Function at 0x1400faa20
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0x128], rbx
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0xa8]
cmp dword [rcx + 4], 0
je 0x1400fb064
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.1400f99f0
test rax, rax
je 0x1400fb064
cmp byte [rbx + 0x18], 0
jne 0x1400fb064
mov rcx, rbx
call fcn.1400f99f0
test rax, rax
je 0x1400fb064
mov rcx, qword [rdi]
mov qword [rbp - 0x79], rcx
mov eax, dword [rcx]
inc eax
cmp eax, 1
jbe 0x1400faaa5
lock inc dword [rcx]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0x67]
call fcn.1400f9630
nop
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400f9dd0
mov r14, rax
mov rcx, qword [rsi + 0xa8]
xor r15d, r15d
cmp dword [rcx + 4], r15d
je 0x1400faafa
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.1400f99f0
test rax, rax
je 0x1400faafa
cmp byte [rbx + 0x18], r15b
jne 0x1400faafa
mov rcx, rbx
call fcn.1400f99f0
mov rdi, rax
jmp 0x1400faafd
mov rdi, r15
mov ebx, dword [rsi + 0xb4]
mov qword [rbp - 0x71], r15
or ebx, 0x2001f
mov rcx, r14
call fcn.14002b720
mov rdx, rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, r15
test eax, eax
cmove rbx, qword [rbp - 0x71]
mov rcx, qword [rbp - 0x69]
mov eax, dword [rcx]
or edi, 0xffffffff
test eax, eax
je 0x1400fab5a
cmp eax, edi
je 0x1400fab68
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fab68
mov rcx, qword [rbp - 0x69]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
test rbx, rbx
je 0x1400fabc5
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x61]
call fcn.1400f9c70
nop
mov rcx, rax
call fcn.14002b720
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rcx, qword [rbp - 0x61]
mov eax, dword [rcx]
test eax, eax
je 0x1400fabae
cmp eax, 0xffffffff
je 0x1400fabbc
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fabbc
mov rcx, qword [rbp - 0x61]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi + 0xa8]
cmp dword [rcx + 4], 0
je 0x1400fabf9
mov rbx, qword [rcx + 0x10]
add rbx, rcx
mov rcx, rbx
call fcn.1400f99f0
test rax, rax
je 0x1400fabf9
cmp byte [rbx + 0x18], 0
jne 0x1400fabf9
mov rcx, rbx
call fcn.1400f99f0
mov r14, rax
jmp 0x1400fabfc
mov r14, r15
mov ebx, dword [rsi + 0xb4]
mov qword [rbp - 0x59], r15
or ebx, 0x2001f
lea rcx, [rbp + 0x67]
call fcn.14002b720
mov rdx, rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400fb038
mov r12, qword [rbp - 0x59]
test r12, r12
je 0x1400fb038
mov edx, dword [rsi + 0xb4]
mov rcx, r12
call fcn.1400f9280
mov rax, qword [rbp + 0x67]
cmp dword [rax + 4], 0
jne 0x1400faed2
mov r8d, 1
mov rdx, r12
lea rcx, [rbp + 0x77]
call fcn.1400f8440
nop
mov r14d, r15d
mov rax, qword [rbp + 0x77]
lea r13, [rax + 0xc]
lea r15, [rax + 8]
mov eax, dword [r13]
sub eax, dword [r15]
test eax, eax
jle 0x1400fae53
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, dword [r15]
add rcx, rsi
mov rax, qword [rbp + 0x77]
mov rax, qword [rax + rcx*8 + 0x10]
mov qword [rbp + 0x7f], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x1400facbf
lock inc dword [rax]
lea rcx, [rbp + 0x7f]
call fcn.14002b720
mov rdx, rax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400fae11
mov edx, eax
lea rcx, [rbp - 0x41]
call fcn.140079d10
nop
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.140020590
mov rbx, rax
mov rcx, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rcx
mov edx, dword [rcx]
inc edx
cmp edx, 1
jbe 0x1400fad0c
lock inc dword [rcx]
lea rdx, [rbp - 0x51]
lea rcx, [rsp + 0x30]
call fcn.140020590
nop
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x10]
add r9, rdx
mov rcx, qword [rax]
mov r8, qword [rcx + 0x10]
add r8, rcx
mov qword [rbp - 0x21], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
lea rax, [0x1402c4b50]
mov qword [rbp - 9], rax
lea rdx, [0x14029b510]
lea rcx, [rbp - 0x21]
call fcn.14001ead0
nop
mov rcx, qword [rbp - 0x51]
mov eax, dword [rcx]
test eax, eax
je 0x1400fad79
cmp eax, 0xffffffff
je 0x1400fad88
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fad88
mov rcx, qword [rbp - 0x51]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.140035d80
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x1400fada3
cmp ecx, 0xffffffff
je 0x1400fadb7
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1400fadb7
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x30]
call fcn.140035d80
nop
mov rcx, qword [rbp - 0x49]
mov eax, dword [rcx]
test eax, eax
je 0x1400fadd5
cmp eax, 0xffffffff
je 0x1400fade4
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fade4
mov rcx, qword [rbp - 0x49]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.140035d80
nop
mov rcx, qword [rbp - 0x41]
mov eax, dword [rcx]
test eax, eax
je 0x1400fae02
cmp eax, 0xffffffff
je 0x1400fae11
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fae11
mov rcx, qword [rbp - 0x41]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
nop
mov rcx, qword [rbp + 0x7f]
mov eax, dword [rcx]
test eax, eax
je 0x1400fae2f
cmp eax, 0xffffffff
je 0x1400fae3d
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fae3d
mov rcx, qword [rbp + 0x7f]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
inc r14d
inc rsi
mov eax, dword [r13]
sub eax, dword [r15]
cmp r14d, eax
jl 0x1400faca0
mov rax, qword [rbp + 0x77]
mov ecx, dword [rax]
test ecx, ecx
je 0x1400fae6d
cmp ecx, 0xffffffff
je 0x1400faecd
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1400faecd
movsxd rbx, dword [r13]
mov rax, qword [rbp + 0x77]
add rbx, 2
lea rbx, [rax + rbx*8]
movsxd rsi, dword [r15]
add rsi, 2
lea rsi, [rax + rsi*8]
cmp rsi, rbx
je 0x1400faec3
nop dword [rax]
sub rbx, 8
mov rcx, qword [rbx]
mov eax, dword [rcx]
test eax, eax
je 0x1400faead
cmp eax, 0xffffffff
je 0x1400faebe
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400faebe
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rbx]
call fcn.140035d80
cmp rbx, rsi
jne 0x1400fae90
mov rcx, qword [rbp + 0x77]
call fcn.140103190
nop
jmp 0x1400fb02e
lea rcx, [rbp + 0x67]
call fcn.14002b720
mov rbx, rax
mov rcx, rsi
call fcn.1400fbac0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400fb02e
mov edx, eax
lea rcx, [rbp - 0x29]
call fcn.140079d10
nop
lea rdx, [rbp - 0x31]
mov rcx, rax
call fcn.140020590
mov rbx, rax
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x38], rcx
mov edx, dword [rcx]
inc edx
cmp edx, 1
jbe 0x1400faf2a
lock inc dword [rcx]
lea rdx, [rbp - 0x39]
lea rcx, [rsp + 0x38]
call fcn.140020590
nop
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x10]
add r9, rdx
mov rcx, qword [rax]
mov r8, qword [rcx + 0x10]
add r8, rcx
mov qword [rbp - 1], 2
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
lea rax, [0x1402c4b50]
mov qword [rbp + 0x17], rax
lea rdx, [0x14029b548]
lea rcx, [rbp - 1]
call fcn.14001ead0
nop
mov rcx, qword [rbp - 0x39]
mov eax, dword [rcx]
test eax, eax
je 0x1400faf97
cmp eax, 0xffffffff
je 0x1400fafa6
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fafa6
mov rcx, qword [rbp - 0x39]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.140035d80
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax]
test ecx, ecx
je 0x1400fafc1
cmp ecx, 0xffffffff
je 0x1400fafd5
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x1400fafd5
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x38]
call fcn.140035d80
nop
mov rcx, qword [rbp - 0x31]
mov eax, dword [rcx]
test eax, eax
je 0x1400faff3
cmp eax, 0xffffffff
je 0x1400fb002
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fb002
mov rcx, qword [rbp - 0x31]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.140035d80
nop
mov rcx, qword [rbp - 0x29]
mov eax, dword [rcx]
test eax, eax
je 0x1400fb020
cmp eax, 0xffffffff
je 0x1400fb02e
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400fb02e
mov rcx, qword [rbp - 0x29]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x67]
mov eax, dword [rcx]
test eax, eax
je 0x1400fb054
cmp eax, 0xffffffff
je 0x1400fb071
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x1400fb071
mov rcx, qword [rbp + 0x67]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140035d80
jmp 0x1400fb071
mov edx, 1
mov rcx, rsi
call fcn.1400e7b80
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret