Function at 0x1400055b0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2208]
mov eax, 0x2308
call fcn.14000aff0
sub rsp, rax
mov rax, qword [0x140013010]
xor rax, rsp
mov qword [rbp + 0x21f0], rax
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x68], r8
mov r15, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor esi, esi
mov r12d, esi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
mov qword [rbp - 0x80], rsi
call fcn.1400053d0
mov ebx, eax
test eax, eax
js 0x1400062f0
cmp word [r15], 0x7d
je 0x1400062f0
mov r13d, 1
lea rdx, str.Delete
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
sete sil
lea rdx, str.ForceRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000565f
test esi, esi
je 0x1400058c0
mov rbx, r15
mov rdi, qword [r14]
movzx eax, word [rdi]
cmp ax, 9
jb 0x14000568e
cmp ax, 0xa
jbe 0x140005680
cmp ax, 0xd
je 0x140005680
cmp ax, 0x20
jne 0x14000568e
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005662
xor ecx, ecx
cmp cx, ax
je 0x1400062eb
mov edx, 0x27
cmp dx, ax
jne 0x140005781
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
xor edi, edi
cmp di, ax
je 0x140005762
mov ecx, 0x27
cmp cx, ax
jne 0x1400056e5
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
mov ecx, 0x27
cmp cx, word [rax]
jne 0x140005762
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140005701
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x140005753
sub rdi, rbx
mov ecx, edx
nop word [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x140005740
mov r8, qword [r14]
movzx eax, word [r8]
xor edi, edi
cmp di, ax
jne 0x1400056c4
mov rax, qword [r14]
cmp di, word [rax]
je 0x1400062eb
mov word [rbx], di
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
xor ecx, ecx
jmp 0x1400057f4
cmp ax, 0x20
ja 0x140005797
movabs rdx, 0x100002600
bt rdx, rax
jb 0x1400057f1
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x1400057e3
sub rdi, rbx
mov ecx, edx
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, r13
jne 0x1400057d0
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
xor ecx, ecx
cmp cx, ax
jne 0x140005781
mov word [rbx], cx
mov edi, dword [rsp + 0x60]
test edi, edi
je 0x1400058c0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x58], rcx
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x140005842
nop dword [rax]
cmp ax, 0x5c
je 0x140005839
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140005820
jmp 0x140005842
test rcx, rcx
jne 0x1400062eb
lea rbx, [0x14000ea40]
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000588d
add rbx, 8
lea rax, str.RegOpenKeyTransactedW
cmp rbx, rax
jl 0x140005850
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x68], rax
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140005070
mov qword [rbp - 0x68], 0
test esi, esi
je 0x1400058c0
mov rdx, r15
mov rcx, r14
call fcn.1400053d0
mov ebx, eax
test eax, eax
js 0x1400062f0
mov rdx, r15
mov rcx, r14
call fcn.140004ec0
mov ebx, eax
test eax, eax
js 0x1400062f0
jmp 0x14000601c
lea rdx, str.NoRemove
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jne 0x140005a63
mov r13d, esi
mov rbx, r15
mov rdi, qword [r14]
movzx eax, word [rdi]
cmp ax, 9
jb 0x14000590c
cmp ax, 0xa
jbe 0x1400058fe
cmp ax, 0xd
je 0x1400058fe
cmp ax, 0x20
jne 0x14000590c
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x1400058e0
cmp si, ax
je 0x1400062eb
mov ecx, 0x27
cmp cx, ax
jne 0x1400059f0
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x1400059d1
nop
mov edi, 0x27
cmp di, ax
jne 0x140005958
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x1400059d1
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140005974
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x1400059c4
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400059b0
mov r8, qword [r14]
movzx eax, word [r8]
cmp si, ax
jne 0x140005940
mov rax, qword [r14]
cmp si, word [rax]
je 0x1400062eb
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005a63
cmp ax, 0x20
ja 0x140005a06
movabs rcx, 0x100002600
bt rcx, rax
jb 0x140005a60
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x140005a54
sub rdi, rbx
mov ecx, edx
nop
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140005a40
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
jne 0x1400059f0
mov word [rbx], si
lea rdx, [0x14000e910]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005e47
lea rbx, [rbp + 0x1f0]
mov rdi, qword [r14]
movzx eax, word [rdi]
cmp ax, 9
jb 0x140005aae
cmp ax, 0xa
jbe 0x140005aa0
cmp ax, 0xd
je 0x140005aa0
cmp ax, 0x20
jne 0x140005aae
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005a82
cmp si, ax
je 0x1400062eb
mov ecx, 0x27
cmp cx, ax
jne 0x140005b87
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x140005b6d
mov edi, 0x27
cmp di, ax
jne 0x140005af8
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x140005b6d
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140005b14
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov rdx, rax
mov qword [r14], rax
mov rcx, rax
sub rcx, rdi
sar rcx, 1
lea rax, [rcx + 1]
lea rax, [rbx + rax*2]
lea r8, [rbp + 0x21f0]
cmp rax, r8
jae 0x1400062eb
test ecx, ecx
jle 0x140005b61
sub rdi, rbx
mov ecx, ecx
nop dword [rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140005b50
movzx eax, word [rdx]
cmp si, ax
jne 0x140005ae0
mov rcx, qword [r14]
cmp si, word [rcx]
je 0x1400062eb
mov word [rbx], si
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005c00
cmp ax, 0x20
ja 0x140005b9d
movabs rcx, 0x100002600
bt rcx, rax
jb 0x140005bfd
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [rbp + 0x21f0]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x140005bf1
sub rdi, rbx
mov ecx, edx
nop word [rax + rax]
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140005be0
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
jne 0x140005b87
mov word [rbx], si
mov rbx, r15
mov rdi, qword [r14]
movzx eax, word [rdi]
cmp ax, 9
jb 0x140005c2f
cmp ax, 0xa
jbe 0x140005c21
cmp ax, 0xd
je 0x140005c21
cmp ax, 0x20
jne 0x140005c2f
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005c03
cmp si, ax
je 0x1400062eb
mov ecx, 0x27
cmp cx, ax
jne 0x140005d10
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
movzx eax, word [rax]
cmp si, ax
je 0x140005cf1
mov edi, 0x27
cmp di, ax
jne 0x140005c79
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextW]
cmp di, word [rax]
jne 0x140005cf1
mov rdi, qword [r14]
mov eax, 0x27
cmp ax, word [rdi]
jne 0x140005c95
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x140005ce4
sub rdi, rbx
mov ecx, edx
nop
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140005cd0
mov r8, qword [r14]
movzx eax, word [r8]
cmp si, ax
jne 0x140005c61
mov rax, qword [r14]
cmp si, word [rax]
je 0x1400062eb
mov word [rbx], si
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [r14], rax
jmp 0x140005d83
cmp ax, 0x20
ja 0x140005d26
movabs rcx, 0x100002600
bt rcx, rax
jb 0x140005d80
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
sar rdx, 1
lea rcx, [rdx + 1]
lea rcx, [rbx + rcx*2]
lea rax, [r15 + 0x2000]
cmp rcx, rax
jae 0x1400062eb
test edx, edx
jle 0x140005d74
sub rdi, rbx
mov ecx, edx
nop
movzx eax, word [rdi + rbx]
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140005d60
mov r8, qword [r14]
movzx eax, word [r8]
mov rdi, r8
cmp si, ax
jne 0x140005d10
mov word [rbx], si
cmp word [r15], 0x3d
jne 0x1400062eb
cmp dword [rsp + 0x60], 0
je 0x140005dcd
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov rdi, qword [rsp + 0x68]
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
mov r9, r15
lea r8, [rbp + 0x1f0]
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.1400048b0
mov ebx, eax
mov qword [rbp - 0x50], rsi
jmp 0x140006010
cmp dword [rbp + 0x2270], 0
jne 0x140005e37
test r13d, r13d
je 0x140005e37
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140004f70
test eax, eax
jne 0x1400062b8
lea rdx, [rbp + 0x1f0]
mov rdi, qword [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x14000629f
test rdi, rdi
je 0x140005e37
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r15
mov rcx, r14
call fcn.140004ec0
jmp 0x140005612
mov rcx, r15
movzx eax, word [r15]
test ax, ax
je 0x140005e75
cmp ax, 0x5c
je 0x140005e6c
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140005e53
jmp 0x140005e75
test rcx, rcx
jne 0x1400062eb
cmp dword [rsp + 0x60], 0
je 0x140006071
mov r9d, 0x2001f
mov r8, r15
mov rdi, qword [rsp + 0x68]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140004f70
test eax, eax
je 0x140005fd5
mov r9d, 0x20019
mov r8, r15
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140004f70
test eax, eax
je 0x140005fd5
mov qword [rbp - 0x78], rsi
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x140005f74
cmp qword [rbx], 0
je 0x140005f67
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140005f0e
mov eax, 1
mov r12, qword [rsp + 0x70]
test eax, eax
je 0x140005fda
mov ecx, eax
call fcn.1400053c0
mov ebx, eax
jmp 0x1400062f0
lea rdx, str.RegCreateKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140005f6d
mov qword [rsp + 0x50], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call r10
jmp 0x140005fa9
cmp dword [rbx + 8], 0
jne 0x140005f74
mov eax, 1
jmp 0x140005fa9
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140005ef3
mov eax, esi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005fc3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rbp - 0x78]
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], esi
jmp 0x140005ef8
mov r12, qword [rsp + 0x70]
mov rdx, r15
mov rcx, r14
call fcn.1400053d0
mov ebx, eax
test eax, eax
js 0x1400062f0
cmp word [r15], 0x3d
jne 0x140006018
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400048b0
mov ebx, eax
mov r12, qword [rsp + 0x70]
test eax, eax
js 0x1400062f0
mov edi, dword [rsp + 0x60]
cmp word [r15], 0x7b
jne 0x140006171
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [r15 + rax*2], 0
jne 0x140006030
xor esi, esi
cmp rax, 1
jne 0x14000561c
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.1400055b0
mov ebx, eax
test eax, eax
js 0x1400062f0
mov rdx, r15
mov rcx, r14
jmp 0x14000560d
mov ebx, dword [rbp + 0x2270]
test ebx, ebx
jne 0x14000609c
mov r9d, 0x20019
mov r8, r15
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140004f70
mov edi, eax
mov r12, qword [rsp + 0x70]
jmp 0x1400060a1
mov edi, 2
mov esi, 1
test edi, edi
cmove esi, ebx
mov r9, 0xffffffffffffffff
mov r8, r15
mov edx, 0x104
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
test eax, eax
je 0x1400060da
cmp eax, 0xc
je 0x1400062d9
cmp eax, 0x50
jne 0x1400062d2
mov rdx, r15
mov rcx, r14
call fcn.1400053d0
mov ebx, eax
test eax, eax
js 0x1400062f0
mov rdx, r15
mov rcx, r14
call fcn.140004ec0
mov ebx, eax
test eax, eax
js 0x1400062f0
cmp word [r15], 0x7b
jne 0x14000615b
mov rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], 0
jne 0x140006112
cmp rax, 1
jne 0x14000615b
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.1400055b0
mov ebx, eax
test eax, eax
jns 0x140006146
test esi, esi
je 0x1400062f0
mov rdx, r15
mov rcx, r14
call fcn.1400053d0
mov ebx, eax
test eax, eax
js 0x1400062f0
cmp edi, 2
je 0x140006171
test edi, edi
je 0x140006178
cmp dword [rbp + 0x2270], 0
je 0x1400062e0
xor esi, esi
jmp 0x14000561c
cmp dword [rbp + 0x2270], 0
je 0x1400061e0
mov rdx, r12
call fcn.1400051c0
test eax, eax
je 0x1400061e0
lea rdi, [0x14000ea40]
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140006171
add rdi, 8
lea rax, str.RegOpenKeyTransactedW
cmp rdi, rax
jl 0x1400061a0
test r13d, r13d
je 0x140006171
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.140005070
mov r12, qword [rsp + 0x70]
xor esi, esi
jmp 0x14000561c
mov rdx, r12
call fcn.1400051c0
mov edi, eax
xor esi, esi
mov eax, esi
test r12, r12
je 0x140006204
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, esi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
test eax, eax
jne 0x140005f00
test r13d, r13d
je 0x14000561c
test edi, edi
jne 0x14000561c
cmp byte [0x140013fe0], dil
jne 0x14000626c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000625c
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140013fd8], rax
mov byte [0x140013fe0], 1
jmp 0x140006273
mov rax, qword [0x140013fd8]
mov byte [0x140013fe0], 1
jmp 0x140006273
mov rax, qword [0x140013fd8]
lea rdx, [rbp - 0x20]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x14000628b
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x140006292
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test eax, eax
jne 0x140005f00
jmp 0x14000561c
mov ecx, eax
call fcn.1400053c0
mov ebx, eax
test rdi, rdi
je 0x1400062f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400062f0
mov ecx, eax
call fcn.1400053c0
mov ebx, eax
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400062f0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400062f0
call qword [sym.imp.mfc140u.dll_AfxRegDeleteKey]
int3
call qword [sym.imp.mfc140u.dll_AfxRegisterMFCCtrlClasses]
int3
mov ecx, edi
call fcn.1400053c0
mov ebx, eax
jmp 0x1400062f0
mov ebx, 0x80020009
test r12, r12
je 0x1400062fe
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x21f0]
xor rcx, rsp
call fcn.1400092d0
add rsp, 0x2308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret