Function at 0x140022aa0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov ebx, r9d
mov rsi, r8
mov r12, rdx
xor edi, edi
call fcn.140021d70
mov r14, rax
test rax, rax
jne 0x140022ad4
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
mov qword [rsp + 0x70], rbp
lea rcx, str.RemoveRegKey_____s__n
call fcn.1400213c0
lea rcx, [0x140106978]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
mov rbp, rax
test rax, rax
je 0x140022b31
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call rbp
cmp dword [rsp + 0x30], edi
je 0x140022b31
bt ebx, 9
jb 0x140022b31
bts ebx, 8
lea rax, [rsp + 0x38]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022d39
mov qword [rsp + 0x80], r13
mov r9d, 0x20019
mov r8, rsi
mov qword [rsp + 0x88], r15
mov rdx, r14
xor ecx, ecx
call fcn.140021ef0
imul ecx, eax, 0x208
mov r15d, eax
call fcn.140027a58
mov r13, rax
test rax, rax
je 0x140022bf6
mov dword [rsp + 0x28], 0x20019
mov r9, rax
mov r8, rsi
mov dword [rsp + 0x20], r15d
mov rdx, r14
xor ecx, ecx
call fcn.140022020
test r15d, r15d
jle 0x140022be9
movzx r12d, byte [rsp + 0x90]
mov rbp, r13
nop dword [rax]
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
mov r8, rbp
mov byte [rsp + 0x20], r12b
xor ecx, ecx
call fcn.140022aa0
add rbp, 0x208
sub r15, 1
jne 0x140022bc0
mov r12, qword [rsp + 0x78]
mov edx, 1
mov rcx, r13
call fcn.1400277b4
mov r9d, 0x20019
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call fcn.140022130
imul ecx, eax, 0x208
mov ebp, eax
call fcn.140027a58
mov r13, qword [rsp + 0x80]
mov r15, rax
test rax, rax
je 0x140022c86
mov dword [rsp + 0x28], 0x20019
mov r9, rax
mov r8, rsi
mov dword [rsp + 0x20], ebp
mov rdx, r14
xor ecx, ecx
call fcn.140022260
test ebp, ebp
jle 0x140022c75
mov rbx, r15
nop dword [rax]
mov r9, rbx
mov dword [rsp + 0x20], 0xf003f
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call fcn.140022d50
add rbx, 0x208
sub rbp, 1
jne 0x140022c50
mov ebp, 1
mov rcx, r15
mov edx, ebp
call fcn.1400277b4
jmp 0x140022c8b
mov ebp, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140106978]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, qword [rsp + 0x88]
mov rbx, rax
mov dword [rsp + 0x30], edi
test rax, rax
je 0x140022d28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call rbx
cmp dword [rsp + 0x30], edi
je 0x140022d28
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140022d39
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022d1d
xor r9d, r9d
mov r8d, 0x100
mov rdx, rsi
mov rcx, r12
call rax
test eax, eax
cmove edi, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140022d39
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
cmove edi, ebp
mov rbp, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret