
lea r15, [0x1000034e0]
cmp dword [0x1000361bc], r14d
je 0x100020cd3
lea rax, [rsp + 0x40]
lea rsi, [0x100003420]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020eb2
lea r8, [0x1000034b8]
mov edx, 0x6c0
jmp 0x100020ea5
lea rcx, [0x100003500]
mov dword [rsp + 0x38], r14d
call fcn.10002235c
cmp eax, r14d
mov ebx, eax
jge 0x100020cfc
lea r8, [0x100003520]
mov edx, 0x6c7
jmp 0x100020ea5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, r14d
jne 0x100020d45
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003548]
mov edx, 0x6ca
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
jmp 0x100020ea5
mov ecx, dword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, r14d
jne 0x100020d96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rsp + 0x38]
lea r8, [0x100003568]
movzx ebx, ax
mov edx, 0x6cd
mov rcx, r15
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
call fcn.100026818
jmp 0x1000210ee
xor edx, edx
lea rcx, [rsp + 0x81]
mov byte [rsp + 0x80], r14b
lea r8d, [rdx + 0x47]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x48
call fcn.10002250c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, r14d
jne 0x100020e11
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003598]
mov edx, 0x6d3
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
jmp 0x100020ea5
mov rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020e61
mov r9, qword [rsp + 0x30]
lea r8, [0x1000035b8]
mov edx, 0x6d7
jmp 0x10002106c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
lea rsi, [0x100003420]
mov rdx, rsi
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020eb2
lea r8, [0x1000035e0]
mov edx, 0x6db
mov rcx, r15
call fcn.100026818
jmp 0x1000210ee
mov rdx, qword [0x100036218]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r14d
jne 0x10002109d
mov r9, qword [rsp + 0x30]
cmp dword [0x1000361bc], r14d
mov rax, qword [0x100036218]
mov qword [rsp + 0x28], rax
lea r12, [0x100003608]
lea r8, [0x100003618]
mov edx, 0x6e2
mov rcx, r15
cmovne r9, r12
mov qword [rsp + 0x20], rsi
call fcn.100026818
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xd0]
mov r9d, 0x200
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000210ee
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x10002108c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x100021076
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4d0]
lea rdx, [0x1000034a0]
xor r8d, r8d
mov dword [rsp + 0x58], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
mov ebp, eax
cmp rcx, r14
je 0x100020fce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
cmp ebp, r14d
jne 0x10002103b
mov rdx, qword [0x100036218]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100021040
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r9, qword [rsp + 0x30]
mov rcx, r15
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
lea rax, [rsp + 0xd0]
cmp ebx, r14d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
jge 0x100021048
lea r8, [0x1000036d0]
mov edx, 0x71b
jmp 0x1000210de
cmp ebp, 2
jne 0x100021059
inc r13d
jmp 0x100020f09
lea r8, [0x1000036f8]
mov edx, 0x71c
jmp 0x1000210de
lea r9, [0x1000034a0]
lea r8, [0x1000036a8]
mov edx, 0x710
mov rcx, r15
call fcn.100026818
jmp 0x1000210ee
lea r9, [rsp + 0xd0]
lea r8, [0x100003688]
mov edx, 0x6fa
jmp 0x10002106c
mov r9, rsi
lea r8, [0x100003670]
mov edx, 0x6f5
jmp 0x10002106c
cmp eax, 2
je 0x1000210ee
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100021125
mov rax, qword [0x100036218]
mov r9, qword [rsp + 0x30]
lea r12, [0x100003608]
mov qword [rsp + 0x28], rax
lea r8, [0x100003640]
mov edx, 0x6e7
mov qword [rsp + 0x20], rsi
mov rcx, r15
cmp dword [0x1000361bc], r14d
cmovne r9, r12
call fcn.100026818
cmp ebx, r14d
jge 0x100021125
lea rdx, [rsp + 0x70]
mov ecx, ebx
mov qword [rsp + 0x70], r14
call fcn.100021e1c
mov r11, qword [rsp + 0x70]
lea r8, [0x100001b60]
mov r9d, ebx
mov edx, 0x721
mov rcx, r15
mov qword [rsp + 0x20], r11
call fcn.100026818
mov rcx, qword [rsp + 0x50]
call fcn.100020868
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x100021144
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x100021159
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], r14
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x10002116e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x100021183
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x100021193
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1000336c0
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret