Function at 0x1401f8b24
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x57]
sub rsp, 0xd0
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, r8
mov rbx, rcx
xor edi, edi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x61], rax
mov r9, rsi
mov r8, qword [rbp + 0x7f]
mov r8, qword [r8]
lea rdx, [0x14035f058]
lea rcx, [rbp - 0x61]
call fcn.14000d9c8
mov rcx, qword [rbx + 0x48]
mov rbx, qword [rbp - 0x61]
xor edx, edx
test rcx, rcx
je 0x1401f8bad
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x38]
xor edx, edx
test al, al
jne 0x1401f8d7b
mov qword [rbp - 0x39], rdx
mov dword [rbp - 0x31], edx
mov qword [rbp - 0x29], rdx
or eax, 0xffffffff
mov dword [rbp - 0x21], eax
mov dword [rbp - 0x1d], eax
mov dword [rbp - 0x19], edx
lea rax, vtable.Piriform::Registry::CEnumRegKey.0
mov qword [rbp - 0x41], rax
lea rax, vtable.Piriform::Registry::CEnumRegKey.1.0
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rdx
mov qword [rbp - 1], rdx
mov qword [rbp + 7], rdx
mov byte [rbp + 0x17], 1
mov qword [rbp + 0x1f], rdx
mov r9d, dword [rbp + 0x77]
mov r8, rsi
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp - 0x39]
call fcn.1400114d4
mov edi, eax
test eax, eax
jne 0x1401f8d71
lea rcx, [rbp - 0x41]
call fcn.140211a58
mov qword [rbp - 0x59], rax
mov rcx, qword [rax + 8]
cmp qword [rax], rcx
je 0x1401f8ccf
and qword [rbp - 0x49], 0
sub rcx, qword [rax]
sar rcx, 3
test rcx, rcx
je 0x1401f8cb4
mov rcx, qword [rbp + 0x5f]
add rcx, 8
mov qword [rbp - 0x51], rcx
mov rax, qword [rcx]
call qword [rax + 0x30]
test al, al
je 0x1401f8cac
test edi, edi
jne 0x1401f8d71
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 0x37]
call fcn.14000c4d8
mov rcx, qword [rbp - 0x59]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x77]
mov r8, qword [rbp - 0x49]
mov r8, qword [rcx + r8*8]
mov rdx, qword [rbp - 0x39]
mov rcx, qword [rbp + 0x5f]
call fcn.1401f8b24
mov edi, eax
mov rdx, qword [rbp - 0x49]
inc rdx
mov qword [rbp - 0x49], rdx
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx + 8]
sub rax, qword [rcx]
sar rax, 3
cmp rdx, rax
mov rcx, qword [rbp - 0x51]
jb 0x1401f8c43
test edi, edi
jne 0x1401f8d71
lea rcx, [rbp - 9]
call fcn.14000bff0
lea rcx, [rbp - 0x41]
call fcn.140211a58
mov rcx, qword [rax + 8]
cmp qword [rax], rcx
jne 0x1401f8cfb
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1401f8ce3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x39], 0
and dword [rbp - 0x31], 0
mov r8d, dword [rbp + 0x77]
mov rdx, rsi
mov rcx, qword [rbp + 0x67]
call fcn.140223e38
mov edi, eax
jmp 0x1401f8d71
lea rcx, [rbp - 9]
call fcn.14000bff0
lea rcx, [rbp - 0x41]
call fcn.140211a18
mov rsi, rax
and qword [rbp - 0x51], 0
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
sar rcx, 3
test rcx, rcx
je 0x1401f8d71
mov rcx, qword [rbp + 0x5f]
add rcx, 8
mov qword [rbp - 0x59], rcx
mov rbx, qword [rbp - 0x51]
mov rax, qword [rcx]
call qword [rax + 0x30]
test al, al
je 0x1401f8d6d
test edi, edi
jne 0x1401f8d6d
mov rdx, qword [rsi]
mov rdx, qword [rdx + rbx*8]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
inc rbx
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 3
cmp rbx, rax
mov rcx, qword [rbp - 0x59]
jb 0x1401f8d35
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x41]
call fcn.140211a98
nop
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401f8d99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp + 0x7f]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401f8dba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret