Function at 0x140061350
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x208], ebp
cmp byte [0x1400cac11], bpl
je 0x1400616c4
test bl, bl
je 0x1400614a4
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.1400606f0
nop
mov byte [rsp + 0x208], 1
lea rcx, [rsp + 0x68]
call fcn.14005ced0
nop
mov dword [rsp + 0x30], 0x18
mov dword [rsp + 0x40], ebp
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov r9d, dword [rdi + 8]
or r9d, 0xf003f
lea rax, [rsp + 0x208]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r8, rsi
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.140060270
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x88], rbp
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x80], rbp
mov rcx, qword [rsp + 0x78]
call fcn.140064550
mov rcx, qword [rsp + 0x70]
call fcn.140064550
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8b, 1
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14005fc30
test rax, rax
je 0x140061485
nop
movzx r8d, bl
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140061350
mov r8b, 1
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14005fc30
test rax, rax
jne 0x140061460
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14006149a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x58]
call fcn.140064550
mov eax, dword [0x1400cce78]
test al, 1
jne 0x1400614e1
or eax, 1
mov dword [0x1400cce78], eax
xor r9d, r9d
lea r8, str.RegDeleteKeyEx
lea rdx, str.advapi32
lea rcx, [0x1400cce68]
call fcn.14001b0f0
lea rcx, [0x1400a0310]
call fcn.140065eb0
nop
cmp qword [0x1400cce68], 0
je 0x140061566
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], ebp
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400195d0
nop
mov r8d, dword [rdi + 8]
and r8d, 0x300
xor r9d, r9d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdi]
call fcn.14005f470
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x140061557
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006155c
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.140019030
mov rcx, qword [rsp + 0x38]
jmp 0x14006155c
mov rcx, qword [rsp + 0x38]
call fcn.140064550
jmp 0x140061629
test dword [rdi + 8], 0x300
je 0x1400615c0
lea rax, [0x1400a1850]
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa0], 0
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.RegDeleteKeyEx_not_available_and_view_is_not_default
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.140006c70
lea rdx, [0x1400c8340]
lea rcx, [rsp + 0x98]
call fcn.1400649f0
int3
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], ebp
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400195d0
nop
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14006161f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140061624
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.140019030
mov rcx, qword [rsp + 0x38]
jmp 0x140061624
mov rcx, qword [rsp + 0x38]
call fcn.140064550
test ebx, ebx
je 0x1400616ee
lea rax, [0x1400a1850]
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa0], 0
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.RegDeleteKey
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.140006c70
lea r11, [0x1400a2698]
mov qword [rsp + 0x98], r11
mov byte [rsp + 0x1a0], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x1a0]
call fcn.140006c70
mov edx, ebx
lea rcx, [rsp + 0x98]
call fcn.14001bad0
lea rdx, [0x1400c83b8]
lea rcx, [rsp + 0x98]
call fcn.1400649f0
int3
mov r9d, 0xf5
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x98]
call fcn.14001b760
mov rcx, rax
call fcn.14001b660
int3
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret