Function at 0x140005878
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f8
lea rbp, [rsp + 0x60]
mov rax, qword [0x1400153a0]
xor rax, rbp
mov qword [rbp + 0x280], rax
mov dword [rbp + 8], r9d
mov qword [rbp + 0x10], r8
mov r14, rdx
mov r12, rcx
xor eax, eax
mov ebx, eax
mov qword [rbp + 0x60], rax
mov esi, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov r13d, eax
mov dword [rbp + 0x18], 1
mov eax, dword [rbp + 0x300]
mov dword [rbp + 0x38], eax
call fcn.140004c34
mov edi, eax
test eax, eax
jns 0x1400058e9
jmp 0x140006212
cmp word [r14], 0x7d
je 0x140005b68
lea rdx, str.Delete
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
xor edi, edi
mov r15d, edi
test eax, eax
sete r15b
lea rdx, str.ForceRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140005938
test r15d, r15d
je 0x140005a04
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
xor edi, edi
cmp dword [rbp + 8], edi
je 0x140005a04
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rcx, r14
movzx eax, word [r14]
jmp 0x140005985
cmp ax, 0x5c
je 0x14000598c
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x14000596d
jmp 0x140005995
test rcx, rcx
jne 0x14000607f
lea rdi, str.CLSID
mov rdx, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x1400059d6
add rdi, 8
lea rax, [0x140010600]
cmp rdi, rax
jl 0x14000599c
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.1400051a8
xor edi, edi
test r15d, r15d
je 0x140005a04
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x1400060b2
mov rdx, r14
mov rcx, r12
call fcn.140006870
mov edi, eax
jmp 0x14000601d
lea rdx, str.NoRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x140005a38
mov dword [rbp + 0x18], edi
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
xor edi, edi
lea rdx, [0x1400111e0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x140005b82
lea rdx, [rbp + 0x70]
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005b68
cmp word [r14], 0x3d
jne 0x140006111
xor edi, edi
cmp dword [rbp + 8], edi
je 0x140005ae1
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov byte [rsp + 0x20], dil
mov r9, r14
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x20]
mov rcx, r12
call fcn.140002bec
mov edi, eax
test eax, eax
jns 0x140006025
test rsi, rsi
je 0x140005adc
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x1400060c9
cmp dword [rbp + 0x300], ecx
jne 0x140005b53
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400060fd
mov r15, qword [rbp]
lea rdx, [rbp + 0x70]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov edi, eax
test eax, 0xfffffffd
jne 0x1400060d3
test r15, r15
je 0x140005b53
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, r14
mov rcx, r12
call fcn.140006870
mov edi, eax
test eax, eax
jns 0x1400058e9
test rsi, rsi
je 0x140005b7d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000620b
mov rcx, r14
movzx eax, word [r14]
jmp 0x140005ba3
cmp ax, 0x5c
je 0x140005baa
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140005b8b
jmp 0x140005bb3
test rcx, rcx
jne 0x140006144
cmp dword [rbp + 8], edi
je 0x140005d47
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r14
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x140005c16
mov eax, r15d
test rsi, rsi
je 0x140005c06
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005cd4
mov qword [rbp], r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005c65
mov eax, r15d
test rsi, rsi
je 0x140005c59
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005cd4
mov qword [rbp], r15
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006174
mov eax, r15d
test rsi, rsi
je 0x140005cc4
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
jne 0x140006174
movzx eax, word [r14]
sub ax, 0x4c
mov ecx, 0xffdf
test cx, ax
jne 0x140005d0b
lea rdx, str.LocalServer32
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
movzx r15d, r15b
test eax, eax
mov eax, 1
cmove r15d, eax
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
cmp word [r14], 0x3d
jne 0x140006025
mov byte [rsp + 0x20], r15b
mov r9, r14
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.140002bec
jmp 0x14000601b
mov r15d, dword [rbp + 0x300]
test r15d, r15d
jne 0x140005db0
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005da2
mov eax, edi
test rsi, rsi
je 0x140005d96
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rbp]
mov qword [rbp + 0x40], rsi
test eax, eax
je 0x140005db0
mov eax, 1
mov r15d, eax
mov dword [rbp + 0x300], eax
test r13, r13
jne 0x140005e0b
mov ecx, 0x208
call fcn.140006dc0
test al, al
je 0x140005dd9
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea r13, [rsp + 0x60]
mov eax, dword [r13]
jmp 0x140005e02
mov ecx, 0x218
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x140005df4
mov r13, rdi
jmp 0x140005e02
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 0x60], rax
lea r13, [rax + 0x10]
test r13, r13
je 0x1400061a4
mov r8d, 0x104
mov rdx, r14
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
test r15d, r15d
jne 0x140005e87
mov dword [rbp], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
js 0x140005e77
cmp dword [rbp], edi
ja 0x140005e87
mov rdx, rsi
call fcn.14000439c
test eax, eax
je 0x140005fb6
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
mov rdx, r14
mov rcx, r12
call fcn.140006870
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005b68
cmp word [r14], 0x7b
jne 0x140005f04
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.140005878
mov edi, eax
xor ecx, ecx
test eax, eax
js 0x140005b68
test r15d, r15d
je 0x140005f0d
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x300], eax
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
jmp 0x140005b53
test r15d, r15d
jne 0x1400058e9
mov dword [rbp], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
js 0x140005fab
cmp dword [rbp], ecx
jbe 0x140005fab
lea rdi, str.CLSID
mov rdx, qword [rdi]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x140005f9b
add rdi, 8
lea rax, [0x140010600]
cmp rdi, rax
jl 0x140005f65
mov rdx, r13
lea rcx, [rbp + 0x40]
call fcn.1400051a8
mov rsi, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r12
call fcn.140004c34
jmp 0x140005b5e
test r15d, r15d
jne 0x1400058e9
xor edi, edi
test rsi, rsi
je 0x140005fd9
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, rdi
mov qword [rbp + 0x40], rdi
test eax, eax
jne 0x1400061d9
cmp dword [rbp + 0x18], edi
je 0x140005ffb
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov rdx, r13
lea rcx, [rbp + 0x20]
call fcn.140004288
nop
mov rdx, r14
mov rcx, r12
call fcn.140004c34
mov edi, eax
test eax, eax
js 0x140005b68
mov rdx, r14
mov rcx, r12
call fcn.140006870
mov edi, eax
test eax, eax
js 0x140005b68
mov ecx, dword [rbp + 8]
xor edx, edx
test ecx, ecx
je 0x1400058e9
cmp word [r14], 0x7b
jne 0x1400058e9
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], dx
jne 0x140006041
mov edx, 1
cmp rax, rdx
jne 0x1400058e9
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.140005878
mov edi, eax
test eax, eax
js 0x140005b68
jmp 0x140005f9b
test rsi, rsi
je 0x140006094
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x1400060a8
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140006096
jmp 0x1400061f2
jmp 0x140005b68
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400060b7
jmp 0x140006210
test eax, eax
jle 0x1400060e0
movzx edi, ax
or edi, 0x80070000
test r15, r15
je 0x140005b68
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140005b68
jle 0x140005b68
movzx edi, ax
or edi, 0x80070000
jmp 0x140005b68
test rsi, rsi
je 0x140006126
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000613a
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x140006128
jmp 0x1400061f2
test rsi, rsi
je 0x140006159
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000616d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000615b
jmp 0x1400061f2
test rsi, rsi
je 0x140006189
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14000619d
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000618b
jmp 0x1400061f2
test rsi, rsi
je 0x1400061b9
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x1400061cd
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400061bb
mov eax, 0x8007000e
jmp 0x140006212
jmp 0x1400061ed
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400061db
mov eax, 0x80020009
jmp 0x140006212
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x1400061f9
mov eax, edi
mov rcx, qword [rbp + 0x280]
xor rcx, rbp
call fcn.140001830
lea rsp, [rbp + 0x298]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret