Function at 0x14000ff20
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rcx, qword [0x1400b81d0]
mov eax, dword [0x1400be798]
xor ebx, ebx
mov dword [0x1400b81ec], eax
cmp rcx, rbx
je 0x14000ff63
call fcn.1400124f4
mov edx, dword [0x1400be798]
mov rcx, qword [0x1400b81d0]
mov dword [0x1400b81ec], eax
call fcn.140011f84
jmp 0x140010026
mov rdx, qword [0x1400b81d8]
cmp rdx, rbx
je 0x140010026
or qword [rsp + 0x60], 0xffffffffffffffff
lea r9, [rsp + 0x60]
mov rcx, 0xffffffff80000001
mov r8d, 0x2001f
mov dword [rsp + 0x98], 4
call fcn.140022c8c
cmp eax, ebx
jne 0x140010026
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
lea rdx, str.LastUILang
mov qword [rsp + 0x20], rax
call fcn.1400145fc
cmp eax, ebx
jne 0x14001001b
mov eax, dword [rsp + 0x90]
mov r8d, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
mov dword [0x1400b81ec], eax
mov eax, dword [0x1400be798]
lea r9, [rsp + 0x90]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x98]
lea rdx, str.LastUILang
mov dword [rsp + 0x20], eax
call fcn.140014620
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [0x140082c38], rbx
je 0x140010042
call fcn.14000fef4
mov rcx, qword [0x140082c38]
mov edx, eax
call fcn.140011f84
call fcn.14000fef4
mov esi, eax
call fcn.14000fec8
mov edi, eax
cmp esi, eax
je 0x1400101fd
movzx ecx, si
call fcn.1400224fc
cmp eax, ebx
jne 0x140010074
movzx ecx, di
call fcn.1400224fc
cmp eax, ebx
je 0x1400101fd
lea r8, [rsp + 0xa8]
lea rcx, [0x1400511c0]
mov edx, 0x20019
call fcn.140011e6c
cmp eax, ebx
jne 0x1400101fd
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r11d, dword [rsp + 0x90]
cmp r11d, ebx
je 0x1400101fd
imul r11d, r11d, 0x104
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x98], 0x104
mov edx, r11d
mov edi, ebx
call fcn.14000a0e8
mov rcx, qword [rsp + 0xa8]
cmp eax, ebx
jne 0x14001012e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400101fd
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
jne 0x1400101b7
mov esi, ebx
cmp edi, dword [rsp + 0x90]
jae 0x1400101b7
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
add esi, 0x104
inc edi
lea r9, [rsp + 0x98]
movsxd r8, esi
mov edx, edi
mov qword [rsp + 0x28], rbx
add r8, qword [rsp + 0xa0]
mov dword [rsp + 0x98], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
je 0x140010160
cmp edi, ebx
jle 0x1400101e2
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
lea rdx, [rbx + rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add rbx, 0x104
sub rdi, 1
jne 0x1400101bb
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xa0]
call fcn.140009e7c
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret