Function at 0x14000bf40
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1400533d8]
xor r13d, r13d
mov dword [rsp + 0x58], eax
mov r14, r8
movzx eax, word [0x1400533dc]
mov rbx, rdx
mov word [rsp + 0x5c], ax
mov r15, rcx
mov dword [r8], r13d
test rdx, rdx
je 0x14000bfcc
nop dword [rax]
cmp word [rbx], r13w
je 0x14000bfcc
lea rax, [rsp + 0x58]
nop dword [rax + rax]
movzx ecx, word [rax]
test cx, cx
je 0x14000bfbb
cmp word [rbx], cx
je 0x14000bff3
mov rcx, rax
call qword [sym.imp.user32.dll_CharNextW]
test rax, rax
jne 0x14000bfa0
mov rcx, rbx
call qword [sym.imp.user32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000bf90
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001bc60
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.user32.dll_CharNextW]
mov rbx, rax
test rax, rax
je 0x14000bfcc
movabs r12, 0x100000201
nop
movzx ecx, word [rbx]
lea rsi, str.install
mov rbp, rbx
call qword [sym.imp.user32.dll_CharUpperW]
mov ecx, 0x69
mov rdi, rax
call qword [sym.imp.user32.dll_CharUpperW]
mov rdx, rax
test di, di
je 0x14000c098
nop dword [rax]
cmp di, dx
jne 0x14000c089
cmp di, 0x20
je 0x14000c08f
cmp di, 9
je 0x14000c089
mov rcx, rbp
call qword [sym.imp.user32.dll_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.user32.dll_CharNextW]
movzx ecx, word [rbp]
mov rsi, rax
call qword [sym.imp.user32.dll_CharUpperW]
movzx ecx, word [rsi]
movzx edi, ax
call qword [sym.imp.user32.dll_CharUpperW]
movzx edx, ax
test di, di
jne 0x14000c040
jmp 0x14000c098
cmp di, 0x20
ja 0x14000c0ab
movzx eax, di
bt r12, rax
jae 0x14000c0ab
cmp dx, 0x20
ja 0x14000c0ab
movzx eax, dx
bt r12, rax
jb 0x14000c19b
movzx ecx, word [rbx]
lea rsi, str.uninstall
mov rbp, rbx
call qword [sym.imp.user32.dll_CharUpperW]
mov ecx, 0x75
mov rdi, rax
call qword [sym.imp.user32.dll_CharUpperW]
mov rdx, rax
test di, di
je 0x14000c12c
cmp di, dx
jne 0x14000c11d
cmp di, 0x20
je 0x14000c123
cmp di, 9
je 0x14000c11d
mov rcx, rbp
call qword [sym.imp.user32.dll_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.user32.dll_CharNextW]
movzx ecx, word [rbp]
mov rsi, rax
call qword [sym.imp.user32.dll_CharUpperW]
movzx ecx, word [rsi]
movzx edi, ax
call qword [sym.imp.user32.dll_CharUpperW]
movzx edx, ax
test di, di
jne 0x14000c0d4
jmp 0x14000c12c
cmp di, 0x20
ja 0x14000c140
movzx eax, di
bt r12, rax
jae 0x14000c140
cmp dx, 0x20
ja 0x14000c140
movzx eax, dx
bt r12, rax
jb 0x14000c1f0
nop
cmp word [rbx], r13w
je 0x14000bfcc
lea rax, [rsp + 0x58]
nop
movzx ecx, word [rax]
test cx, cx
je 0x14000c16b
cmp word [rbx], cx
je 0x14000c181
mov rcx, rax
call qword [sym.imp.user32.dll_CharNextW]
test rax, rax
jne 0x14000c150
mov rcx, rbx
call qword [sym.imp.user32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000c140
jmp 0x14000bfcc
mov rcx, rbx
call qword [sym.imp.user32.dll_CharNextW]
mov rbx, rax
test rax, rax
jne 0x14000c010
jmp 0x14000bfcc
mov rcx, r15
call fcn.1400125b0
test eax, eax
jne 0x14000c1b0
lea rdx, str.Uninstall___failed
jmp 0x14000c1c3
mov rcx, r15
call fcn.14000fdf0
test eax, eax
jne 0x14000c1d2
lea rdx, str.Install___failed
xor ecx, ecx
call fcn.140005ea0
mov ebx, 0x80004005
mov dword [r14], ebx
cmp dword [r14], r13d
jne 0x14000c3b9
lea rdx, str.Installation_succeeded
xor ecx, ecx
call fcn.140005ea0
xor al, al
jmp 0x14000bfce
mov rax, qword [0x140072d30]
test rax, rax
je 0x14000c206
call qword [case.0x14002508a.0]
test eax, eax
js 0x14000c276
mov rbx, qword [0x140070060]
mov eax, r13d
mov rcx, qword [0x140070068]
cmp rbx, rcx
jae 0x14000c268
nop dword [rax]
mov rdi, qword [rbx]
test rdi, rdi
je 0x14000c25b
mov rax, qword [rdi + 0x30]
call qword [case.0x14002508a.0]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.14000e890
test eax, eax
js 0x14000c276
mov rax, qword [rdi + 8]
xor ecx, ecx
call qword [case.0x14002508a.0]
test eax, eax
js 0x14000c276
mov rcx, qword [0x140070068]
add rbx, 8
cmp rbx, rcx
jb 0x14000c220
test eax, eax
js 0x14000c276
mov rcx, qword [0x140070058]
xor edx, edx
call fcn.14000ef30
mov r8d, eax
mov dword [r14], eax
lea rdx, str.UnregisterServer_TRUE__done_0x_x
xor ecx, ecx
call fcn.140005ea0
cmp dword [r14], r13d
jl 0x14000c3b9
mov rcx, r15
call fcn.1400125b0
test eax, eax
jne 0x14000c2a9
mov ebx, 0x80004005
jmp 0x14000c3a5
mov r9d, 0x20006
mov qword [rsp + 0x40], r13
lea r8, str.AppID
mov dword [rsp + 0x48], r13d
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x40]
call fcn.1400102d0
test eax, eax
je 0x14000c2f6
mov ecx, eax
call fcn.14000e590
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14000c3a5
jmp 0x14000c39f
mov rdi, qword [rsp + 0x40]
lea rbx, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov r8, rbx
mov qword [rsp + 0x20], r13
mov rdx, rdi
mov dword [rsp + 0x28], r13d
mov r9d, 0x20006
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x20]
call fcn.1400102d0
test eax, eax
je 0x14000c340
mov ecx, eax
call fcn.14000e590
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x14000c397
jmp 0x14000c391
mov rsi, qword [rsp + 0x20]
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
mov rcx, qword [0x140072d18]
lea rax, str.APPID
xor r8d, r8d
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
lea edx, [r8 + 0x65]
call fcn.1400129f0
mov ebx, eax
test rsi, rsi
je 0x14000c397
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
test rdi, rdi
je 0x14000c3a5
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov r8d, ebx
mov dword [r14], ebx
lea rdx, str.UnregisterAppId___done_0x_x
xor ecx, ecx
call fcn.140005ea0
xor al, al
jmp 0x14000bfce