Function at 0x1400326bc
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x130], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, rcx
lea r8, str.CRegistryUninstaller::DeleteCDGuids____n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
xor r13d, r13d
mov esi, r13d
lea ecx, [r13 + 8]
call fcn.140061238
cmp rax, r13
je 0x140032735
lea rcx, [rsp + 0x90]
mov qword [rax], rcx
jmp 0x140032738
mov rax, r13
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x90]
call fcn.140005ed4
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], r13
lea r8, [r12 + 0x10]
lea rdx, str.Scrubber.
lea rcx, [rsp + 0x160]
call fcn.14000d2d8
nop
lea r8, str..CDGuids
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.14000e9d8
nop
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp qword [rax + 0x20], r14
jb 0x1400327a1
mov rdx, qword [rax + 8]
jmp 0x1400327a5
lea rdx, [rax + 8]
lea r9, [rsp + 0x90]
xor r8d, r8d
mov rcx, qword [r12 + 0xd0]
call fcn.14003e968
nop
cmp qword [rsp + 0xf0], r14
jb 0x1400327d5
mov rcx, qword [rsp + 0xd8]
call fcn.14006127c
mov r15d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xe8], r13
mov byte [rsp + 0xd8], r13b
cmp qword [rsp + 0x180], r14
jb 0x14003280a
mov rcx, qword [rsp + 0x168]
call fcn.14006127c
cmp qword [rsp + 0xc0], r13
je 0x14003330d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x140], r13b
lea rcx, [0x1400c49dc]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c49dc]
lea rcx, [rsp + 0x138]
call fcn.14000352c
nop
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov qword [rsp + 0x1a0], r13
mov byte [rsp + 0x190], r13b
lea rcx, str.Software_
call fcn.1400980d0
mov r8, rax
lea rdx, str.Software_
lea rcx, [rsp + 0x188]
call fcn.14000352c
nop
mov rax, qword [r12 + 0x88]
cmp qword [rax + 0x360], r14
jb 0x1400328af
mov rbx, qword [rax + 0x348]
jmp 0x1400328b6
lea rbx, [rax + 0x348]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x188]
call fcn.14000627c
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x138]
call fcn.140002458
lea rcx, str.Installed_Products
call fcn.1400980d0
mov r8, rax
lea rdx, str.Installed_Products
lea rcx, [rsp + 0x138]
call fcn.14000627c
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], r14
cmovae rdx, qword [rsp + 0x140]
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14004e070
mov ebx, eax
cmp eax, r13d
je 0x1400329e3
mov ecx, eax
call fcn.14004d8f0
mov r9, rax
lea r8, str.RegOpenKeyEx
lea rdx, str._s_failed_with__s_n
lea rcx, [0x14010f570]
call fcn.14004b7ec
nop
cmp qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r14
jb 0x140032997
mov rcx, qword [rsp + 0x190]
call fcn.14006127c
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov qword [rsp + 0x1a0], r13
mov byte [rsp + 0x190], r13b
cmp qword [rsp + 0x158], r14
jb 0x1400329c6
mov rcx, qword [rsp + 0x140]
call fcn.14006127c
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x140], r13b
jmp 0x140033328
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
cmp rdi, r13
je 0x140032a1f
cmp rdi, rax
je 0x140032a24
call fcn.14009861c
cmp rbx, rsi
je 0x140032ab5
cmp rdi, r13
jne 0x140032a3c
call fcn.14009861c
mov r11, r13
jmp 0x140032a3f
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032a4a
call fcn.14009861c
cmp qword [rbx + 0x30], r14
jb 0x140032a56
mov r9, qword [rbx + 0x18]
jmp 0x140032a5a
lea r9, [rbx + 0x18]
lea r8, [rsp + 0x140]
cmp qword [rsp + 0x158], r14
cmovae r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call fcn.14003035c
cmp rdi, r13
jne 0x140032a8f
call fcn.14009861c
mov r11, r13
jmp 0x140032a92
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032a9d
call fcn.14009861c
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x90]
jmp 0x140032a15
mov rcx, qword [rsp + 0x50]
call fcn.14004e608
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x138]
call fcn.140002458
lea rcx, str.Install
call fcn.1400980d0
mov r8, rax
lea rdx, str.Install
lea rcx, [rsp + 0x138]
call fcn.14000627c
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x158], r14
cmovae rdx, qword [rsp + 0x140]
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14004e070
mov esi, eax
cmp eax, r13d
je 0x140032bcf
mov ecx, eax
call fcn.14004d8f0
mov r9, rax
lea r8, str.RegOpenKeyEx
lea rdx, str._s_failed_with__s_n
lea rcx, [0x14010f570]
call fcn.14004b7ec
nop
cmp qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r14
jb 0x140032b81
mov rcx, qword [rsp + 0x190]
call fcn.14006127c
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov qword [rsp + 0x1a0], r13
mov byte [rsp + 0x190], r13b
cmp qword [rsp + 0x158], r14
jb 0x140032bb0
mov rcx, qword [rsp + 0x140]
call fcn.14006127c
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x140], r13b
mov ebx, esi
jmp 0x140033328
mov qword [rsp + 0xc8], r13
mov rbp, qword [rsp + 0xb8]
mov rax, qword [rbp]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
cmp rdi, r13
je 0x140032c1d
cmp rdi, rax
je 0x140032c22
call fcn.14009861c
cmp rbx, rbp
je 0x140032cf0
cmp rdi, r13
jne 0x140032c3a
call fcn.14009861c
mov r11, r13
jmp 0x140032c3d
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032c48
call fcn.14009861c
cmp qword [rbx + 0x30], r14
jb 0x140032c54
mov rbp, qword [rbx + 0x18]
jmp 0x140032c58
lea rbp, [rbx + 0x18]
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x50]
call fcn.14004e070
cmp eax, r13d
jne 0x140032cbb
mov rcx, qword [rsp + 0xc8]
call fcn.14004e608
lea r8, [rsp + 0x140]
cmp qword [rsp + 0x158], r14
cmovae r8, qword [rsp + 0x140]
mov r9, rbp
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call fcn.14002ffb0
cmp rdi, r13
jne 0x140032cca
call fcn.14009861c
mov r11, r13
jmp 0x140032ccd
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032cd8
call fcn.14009861c
mov rbx, qword [rbx]
mov rbp, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x90]
jmp 0x140032c13
mov rcx, qword [rsp + 0x50]
call fcn.14004e608
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x178], r13
mov byte [rsp + 0x168], r13b
lea rcx, str.SOFTWARE_
call fcn.1400980d0
mov r8, rax
lea rdx, str.SOFTWARE_
lea rcx, [rsp + 0x160]
call fcn.14000352c
mov r11, qword [r12 + 0x88]
cmp qword [r11 + 0x360], r14
jb 0x140032d4f
mov rbx, qword [r11 + 0x348]
jmp 0x140032d56
lea rbx, [r11 + 0x348]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x160]
call fcn.14000627c
lea rcx, [0x1400c55c0]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c55c0]
lea rcx, [rsp + 0x160]
call fcn.14000627c
lea rcx, str.Models
call fcn.1400980d0
mov r8, rax
lea rdx, str.Models
lea rcx, [rsp + 0x160]
call fcn.14000627c
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], r14
cmovae rdx, qword [rsp + 0x168]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14004e2cc
cmp eax, r13d
jne 0x140033298
mov r12d, 0x64
mov dword [rsp + 0x5c], r12d
mov byte [rsp + 0x1b0], r13b
lea ebx, [r12 - 1]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x1b1]
call fcn.1400988d0
mov byte [rsp + 0x220], r13b
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x221]
call fcn.1400988d0
mov ebp, r13d
mov dword [rsp + 0x70], 1
lea ecx, [rbx - 0x5b]
call fcn.140061238
cmp rax, r13
je 0x140032e75
lea rcx, [rsp + 0xf8]
mov qword [rax], rcx
jmp 0x140032e78
mov rax, r13
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.140005ed4
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], r13
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x1b0]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, r13d
jne 0x1400330ab
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rsi]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
cmp rdi, r13
je 0x140032f2b
cmp rdi, rax
je 0x140032f30
call fcn.14009861c
cmp rbx, rsi
je 0x140033046
cmp rdi, r13
jne 0x140032f48
call fcn.14009861c
mov r11, r13
jmp 0x140032f4b
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032f56
call fcn.14009861c
cmp qword [rbx + 0x30], r14
jb 0x140032f62
mov rdx, qword [rbx + 0x18]
jmp 0x140032f66
lea rdx, [rbx + 0x18]
lea rcx, [rsp + 0x220]
call fcn.140099250
cmp rax, r13
jne 0x140032fad
cmp rdi, r13
jne 0x140032f87
call fcn.14009861c
mov r11, r13
jmp 0x140032f8a
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140032f95
call fcn.14009861c
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x90]
jmp 0x140032f21
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xe8], r13
mov byte [rsp + 0xd8], r13b
lea rcx, [rsp + 0x1b0]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xd0]
call fcn.14000352c
nop
mov rdi, qword [rsp + 0x120]
lea r9, [rsp + 0xd0]
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [rsp + 0xf8]
call fcn.14000739c
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.1400064b0
mov qword [rdi + 8], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rbx
cmp qword [rsp + 0xf0], r14
jb 0x140033046
mov rcx, qword [rsp + 0xd8]
call fcn.14006127c
mov byte [rsp + 0x1b0], r13b
mov byte [rsp + 0x220], r13b
inc ebp
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x5c], r12d
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x1b0]
mov edx, ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, r13d
je 0x140032ee6
cmp qword [rsp + 0x128], r13
je 0x1400331c4
mov rsi, qword [rsp + 0x120]
mov rax, qword [rsi]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
cmp rdi, r13
je 0x1400330fe
cmp rdi, rax
je 0x140033103
call fcn.14009861c
cmp rbx, rsi
je 0x1400331c4
cmp rdi, r13
jne 0x14003311b
call fcn.14009861c
mov r11, r13
jmp 0x14003311e
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140033129
call fcn.14009861c
cmp qword [rbx + 0x30], r14
jb 0x140033135
mov rdx, qword [rbx + 0x18]
jmp 0x140033139
lea rdx, [rbx + 0x18]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
cmp rdi, r13
jne 0x140033155
call fcn.14009861c
mov r11, r13
jmp 0x140033158
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140033163
call fcn.14009861c
cmp qword [rbx + 0x30], r14
jb 0x14003316f
mov r9, qword [rbx + 0x18]
jmp 0x140033173
lea r9, [rbx + 0x18]
mov dword [rsp + 0x20], esi
lea r8, str.Deleted_value__s_with_error_d
mov edx, 1
lea rcx, [0x14010f570]
call fcn.140001000
cmp rdi, r13
jne 0x14003319e
call fcn.14009861c
mov r11, r13
jmp 0x1400331a1
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x1400331ac
call fcn.14009861c
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x120]
mov rax, qword [rsp + 0xf8]
jmp 0x1400330f4
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x1b0]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
cmp eax, 0x103
jne 0x14003325d
mov rcx, qword [rsp + 0x50]
call fcn.14004e608
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], r14
cmovae rdx, qword [rsp + 0x168]
mov rcx, 0xffffffff80000002
call fcn.14004da30
lea r9, [rsp + 0x168]
cmp qword [rsp + 0x180], r14
cmovae r9, qword [rsp + 0x168]
lea r8, str.Deleted_key__s_because_it_was_empty
mov edx, 1
lea rcx, [0x14010f570]
call fcn.140001000
jmp 0x140033268
mov rcx, qword [rsp + 0x50]
call fcn.14004e608
nop
lea rcx, [rsp + 0xf8]
call fcn.140007328
mov rcx, qword [rsp + 0x120]
call fcn.14006127c
mov qword [rsp + 0x120], r13
mov rcx, qword [rsp + 0xf8]
call fcn.14006127c
nop
cmp qword [rsp + 0x180], r14
jb 0x1400332af
mov rcx, qword [rsp + 0x168]
call fcn.14006127c
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x178], r13
mov byte [rsp + 0x168], r13b
cmp qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r14
jb 0x1400332de
mov rcx, qword [rsp + 0x190]
call fcn.14006127c
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov qword [rsp + 0x1a0], r13
mov byte [rsp + 0x190], r13b
cmp qword [rsp + 0x158], r14
jb 0x14003330d
mov rcx, qword [rsp + 0x140]
call fcn.14006127c
lea r8, str.CRegistryUninstaller::DeleteCDGuids____n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
mov ebx, esi
lea rcx, [rsp + 0x90]
call fcn.140007328
mov rcx, qword [rsp + 0xb8]
call fcn.14006127c
mov qword [rsp + 0xb8], r13
mov rcx, qword [rsp + 0x90]
call fcn.14006127c
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret