Function at 0x14000bb60
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006d0d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x140050968]
xor r13d, r13d
mov dword [rsp + 0x58], eax
mov r14, r8
movzx eax, word [0x14005096c]
mov rbx, rdx
mov word [rsp + 0x5c], ax
mov r15, rcx
mov dword [r8], r13d
test rdx, rdx
je 0x14000bbec
nop dword [rax]
cmp word [rbx], r13w
je 0x14000bbec
lea rax, [rsp + 0x58]
nop dword [rax + rax]
movzx ecx, word [rax]
test cx, cx
je 0x14000bbdb
cmp word [rbx], cx
je 0x14000bc13
mov rcx, rax
call qword [sym.imp.USER32.DLL_CharNextW]
test rax, rax
jne 0x14000bbc0
mov rcx, rbx
call qword [sym.imp.USER32.DLL_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000bbb0
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001bae0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.USER32.DLL_CharNextW]
mov rbx, rax
test rax, rax
je 0x14000bbec
movabs r12, 0x100000201
nop
movzx ecx, word [rbx]
lea rsi, str.install
mov rbp, rbx
call qword [sym.imp.USER32.DLL_CharUpperW]
mov ecx, 0x69
mov rdi, rax
call qword [sym.imp.USER32.DLL_CharUpperW]
mov rdx, rax
test di, di
je 0x14000bcb8
nop dword [rax]
cmp di, dx
jne 0x14000bca9
cmp di, 0x20
je 0x14000bcaf
cmp di, 9
je 0x14000bca9
mov rcx, rbp
call qword [sym.imp.USER32.DLL_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.DLL_CharNextW]
movzx ecx, word [rbp]
mov rsi, rax
call qword [sym.imp.USER32.DLL_CharUpperW]
movzx ecx, word [rsi]
movzx edi, ax
call qword [sym.imp.USER32.DLL_CharUpperW]
movzx edx, ax
test di, di
jne 0x14000bc60
jmp 0x14000bcb8
cmp di, 0x20
ja 0x14000bccb
movzx eax, di
bt r12, rax
jae 0x14000bccb
cmp dx, 0x20
ja 0x14000bccb
movzx eax, dx
bt r12, rax
jb 0x14000bdbb
movzx ecx, word [rbx]
lea rsi, str.uninstall
mov rbp, rbx
call qword [sym.imp.USER32.DLL_CharUpperW]
mov ecx, 0x75
mov rdi, rax
call qword [sym.imp.USER32.DLL_CharUpperW]
mov rdx, rax
test di, di
je 0x14000bd4c
cmp di, dx
jne 0x14000bd3d
cmp di, 0x20
je 0x14000bd43
cmp di, 9
je 0x14000bd3d
mov rcx, rbp
call qword [sym.imp.USER32.DLL_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.DLL_CharNextW]
movzx ecx, word [rbp]
mov rsi, rax
call qword [sym.imp.USER32.DLL_CharUpperW]
movzx ecx, word [rsi]
movzx edi, ax
call qword [sym.imp.USER32.DLL_CharUpperW]
movzx edx, ax
test di, di
jne 0x14000bcf4
jmp 0x14000bd4c
cmp di, 0x20
ja 0x14000bd60
movzx eax, di
bt r12, rax
jae 0x14000bd60
cmp dx, 0x20
ja 0x14000bd60
movzx eax, dx
bt r12, rax
jb 0x14000be10
nop
cmp word [rbx], r13w
je 0x14000bbec
lea rax, [rsp + 0x58]
nop
movzx ecx, word [rax]
test cx, cx
je 0x14000bd8b
cmp word [rbx], cx
je 0x14000bda1
mov rcx, rax
call qword [sym.imp.USER32.DLL_CharNextW]
test rax, rax
jne 0x14000bd70
mov rcx, rbx
call qword [sym.imp.USER32.DLL_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000bd60
jmp 0x14000bbec
mov rcx, rbx
call qword [sym.imp.USER32.DLL_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000bc30
jmp 0x14000bbec
mov rcx, r15
call fcn.1400121e0
test eax, eax
jne 0x14000bdd0
lea rdx, str.Uninstall___failed
jmp 0x14000bde3
mov rcx, r15
call fcn.14000fa30
test eax, eax
jne 0x14000bdf2
lea rdx, str.Install___failed
xor ecx, ecx
call fcn.140005e60
mov ebx, 0x80004005
mov dword [r14], ebx
cmp dword [r14], r13d
jne 0x14000bfd9
lea rdx, str.Installation_succeeded
xor ecx, ecx
call fcn.140005e60
xor al, al
jmp 0x14000bbee
mov rax, qword [0x14006fd68]
test rax, rax
je 0x14000be26
call qword [case.0x140024e4a.0]
test eax, eax
js 0x14000be96
mov rbx, qword [0x14006d060]
mov eax, r13d
mov rcx, qword [0x14006d068]
cmp rbx, rcx
jae 0x14000be88
nop dword [rax]
mov rdi, qword [rbx]
test rdi, rdi
je 0x14000be7b
mov rax, qword [rdi + 0x30]
call qword [case.0x140024e4a.0]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.14000e4e0
test eax, eax
js 0x14000be96
mov rax, qword [rdi + 8]
xor ecx, ecx
call qword [case.0x140024e4a.0]
test eax, eax
js 0x14000be96
mov rcx, qword [0x14006d068]
add rbx, 8
cmp rbx, rcx
jb 0x14000be40
test eax, eax
js 0x14000be96
mov rcx, qword [0x14006d058]
xor edx, edx
call fcn.14000eb80
mov r8d, eax
mov dword [r14], eax
lea rdx, str.UnregisterServer_TRUE__done_0x_x
xor ecx, ecx
call fcn.140005e60
cmp dword [r14], r13d
jl 0x14000bfd9
mov rcx, r15
call fcn.1400121e0
test eax, eax
jne 0x14000bec9
mov ebx, 0x80004005
jmp 0x14000bfc5
mov r9d, 0x20006
mov qword [rsp + 0x40], r13
lea r8, str.AppID
mov dword [rsp + 0x48], r13d
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x40]
call fcn.14000ff10
test eax, eax
je 0x14000bf16
mov ecx, eax
call fcn.14000e1f0
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14000bfc5
jmp 0x14000bfbf
mov rdi, qword [rsp + 0x40]
lea rbx, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov r8, rbx
mov qword [rsp + 0x20], r13
mov rdx, rdi
mov dword [rsp + 0x28], r13d
mov r9d, 0x20006
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x20]
call fcn.14000ff10
test eax, eax
je 0x14000bf60
mov ecx, eax
call fcn.14000e1f0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x14000bfb7
jmp 0x14000bfb1
mov rsi, qword [rsp + 0x20]
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
mov rcx, qword [0x14006fd78]
lea rax, str.APPID
xor r8d, r8d
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
lea edx, [r8 + 0x65]
call fcn.140012620
mov ebx, eax
test rsi, rsi
je 0x14000bfb7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test rdi, rdi
je 0x14000bfc5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov r8d, ebx
mov dword [r14], ebx
lea rdx, str.UnregisterAppId___done_0x_x
xor ecx, ecx
call fcn.140005e60
xor al, al
jmp 0x14000bbee