Function at 0x100072cbc
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x2338
call fcn.1000c9670
sub rsp, rax
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov rax, qword [0x100142128]
xor rax, rsp
mov qword [rsp + 0x2320], rax
mov dword [rsp + 0x74], r9d
mov qword [rsp + 0x90], r8
mov rbp, rdx
mov rax, rcx
mov qword [rsp + 0x68], rcx
xor ecx, ecx
mov rbx, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rcx
mov ecx, dword [rsp + 0x2380]
mov dword [rsp + 0x98], ecx
mov rcx, rax
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jge 0x100072d41
jmp 0x1000736a0
cmp word [rbp], 0x7d
je 0x100073689
mov eax, 1
mov dword [rsp + 0x70], eax
lea rdx, [0x100001f08]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
mov esi, edi
cmp eax, edi
sete sil
lea rdx, [0x100001f30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x100072d8b
cmp esi, edi
je 0x100072e8b
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
cmp dword [rsp + 0x74], edx
je 0x100072e89
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], rdx
mov rcx, rbp
movzx eax, word [rbp]
cmp ax, dx
je 0x100072df6
cmp ax, 0x5c
je 0x100072ded
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
xor edx, edx
cmp ax, dx
jne 0x100072dd2
jmp 0x100072df6
cmp rcx, rdx
jne 0x100073560
lea rdi, [0x100001fb0]
mov rdx, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100072e49
add rdi, 8
lea rax, [0x100002010]
cmp rdi, rax
jl 0x100072dfd
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xb8], rax
mov rdx, rbp
lea rcx, [rsp + 0xb8]
call fcn.100072884
xor edi, edi
mov qword [rsp + 0xb8], rdi
jmp 0x100072e4b
xor edi, edi
cmp esi, edi
je 0x100072e87
mov rdx, rbp
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073584
mov rdx, rbp
mov rcx, rsi
call fcn.1000727dc
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x10007357f
jmp 0x1000731e0
jmp 0x100072e8b
xor edi, edi
lea rdx, [0x100001f18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x100072ec1
mov dword [rsp + 0x70], edi
mov rdx, rbp
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
jmp 0x100072ec8
mov rsi, qword [rsp + 0x68]
jmp 0x100072eca
xor edi, edi
lea rdx, [0x100001f48]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x10007304c
lea rdx, [rsp + 0x320]
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
mov rdx, rbp
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
cmp word [rbp], 0x3d
jne 0x1000735e1
cmp dword [rsp + 0x74], edx
je 0x100072f82
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], rdx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xd0], rax
mov r9, rbp
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.100072330
mov edi, eax
xor edx, edx
mov qword [rsp + 0xd0], rdx
cmp eax, edx
jl 0x100073589
jmp 0x1000731e0
cmp dword [rsp + 0x2380], edx
jne 0x100073030
cmp dword [rsp + 0x70], edx
je 0x100073030
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
jne 0x1000735d1
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rsi
lea rdx, [rsp + 0x320]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x10007300e
cmp eax, 2
jne 0x1000735a5
cmp rsi, rdi
je 0x10007302b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rdi
mov rsi, qword [rsp + 0x68]
jmp 0x100073030
mov rsi, qword [rsp + 0x68]
mov rdx, rbp
mov rcx, rsi
call fcn.1000727dc
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
jmp 0x10007354b
mov rcx, rbp
movzx eax, word [rbp]
cmp ax, di
je 0x10007307a
cmp ax, 0x5c
je 0x100073071
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
cmp ax, di
jne 0x100073058
jmp 0x10007307a
cmp rcx, rdi
jne 0x100073600
cmp dword [rsp + 0x74], edi
je 0x100073242
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbp
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x1000730df
mov eax, ecx
cmp rbx, rcx
je 0x1000730cd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
cmp eax, ecx
je 0x10007319e
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x10007312e
mov eax, ecx
cmp rbx, rcx
je 0x100073120
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
cmp eax, ecx
je 0x10007319e
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edi, edi
cmp eax, edi
jne 0x100073624
mov eax, edi
cmp rbx, rdi
je 0x10007318c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
cmp eax, edi
jne 0x100073624
mov rdx, rbp
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
cmp word [rbp], 0x3d
jne 0x1000731e0
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.100072330
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x10007361d
mov rbx, qword [rsp + 0x78]
cmp word [rbp], 0x7b
jne 0x10007354b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x100073549
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x74]
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.100072cbc
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
mov rdx, rbp
mov rcx, rsi
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
jmp 0x10007354b
mov edi, dword [rsp + 0x2380]
xor eax, eax
cmp edi, eax
jne 0x1000732a5
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x1000732aa
mov esi, eax
cmp rbx, rax
je 0x100073299
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
xor eax, eax
mov qword [rsp + 0x78], rax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
jmp 0x1000732aa
mov esi, 2
cmp esi, eax
mov eax, 1
cmovne edi, eax
mov dword [rsp + 0x2380], edi
or r9, 0xffffffffffffffff
mov r8, rbp
mov edx, 0x104
lea rcx, [rsp + 0x110]
call sub.msvcrt.dll_wcsncpy_s
xor ecx, ecx
cmp eax, ecx
je 0x1000732fe
cmp eax, 0xc
je 0x10007365c
cmp eax, 0x16
je 0x100073651
cmp eax, 0x22
je 0x100073651
cmp eax, 0x50
jne 0x100073646
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.1000727dc
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
cmp word [rbp], 0x7b
jne 0x100073399
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x100073397
mov eax, dword [rsp + 0x2380]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.100072cbc
mov edi, eax
xor edx, edx
cmp eax, edx
jge 0x10007337c
cmp dword [rsp + 0x2380], edx
je 0x100073689
mov rdx, rbp
mov rcx, qword [rsp + 0x68]
call fcn.100072b30
mov edi, eax
xor edx, edx
cmp eax, edx
jl 0x100073689
jmp 0x100073399
xor edx, edx
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x2380], eax
cmp esi, 2
je 0x10007354b
cmp esi, edx
je 0x1000733c1
cmp eax, edx
je 0x100073667
jmp 0x10007354b
cmp eax, edx
je 0x100073478
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
jne 0x100073478
mov eax, edx
cmp dword [rsp + 0x60], edx
seta al
cmp eax, edx
je 0x100073478
lea rsi, [0x100001fb0]
mov rdx, qword [rsi]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x10007354b
add rsi, 8
lea rax, [0x100002010]
cmp rsi, rax
jl 0x100073425
cmp dword [rsp + 0x70], edx
je 0x10007354b
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call fcn.100072884
mov rbx, qword [rsp + 0x78]
xor edx, edx
jmp 0x10007354b
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
je 0x1000734c4
mov esi, edx
jmp 0x1000734ce
mov esi, edx
cmp dword [rsp + 0x60], edx
seta sil
cmp rbx, rdx
je 0x1000734ee
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rbx, rdx
mov qword [rsp + 0x78], rdx
cmp eax, edx
jne 0x100073674
cmp dword [rsp + 0x70], edx
je 0x10007354b
cmp esi, edx
jne 0x10007354b
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xf8], rdx
mov qword [rsp + 0x100], rdx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xf0]
call fcn.100072a6c
xor edx, edx
mov qword [rsp + 0xf0], rdx
cmp eax, edx
jne 0x10007367e
jmp 0x10007354b
xor edx, edx
cmp word [rbp], 0x7d
je 0x100073689
mov eax, 1
jmp 0x100072d51
cmp rbx, rdx
je 0x100073575
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x78], rax
mov eax, 0x80020009
jmp 0x1000736a0
jmp 0x100073689
jmp 0x100073689
cmp rbx, rdx
je 0x10007359e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x78], rax
mov eax, edi
jmp 0x1000736a0
mov ecx, eax
call fcn.100072b1c
mov edi, eax
xor edx, edx
cmp rsi, rdx
je 0x100073689
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov qword [rsp + 0xa0], rdx
jmp 0x100073689
mov ecx, eax
call fcn.100072b1c
mov edi, eax
xor edx, edx
jmp 0x100073689
cmp rbx, rdx
je 0x1000735f6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x78], rax
mov eax, 0x80020009
jmp 0x1000736a0
cmp rbx, rdi
je 0x100073613
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov eax, 0x80020009
jmp 0x1000736a0
mov rbx, qword [rsp + 0x78]
jmp 0x100073689
mov ecx, eax
call fcn.100072b1c
mov edi, eax
xor esi, esi
cmp rbx, rsi
je 0x100073642
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov eax, edi
jmp 0x1000736a0
mov ecx, 0x80004005
call fcn.10002c1d4
int3
mov ecx, 0x80070057
call fcn.10002c1d4
int3
mov ecx, 0x8007000e
call fcn.10002c1d4
int3
mov ecx, esi
call fcn.100072b1c
mov edi, eax
xor edx, edx
jmp 0x100073689
mov ecx, eax
call fcn.100072b1c
nop
jmp 0x1000736a0
mov ecx, eax
call fcn.100072b1c
mov edi, eax
xor edx, edx
cmp rbx, rdx
je 0x10007369e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x78], rax
mov eax, edi
mov rcx, qword [rsp + 0x2320]
xor rcx, rsp
call fcn.1000c8b30
add rsp, 0x2338
pop rdi
pop rsi
pop rbp
pop rbx
ret