Function at 0x14004c1f0
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r13, rcx
call fcn.140069504
mov r14, qword [rax + 8]
call fcn.140015a10
mov esi, eax
call fcn.1400696cc
mov rcx, rax
xor ebp, ebp
mov edx, ebp
test rax, rax
setne dl
test edx, edx
jne 0x14004c23c
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x88], rbx
call fcn.1400696cc
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14004c26d
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x90], rdi
call fcn.1400696cc
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14004c2a1
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
cmp esi, 2
je 0x14004c4eb
cmp esi, 3
je 0x14004c4eb
mov rdx, qword [r14 + 0x5d8]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
or r12d, 0xffffffff
cmp rcx, rdi
je 0x14004c339
cmp dword [rdi + 0x10], 0
jl 0x14004c320
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004c320
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, r12d
test ecx, ecx
jg 0x14004c312
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rbx, 0x18
mov qword [rsp + 0x88], rbx
jmp 0x14004c339
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003c40
mov rbx, qword [rsp + 0x88]
mov r8, rbx
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.14004bdf0
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004c36f
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdi, rbp
cmp qword [r13 + 0x1a8], rbp
jle 0x14004c9b6
nop
test rdi, rdi
js 0x14004c4e5
cmp rdi, qword [r13 + 0x1a8]
jge 0x14004c4e5
mov rax, qword [r13 + 0x1a0]
mov rbx, qword [rax + rdi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14004c3c5
cmp rax, qword [rbx - 0x18]
jne 0x14004c3c5
lea rsi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x14004c401
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14004c4df
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140080540
lea rbx, [rsi + 0x18]
cmp dword [rbx - 0x10], 0
jl 0x14004c429
lea rdx, str.PCL6
mov rcx, rbx
call fcn.1400804d0
test rax, rax
je 0x14004c429
sub rax, rbx
sar rax, 1
test eax, eax
jns 0x14004c461
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c445
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add ebp, 1
add rdi, 1
movsxd rax, ebp
cmp rax, qword [r13 + 0x1a8]
jge 0x14004c9b6
jmp 0x14004c380
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c47d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.PCL6
lea rdx, str.PCL5e
lea rcx, [rsp + 0x88]
call fcn.1400140f0
mov rbx, qword [rsp + 0x88]
mov r8, rbx
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.14004bdf0
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004c9b6
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14004c9b6
call fcn.1400019f0
int3
call fcn.14006766c
int3
mov rdx, qword [r14 + 0x5d8]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or r12d, 0xffffffff
cmp rcx, rbx
je 0x14004c55c
cmp dword [rbx + 0x10], 0
jl 0x14004c54b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004c54b
call fcn.1400031e0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
add ecx, r12d
test ecx, ecx
jg 0x14004c535
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x90]
jmp 0x14004c55c
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003c40
mov rdx, qword [r14 + 0x5e8]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004c5c1
cmp dword [rdi + 0x10], 0
jl 0x14004c5b0
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004c5b0
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004c5a2
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x90], rax
jmp 0x14004c5c1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x90]
call fcn.140003c40
call fcn.1400696cc
mov r11, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14004c5e0
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, str.Driver
test rdx, 0xffffffffffff0000
jne 0x14004c623
movzx ebx, dx
mov ecx, ebx
call fcn.1400696b8
test rax, rax
je 0x14004c62e
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140003a40
jmp 0x14004c62e
lea rcx, [rsp + 0x20]
call fcn.14000fcf0
nop
lea r8, [rsp + 0x20]
lea rdx, [r14 + 0x5d8]
lea rcx, [rsp + 0x28]
call fcn.140003ec0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x98]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004c6af
cmp dword [rbx + 0x10], 0
jl 0x14004c69d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004c69d
call fcn.1400031e0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14004c68f
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x98], rax
jmp 0x14004c6af
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x98]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c6d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c6f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x88]
mov r8, rdi
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.14004bdf0
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004c732
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14004c73b
call fcn.14002bb20
test eax, eax
jne 0x14004c762
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.1400222b0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rsi, rbp
cmp qword [r13 + 0x1a8], rbp
jle 0x14004c92d
test rsi, rsi
js 0x14004c927
cmp rsi, qword [r13 + 0x1a8]
jge 0x14004c927
mov rax, qword [r13 + 0x1a0]
mov rbx, qword [rax + rsi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14004c7b7
cmp rax, qword [rbx - 0x18]
jne 0x14004c7b7
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x14004c7f3
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14004c921
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140080540
lea rbx, [rdi + 0x18]
cmp dword [rbx - 0x10], 0
jl 0x14004c81b
lea rdx, str.PCL6
mov rcx, rbx
call fcn.1400804d0
test rax, rax
je 0x14004c81b
sub rax, rbx
sar rax, 1
test eax, eax
jns 0x14004c853
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c837
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add ebp, 1
add rsi, 1
movsxd rax, ebp
cmp rax, qword [r13 + 0x1a8]
jge 0x14004c917
jmp 0x14004c772
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004c86f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.PCL6
lea rdx, str.PCL5e
lea rcx, [rsp + 0x88]
call fcn.1400140f0
lea r8, str.PCL6
lea rdx, str.PCL5e
lea rcx, [rsp + 0x90]
call fcn.1400140f0
mov rdi, qword [rsp + 0x88]
mov r8, rdi
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.14004bdf0
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004c8e5
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14004c8ee
call fcn.14002bb20
test eax, eax
jne 0x14004c92d
mov rbx, qword [rsp + 0x90]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.1400222b0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14004c92d
mov rdi, qword [rsp + 0x88]
jmp 0x14004c92d
call fcn.1400019f0
int3
call fcn.14006766c
int3
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.1400223e0
cmp eax, 1
jne 0x14004c959
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r8, rdi
mov rdx, 0xffffffff80000001
mov rcx, r13
call fcn.14004bdf0
mov rdx, rdi
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004c98f
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x98]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.1400222b0
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000001
call fcn.1400223e0
cmp eax, 1
jne 0x14004c9e3
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ca08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004ca2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14004ca51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret