Function at 0x14002b7d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1400f63f8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x68], rsi
test rdx, rdx
je 0x14002bcd9
mov eax, dword [0x1400c9690]
cmp dword [rcx], eax
jne 0x14002b846
mov eax, dword [0x1400c9694]
cmp dword [rcx + 4], eax
jne 0x14002b846
mov eax, dword [0x1400c9698]
cmp dword [rcx + 8], eax
jne 0x14002b846
mov eax, dword [0x1400c969c]
cmp dword [rcx + 0xc], eax
je 0x14002bcd9
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1330]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400c96c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14002bcd9
mov ecx, dword [rbx]
test ecx, ecx
je 0x14002b8eb
nop dword [rax + rax]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
lea r9, [rbp - 0x80]
mov r8d, 1
mov rdx, rdi
test r14d, r14d
je 0x14002b8c4
cmp ecx, r8d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x14002b8b0
mov rax, qword [rax + 0x28]
jmp 0x14002b8b4
mov rax, qword [rax + 0x38]
call qword [case.0x14005a798.0]
test eax, eax
js 0x14002bcdb
jmp 0x14002b8e1
cmp ecx, 1
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
jne 0x14002b8d7
mov rax, qword [rax + 0x30]
jmp 0x14002b8db
mov rax, qword [rax + 0x40]
call qword [case.0x14005a798.0]
add rbx, 0x10
mov ecx, dword [rbx]
test ecx, ecx
jne 0x14002b880
test r14d, r14d
jne 0x14002bcdd
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x14002b915
lea eax, [r14 + 0xd]
jmp 0x14002bcdb
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008db44
test eax, eax
je 0x14002b952
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008dacc
test eax, eax
je 0x14002b98f
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008dacc
test eax, eax
je 0x14002b9cc
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
mov rbx, rsi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ba07
mov eax, esi
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x14002bae3
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14002ba61
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x14002bae3
cmp dword [rsp + 0x60], edi
jne 0x14002bae3
cmp byte [0x1400fb020], dil
jne 0x14002bab7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002baa7
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400fb018], rax
mov byte [0x1400fb020], 1
jmp 0x14002babe
mov rax, qword [0x1400fb018]
mov byte [0x1400fb020], 1
jmp 0x14002babe
mov rax, qword [0x1400fb018]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x14002badc
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14005a798.0]
jmp 0x14002bae3
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008db44
test eax, eax
je 0x14002bb20
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
lea r8, [rbp + 0x90]
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008dacc
test eax, eax
je 0x14002bb5d
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008dacc
test eax, eax
je 0x14002bb9a
cmp eax, 0xc
je 0x14002bd1e
cmp eax, 0x16
je 0x14002bd34
cmp eax, 0x22
je 0x14002bd34
cmp eax, 0x50
jne 0x14002bd29
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002bbdc
mov eax, esi
test rbx, rbx
je 0x14002bbd7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
test eax, eax
jne 0x14002bcbc
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x14002bc36
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x14002bcca
cmp dword [rsp + 0x60], edi
jne 0x14002bcbc
cmp byte [0x1400fb020], dil
jne 0x14002bc90
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002bc80
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400fb018], rax
mov byte [0x1400fb020], 1
jmp 0x14002bc97
mov rax, qword [0x1400fb018]
mov byte [0x1400fb020], 1
jmp 0x14002bc97
mov rax, qword [0x1400fb018]
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x14002bcb5
xor r9d, r9d
xor r8d, r8d
call qword [case.0x14005a798.0]
jmp 0x14002bcbc
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test rbx, rbx
je 0x14002bcca
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002bcdd
mov eax, esi
mov esi, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002bcf5
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14005a798.0]
nop
mov eax, esi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140085660
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14001f1c0
int3
mov ecx, 0x80004005
call fcn.14001f1c0
int3
mov ecx, 0x80070057
call fcn.14001f1c0
int3