Function at 0x14000bd80
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x240], rax
movzx edi, dl
mov rsi, rcx
mov edx, 0x20006
add rcx, 2
call fcn.14000db20
mov rbx, rax
test rax, rax
jne 0x14000bdcc
lea eax, [rbx + 1]
jmp 0x14000c7ca
lea r9, [rsp + 0x40]
mov qword [rsp + 0x278], rbp
xor r8d, r8d
mov dword [rsp + 0x20], 0xff
mov dl, 1
lea rcx, [rsi + 2]
call fcn.14000e060
lea r8, [rsi + 0x1842a]
mov rcx, rbx
lea rdx, [0x14002fb50]
mov ebp, eax
call fcn.14000e0d0
test eax, eax
je 0x14000be34
test ebp, ebp
jle 0x14000be21
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
jmp 0x14000c7c2
lea r8, [rsi + 0x28428]
mov rcx, rbx
lea rdx, str.AppParameters
call fcn.14000e0d0
test eax, eax
je 0x14000be77
test ebp, ebp
jle 0x14000be64
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14000c7c2
lea r8, [rsi + 0x30426]
mov rcx, rbx
lea rdx, str.AppDirectory
call fcn.14000e0d0
test eax, eax
je 0x14000beba
test ebp, ebp
jle 0x14000bea7
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x14000c7c2
mov r8d, dword [rsi + 0x4043c]
cmp r8d, 0x20
je 0x14000bed8
lea rdx, str.AppPriority
mov rcx, rbx
call fcn.14000e270
jmp 0x14000beed
test dil, dil
je 0x14000beed
lea rdx, str.AppPriority
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsi + 0x40418]
mov r15d, 1
test rcx, rcx
je 0x14000bfc1
lea rdx, [rsp + 0x30]
call fcn.14000e520
test eax, eax
jne 0x14000bfa1
mov rcx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14000bf21
lea eax, [rax*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], eax
lea rdx, str.AppAffinity
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000bfa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
xor ebp, ebp
movzx ecx, r15w
mov r9, rax
mov qword [rsp + 0x20], rbp
lea r8, str.AppAffinity
mov edx, 0xc00003fb
call fcn.140002610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [rbp + 5]
jmp 0x14000c7c2
cmp qword [rsp + 0x30], 0
je 0x14000bfd6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000bfd6
test dil, dil
je 0x14000bfd6
lea rdx, str.AppAffinity
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704d8]
not r8d
test r8d, r8d
je 0x14000bff6
lea rdx, str.AppStopMethodSkip
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c00b
test dil, dil
je 0x14000c00b
lea rdx, str.AppStopMethodSkip
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsi + 0x704cc]
cmp eax, 4
jae 0x14000c030
mov edx, eax
lea rcx, [rsi + 2]
lea rax, [0x14003e058]
movzx r8d, dil
mov rdx, qword [rax + rdx*8]
call fcn.14000ba50
mov r8d, dword [rsi + 0x704d0]
test r8d, r8d
je 0x14000c04d
lea rdx, str.AppRestartDelay
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c062
test dil, dil
je 0x14000c062
lea rdx, str.AppRestartDelay
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704d4]
cmp r8d, 0x5dc
je 0x14000c083
lea rdx, str.AppThrottle
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c098
test dil, dil
je 0x14000c098
lea rdx, str.AppThrottle
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704dc]
cmp r8d, 0x5dc
je 0x14000c0b9
lea rdx, str.AppStopMethodConsole
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c0ce
test dil, dil
je 0x14000c0ce
lea rdx, str.AppStopMethodConsole
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704e0]
cmp r8d, 0x5dc
je 0x14000c0ef
lea rdx, str.AppStopMethodWindow
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c104
test dil, dil
je 0x14000c104
lea rdx, str.AppStopMethodWindow
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704e4]
cmp r8d, 0x5dc
je 0x14000c125
lea rdx, str.AppStopMethodThreads
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c13a
test dil, dil
je 0x14000c13a
lea rdx, str.AppStopMethodThreads
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [rsi + 0x704e8], 0
jne 0x14000c157
xor r8d, r8d
lea rdx, str.AppKillProcessTree
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c16c
test dil, dil
je 0x14000c16c
lea rdx, str.AppKillProcessTree
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea r8, [rsi + 0x40444]
movzx eax, word [r8]
test ax, ax
jne 0x14000c18a
test dil, dil
je 0x14000c273
test ax, ax
je 0x14000c19b
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000e0d0
jmp 0x14000c1b0
test dil, dil
je 0x14000c1b0
lea rdx, str.AppStdin
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rsi + 0x50444]
cmp r9d, 2
je 0x14000c1d5
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140009330
jmp 0x14000c1f0
test dil, dil
je 0x14000c1f0
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140007fe0
mov r9d, dword [rsi + 0x50448]
cmp r9d, 3
je 0x14000c215
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140009330
jmp 0x14000c230
test dil, dil
je 0x14000c230
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140007fe0
mov r9d, dword [rsi + 0x5044c]
cmp r9d, 0x80
je 0x14000c258
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140009330
jmp 0x14000c273
test dil, dil
je 0x14000c273
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStdin
call fcn.140007fe0
lea r8, [rsi + 0x50450]
movzx eax, word [r8]
test ax, ax
jne 0x14000c291
test dil, dil
je 0x14000c3b9
test ax, ax
je 0x14000c2a2
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000e0d0
jmp 0x14000c2b7
test dil, dil
je 0x14000c2b7
lea rdx, str.AppStdout
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rsi + 0x60450]
cmp r9d, 3
je 0x14000c2dc
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140009330
jmp 0x14000c2f7
test dil, dil
je 0x14000c2f7
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140007fe0
mov r9d, dword [rsi + 0x60454]
cmp r9d, 4
je 0x14000c31c
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140009330
jmp 0x14000c337
test dil, dil
je 0x14000c337
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140007fe0
mov r9d, dword [rsi + 0x60458]
cmp r9d, 0x80
je 0x14000c35f
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140009330
jmp 0x14000c37a
test dil, dil
je 0x14000c37a
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140007fe0
cmp byte [rsi + 0x704af], 0
je 0x14000c39e
mov r9d, r15d
lea r8, str.CopyAndTruncate
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.140009330
jmp 0x14000c3b9
test dil, dil
je 0x14000c3b9
lea r8, str.CopyAndTruncate
mov rcx, rbx
lea rdx, str.AppStdout
call fcn.140007fe0
lea r8, [rsi + 0x6047c]
movzx eax, word [r8]
test ax, ax
jne 0x14000c3d7
test dil, dil
je 0x14000c4ff
test ax, ax
je 0x14000c3e8
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000e0d0
jmp 0x14000c3fd
test dil, dil
je 0x14000c3fd
lea rdx, str.AppStderr
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rsi + 0x7047c]
cmp r9d, 3
je 0x14000c422
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140009330
jmp 0x14000c43d
test dil, dil
je 0x14000c43d
lea r8, str.ShareMode
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140007fe0
mov r9d, dword [rsi + 0x70480]
cmp r9d, 4
je 0x14000c462
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140009330
jmp 0x14000c47d
test dil, dil
je 0x14000c47d
lea r8, str.CreationDisposition
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140007fe0
mov r9d, dword [rsi + 0x70484]
cmp r9d, 0x80
je 0x14000c4a5
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140009330
jmp 0x14000c4c0
test dil, dil
je 0x14000c4c0
lea r8, str.FlagsAndAttributes
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140007fe0
cmp byte [rsi + 0x704b0], 0
je 0x14000c4e4
mov r9d, r15d
lea r8, str.CopyAndTruncate
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.140009330
jmp 0x14000c4ff
test dil, dil
je 0x14000c4ff
lea r8, str.CopyAndTruncate
mov rcx, rbx
lea rdx, str.AppStderr
call fcn.140007fe0
cmp byte [rsi + 0x704ae], 0
je 0x14000c51c
mov r8d, r15d
lea rdx, str.AppTimestampLog
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c531
test dil, dil
je 0x14000c531
lea rdx, str.AppTimestampLog
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [rsi + 0x704ac], 0
je 0x14000c54e
mov r8d, r15d
lea rdx, str.AppRedirectHook
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c563
test dil, dil
je 0x14000c563
lea rdx, str.AppRedirectHook
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [rsi + 0x704ad], 0
je 0x14000c580
mov r8d, r15d
lea rdx, str.AppRotateFiles
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c595
test dil, dil
je 0x14000c595
lea rdx, str.AppRotateFiles
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rsi + 0x704b4], 0
je 0x14000c5b2
mov r8d, r15d
lea rdx, str.AppRotateOnline
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c5c7
test dil, dil
je 0x14000c5c7
lea rdx, str.AppRotateOnline
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704bc]
test r8d, r8d
je 0x14000c5e4
lea rdx, str.AppRotateSeconds
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c5f9
test dil, dil
je 0x14000c5f9
lea rdx, str.AppRotateSeconds
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704c0]
test r8d, r8d
je 0x14000c616
lea rdx, str.AppRotateBytes
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c62b
test dil, dil
je 0x14000c62b
lea rdx, str.AppRotateBytes
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704c4]
test r8d, r8d
je 0x14000c648
lea rdx, str.AppRotateBytesHigh
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c65d
test dil, dil
je 0x14000c65d
lea rdx, str.AppRotateBytesHigh
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rsi + 0x704c8]
test r8d, r8d
je 0x14000c67a
lea rdx, str.AppRotateDelay
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c68f
test dil, dil
je 0x14000c68f
lea rdx, str.AppRotateDelay
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rsi + 0x40440], 0
je 0x14000c6ac
mov r8d, r15d
lea rdx, str.AppNoConsole
mov rcx, rbx
call fcn.14000e270
jmp 0x14000c6c1
test dil, dil
je 0x14000c6c1
lea rdx, str.AppNoConsole
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsi + 0x40410]
xor ebp, ebp
test rcx, rcx
je 0x14000c727
mov eax, dword [rsi + 0x4042c]
lea r9d, [rbp + 7]
add eax, eax
lea rdx, str.AppEnvironment
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000c73c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
movzx ecx, r15w
lea r8, str.AppEnvironment
mov qword [rsp + 0x20], rbp
mov edx, 0xc00003fb
call fcn.140002610
jmp 0x14000c73c
test dil, dil
je 0x14000c73c
lea rdx, str.AppEnvironment
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsi + 0x40430]
test rcx, rcx
je 0x14000c7a2
mov eax, dword [rsi + 0x40438]
lea rdx, str.AppEnvironmentExtra
add eax, eax
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000c7b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
movzx ecx, r15w
lea r8, str.AppEnvironmentExtra
mov qword [rsp + 0x20], rbp
mov edx, 0xc00003fb
call fcn.140002610
jmp 0x14000c7b7
test dil, dil
je 0x14000c7b7
lea rdx, str.AppEnvironmentExtra
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbp, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400180d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret