Function at 0x140004b30
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2388
call fcn.1400086d0
sub rsp, rax
mov qword [rsp + 0x148], 0xfffffffffffffffe
mov rax, qword [0x14001a1f0]
xor rax, rsp
mov qword [rsp + 0x2370], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x23b0]
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004be8
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xc8], eax
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xc8]
jmp 0x14000574a
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
cmp eax, 0x7d
je 0x14000572e
mov dword [rsp + 0x48], 1
mov rdx, qword [str.Delete]
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c27
mov dword [rsp + 0x70], 1
jmp 0x140004c2f
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], eax
mov rdx, qword [str.ForceRemove]
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004c5b
cmp dword [rsp + 0x74], 0
je 0x140004ec2
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004c80
jmp 0x14000572e
cmp dword [rsp + 0x23a8], 0
je 0x140004ec2
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x2398]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xe8], 0
cmp qword [rsp + 0x68], 0
jne 0x140004ce0
mov qword [rsp + 0xf0], 0
jmp 0x140004d31
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
test eax, eax
je 0x140004d21
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
mov ecx, 0x5c
movzx ecx, cx
cmp eax, ecx
jne 0x140004d0f
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xe8], rax
jmp 0x140004d21
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x68], rax
jmp 0x140004ce0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004d6b
mov dword [rsp + 0xe0], 0x80020009
lea rcx, [rsp + 0x80]
call fcn.140002b70
nop
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xe0]
jmp 0x14000574a
mov dword [rsp + 0x4c], 0
jmp 0x140004d7f
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0xc
jge 0x140004db4
movsxd rax, dword [rsp + 0x4c]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004db2
mov dword [rsp + 0x78], 0
jmp 0x140004dbc
jmp 0x140004d75
mov dword [rsp + 0x78], 1
cmp dword [rsp + 0x78], 0
je 0x140004e38
xor eax, eax
test eax, eax
jne 0x140004dc3
mov rax, qword [rsp + 0x23a0]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rdx, qword [rsp + 0x2398]
lea rcx, [rsp + 0x80]
call fcn.140004190
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
cmp dword [rsp + 0x74], 0
je 0x140004eb5
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004e71
lea rcx, [rsp + 0x80]
call fcn.140002b70
jmp 0x14000572e
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140005d80
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004ea3
lea rcx, [rsp + 0x80]
call fcn.140002b70
jmp 0x14000572e
lea rcx, [rsp + 0x80]
call fcn.140002b70
jmp 0x140005665
lea rcx, [rsp + 0x80]
call fcn.140002b70
mov rdx, qword [str.NoRemove]
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004f08
mov dword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004f08
jmp 0x14000572e
mov rdx, qword [0x1400115f0]
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400051b1
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004f4a
jmp 0x14000572e
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140004f6f
jmp 0x14000572e
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
cmp eax, 0x3d
je 0x140004fa0
mov dword [rsp + 0xc4], 0x80020009
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xc4]
jmp 0x14000574a
cmp dword [rsp + 0x23a8], 0
je 0x1400050a7
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
xor eax, eax
test eax, eax
jne 0x140004fd1
mov rax, qword [rsp + 0x23a0]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov r9, qword [rsp + 0x2398]
lea r8, [rsp + 0x370]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x2390]
call fcn.140001c80
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
cmp dword [rsp + 0x40], 0
jge 0x140005090
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0xa8]
call fcn.140002b70
nop
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xcc]
jmp 0x14000574a
lea rcx, [rsp + 0xa8]
call fcn.140002b70
jmp 0x140005665
cmp dword [rsp + 0x23b0], 0
jne 0x140005187
cmp dword [rsp + 0x48], 0
je 0x140005187
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0x110]
call fcn.140003950
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000515b
xor eax, eax
test eax, eax
jne 0x14000510c
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140005159
cmp dword [rsp + 0x44], 2
je 0x140005159
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x110]
call fcn.140002b70
jmp 0x14000572e
jmp 0x14000517a
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x110]
call fcn.140002b70
jmp 0x14000572e
lea rcx, [rsp + 0x110]
call fcn.140002b70
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140005d80
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400051ac
jmp 0x14000572e
jmp 0x140004be8
mov dx, 0x5c
mov rcx, qword [rsp + 0x2398]
call fcn.140005ec0
test rax, rax
je 0x1400051e8
mov dword [rsp + 0xd4], 0x80020009
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xd4]
jmp 0x14000574a
cmp dword [rsp + 0x23a8], 0
je 0x140005327
mov r9d, 0x2001f
mov r8, qword [rsp + 0x2398]
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0x50]
call fcn.140003950
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400052c0
mov r9d, 0x20019
mov r8, qword [rsp + 0x2398]
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0x50]
call fcn.140003950
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400052c0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x2398]
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0x50]
call fcn.140002bc0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400052c0
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0xdc], eax
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xdc]
jmp 0x14000574a
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400052e5
jmp 0x14000572e
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
cmp eax, 0x3d
jne 0x140005322
mov r9, qword [rsp + 0x2398]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x2390]
call fcn.140001c80
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005322
jmp 0x14000572e
jmp 0x140005665
cmp dword [rsp + 0x23b0], 0
jne 0x140005357
mov r9d, 0x20019
mov r8, qword [rsp + 0x2398]
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0x50]
call fcn.140003950
mov dword [rsp + 0x44], eax
jmp 0x14000535f
mov dword [rsp + 0x44], 2
cmp dword [rsp + 0x44], 0
je 0x140005371
mov dword [rsp + 0x23b0], 1
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x2398]
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.140007b34
mov ecx, eax
call fcn.1400027a0
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400053be
jmp 0x14000572e
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140005d80
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400053e3
jmp 0x14000572e
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x1400054ac
mov rax, qword [rsp + 0x2398]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x98], 0xffffffffffffffff
inc qword [rsp + 0x98]
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x98]
cmp word [rax + rcx*2], 0
jne 0x140005413
mov rax, qword [rsp + 0x98]
cmp rax, 1
jne 0x1400054ac
mov eax, dword [rsp + 0x23b0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x23a8]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140004b30
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005487
cmp dword [rsp + 0x23b0], 0
jne 0x140005487
jmp 0x14000572e
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400054ac
jmp 0x14000572e
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x23b0], eax
cmp dword [rsp + 0x44], 2
jne 0x1400054c6
jmp 0x140004be8
cmp dword [rsp + 0x44], 0
je 0x1400054f0
cmp dword [rsp + 0x23b0], 0
je 0x1400054de
jmp 0x140004be8
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0x40], eax
jmp 0x14000572e
cmp dword [rsp + 0x23b0], 0
je 0x140005557
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x2390]
call fcn.140003150
test eax, eax
je 0x140005557
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x2390]
call fcn.140002900
test eax, eax
je 0x140005552
cmp dword [rsp + 0x48], 0
je 0x140005552
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.140004190
jmp 0x140004be8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x2390]
call fcn.140003150
mov dword [rsp + 0xd8], eax
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400055bb
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0xc0], eax
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xc0]
jmp 0x14000574a
cmp dword [rsp + 0x48], 0
je 0x140005665
cmp dword [rsp + 0xd8], 0
jne 0x140005665
mov qword [rsp + 0xf8], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov rdx, qword [rsp + 0x23a0]
lea rcx, [rsp + 0xf8]
call fcn.1400028c0
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0xf8]
call fcn.140002d70
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0xf8]
call fcn.140002e40
cmp dword [rsp + 0x44], 0
je 0x140005658
mov ecx, dword [rsp + 0x44]
call fcn.140002850
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0xf8]
call fcn.140002b70
jmp 0x14000572e
lea rcx, [rsp + 0xf8]
call fcn.140002b70
cmp dword [rsp + 0x23a8], 0
je 0x140005729
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x140005729
mov rax, qword [rsp + 0x2398]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0xa0], 0xffffffffffffffff
inc qword [rsp + 0xa0]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0xa0]
cmp word [rax + rcx*2], 0
jne 0x1400056a3
mov rax, qword [rsp + 0xa0]
cmp rax, 1
jne 0x140005729
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x23a8]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140004b30
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005707
jmp 0x14000572e
mov rdx, qword [rsp + 0x2398]
mov rcx, qword [rsp + 0x2390]
call fcn.140003650
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140005729
jmp 0x14000572e
jmp 0x140004be8
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xd0], eax
lea rcx, [rsp + 0x50]
call fcn.140002b70
mov eax, dword [rsp + 0xd0]
mov rcx, qword [rsp + 0x2370]
xor rcx, rsp
call fcn.140008730
add rsp, 0x2388
ret