Function at 0x14009f810
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0xd0]
cmp dword [rbx + 8], 0
je 0x14009fc5f
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009fc5f
cmp byte [rbx + 0x28], 0
jne 0x14009fc5f
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009fc5f
mov rax, qword [rsi]
mov qword [rbp + 0x17], rax
lock inc dword [rax]
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x67]
call fcn.14009d280
nop
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x29]
call fcn.14009ceb0
mov rsi, rax
mov rbx, qword [rdi + 0xd0]
xor r12d, r12d
cmp dword [rbx + 8], r12d
je 0x14009f8ce
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009f8ce
cmp byte [rbx + 0x28], r12b
jne 0x14009f8ce
lea rcx, [rbx + 0x10]
call fcn.14009ce20
mov rbx, rax
jmp 0x14009f8d1
mov rbx, r12
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.140012e50
mov rdx, rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, r12
test eax, eax
cmove rbx, qword [rbp - 9]
mov rcx, qword [rbp - 0x29]
lock dec dword [rcx]
jne 0x14009f917
mov rcx, qword [rbp - 0x29]
call fcn.140012a00
test rbx, rbx
je 0x14009f95a
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0xf]
call fcn.14009d150
nop
mov rcx, rax
call fcn.140012e50
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov rax, qword [rbp + 0xf]
lock dec dword [rax]
jne 0x14009f951
mov rcx, qword [rbp + 0xf]
call fcn.140012a00
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rdi + 0xd0]
cmp dword [rbx + 8], 0
je 0x14009f989
lea rcx, [rbx + 0x10]
call fcn.14009ce20
test rax, rax
je 0x14009f989
cmp byte [rbx + 0x28], 0
jne 0x14009f989
lea rcx, [rbx + 0x10]
call fcn.14009ce20
mov rbx, rax
jmp 0x14009f98c
mov rbx, r12
mov qword [rbp - 0x19], r12
lea rcx, [rbp + 0x67]
call fcn.140012e50
mov rdx, rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009fc4b
mov r14, qword [rbp - 0x19]
test r14, r14
je 0x14009fc4b
mov rcx, r14
call fcn.14009f590
mov r11, qword [rbp + 0x67]
cmp dword [r11 + 8], 0
jne 0x14009fb90
mov r8d, 1
mov rdx, r14
lea rcx, [rbp + 0x7f]
call fcn.14009ed40
nop
mov rax, qword [rbp + 0x7f]
mov r13, r12
mov ecx, dword [rax + 0xc]
sub ecx, dword [rax + 8]
test ecx, ecx
jle 0x14009fb37
nop dword [rax + rax]
movsxd rcx, dword [rax + 8]
add rcx, r13
mov rax, qword [rax + rcx*8 + 0x18]
mov qword [rbp + 0x77], rax
lock inc dword [rax]
lea rcx, [rbp + 0x77]
call fcn.140012e50
mov rdx, rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14009fb0c
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.14009cf30
nop
lea rdx, [rbp - 0x39]
mov rcx, rax
call fcn.140012020
mov rdi, rax
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x77]
call fcn.140012020
mov rbx, rax
mov rcx, qword [rdi]
mov edx, dword [rcx]
cmp edx, 1
jne 0x14009fa82
mov rdx, qword [rdi]
lea rcx, [rdx + 0x18]
cmp qword [rdx + 0x10], rcx
je 0x14009fa90
mov rcx, qword [rdi]
mov edx, dword [rcx + 8]
mov rcx, rdi
call fcn.14000cc90
mov rax, qword [rdi]
mov rdi, qword [rax + 0x10]
mov rax, qword [rbx]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x14009faae
mov rcx, qword [rbx]
lea rax, [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x14009fabc
mov rax, qword [rbx]
mov edx, dword [rax + 8]
mov rcx, rbx
call fcn.14000cc90
mov rax, qword [rbx]
mov r8, rdi
mov rdx, qword [rax + 0x10]
lea rcx, [0x1415a6de0]
call fcn.14001b2c0
nop
mov rax, qword [rbp + 7]
lock dec dword [rax]
jne 0x14009fae6
mov rcx, qword [rbp + 7]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x39]
lock dec dword [rax]
jne 0x14009faf9
mov rcx, qword [rbp - 0x39]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x31]
lock dec dword [rax]
jne 0x14009fb0c
mov rcx, qword [rbp - 0x31]
call fcn.140012a00
nop
mov rax, qword [rbp + 0x77]
lock dec dword [rax]
jne 0x14009fb1e
mov rcx, qword [rbp + 0x77]
call fcn.140012a00
inc r12d
inc r13
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rax + 0xc]
sub ecx, dword [rax + 8]
cmp r12d, ecx
jl 0x14009fa10
lock dec dword [rax]
jne 0x14009fc41
mov rdi, qword [rbp + 0x7f]
movsxd rax, dword [rdi + 0xc]
lea rbx, [rdi + rax*8 + 0x18]
movsxd rax, dword [rdi + 8]
lea r12, [rdi + rax*8 + 0x18]
cmp r12, rbx
je 0x14009fb79
nop dword [rax + rax]
sub rbx, 8
mov rcx, qword [rbx]
lock dec dword [rcx]
jne 0x14009fb74
mov rcx, qword [rbx]
call fcn.140012a00
cmp rbx, r12
jne 0x14009fb60
mov eax, dword [rdi]
test eax, eax
jne 0x14009fc41
mov rcx, rdi
call fcn.14000c4e0
jmp 0x14009fc41
lea rcx, [rbp + 0x67]
call fcn.140012e50
mov rbx, rax
mov rcx, rdi
call fcn.14009d000
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14009fc41
mov edx, eax
lea rcx, [rbp - 1]
call fcn.14009cf30
nop
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.140012020
mov rbx, rax
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x67]
call fcn.140012020
mov rdi, rax
mov rcx, rbx
call fcn.140001050
mov rbx, rax
mov rcx, rdi
call fcn.140001050
mov rdx, rax
mov r8, rbx
lea rcx, [0x1415a6db0]
call fcn.14001b2c0
nop
mov rax, qword [rbp - 0x21]
lock dec dword [rax]
jne 0x14009fc1c
mov rcx, qword [rbp - 0x21]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 0x11]
lock dec dword [rax]
jne 0x14009fc2f
mov rcx, qword [rbp - 0x11]
call fcn.14000c4e0
nop
mov rax, qword [rbp - 1]
lock dec dword [rax]
jne 0x14009fc41
mov rcx, qword [rbp - 1]
call fcn.140012a00
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x67]
lock dec dword [rax]
jne 0x14009fc6c
mov rcx, qword [rbp + 0x67]
call fcn.140012a00
jmp 0x14009fc6c
mov edx, 1
mov rcx, rdi
call fcn.140082d20
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret