Function at 0x14001b9a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.Tool_RemoveRegistry
lea rcx, [rbp - 0x11]
call fcn.140017fc0
nop
mov r9, rbx
lea r8, str.szRegPath___s
mov edx, 1
lea rcx, [rbp - 0x11]
call fcn.140017c80
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor r11d, r11d
mov qword [rbp - 0x19], r11
mov dword [rbp - 1], r11d
mov dword [rbp + 0x7f], r11d
mov dword [rbp + 0x77], r11d
mov dword [rbp + 3], r11d
mov dword [rbp + 0xf], r11d
mov dword [rbp + 0x17], r11d
mov dword [rbp + 0x1b], r11d
mov dword [rbp + 0x13], r11d
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bc78
lea rax, [rbp + 0x27]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x13]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1b]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 3]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14001bad5
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
lea r8, str.return___08x
lea edx, [r9 + 1]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
jmp 0x14001bcc2
cmp dword [rbp + 0x7f], 0
jne 0x14001baf6
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001bc53
mov ecx, dword [rbp + 0x77]
inc ecx
add rcx, rcx
call fcn.140196f10
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [rbp + 0x77]
lea ecx, [rax + rdi + 2]
add rcx, rcx
call fcn.140196f10
mov qword [rbp + 7], rax
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
je 0x14001bc2a
nop dword [rax]
lea ecx, [rdi + 1]
mov dword [rbp - 1], ecx
lea edx, [rbx - 1]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 1]
mov r8, rsi
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001bb91
mov r9, rsi
mov r8, qword [rbp + 0x6f]
lea rdx, str._s_s
mov rdi, qword [rbp + 7]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rdi
mov rcx, qword [rbp + 0x67]
call fcn.14001b9a0
test eax, eax
je 0x14001bba5
jmp 0x14001bb98
cmp eax, 0x103
jne 0x14001bbe7
dec ebx
je 0x14001bc2a
mov edi, dword [rbp + 0x77]
jmp 0x14001bb30
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.140196ed0
mov rcx, rdi
call fcn.140196ed0
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
lea rcx, [rbp - 0x11]
call fcn.140018150
xor eax, eax
jmp 0x14001bcd0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.140196ed0
mov rcx, qword [rbp + 7]
call fcn.140196ed0
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
lea rcx, [rbp - 0x11]
call fcn.140018150
xor eax, eax
jmp 0x14001bcd0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rsi
call fcn.140196ed0
mov rcx, qword [rbp + 7]
call fcn.140196ed0
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
lea rcx, [rbp - 0x11]
call fcn.140018150
xor eax, eax
jmp 0x14001bcd0
cmp eax, 2
je 0x14001bca7
cmp eax, 3
je 0x14001bca7
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
lea rcx, [rbp - 0x11]
call fcn.140018150
xor eax, eax
jmp 0x14001bcd0
mov r9d, 1
lea r8, str.return___08x
lea edx, [r9 + 1]
lea rcx, [rbp - 0x11]
call fcn.140017c80
nop
lea rcx, [rbp - 0x11]
call fcn.140018150
mov eax, 1
add rsp, 0xb8
pop rdi
pop rsi
pop rbx
pop rbp
ret