Function at 0x14009ded0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb70
mov qword [rsp + 0xb48], 0xfffffffffffffffe
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xb60], rax
cmp dword [0x14012ea10], 1
je 0x14009df10
xor eax, eax
jmp 0x14009e47d
xor eax, eax
test eax, eax
jne 0x14009df00
mov rax, qword [rsp + 0xb88]
mov dword [rax], 0
mov dword [rsp + 0xa74], 0
lea rcx, [rsp + 0xaa0]
call fcn.1400a4120
nop
mov eax, 0xa
mov word [rsp + 0xa70], ax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0xb80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
lea rax, [rcx + rcx + 2]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0xa70]
mov r8d, eax
mov rdx, qword [rsp + 0xb80]
lea rcx, [rsp + 0xaa0]
call fcn.1400a5090
mov r8d, 0x500
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xaa0]
call fcn.1400a4950
test eax, eax
jne 0x14009dfd5
mov eax, dword [rsp + 0xa74]
mov dword [rsp + 0xb30], eax
lea rcx, [rsp + 0xaa0]
call fcn.1400a4310
mov eax, dword [rsp + 0xb30]
jmp 0x14009e47d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb80]
call fcn.14009ce00
test eax, eax
jne 0x14009e01d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb80]
call fcn.14009ce00
mov dword [rsp + 0xb34], eax
lea rcx, [rsp + 0xaa0]
call fcn.1400a4310
mov eax, dword [rsp + 0xb34]
jmp 0x14009e47d
xor eax, eax
test eax, eax
jne 0x14009dfd5
mov r8d, 0x500
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xaa0]
call fcn.1400a4950
test eax, eax
jne 0x14009e066
mov eax, dword [rsp + 0xa74]
mov dword [rsp + 0xb38], eax
lea rcx, [rsp + 0xaa0]
call fcn.1400a4310
mov eax, dword [rsp + 0xb38]
jmp 0x14009e47d
lea rcx, [rsp + 0x60]
call fcn.1400aff20
mov dword [rsp + 0xa90], eax
lea rdx, [0x1400f4d5c]
lea rcx, [rsp + 0xa88]
call fcn.1400330a0
nop
lea rdx, [0x1400f4d6c]
lea rcx, [rsp + 0xa80]
call fcn.1400330a0
nop
mov dword [rsp + 0xa7c], 0
mov dword [rsp + 0xa74], 1
mov rax, qword [rsp + 0xb88]
mov dword [rax], 1
mov qword [rsp + 0x50], 0
call fcn.14009b3f0
mov rdx, rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0xa78], eax
cmp dword [rsp + 0xa78], 0
je 0x14009e18b
cmp dword [rsp + 0xa78], 0
jne 0x14009e13d
mov dword [rsp + 0xb50], 1
jmp 0x14009e148
mov dword [rsp + 0xb50], 0
mov eax, dword [rsp + 0xb50]
mov dword [rsp + 0xb3c], eax
lea rcx, [rsp + 0xa80]
call fcn.140021400
nop
lea rcx, [rsp + 0xa88]
call fcn.140021400
nop
lea rcx, [rsp + 0xaa0]
call fcn.1400a4310
mov eax, dword [rsp + 0xb3c]
jmp 0x14009e47d
xor eax, eax
test eax, eax
jne 0x14009e11c
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [rsp + 0xa90], 0
jbe 0x14009e400
mov r8d, 0x500
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xaa0]
call fcn.1400a4950
test eax, eax
je 0x14009e400
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb28], rax
mov eax, dword [rsp + 0xa90]
sub eax, 1
mov dword [rsp + 0xa90], eax
mov dx, 9
mov rcx, qword [rsp + 0xb28]
call fcn.14009c310
mov qword [rsp + 0xb20], rax
cmp qword [rsp + 0xb20], 0
je 0x14009e21d
xor ecx, ecx
mov rax, qword [rsp + 0xb20]
mov word [rax], cx
jmp 0x14009e222
jmp 0x14009e19e
mov rdx, qword [rsp + 0xb28]
lea rcx, [rsp + 0xa88]
call fcn.140033190
mov rax, qword [rsp + 0xb20]
add rax, 2
mov qword [rsp + 0xb20], rax
mov rax, qword [rsp + 0xb20]
movzx eax, word [rax]
cmp eax, 9
jne 0x14009e271
mov rax, qword [rsp + 0xb20]
add rax, 2
mov qword [rsp + 0xb20], rax
jmp 0x14009e24b
mov rax, qword [rsp + 0xb20]
mov qword [rsp + 0xb28], rax
mov dx, 9
mov rcx, qword [rsp + 0xb20]
call fcn.14009c310
mov qword [rsp + 0xb20], rax
cmp qword [rsp + 0xb20], 0
je 0x14009e2b4
xor ecx, ecx
mov rax, qword [rsp + 0xb20]
mov word [rax], cx
jmp 0x14009e2b9
jmp 0x14009e19e
mov rdx, qword [rsp + 0xb28]
lea rcx, [rsp + 0xa80]
call fcn.140033190
mov rax, qword [rsp + 0xb20]
add rax, 2
mov qword [rsp + 0xb20], rax
mov rax, qword [rsp + 0xb20]
movzx eax, word [rax]
cmp eax, 9
jne 0x14009e308
mov rax, qword [rsp + 0xb20]
add rax, 2
mov qword [rsp + 0xb20], rax
jmp 0x14009e2e2
mov rax, qword [rsp + 0xb20]
mov qword [rsp + 0xb28], rax
lea rdx, [0x1400f4d8c]
mov rcx, qword [rsp + 0xb28]
call fcn.1400af0e8
test eax, eax
jne 0x14009e33d
mov dword [rsp + 0xa7c], 0
jmp 0x14009e392
lea rdx, [0x1400f4e64]
mov rcx, qword [rsp + 0xb28]
call fcn.1400af0e8
test eax, eax
jne 0x14009e362
mov dword [rsp + 0xa7c], 1
jmp 0x14009e392
lea rdx, [0x1400f4e7c]
mov rcx, qword [rsp + 0xb28]
call fcn.1400af0e8
test eax, eax
jne 0x14009e387
mov dword [rsp + 0xa7c], 2
jmp 0x14009e392
mov dword [rsp + 0xa7c], 0
lea rcx, [rsp + 0xa80]
call fcn.140021430
mov rdi, rax
lea rcx, [rsp + 0xa88]
call fcn.140021430
mov r9d, dword [rsp + 0xa7c]
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14009c440
test eax, eax
je 0x14009e3e2
cmp dword [rsp + 0xa74], 0
je 0x14009e3e2
mov dword [rsp + 0xb54], 1
jmp 0x14009e3ed
mov dword [rsp + 0xb54], 0
mov eax, dword [rsp + 0xb54]
mov dword [rsp + 0xa74], eax
jmp 0x14009e19e
cmp qword [rsp + 0x50], 0
je 0x14009e413
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0xa74], 0
je 0x14009e434
cmp dword [rsp + 0xa90], 0
jne 0x14009e434
mov dword [rsp + 0xb58], 1
jmp 0x14009e43f
mov dword [rsp + 0xb58], 0
mov eax, dword [rsp + 0xb58]
mov dword [rsp + 0xb40], eax
lea rcx, [rsp + 0xa80]
call fcn.140021400
nop
lea rcx, [rsp + 0xa88]
call fcn.140021400
nop
lea rcx, [rsp + 0xaa0]
call fcn.1400a4310
mov eax, dword [rsp + 0xb40]
mov rcx, qword [rsp + 0xb60]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0xb70
pop rdi
ret