Function at 0x14002b9f0
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0x240], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov esi, r9d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x60], r8d
mov rbp, rdx
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0xd8], rcx
mov eax, 7
mov qword [r11 - 0xa0], rax
xor ebx, ebx
mov qword [r11 - 0xa8], rbx
mov word [rsp + 0x260], bx
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x80], rbx
mov word [rsp + 0x288], bx
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rbx
mov word [r11 - 0x68], bx
lea edi, [rax + 1]
mov rcx, rdi
call fcn.14005b298
cmp rax, rbx
je 0x14002ba9e
lea rcx, [rsp + 0xf0]
mov qword [rax], rcx
jmp 0x14002baa1
mov rax, rbx
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbx
mov rcx, rdi
call fcn.14005b298
cmp rax, rbx
je 0x14002badb
lea rcx, [rsp + 0x1d0]
mov qword [rax], rcx
jmp 0x14002bade
mov rax, rbx
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rbx
mov rcx, rdi
call fcn.14005b298
cmp rax, rbx
je 0x14002bb18
lea rcx, [rsp + 0x200]
mov qword [rax], rcx
jmp 0x14002bb1b
mov rax, rbx
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], rbx
mov rcx, rdi
call fcn.14005b298
cmp rax, rbx
je 0x14002bb55
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
jmp 0x14002bb58
mov rax, rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0x120]
call fcn.14004a428
nop
lea rcx, [rsp + 0x138]
call fcn.14004a428
nop
lea rcx, [rsp + 0x30]
call fcn.14004a428
nop
lea rcx, [rsp + 0xe0]
call fcn.14004a428
nop
mov r14d, 1
mov qword [rsp + 0x40], rbx
mov r9d, 0x2000000
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x120]
call fcn.14004a460
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14004ab28
mov r11, qword [rsp + 0x108]
mov rdi, r11
mov rbx, qword [rsp + 0x110]
cmp r11, rbx
jbe 0x14002bc1b
call fcn.14005c2f8
mov rbx, qword [rsp + 0x110]
mov r11, qword [rsp + 0x108]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor edi, edi
cmp r11, rbx
jbe 0x14002bc4e
call fcn.14005c2f8
cmp r12, rdi
je 0x14002bc5d
cmp r12, qword [rsp + 0xf0]
je 0x14002bc62
call fcn.14005c2f8
cmp r15, rbx
je 0x14002cdfa
mov r9d, 0x2000000
lea r8, [0x140077480]
mov rdx, 0xffffffff80000003
lea rcx, [rsp + 0x138]
call fcn.14004a460
mov r13, rax
cmp r12, rdi
jne 0x14002bc9e
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002bca2
mov r11, qword [r12]
cmp r15, qword [r11 + 0x20]
jb 0x14002bcad
call fcn.14005c2f8
cmp qword [r15 + 0x20], 8
jb 0x14002bcbd
lea rbx, [r15 + 8]
mov rdx, qword [rbx]
jmp 0x14002bcc4
lea rbx, [r15 + 8]
mov rdx, rbx
lea rcx, [rsp + 0x138]
call fcn.14004a4c4
cmp eax, edi
je 0x14002c535
cmp r12, rdi
jne 0x14002bce8
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002bcec
mov r11, qword [r12]
cmp r15, qword [r11 + 0x20]
jb 0x14002bcf7
call fcn.14005c2f8
cmp qword [r15 + 0x20], 8
jb 0x14002bd01
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x258]
call fcn.140002280
lea rcx, [0x1400778f0]
call fcn.14005b1c0
mov r8, rax
lea rdx, [0x1400778f0]
lea rcx, [rsp + 0x258]
call fcn.14000362c
mov rcx, rbp
call fcn.14005b1c0
mov r8, rax
mov rdx, rbp
lea rcx, [rsp + 0x258]
call fcn.14000362c
mov eax, 0x2a
mov word [rsp + 0x20], ax
lea ebx, [rax - 0x29]
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020e64
or rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x14002bdd4
lea eax, [rbx + 0x3e]
mov word [rsp + 0x20], ax
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020e64
cmp rax, rbp
jne 0x14002bdd4
lea rcx, [rsp + 0x80]
call fcn.1400078cc
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x80]
call fcn.14001a3a4
jmp 0x14002bfa0
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x280]
call fcn.140002130
mov r12d, 0x5c
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020f70
cmp rax, rbp
je 0x14002bece
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020f70
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x258]
call fcn.140003ab8
nop
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x258]
call fcn.140002130
nop
cmp qword [rsp + 0xd0], 8
jb 0x14002be85
mov rcx, qword [rsp + 0xb8]
call fcn.14005ab0c
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x280]
call fcn.140020f70
lea r8, [rax + 1]
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.1400018e0
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.140002130
jmp 0x14002bee0
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x258]
call fcn.1400018e0
lea r8, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r8, qword [rsp + 0x260]
mov r9d, esi
mov rdx, r13
lea rcx, [rsp + 0xe0]
call fcn.14004a460
mov rbx, rax
cmp rax, rdi
je 0x14002bf6e
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rdi
mov word [rsp + 0xb8], di
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0xb0]
call fcn.140002130
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
call fcn.14004ac14
mov r13, rbx
jmp 0x14002bfa0
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
lea r8, str.Cannot_open_the_key___1_s___by_CMpReg_n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
mov ecx, 5
call fcn.140009480
mov rcx, qword [rsp + 0x98]
mov rdi, rcx
mov rbx, qword [rsp + 0xa0]
cmp rcx, rbx
jbe 0x14002bfcd
call fcn.14005c2f8
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rdi
movaps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x50], xmm0
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor edi, edi
cmp rcx, rbx
jbe 0x14002c009
call fcn.14005c2f8
cmp rbp, rdi
je 0x14002c018
cmp rbp, qword [rsp + 0x80]
je 0x14002c01d
call fcn.14005c2f8
cmp rsi, rbx
je 0x14002cdad
cmp rbp, rdi
jne 0x14002c035
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c039
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c044
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c054
lea rbx, [rsi + 8]
mov r9, qword [rbx]
jmp 0x14002c05b
lea rbx, [rsi + 8]
mov r9, rbx
lea r8, str.DelReg_CMD_UNINSTREG_DELETEKEY::__1_s___n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
mov ecx, 5
call fcn.140009480
cmp rbp, rdi
jne 0x14002c082
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c086
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c091
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c09d
mov r8, qword [rbx]
jmp 0x14002c0a0
mov r8, rbx
mov r9d, dword [rsp + 0x28]
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.14004a460
cmp rax, rdi
je 0x14002c4fe
lea rcx, [rsp + 0x230]
call fcn.14004a428
nop
mov ecx, 8
call fcn.14005b298
cmp rax, rdi
je 0x14002c0e5
lea rcx, [rsp + 0x178]
mov qword [rax], rcx
jmp 0x14002c0e8
mov rax, rdi
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], rdi
lea rcx, str.Advapi32.dll
call fcn.140002494
mov r12, rax
cmp rax, rdi
je 0x14002c131
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov edi, dword [rsp + 0x60]
and edi, 0xff00
je 0x14002c41e
cmp edi, 0x100
je 0x14002c344
cmp edi, 0x200
je 0x14002c284
cmp edi, 0x300
je 0x14002c1c4
mov r9d, edi
lea r8, str.CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
mov ecx, 5
call fcn.140009480
test rbp, rbp
jne 0x14002c18b
call fcn.14005c2f8
xor r11d, r11d
jmp 0x14002c18f
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c19a
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c1a4
mov rbx, qword [rbx]
mov r9d, edi
mov r8, rbx
mov rdx, r13
mov rcx, qword [rsp + 0xd8]
call fcn.140026240
and r14d, eax
xor edi, edi
jmp 0x14002c4c7
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call fcn.14004af38
xor edi, edi
cmp eax, edi
jne 0x14002c4c7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
mov rdi, qword [rsp + 0x40]
xor eax, eax
cmp rdi, rax
je 0x14002c23f
cmp rbp, rax
jne 0x14002c205
call fcn.14005c2f8
xor r11d, r11d
jmp 0x14002c209
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c214
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c21e
mov rbx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, rbx
mov rcx, r13
call rdi
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
xor edi, edi
cmp rbp, rdi
jne 0x14002c250
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c254
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c25f
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c269
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call fcn.14004ab28
xor edi, edi
cmp eax, edi
jne 0x14002c4c7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
mov rdi, qword [rsp + 0x40]
xor eax, eax
cmp rdi, rax
je 0x14002c2ff
cmp rbp, rax
jne 0x14002c2c5
call fcn.14005c2f8
xor r11d, r11d
jmp 0x14002c2c9
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c2d4
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c2de
mov rbx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, rbx
mov rcx, r13
call rdi
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
xor edi, edi
cmp rbp, rdi
jne 0x14002c310
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c314
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c31f
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c329
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call fcn.14004ab28
xor edi, edi
cmp eax, edi
jne 0x14002c4c7
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call fcn.14004af38
cmp eax, edi
jne 0x14002c4c7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
mov rdi, qword [rsp + 0x40]
xor eax, eax
cmp rdi, rax
je 0x14002c3d9
cmp rbp, rax
jne 0x14002c39f
call fcn.14005c2f8
xor r11d, r11d
jmp 0x14002c3a3
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c3ae
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c3b8
mov rbx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, rbx
mov rcx, r13
call rdi
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
xor edi, edi
cmp rbp, rdi
jne 0x14002c3ea
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c3ee
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c3f9
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c403
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
lea rcx, [rsp + 0x30]
call fcn.14004b248
and r14d, eax
lea rcx, [rsp + 0x30]
call fcn.14004a43c
mov rdi, qword [rsp + 0x40]
xor eax, eax
cmp rdi, rax
je 0x14002c487
cmp rbp, rax
jne 0x14002c450
call fcn.14005c2f8
xor r11d, r11d
jmp 0x14002c454
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c45f
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c469
mov rbx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, rbx
mov rcx, r13
call rdi
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002c4c7
xor edi, edi
cmp rbp, rdi
jne 0x14002c498
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c49c
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c4a7
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c4b1
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
cmp r12, rdi
je 0x14002c4d6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x178]
call fcn.140005204
mov rcx, qword [rsp + 0x178]
call fcn.14005ab0c
nop
lea rcx, [rsp + 0x230]
call fcn.14004a8ec
cmp rbp, rdi
jne 0x14002c50d
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c511
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c51c
call fcn.14005c2f8
add rsi, 0x28
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
jmp 0x14002bfff
mov edx, 1
lea rcx, str.SeRestorePrivilege
call fcn.140056dec
cmp eax, edi
je 0x14002cdb2
mov r13, 0xffffffff80000003
cmp r12, rdi
jne 0x14002c564
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c568
mov r11, qword [r12]
cmp r15, qword [r11 + 0x20]
jb 0x14002c573
call fcn.14005c2f8
cmp qword [r15 + 0x20], 8
jb 0x14002c57f
mov rcx, qword [rbx]
jmp 0x14002c582
mov rcx, rbx
call fcn.1400575d4
cmp eax, edi
je 0x14002cd9d
cmp r12, rdi
jne 0x14002c59e
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c5a2
mov r11, qword [r12]
cmp r15, qword [r11 + 0x20]
jb 0x14002c5ad
call fcn.14005c2f8
cmp qword [r15 + 0x20], 8
jb 0x14002c5b7
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x258]
call fcn.140002280
lea rcx, [0x1400778f0]
call fcn.14005b1c0
mov r8, rax
lea rdx, [0x1400778f0]
lea rcx, [rsp + 0x258]
call fcn.14000362c
mov rcx, rbp
call fcn.14005b1c0
mov r8, rax
mov rdx, rbp
lea rcx, [rsp + 0x258]
call fcn.14000362c
mov eax, 0x2a
mov word [rsp + 0x20], ax
lea ebx, [rax - 0x29]
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020e64
or rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x14002c68a
lea eax, [rbx + 0x3e]
mov word [rsp + 0x20], ax
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020e64
cmp rax, rbp
jne 0x14002c68a
lea rcx, [rsp + 0x80]
call fcn.1400078cc
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x80]
call fcn.14001a3a4
jmp 0x14002c85a
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x280]
call fcn.140002130
mov r12d, 0x5c
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020f70
cmp rax, rbp
je 0x14002c784
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call fcn.140020f70
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x258]
call fcn.140003ab8
nop
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x258]
call fcn.140002130
nop
cmp qword [rsp + 0xd0], 8
jb 0x14002c73b
mov rcx, qword [rsp + 0xb8]
call fcn.14005ab0c
mov word [rsp + 0x20], r12w
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x280]
call fcn.140020f70
lea r8, [rax + 1]
xor edx, edx
lea rcx, [rsp + 0x280]
call fcn.1400018e0
mov r9, rbp
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.140002130
jmp 0x14002c796
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x258]
call fcn.1400018e0
lea r8, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r8, qword [rsp + 0x260]
mov r9d, esi
mov rdx, 0xffffffff80000003
lea rcx, [rsp + 0xe0]
call fcn.14004a460
mov rbx, rax
cmp rax, rdi
je 0x14002c828
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rdi
mov word [rsp + 0xb8], di
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0xb0]
call fcn.140002130
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
call fcn.14004ac14
mov r13, rbx
jmp 0x14002c85a
lea r9, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
cmovae r9, qword [rsp + 0x260]
lea r8, str.Cannot_open_the_key___1_s___by_CMpReg_n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
mov ecx, 5
call fcn.140009480
mov rcx, qword [rsp + 0x98]
mov rdi, rcx
mov rbx, qword [rsp + 0xa0]
cmp rcx, rbx
jbe 0x14002c887
call fcn.14005c2f8
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rdi
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0x50], xmm0
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x40]
xor edi, edi
cmp rcx, rbx
jbe 0x14002c8c8
call fcn.14005c2f8
cmp rbp, rdi
je 0x14002c8d7
cmp rbp, qword [rsp + 0x80]
je 0x14002c8dc
call fcn.14005c2f8
cmp rsi, rbx
je 0x14002cd6e
cmp rbp, rdi
jne 0x14002c8f4
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002c8f8
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c903
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c913
lea rdi, [rsi + 8]
mov r9, qword [rdi]
jmp 0x14002c91a
lea rdi, [rsi + 8]
mov r9, rdi
lea r8, str.DelReg_CMD_UNINSTREG_DELETEKEY::__1_s___n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
mov ecx, 5
call fcn.140009480
xor ebx, ebx
cmp rbp, rbx
jne 0x14002c943
call fcn.14005c2f8
mov r11, rbx
jmp 0x14002c947
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002c952
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002c95e
mov r8, qword [rdi]
jmp 0x14002c961
mov r8, rdi
mov r9d, 0x2000000
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.14004a460
cmp rax, rbx
je 0x14002cd30
lea rcx, [rsp + 0x248]
call fcn.14004a428
nop
mov ecx, 8
call fcn.14005b298
cmp rax, rbx
je 0x14002c9a7
lea rcx, [rsp + 0x148]
mov qword [rax], rcx
jmp 0x14002c9aa
mov rax, rbx
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], rbx
lea rcx, str.Advapi32.dll
call fcn.140002494
mov r12, rax
cmp rax, rbx
je 0x14002c9f1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov ebx, dword [rsp + 0x60]
and ebx, 0xff00
xor eax, eax
cmp ebx, eax
je 0x14002cc52
cmp ebx, 0x100
je 0x14002cba2
cmp ebx, 0x200
je 0x14002cb0c
cmp ebx, 0x300
je 0x14002ca76
mov r9d, ebx
lea r8, str.CMD_UNINSTREG_DELTEKEY_others__nAct__0xFF00__0x_1_lx___n
lea rdx, str.CUninstallActions::DeleteUsersRegistryKey
lea ecx, [rax + 5]
call fcn.140009480
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002ca55
mov r8, qword [rax + 8]
jmp 0x14002ca59
lea r8, [rax + 8]
mov r9d, ebx
mov rdx, r13
mov rcx, qword [rsp + 0xd8]
call fcn.140026240
and r14d, eax
xor edi, edi
jmp 0x14002ccf7
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.14004af38
xor edi, edi
cmp eax, edi
jne 0x14002ccf7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
cmp r15, rdi
je 0x14002cad9
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cab8
mov rdx, qword [rax + 8]
jmp 0x14002cabc
lea rdx, [rax + 8]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rcx, r13
call r15
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002caf0
mov rdx, qword [rax + 8]
jmp 0x14002caf4
lea rdx, [rax + 8]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.14004ab28
xor edi, edi
cmp eax, edi
jne 0x14002ccf7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
cmp r15, rdi
je 0x14002cb6f
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cb4e
mov rdx, qword [rax + 8]
jmp 0x14002cb52
lea rdx, [rax + 8]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rcx, r13
call r15
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cb86
mov rdx, qword [rax + 8]
jmp 0x14002cb8a
lea rdx, [rax + 8]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.14004ab28
xor edi, edi
cmp eax, edi
jne 0x14002ccf7
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.14004af38
cmp eax, edi
jne 0x14002ccf7
lea rcx, [rsp + 0x30]
call fcn.14004a43c
cmp r15, rdi
je 0x14002cc1f
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cbfe
mov rdx, qword [rax + 8]
jmp 0x14002cc02
lea rdx, [rax + 8]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rcx, r13
call r15
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rcx, [rsp + 0x50]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cc36
mov rdx, qword [rax + 8]
jmp 0x14002cc3a
lea rdx, [rax + 8]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
lea rcx, [rsp + 0x30]
call fcn.14004b248
and r14d, eax
lea rcx, [rsp + 0x30]
call fcn.14004a43c
xor ebx, ebx
cmp r15, rbx
je 0x14002ccb7
cmp rbp, rbx
jne 0x14002cc7f
call fcn.14005c2f8
mov r11, rbx
jmp 0x14002cc83
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002cc8e
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002cc98
mov rdi, qword [rdi]
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, rdi
mov rcx, r13
call r15
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
jmp 0x14002ccf7
cmp rbp, rbx
jne 0x14002ccc6
call fcn.14005c2f8
mov r11, rbx
jmp 0x14002ccca
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002ccd5
call fcn.14005c2f8
cmp qword [rsi + 0x20], 8
jb 0x14002ccdf
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edi, edi
mov ecx, edi
cmp eax, edi
sete cl
and r14d, ecx
cmp r12, rdi
je 0x14002cd06
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x148]
call fcn.140005204
mov rcx, qword [rsp + 0x148]
call fcn.14005ab0c
nop
lea rcx, [rsp + 0x248]
call fcn.14004a8ec
jmp 0x14002cd32
xor edi, edi
cmp rbp, rdi
jne 0x14002cd41
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002cd45
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x20]
jb 0x14002cd50
call fcn.14005c2f8
add rsi, 0x28
mov qword [rsp + 0x58], rsi
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
jmp 0x14002c8be
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x70]
call fcn.140009fc0
cmp qword [rax + 0x20], 8
jb 0x14002cd8a
mov rcx, qword [rax + 8]
jmp 0x14002cd8e
lea rcx, [rax + 8]
call fcn.140056eb8
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor edx, edx
lea rcx, str.SeRestorePrivilege
call fcn.140056dec
jmp 0x14002cdb2
mov r12, qword [rsp + 0x70]
cmp r12, rdi
jne 0x14002cdc1
call fcn.14005c2f8
mov r11, rdi
jmp 0x14002cdc5
mov r11, qword [r12]
cmp r15, qword [r11 + 0x20]
jb 0x14002cdd0
call fcn.14005c2f8
add r15, 0x28
mov qword [rsp + 0x78], r15
mov rbx, qword [rsp + 0x110]
mov r11, qword [rsp + 0x108]
mov esi, dword [rsp + 0x28]
mov rbp, qword [rsp + 0x130]
jmp 0x14002bc44
lea rcx, [rsp + 0xe0]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0x30]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0x138]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0x120]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0x80]
call fcn.140005204
mov rcx, qword [rsp + 0x80]
call fcn.14005ab0c
nop
lea rcx, [rsp + 0x200]
call fcn.140005204
mov rcx, qword [rsp + 0x200]
call fcn.14005ab0c
nop
lea rcx, [rsp + 0x1d0]
call fcn.140005204
mov rcx, qword [rsp + 0x1d0]
call fcn.14005ab0c
nop
lea rcx, [rsp + 0xf0]
call fcn.140005204
mov rcx, qword [rsp + 0xf0]
call fcn.14005ab0c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x2a8]
call fcn.140001624
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x280]
call fcn.140001624
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x258]
call fcn.140001624
mov eax, r14d
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14005bad0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret