Function at 0x14002f550
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x790
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x780], rax
lea rdx, [0x140000000]
mov rbx, rcx
lea rcx, [rsp + 0x78]
mov rax, qword [rdx + 0xed5d8]
mov dword [rsp + 0x60], 0xdeca39c1
mov word [rsp + 0x64], 0xf713
mov qword [rcx], rax
movzx eax, byte [rdx + 0xed5e0]
mov word [rsp + 0x66], 0x11d2
mov byte [rcx + 8], al
lea rcx, [rsp + 0x90]
movabs rax, 0x6c706b6d6c7275
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 0xed590]
mov byte [rsp + 0x68], 0xba
mov qword [rcx], rax
mov rax, qword [rdx + 0xed598]
mov byte [rsp + 0x69], 0x99
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0xed5a0]
mov byte [rsp + 0x6a], 0
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0xed5a8]
mov byte [rsp + 0x6b], 0x80
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0xed5b0]
mov byte [rsp + 0x6c], 0xc8
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0xed5b8]
mov byte [rsp + 0x6d], 0xe9
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0xed5c0]
mov byte [rsp + 0x6e], 0x49
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0xed5c8]
mov byte [rsp + 0x6f], 0x1a
mov qword [rcx + 0x38], rax
mov eax, dword [rdx + 0xed5d0]
mov dword [rcx + 0x40], eax
mov rax, qword [rdx + 0xed540]
lea rcx, [rsp + 0xe0]
mov qword [rcx], rax
mov rax, qword [rdx + 0xed548]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0xed550]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0xed558]
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0xed560]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0xed568]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0xed570]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0xed578]
mov qword [rcx + 0x38], rax
mov eax, dword [rdx + 0xed580]
mov dword [rcx + 0x40], eax
movzx eax, byte [rdx + 0xed584]
mov byte [rcx + 0x44], al
mov rax, qword [rdx + 0xed4f0]
lea rcx, [rsp + 0x130]
mov qword [rcx], rax
mov rax, qword [rdx + 0xed4f8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0xed500]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0xed508]
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0xed510]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0xed518]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0xed520]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0xed528]
mov qword [rcx + 0x38], rax
mov eax, dword [rdx + 0xed530]
mov dword [rcx + 0x40], eax
movzx eax, word [rdx + 0xed534]
mov word [rcx + 0x44], ax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.1400b31f0
lea rdx, str.CLSID_s
lea rcx, [rsp + 0x180]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x180]
mov rcx, 0xffffffff80000000
call fcn.1400b3940
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14002f7e7
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.1400b31f0
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14002f85c
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.1400b31f0
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
mov rcx, rbx
call fcn.14002ec00
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x130]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14002f8d8
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x780]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x7a0]
add rsp, 0x790
pop rdi
ret