Function at 0x140016d40
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400a0008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x30], r9d
xor r14b, r14b
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
test rdx, rdx
jne 0x140016d94
mov qword [rsp + 0x70], rdx
jmp 0x140016e0d
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140016da0
inc ebx
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
mov r8, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140001490
test eax, eax
je 0x140016e08
cmp eax, 0xc
je 0x140016dfd
cmp eax, 0x16
je 0x140016df2
cmp eax, 0x22
je 0x140016df2
cmp eax, 0x50
je 0x140016e08
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
cmp byte [rdx], 0
jne 0x140016e2e
xor r8d, r8d
jmp 0x140016e3c
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140016e32
lea rcx, [rsp + 0x48]
call fcn.140002500
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x140016e5b
call fcn.14005d86c
cmp dword [rsp + 0x30], 9
ja 0x140017028
cmp qword [rsp + 0x58], 0
jbe 0x140017028
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp]
call fcn.14005b890
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x110]
call fcn.14005b890
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x110]
call fcn.140013050
mov rdx, rdi
mov rcx, rsi
call fcn.1400168b0
mov ebx, eax
cmp eax, 0xffffffff
je 0x140016f65
lea r8, [rbp]
mov edx, eax
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [rbp]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140016f23
lea rdx, [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov r8, rax
cmp byte [rcx + 0x19], 0
jne 0x140016f4a
cmp dword [rcx + 0x20], ebx
jae 0x140016f3e
mov rcx, qword [rcx + 0x10]
jmp 0x140016f44
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140016f33
cmp r8, rax
je 0x140016f55
cmp ebx, dword [r8 + 0x20]
jae 0x140016f58
mov r8, rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140018360
lea r8, [rbp]
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
mov r9, rdi
lea r8, [rbp + 0x110]
lea rdx, [rbp]
call fcn.140016b20
movzx r14d, al
test al, al
je 0x140017028
mov rcx, qword [rsi]
mov rdx, qword [rcx + 8]
mov rbx, rcx
mov r8d, dword [rsp + 0x30]
cmp byte [rdx + 0x19], 0
jne 0x140016fc8
nop dword [rax]
cmp dword [rdx + 0x20], r8d
jae 0x140016fbc
mov rdx, qword [rdx + 0x10]
jmp 0x140016fc2
mov rbx, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x140016fb0
cmp rbx, rcx
je 0x140016fd3
cmp r8d, dword [rbx + 0x20]
jae 0x140017008
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c20
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c60
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0x28]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x140017028
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.140002630
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x140017080
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x14001707b
test cl, 0x1f
je 0x14001704e
call fcn.14005d6bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001705d
call fcn.14005d6bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001706c
call fcn.14005d6bc
int3
cmp rcx, 0x27
jbe 0x140017078
call fcn.14005d6bc
int3
mov rcx, rax
call fcn.14003aa0c
movzx eax, r14b
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14003aa30
add rsp, 0x330
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret