Function at 0x140018890
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1298
call fcn.140022d10
sub rsp, rax
mov rax, qword [0x1400d8538]
xor rax, rsp
mov qword [rsp + 0x1280], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x12c0]
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14001893c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xf4], eax
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0xf4]
jmp 0x1400195bb
mov rax, qword [rsp + 0x12a8]
movsx eax, byte [rax]
cmp eax, 0x7d
je 0x14001959f
mov dword [rsp + 0x48], 1
mov rdx, qword [0x140080ad0]
mov rcx, qword [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14001897e
mov dword [rsp + 0x80], 1
jmp 0x140018989
mov dword [rsp + 0x80], 0
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x88], eax
mov rdx, qword [0x140080a80]
mov rcx, qword [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400189be
cmp dword [rsp + 0x88], 0
je 0x140018c2e
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400189e3
jmp 0x14001959f
cmp dword [rsp + 0x12b8], 0
je 0x140018c2e
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0x12a8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x110], 0
cmp qword [rsp + 0x70], 0
jne 0x140018a43
mov qword [rsp + 0x118], 0
jmp 0x140018a91
mov rax, qword [rsp + 0x70]
movsx eax, byte [rax]
test eax, eax
je 0x140018a81
mov rax, qword [rsp + 0x70]
movsx eax, byte [rax]
mov ecx, 0x5c
cmp eax, ecx
jne 0x140018a6f
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x110], rax
jmp 0x140018a81
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rsp + 0x70], rax
jmp 0x140018a43
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
je 0x140018acb
mov dword [rsp + 0xf8], 0x80020009
lea rcx, [rsp + 0x98]
call fcn.140003300
nop
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0xf8]
jmp 0x1400195bb
mov dword [rsp + 0x4c], 0
jmp 0x140018adf
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0xc
jge 0x140018b17
movsxd rax, dword [rsp + 0x4c]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140018b15
mov dword [rsp + 0x84], 0
jmp 0x140018b22
jmp 0x140018ad5
mov dword [rsp + 0x84], 1
cmp dword [rsp + 0x84], 0
je 0x140018ba1
xor eax, eax
test eax, eax
jne 0x140018b2c
mov rax, qword [rsp + 0x12b0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rdx, qword [rsp + 0x12a8]
lea rcx, [rsp + 0x98]
call fcn.140017820
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
cmp dword [rsp + 0x88], 0
je 0x140018c21
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018bdd
lea rcx, [rsp + 0x98]
call fcn.140003300
jmp 0x14001959f
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.14001ba60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018c0f
lea rcx, [rsp + 0x98]
call fcn.140003300
jmp 0x14001959f
lea rcx, [rsp + 0x98]
call fcn.140003300
jmp 0x140019514
lea rcx, [rsp + 0x98]
call fcn.140003300
mov rdx, qword [0x140080aa8]
mov rcx, qword [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140018c74
mov dword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018c74
jmp 0x14001959f
mov rdx, qword [str.p_n_b_]
mov rcx, qword [rsp + 0x12a8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140018f2a
lea rdx, [rsp + 0x280]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018cb6
jmp 0x14001959f
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018cdb
jmp 0x14001959f
mov rax, qword [rsp + 0x12a8]
movsx eax, byte [rax]
cmp eax, 0x3d
je 0x140018d0c
mov dword [rsp + 0xfc], 0x80020009
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0xfc]
jmp 0x1400195bb
cmp dword [rsp + 0x12b8], 0
je 0x140018e20
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
xor eax, eax
test eax, eax
jne 0x140018d3d
mov rax, qword [rsp + 0x12b0]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov r9, qword [rsp + 0x12a8]
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140005350
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
cmp dword [rsp + 0x40], 0
jge 0x140018dfc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x100], eax
lea rcx, [rsp + 0xc8]
call fcn.140003300
nop
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0x100]
jmp 0x1400195bb
lea rcx, [rsp + 0xc8]
call fcn.140003300
jmp 0x140019514
cmp dword [rsp + 0x12c0], 0
jne 0x140018f00
cmp dword [rsp + 0x48], 0
je 0x140018f00
mov qword [rsp + 0x130], 0
mov dword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x12b0]
lea rcx, [rsp + 0x130]
call fcn.140014b50
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140018ed4
xor eax, eax
test eax, eax
jne 0x140018e85
lea rdx, [rsp + 0x280]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140018ed2
cmp dword [rsp + 0x44], 2
je 0x140018ed2
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x130]
call fcn.140003300
jmp 0x14001959f
jmp 0x140018ef3
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x130]
call fcn.140003300
jmp 0x14001959f
lea rcx, [rsp + 0x130]
call fcn.140003300
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.14001ba60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140018f25
jmp 0x14001959f
jmp 0x14001893c
mov rax, qword [rsp + 0x12a8]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x120], 0
cmp qword [rsp + 0x78], 0
jne 0x140018f59
mov qword [rsp + 0x128], 0
jmp 0x140018fa7
mov rax, qword [rsp + 0x78]
movsx eax, byte [rax]
test eax, eax
je 0x140018f97
mov rax, qword [rsp + 0x78]
movsx eax, byte [rax]
mov ecx, 0x5c
cmp eax, ecx
jne 0x140018f85
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x120], rax
jmp 0x140018f97
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [rsp + 0x78], rax
jmp 0x140018f59
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
je 0x140018fd3
mov dword [rsp + 0x104], 0x80020009
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0x104]
jmp 0x1400195bb
cmp dword [rsp + 0x12b8], 0
je 0x140019112
mov r9d, 0x2001f
mov r8, qword [rsp + 0x12a8]
mov rdx, qword [rsp + 0x12b0]
lea rcx, [rsp + 0x58]
call fcn.140014b50
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400190ab
mov r9d, 0x20019
mov r8, qword [rsp + 0x12a8]
mov rdx, qword [rsp + 0x12b0]
lea rcx, [rsp + 0x58]
call fcn.140014b50
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400190ab
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x12a8]
mov rdx, qword [rsp + 0x12b0]
lea rcx, [rsp + 0x58]
call fcn.140007cf0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400190ab
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0x108], eax
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0x108]
jmp 0x1400195bb
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400190d0
jmp 0x14001959f
mov rax, qword [rsp + 0x12a8]
movsx eax, byte [rax]
cmp eax, 0x3d
jne 0x14001910d
mov r9, qword [rsp + 0x12a8]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x12a0]
call fcn.140005350
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14001910d
jmp 0x14001959f
jmp 0x140019514
cmp dword [rsp + 0x12c0], 0
jne 0x140019142
mov r9d, 0x20019
mov r8, qword [rsp + 0x12a8]
mov rdx, qword [rsp + 0x12b0]
lea rcx, [rsp + 0x58]
call fcn.140014b50
mov dword [rsp + 0x44], eax
jmp 0x14001914a
mov dword [rsp + 0x44], 2
cmp dword [rsp + 0x44], 0
je 0x14001915c
mov dword [rsp + 0x12c0], 1
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x12a8]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140037858
mov dword [rsp + 0xe0], eax
mov ecx, dword [rsp + 0xe0]
call fcn.1400064a0
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400191b5
jmp 0x14001959f
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.14001ba60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x1400191da
jmp 0x14001959f
mov rax, qword [rsp + 0x12a8]
movsx eax, byte [rax]
cmp eax, 0x7b
jne 0x140019269
mov rcx, qword [rsp + 0x12a8]
call fcn.1400377b0
cmp rax, 1
jne 0x140019269
mov eax, dword [rsp + 0x12c0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x12b8]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140018890
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140019244
cmp dword [rsp + 0x12c0], 0
jne 0x140019244
jmp 0x14001959f
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140019269
jmp 0x14001959f
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x12c0], eax
cmp dword [rsp + 0x44], 2
jne 0x140019283
jmp 0x14001893c
cmp dword [rsp + 0x44], 0
je 0x1400192ad
cmp dword [rsp + 0x12c0], 0
je 0x14001929b
jmp 0x14001893c
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0x40], eax
jmp 0x14001959f
cmp dword [rsp + 0x12c0], 0
je 0x140019360
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x12a0]
call fcn.14000f1e0
test eax, eax
je 0x140019360
mov dword [rsp + 0x50], 0
jmp 0x1400192f5
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xc
jge 0x14001932d
movsxd rax, dword [rsp + 0x50]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14001932b
mov dword [rsp + 0x8c], 0
jmp 0x140019338
jmp 0x1400192eb
mov dword [rsp + 0x8c], 1
cmp dword [rsp + 0x8c], 0
je 0x14001935b
cmp dword [rsp + 0x48], 0
je 0x14001935b
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x58]
call fcn.140017820
jmp 0x14001893c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x150], rax
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x12a0]
call fcn.14000f1e0
mov dword [rsp + 0xec], eax
mov dword [rsp + 0x90], 0
cmp qword [rsp + 0x58], 0
je 0x1400193b7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400193f7
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0xe8], eax
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0xe8]
jmp 0x1400195bb
cmp dword [rsp + 0x48], 0
je 0x140019514
cmp dword [rsp + 0xec], 0
jne 0x140019514
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
xor eax, eax
test eax, eax
jne 0x140019433
mov rax, qword [rsp + 0x12b0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
xor eax, eax
test eax, eax
jne 0x140019460
cmp qword [rsp + 0xc0], 0
je 0x140019494
lea r8, [rsp + 0x170]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xc0]
call fcn.140017b70
mov dword [rsp + 0x44], eax
jmp 0x1400194ae
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
cmp dword [rsp + 0x44], 0
je 0x140019507
mov ecx, dword [rsp + 0x44]
call fcn.1400065c0
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0xb0]
call fcn.140003300
jmp 0x14001959f
lea rcx, [rsp + 0xb0]
call fcn.140003300
cmp dword [rsp + 0x12b8], 0
je 0x14001959a
mov rax, qword [rsp + 0x12a8]
movsx eax, byte [rax]
cmp eax, 0x7b
jne 0x14001959a
mov rcx, qword [rsp + 0x12a8]
call fcn.1400377b0
cmp rax, 1
jne 0x14001959a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x12b8]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140018890
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x140019578
jmp 0x14001959f
mov rdx, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.140010040
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14001959a
jmp 0x14001959f
jmp 0x14001893c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xf0], eax
lea rcx, [rsp + 0x58]
call fcn.140003300
mov eax, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.140022d70
add rsp, 0x1298
ret