Function at 0x14000471c
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21d8]
mov eax, 0x22d8
call fcn.140006660
sub rsp, rax
mov rax, qword [0x14000c298]
xor rax, rsp
mov qword [rbp + 0x21c0], rax
mov dword [rsp + 0x68], r9d
mov r15, r8
mov qword [rsp + 0x70], r8
mov rsi, rdx
mov r12, rcx
xor eax, eax
mov ebx, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
call fcn.140003cd4
mov edi, eax
test eax, eax
jns 0x140004783
jmp 0x140004ed9
cmp word [rsi], 0x7d
je 0x140004ec3
mov r13d, 1
lea rdx, str.Delete
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
xor edi, edi
mov r14d, edi
test eax, eax
sete r14b
lea rdx, str.ForceRemove
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400047d7
test r14d, r14d
je 0x1400048ae
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
xor edi, edi
cmp dword [rsp + 0x68], edi
je 0x1400048ae
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov rcx, rsi
movzx eax, word [rsi]
jmp 0x140004824
cmp ax, 0x5c
je 0x14000482b
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x14000480c
jmp 0x140004834
test rcx, rcx
jne 0x140004f1c
lea rdi, str.AppID
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004871
add rdi, 8
lea rax, [0x140007cb0]
cmp rdi, rax
jl 0x14000483b
mov qword [rbp - 0x70], r15
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.140004208
xor edi, edi
test r14d, r14d
je 0x1400048ae
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
mov rdx, rsi
mov rcx, r12
call fcn.140004f7c
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140004ec3
mov r14d, dword [rsp + 0x68]
jmp 0x140004ba1
lea rdx, str.NoRemove
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x1400048e2
mov r13d, edi
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
xor edi, edi
lea rdx, [0x140008f28]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a09
lea rdx, [rbp + 0x1c0]
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
cmp word [rsi], 0x3d
jne 0x140004f1c
mov r14d, dword [rsp + 0x68]
xor edi, edi
test r14d, r14d
je 0x140004977
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x70], r15
mov r9, rsi
lea r8, [rbp + 0x1c0]
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.140002f4c
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140004ec3
jmp 0x140004ba1
cmp dword [rbp + 0x2240], edi
jne 0x1400049ef
test r13d, r13d
je 0x1400049ef
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004eba
mov r14, qword [rsp + 0x60]
lea rdx, [rbp + 0x1c0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, 0xfffffffd
jne 0x140004efd
test r14, r14
je 0x1400049ef
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, rsi
mov rcx, r12
call fcn.140004f7c
mov edi, eax
test eax, eax
js 0x140004ec3
jmp 0x140004783
mov rcx, rsi
movzx eax, word [rsi]
jmp 0x140004a29
cmp ax, 0x5c
je 0x140004a30
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140004a11
jmp 0x140004a39
test rcx, rcx
jne 0x140004f1c
mov r14d, dword [rsp + 0x68]
test r14d, r14d
je 0x140004bf3
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r13d, 0x2001f
mov r9d, r13d
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004aa0
mov eax, edi
test rbx, rbx
je 0x140004a8e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
test eax, eax
je 0x140004b60
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004af2
mov eax, edi
test rbx, rbx
je 0x140004ae4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
test eax, eax
je 0x140004b60
mov qword [rsp + 0x60], rdi
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004eba
mov eax, edi
test rbx, rbx
je 0x140004b4e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
test eax, eax
jne 0x140004eba
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140004ec3
cmp word [rsi], 0x3d
jne 0x140004ba1
mov r9, rsi
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.140002f4c
mov edi, eax
mov rbx, qword [rsp + 0x78]
test eax, eax
js 0x140004ec3
xor ecx, ecx
cmp word [rsi], 0x7b
jne 0x140004783
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], cx
jne 0x140004baf
cmp rax, 1
jne 0x140004783
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call fcn.14000471c
mov edi, eax
test eax, eax
js 0x140004ec3
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
jmp 0x1400049fa
mov edi, dword [rbp + 0x2240]
xor eax, eax
test edi, edi
jne 0x140004c59
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov r14d, eax
xor eax, eax
test r14d, r14d
jne 0x140004c5f
mov r14d, eax
test rbx, rbx
je 0x140004c4d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov r14d, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
jmp 0x140004c5f
mov r14d, 2
mov r15d, 1
test r14d, r14d
cmove r15d, edi
or r9, 0xffffffffffffffff
mov r8, rsi
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
test eax, eax
je 0x140004cb0
cmp eax, 0xc
je 0x140004f3c
cmp eax, 0x16
je 0x140004f52
cmp eax, 0x22
je 0x140004f52
cmp eax, 0x50
jne 0x140004f47
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
test eax, eax
js 0x140004ec3
mov rdx, rsi
mov rcx, r12
call fcn.140004f7c
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140004ec3
cmp word [rsi], 0x7b
jne 0x140004d31
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], cx
jne 0x140004ce6
cmp rax, 1
jne 0x140004d31
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call fcn.14000471c
mov edi, eax
test eax, eax
jns 0x140004d1a
test r15d, r15d
je 0x140004ec3
mov rdx, rsi
mov rcx, r12
call fcn.140003cd4
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140004ec3
cmp r14d, 2
je 0x140004d48
test r14d, r14d
je 0x140004d52
cmp dword [rbp + 0x2240], ecx
je 0x140004f37
mov r15, qword [rsp + 0x70]
jmp 0x140004783
xor r14d, r14d
cmp dword [rbp + 0x2240], r14d
je 0x140004e09
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140004e09
cmp dword [rsp + 0x60], r14d
jbe 0x140004e09
lea r14, str.AppID
mov rdx, qword [r14]
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140004d48
add r14, 8
lea rax, [0x140007cb0]
cmp r14, rax
jl 0x140004dbd
test r13d, r13d
je 0x140004d48
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x78]
call fcn.140004208
mov rbx, qword [rsp + 0x78]
jmp 0x140004d48
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x140004e62
cmp dword [rsp + 0x60], r15d
seta r14b
test rbx, rbx
je 0x140004e82
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, r15
mov qword [rsp + 0x78], rbx
test eax, eax
jne 0x140004eba
test r13d, r13d
je 0x140004d48
test r14d, r14d
jne 0x140004d48
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov r15, qword [rsp + 0x70]
mov qword [rbp - 0x70], r15
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.140003840
test eax, eax
je 0x140004783
mov ecx, eax
call fcn.1400036d8
mov edi, eax
test rbx, rbx
je 0x140004ed7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x21c0]
xor rcx, rsp
call fcn.140001ee0
add rsp, 0x22d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.1400036d8
mov edi, eax
test r14, r14
je 0x140004ec3
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140004ec3
test rbx, rbx
je 0x140004f30
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, 0x80020009
jmp 0x140004ed9
mov ecx, r14d
jmp 0x140004ebc
mov ecx, 0x8007000e
call fcn.1400036f0
int3
mov ecx, 0x80004005
call fcn.1400036f0
int3
mov ecx, 0x80070057
call fcn.1400036f0
int3