Function at 0x140011530
Capabilities:
Delete registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x38
xor ebx, ebx
lea r8, str.RegDel_1_
mov rdi, rcx
mov qword [rsp + 0x70], rbx
lea rcx, [0x140090f60]
mov qword [rsp + 0x68], rbx
mov edx, 0x80
call fcn.14001b57c
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop dword [rax + rax]
cmp word [rdi + rcx*2 + 2], bx
lea rcx, [rcx + 1]
jne 0x140011570
mov qword [rsp + 0x60], rbp
lea rcx, [rcx*2 + 4]
mov qword [rsp + 0x30], r15
call fcn.14001bda4
mov r14, rax
test rax, rax
jne 0x1400115ba
lea r8, str.malloc
lea rdx, [0x140090f60]
test rdi, rdi
je 0x1400115b2
mov r9, rdi
jmp 0x14001160a
xor r9d, r9d
jmp 0x14001180a
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [rdi + rdx*2], bx
jne 0x1400115c0
inc rdx
mov r8, rdi
mov rcx, r14
call fcn.14001b57c
test eax, eax
je 0x1400115e4
lea r8, str.tcscpy
jmp 0x1400115a1
mov edx, 0x5c
mov rcx, r14
call fcn.14001353c
mov rbp, rax
test rax, rax
jne 0x14001161f
lea r8, [0x140051758]
mov r9, r14
lea rdx, [0x140090f60]
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
mov dword [rsp + 0x20], ebx
call fcn.140001030
jmp 0x140011816
add rbp, 2
mov edx, 0x5c
mov rcx, rbp
call fcn.140013488
mov r15, rax
test rax, rax
jne 0x140011654
lea r8, str.tcschr
lea rdx, [0x140090f60]
test rbp, rbp
je 0x1400115b2
mov r9, rbp
jmp 0x14001160a
lea r8, [rsp + 0x70]
mov word [rax], bx
lea rdx, [0x14003a3e4]
mov rcx, r14
add r15, 2
call fcn.14001b968
mov rdi, rax
test rax, rax
jne 0x140011680
lea r8, str.tcstok
jmp 0x140011600
lea r8, str.RegModify_2_
mov edx, 0x80
lea rcx, [0x140090f60]
call fcn.14001b57c
mov r9, rsi
nop dword [rax + rax]
inc r9
cmp word [rdi + r9*2], bx
jne 0x1400116a0
lea rax, str.HKLM
mov dword [rsp + 0x28], 4
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x14001175e
mov r9, rsi
nop word [rax + rax]
inc r9
cmp word [rdi + r9*2], bx
jne 0x1400116e0
lea rax, str.HKCU
mov dword [rsp + 0x28], 4
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140011720
lea ebx, [rax - 1]
jmp 0x14001175e
inc rsi
cmp word [rdi + rsi*2], bx
jne 0x140011720
lea rax, str.HKCR
mov dword [rsp + 0x28], 4
mov r9, rsi
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ebx, dword [rsp + 0x68]
mov edx, 2
cmp eax, edx
cmove ebx, edx
test ebx, ebx
je 0x14001177e
sub ebx, 1
je 0x140011775
cmp ebx, 1
jne 0x1400117cd
mov rcx, 0xffffffff80000000
jmp 0x140011785
mov rcx, 0xffffffff80000001
jmp 0x140011785
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400117cd
lea r8, str.RegOpenKeyEx
lea rdx, [0x140090f60]
test rbp, rbp
je 0x140011807
mov r9, rbp
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011816
mov rcx, qword [rsp + 0x68]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14001183a
lea r8, str.RegDeleteValue
lea rdx, [0x140090f60]
test r15, r15
je 0x140011807
mov r9, r15
mov dword [rsp + 0x20], eax
lea rcx, str.error______s___s___s__failed._ErrorCode__d__n
call fcn.140001030
jmp 0x140011816
mov r9d, eax
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140011826
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140011833
mov rcx, r14
call fcn.14001bd9c
mov eax, 0x65b
jmp 0x140011854
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001184a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.14001bd9c
xor eax, eax
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret