Function at 0x140016d70
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14009f008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x30], r9d
xor r14b, r14b
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
test rdx, rdx
jne 0x140016dc4
mov qword [rsp + 0x70], rdx
jmp 0x140016e3d
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140016dd0
inc ebx
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
mov r8, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140001490
test eax, eax
je 0x140016e38
cmp eax, 0xc
je 0x140016e2d
cmp eax, 0x16
je 0x140016e22
cmp eax, 0x22
je 0x140016e22
cmp eax, 0x50
je 0x140016e38
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
cmp byte [rdx], 0
jne 0x140016e5e
xor r8d, r8d
jmp 0x140016e6c
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140016e62
lea rcx, [rsp + 0x48]
call fcn.140002500
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x140016e8b
call fcn.14005d6dc
cmp dword [rsp + 0x30], 9
ja 0x140017058
cmp qword [rsp + 0x58], 0
jbe 0x140017058
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp]
call fcn.14005b700
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x110]
call fcn.14005b700
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x110]
call fcn.140013080
mov rdx, rdi
mov rcx, rsi
call fcn.1400168e0
mov ebx, eax
cmp eax, 0xffffffff
je 0x140016f95
lea r8, [rbp]
mov edx, eax
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [rbp]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140016f53
lea rdx, [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov r8, rax
cmp byte [rcx + 0x19], 0
jne 0x140016f7a
cmp dword [rcx + 0x20], ebx
jae 0x140016f6e
mov rcx, qword [rcx + 0x10]
jmp 0x140016f74
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140016f63
cmp r8, rax
je 0x140016f85
cmp ebx, dword [r8 + 0x20]
jae 0x140016f88
mov r8, rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140018390
lea r8, [rbp]
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsi + 0x10]
call section.RT_CODE
mov r9, rdi
lea r8, [rbp + 0x110]
lea rdx, [rbp]
call fcn.140016b50
movzx r14d, al
test al, al
je 0x140017058
mov rcx, qword [rsi]
mov rdx, qword [rcx + 8]
mov rbx, rcx
mov r8d, dword [rsp + 0x30]
cmp byte [rdx + 0x19], 0
jne 0x140016ff8
nop dword [rax]
cmp dword [rdx + 0x20], r8d
jae 0x140016fec
mov rdx, qword [rdx + 0x10]
jmp 0x140016ff2
mov rbx, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x140016fe0
cmp rbx, rcx
je 0x140017003
cmp r8d, dword [rbx + 0x20]
jae 0x140017038
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c50
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140018c90
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx + 0x28]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x140017058
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.140002630
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1400170b0
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x1400170ab
test cl, 0x1f
je 0x14001707e
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001708d
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001709c
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400170a8
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
movzx eax, r14b
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14003a8a0
add rsp, 0x330
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret