Function at 0x14000a320
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4708
call fcn.1402512d0
sub rsp, rax
mov qword [rsp + 0x46e0], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x46f0], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x4730]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a3d5
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x2300], eax
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2300]
jmp 0x14000af33
mov rax, qword [rsp + 0x4718]
movzx eax, word [rax]
cmp eax, 0x7d
je 0x14000af17
mov dword [rsp + 0x40], 1
mov rdx, qword [0x1402ffda8]
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000a417
mov dword [rsp + 0x46e8], 1
jmp 0x14000a422
mov dword [rsp + 0x46e8], 0
mov eax, dword [rsp + 0x46e8]
mov dword [rsp + 0x290], eax
mov rdx, qword [0x1402ffd70]
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a457
cmp dword [rsp + 0x290], 0
je 0x14000a6f4
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a47c
jmp 0x14000af17
cmp dword [rsp + 0x4728], 0
je 0x14000a6f4
mov qword [rsp + 0x298], 0
mov dword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], 0
mov rax, qword [rsp + 0x4718]
mov qword [rsp + 0x2398], rax
mov qword [rsp + 0x2390], 0
cmp qword [rsp + 0x2398], 0
jne 0x14000a4e2
mov qword [rsp + 0x23a0], 0
jmp 0x14000a542
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
test eax, eax
je 0x14000a532
mov rax, qword [rsp + 0x2398]
movzx eax, word [rax]
mov ecx, 0x5c
movzx ecx, cx
cmp eax, ecx
jne 0x14000a51a
mov rax, qword [rsp + 0x2398]
mov qword [rsp + 0x2390], rax
jmp 0x14000a532
mov rcx, qword [rsp + 0x2398]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x2398], rax
jmp 0x14000a4e2
mov rax, qword [rsp + 0x2390]
mov qword [rsp + 0x23a0], rax
cmp qword [rsp + 0x23a0], 0
je 0x14000a57c
mov dword [rsp + 0x2304], 0x80020009
lea rcx, [rsp + 0x298]
call fcn.14000b1b0
nop
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2304]
jmp 0x14000af33
mov dword [rsp + 0x23a8], 0
jmp 0x14000a599
mov eax, dword [rsp + 0x23a8]
inc eax
mov dword [rsp + 0x23a8], eax
cmp dword [rsp + 0x23a8], 0xc
jge 0x14000a5d7
movsxd rax, dword [rsp + 0x23a8]
lea rcx, str.AppID
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000a5d5
mov dword [rsp + 0x23ac], 0
jmp 0x14000a5e2
jmp 0x14000a589
mov dword [rsp + 0x23ac], 1
cmp dword [rsp + 0x23ac], 0
je 0x14000a667
xor eax, eax
test eax, eax
jne 0x14000a5ec
xor eax, eax
test eax, eax
jne 0x14000a5ec
mov rax, qword [rsp + 0x4720]
mov qword [rsp + 0x298], rax
mov dword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], 0
mov rdx, qword [rsp + 0x4718]
lea rcx, [rsp + 0x298]
call fcn.14000b6e0
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2600], rax
mov qword [rsp + 0x298], 0
mov dword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], 0
cmp dword [rsp + 0x290], 0
je 0x14000a6e7
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a6a3
lea rcx, [rsp + 0x298]
call fcn.14000b1b0
jmp 0x14000af17
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c490
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a6d5
lea rcx, [rsp + 0x298]
call fcn.14000b1b0
jmp 0x14000af17
lea rcx, [rsp + 0x298]
call fcn.14000b1b0
jmp 0x14000ae8c
lea rcx, [rsp + 0x298]
call fcn.14000b1b0
mov rdx, qword [0x1402ffd90]
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000a73a
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a73a
jmp 0x14000af17
mov rdx, qword [0x1402ffd50]
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000a9ef
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a77c
jmp 0x14000af17
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a7a1
jmp 0x14000af17
mov rax, qword [rsp + 0x4718]
movzx eax, word [rax]
cmp eax, 0x3d
je 0x14000a7d2
mov dword [rsp + 0x2308], 0x80020009
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2308]
jmp 0x14000af33
cmp dword [rsp + 0x4728], 0
je 0x14000a8df
mov qword [rsp + 0x22b0], 0
mov dword [rsp + 0x22b8], 0
mov qword [rsp + 0x22c0], 0
xor eax, eax
test eax, eax
jne 0x14000a803
xor eax, eax
test eax, eax
jne 0x14000a803
mov rax, qword [rsp + 0x4720]
mov qword [rsp + 0x22b0], rax
mov dword [rsp + 0x22b8], 0
mov qword [rsp + 0x22c0], 0
mov r9, qword [rsp + 0x4718]
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x22b0]
mov rcx, qword [rsp + 0x4710]
call fcn.14000b980
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x22b0]
mov qword [rsp + 0x46c0], rax
mov qword [rsp + 0x22b0], 0
mov dword [rsp + 0x22b8], 0
mov qword [rsp + 0x22c0], 0
cmp dword [rsp + 0x68], 0
jge 0x14000a8c8
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x230c], eax
lea rcx, [rsp + 0x22b0]
call fcn.14000b1b0
nop
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x230c]
jmp 0x14000af33
lea rcx, [rsp + 0x22b0]
call fcn.14000b1b0
jmp 0x14000ae8c
cmp dword [rsp + 0x4730], 0
jne 0x14000a9c5
cmp dword [rsp + 0x40], 0
je 0x14000a9c5
mov qword [rsp + 0x22c8], 0
mov dword [rsp + 0x22d0], 0
mov qword [rsp + 0x22d8], 0
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x22c8]
call fcn.14000b4d0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x14000a999
xor eax, eax
test eax, eax
jne 0x14000a944
xor eax, eax
test eax, eax
jne 0x14000a944
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x22c8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000a997
cmp dword [rsp + 0x60], 2
je 0x14000a997
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x22c8]
call fcn.14000b1b0
jmp 0x14000af17
jmp 0x14000a9b8
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x22c8]
call fcn.14000b1b0
jmp 0x14000af17
lea rcx, [rsp + 0x22c8]
call fcn.14000b1b0
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c490
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000a9ea
jmp 0x14000af17
jmp 0x14000a3d5
mov dx, 0x5c
mov rcx, qword [rsp + 0x4718]
call fcn.14000b910
test rax, rax
je 0x14000aa26
mov dword [rsp + 0x2310], 0x80020009
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2310]
jmp 0x14000af33
cmp dword [rsp + 0x4728], 0
je 0x14000ab65
mov r9d, 0x2001f
mov r8, qword [rsp + 0x4718]
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x48]
call fcn.14000b4d0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000aafe
mov r9d, 0x20019
mov r8, qword [rsp + 0x4718]
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x48]
call fcn.14000b4d0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000aafe
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x4718]
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x48]
call fcn.14000b200
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000aafe
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x2314], eax
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2314]
jmp 0x14000af33
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000ab23
jmp 0x14000af17
mov rax, qword [rsp + 0x4718]
movzx eax, word [rax]
cmp eax, 0x3d
jne 0x14000ab60
mov r9, qword [rsp + 0x4718]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x4710]
call fcn.14000b980
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000ab60
jmp 0x14000af17
jmp 0x14000ae8c
cmp dword [rsp + 0x4730], 0
jne 0x14000ab95
mov r9d, 0x20019
mov r8, qword [rsp + 0x4718]
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x48]
call fcn.14000b4d0
mov dword [rsp + 0x60], eax
jmp 0x14000ab9d
mov dword [rsp + 0x60], 2
cmp dword [rsp + 0x60], 0
je 0x14000abaf
mov dword [rsp + 0x4730], 1
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x4718]
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140251320
mov ecx, eax
call fcn.1400012b0
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000abfc
jmp 0x14000af17
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c490
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000ac21
jmp 0x14000af17
mov rax, qword [rsp + 0x4718]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x14000acb0
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x14000acb0
mov eax, dword [rsp + 0x4730]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x4728]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.14000a320
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000ac8b
cmp dword [rsp + 0x4730], 0
jne 0x14000ac8b
jmp 0x14000af17
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000acb0
jmp 0x14000af17
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x4730], eax
cmp dword [rsp + 0x60], 2
jne 0x14000acc7
jmp 0x14000a3d5
cmp dword [rsp + 0x60], 0
je 0x14000acf1
cmp dword [rsp + 0x4730], 0
je 0x14000acdf
jmp 0x14000a3d5
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x68], eax
jmp 0x14000af17
cmp dword [rsp + 0x4730], 0
je 0x14000ad58
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x46c8], rax
mov rdx, qword [rsp + 0x46c8]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c3f0
test eax, eax
je 0x14000ad58
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c390
test eax, eax
je 0x14000ad53
cmp dword [rsp + 0x40], 0
je 0x14000ad53
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.14000b6e0
jmp 0x14000a3d5
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x46d0], rax
mov rdx, qword [rsp + 0x46d0]
mov rcx, qword [rsp + 0x4710]
call fcn.14000c3f0
mov dword [rsp + 0x22e0], eax
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000adbc
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x2318], eax
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x2318]
jmp 0x14000af33
cmp dword [rsp + 0x40], 0
je 0x14000ae8c
cmp dword [rsp + 0x22e0], 0
jne 0x14000ae8c
mov qword [rsp + 0x22e8], 0
mov dword [rsp + 0x22f0], 0
mov qword [rsp + 0x22f8], 0
mov rdx, qword [rsp + 0x4720]
lea rcx, [rsp + 0x22e8]
call fcn.14000afe0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x22e8]
call fcn.14000b020
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x22e8]
mov qword [rsp + 0x46d8], rax
mov qword [rsp + 0x22e8], 0
mov dword [rsp + 0x22f0], 0
mov qword [rsp + 0x22f8], 0
cmp dword [rsp + 0x60], 0
je 0x14000ae7f
mov ecx, dword [rsp + 0x60]
call fcn.14000af50
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x22e8]
call fcn.14000b1b0
jmp 0x14000af17
lea rcx, [rsp + 0x22e8]
call fcn.14000b1b0
cmp dword [rsp + 0x4728], 0
je 0x14000af12
mov rax, qword [rsp + 0x4718]
movzx eax, word [rax]
cmp eax, 0x7b
jne 0x14000af12
mov rcx, qword [rsp + 0x4718]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x14000af12
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x4728]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.14000a320
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000aef0
jmp 0x14000af17
mov rdx, qword [rsp + 0x4718]
mov rcx, qword [rsp + 0x4710]
call fcn.1400093c0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
jge 0x14000af12
jmp 0x14000af17
jmp 0x14000a3d5
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x231c], eax
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
mov eax, dword [rsp + 0x231c]
mov rcx, qword [rsp + 0x46f0]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x4708
ret