Function at 0x14009f5f8
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rbx, rdx
mov r12, rcx
lea r14, section..data
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009f658
test byte [rcx + 0x1c], 1
je 0x14009f658
cmp byte [rcx + 0x19], 5
jb 0x14009f658
mov edx, reloc.OLEAUT32.dll_DispGetParam
mov dword [rsp + 0x20], 1
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400a09ec
xor r13d, r13d
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], r13
lea rcx, [rbp + 0x7f]
call fcn.1400096e0
nop
mov edi, r13d
mov dword [rsp + 0x20], r13d
or edx, 0xffffffff
mov r9d, edx
mov r8, rbx
lea rcx, str.00_00_00_00_00_00
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x14009fa51
mov rdx, rbx
lea rcx, [rbp + 0x7f]
call fcn.14000a900
lea rcx, [rbp + 0x7f]
call fcn.140007760
xor r8d, r8d
lea rdx, [rbp + 7]
mov rcx, r12
call fcn.14009f1d0
mov edi, eax
mov r10, qword [section..data]
cmp r10, r14
je 0x14009f6fc
test byte [r10 + 0x1c], 2
je 0x14009f6fc
cmp byte [r10 + 0x19], 4
jb 0x14009f6fc
lea edx, [r13 + 0x1c]
mov r9d, eax
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.1400438d8
mov r10, qword [section..data]
test edi, edi
jne 0x14009fa58
mov rbx, qword [rbp + 0x7f]
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.14009b370
mov esi, eax
mov r10, qword [section..data]
cmp r10, r14
je 0x14009f751
test byte [r10 + 0x1c], 2
je 0x14009f751
cmp byte [r10 + 0x19], 4
jb 0x14009f751
lea edx, [rdi + 0x1d]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.140049774
mov r10, qword [section..data]
cmp esi, 2
jne 0x14009f781
mov edi, 0x490
cmp r10, r14
je 0x14009fa92
test byte [r10 + 0x1c], sil
je 0x14009fa58
cmp byte [r10 + 0x19], 4
jb 0x14009fa58
lea edx, [rsi + 0x1c]
jmp 0x14009fa41
mov edi, esi
test esi, esi
jne 0x14009fa58
mov rdx, rbx
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009f7d0
test byte [rcx + 0x1c], 2
je 0x14009f7d0
cmp byte [rcx + 0x19], 4
jb 0x14009f7d0
lea edx, [rsi + 0x1f]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.140049774
mov rax, qword [r12]
movabs r10, 0x8ba916ea3852e270
mov rcx, r12
mov rax, qword [rax + 0x58]
call qword [case.0x140028cb6.0]
test rax, rax
je 0x14009f9f2
mov rax, qword [r12]
movabs r10, 0x8ba916ea3852e270
mov rcx, r12
mov rax, qword [rax + 0x58]
call qword [case.0x140028cb6.0]
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140017070
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
mov r9d, 0x2011f
mov r8, qword [rbp - 0x29]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x11]
call fcn.140005e00
mov r14d, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009f889
test byte [rcx + 0x1c], 2
je 0x14009f889
cmp byte [rcx + 0x19], 4
jb 0x14009f889
mov edx, 0x20
mov dword [rsp + 0x20], r14d
mov r9, qword [rbp - 0x29]
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.140049774
test r14d, r14d
jne 0x14009f9d0
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x11]
call fcn.1400239e8
mov r14d, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14009f8d9
test byte [rcx + 0x1c], 2
je 0x14009f8d9
cmp byte [rcx + 0x19], 4
jb 0x14009f8d9
mov edx, 0x21
mov r9d, r14d
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
test r14d, r14d
jne 0x14009f9d0
mov r14d, r13d
cmp dword [rbp - 0x19], r13d
jbe 0x14009f9d0
lea r12, section..data
mov qword [rbp + 0x1f], r13
mov qword [rbp + 0x27], r13
mov qword [rbp + 0x2f], r13
mov edx, r14d
lea rcx, [rbp - 0x21]
call fcn.14003a7f0
mov r9d, 0x2011f
mov r8, qword [rax]
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp + 0x1f]
call fcn.140005e00
mov esi, eax
mov rcx, qword [section..data]
cmp rcx, r12
je 0x14009f96d
test byte [rcx + 0x1c], 2
je 0x14009f96d
cmp byte [rcx + 0x19], 4
jb 0x14009f96d
mov edx, r14d
lea rcx, [rbp - 0x21]
call fcn.14003a7f0
mov r9, qword [rax]
mov rax, qword [section..data]
mov edx, 0x22
mov dword [rsp + 0x20], esi
lea r8, [0x1400afc70]
mov rcx, qword [rax + 0x10]
call fcn.140049774
test esi, esi
jne 0x14009f9b6
mov rdx, rbx
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, r12
je 0x14009f9b6
test byte [rcx + 0x1c], 2
je 0x14009f9b6
cmp byte [rcx + 0x19], 4
jb 0x14009f9b6
lea edx, [rsi + 0x23]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.140049774
lea rcx, [rbp + 0x1f]
call fcn.140006bec
inc r14d
cmp r14d, dword [rbp - 0x19]
jb 0x14009f8f6
mov r12, qword [rbp + 0x67]
lea rcx, [rbp - 0x21]
call fcn.14000aa8c
lea rcx, [rbp - 0x11]
call fcn.140006bec
lea rcx, [rbp - 0x29]
call fcn.1400043f0
lea r14, section..data
mov rax, qword [r12]
movabs r10, 0x9eac3e3734559970
mov edx, 0x3ea
mov rcx, r12
mov rax, qword [rax + 0x48]
call qword [case.0x140028cb6.0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.1400a163c
mov r10, qword [section..data]
cmp r10, r14
je 0x14009fa92
test byte [r10 + 0x1c], 2
je 0x14009fa58
cmp byte [r10 + 0x19], 4
jb 0x14009fa58
mov edx, 0x24
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.140045cf4
mov r10, qword [section..data]
cmp r10, r14
je 0x14009fa92
test byte [r10 + 0x1c], 1
je 0x14009fa92
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x14009fa92
mov edx, 0x25
mov r9d, edi
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.1400438d8
nop
lea rcx, [rbp + 0x7f]
call fcn.1400043f0
nop
lea rcx, [rbp + 7]
call fcn.140006bec
mov eax, edi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret