Function at 0x140020360
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor r14d, r14d
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov qword [rsp + 0x40], r14
mov rsi, rcx
jb 0x1400203a1
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x4a0], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14002047f
mov ecx, 0x800
call fcn.1400bbc88
mov ecx, 0x800
mov rsi, rax
call fcn.1400bbc88
mov rdi, rax
test rsi, rsi
je 0x140020469
test rax, rax
je 0x140020461
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call fcn.1400c2130
lea rax, [0x140125cd8]
lea r9, str.RC::RCInputImeUninstaller::DeleteInputInUserProfile
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
cmp qword [rbx + 0x18], 8
jb 0x140020446
mov rbx, qword [rbx]
mov r9, rbx
mov r8, rsi
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
mov rcx, rdi
call fcn.140015100
mov rcx, rsi
call fcn.1400bd2dc
test rdi, rdi
je 0x140020650
mov rcx, rdi
call fcn.1400bd2dc
jmp 0x140020650
lea rcx, [rbp + 0x172]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x170], r14w
call fcn.1400c2130
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x170]
xor edx, edx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x4c], 0x100
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140020645
nop dword [rax + rax]
lea rdx, str.0804:
lea rcx, [rsp + 0x50]
mov r8d, 5
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
call fcn.140006900
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x1fe
mov ebx, r14d
mov word [rsp + 0x70], r14w
call fcn.1400c2130
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400205fe
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 8
lea rdx, [rsp + 0x50]
cmovae rdx, qword [rsp + 0x50]
lea rdi, [rax + rax]
lea rcx, [rsp + 0x70]
mov r8, rdi
call fcn.1400c5390
test eax, eax
jne 0x1400205b3
lea rcx, [rsp + 0x70]
lea r8d, [rax + 0x10]
xor edx, edx
add rcx, rdi
call fcn.1400be988
cmp eax, dword [rsi + 0x38]
je 0x1400205ee
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
inc ebx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, ebx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140020570
jmp 0x1400205fe
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp qword [rsp + 0x68], 8
jb 0x140020610
mov rcx, qword [rsp + 0x50]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x170]
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400204e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x4a0]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r14
pop rsi
pop rbp
ret