Function at 0x10000105a
Capabilities:
Delete registry key
Delete registry value

Disassembly:
jmp 0x1000150a8
push rbx
push rbp
push rsi
push rdi
mov eax, 0x22c8
call fcn.100024500
sub rsp, rax
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov rax, rcx
mov qword [rsp + 0x70], rcx
mov ecx, dword [rsp + 0x2310]
mov dword [rsp + 0x90], ecx
xor ebx, ebx
mov rcx, rax
mov dword [rsp + 0x7c], r9d
mov qword [rsp + 0x80], r8
mov rbp, rdx
mov qword [rsp + 0x68], rbx
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001584a
cmp word [rbp], 0x7d
je 0x100015848
mov eax, 1
lea rdx, [0x10000ad30]
mov rcx, rbp
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
test eax, eax
lea rdx, [0x10000ad58]
mov rcx, rbp
sete dil
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100015157
test edi, edi
je 0x10001521f
mov rdi, qword [rsp + 0x70]
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
cmp dword [rsp + 0x7c], 0
je 0x100015224
movzx eax, word [rbp]
mov rcx, rbp
jmp 0x100015197
cmp ax, 0x5c
je 0x10001519e
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x100015185
jmp 0x1000151a7
test rcx, rcx
jne 0x1000157bc
lea rdi, [0x10000b040]
mov rdx, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000151ee
lea rax, [0x10000b0a0]
add rdi, 8
cmp rdi, rax
jl 0x1000151ae
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
mov rdx, rbp
mov qword [rsp + 0x88], rax
call fcn.1000014bf
cmp dword [rsp + 0x60], 0
mov rdi, qword [rsp + 0x70]
je 0x100015224
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
mov rdx, rbp
mov rcx, rdi
call fcn.1000013d9
jmp 0x10001549f
mov rdi, qword [rsp + 0x70]
lea rdx, [0x10000ad40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100015251
and dword [rsp + 0x78], eax
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
lea rdx, [0x10000ad78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10001536a
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
cmp word [rbp], 0x3d
jne 0x1000157bc
xor esi, esi
cmp dword [rsp + 0x7c], esi
je 0x1000152db
mov rax, qword [rsp + 0x80]
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x88]
mov r9, rbp
mov rcx, rdi
mov qword [rsp + 0x88], rax
call fcn.100001190
jmp 0x10001549f
cmp dword [rsp + 0x2310], esi
jne 0x100015350
cmp dword [rsp + 0x78], esi
je 0x100015350
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x60]
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100015831
mov rdi, qword [rsp + 0x60]
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10001533d
cmp eax, 2
jne 0x1000157d1
cmp rdi, rsi
je 0x10001534b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x70]
mov rdx, rbp
mov rcx, rdi
call fcn.1000013d9
test eax, eax
mov esi, eax
js 0x10001583a
jmp 0x1000157ac
movzx eax, word [rbp]
mov rcx, rbp
jmp 0x100015385
cmp ax, 0x5c
je 0x10001538c
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x100015373
jmp 0x100015395
test rcx, rcx
jne 0x1000157bc
cmp dword [rsp + 0x7c], 0
je 0x1000154fc
mov rsi, qword [rsp + 0x80]
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000153ed
test rbx, rbx
je 0x1000153df
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
je 0x10001546b
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100015432
test rbx, rbx
je 0x100015424
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
je 0x10001546b
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8, rbp
mov rdx, rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call fcn.100001758
test eax, eax
jne 0x1000157ea
mov rbx, qword [rsp + 0x68]
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
cmp word [rbp], 0x3d
jne 0x1000154a9
lea rdx, [rsp + 0x68]
mov r9, rbp
xor r8d, r8d
mov rcx, rdi
call fcn.100001190
mov rbx, qword [rsp + 0x68]
test eax, eax
mov esi, eax
js 0x10001583a
cmp word [rbp], 0x7b
jne 0x1000157ac
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x1000157ac
mov r9d, dword [rsp + 0x7c]
and dword [rsp + 0x20], 0
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.10000105a
test eax, eax
mov esi, eax
js 0x10001583a
mov rdx, rbp
mov rcx, rdi
call fcn.1000013e3
jmp 0x10001535b
mov esi, dword [rsp + 0x2310]
test esi, esi
jne 0x100015553
mov rcx, qword [rsp + 0x80]
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov edi, eax
jne 0x100015558
test rbx, rbx
je 0x100015547
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
jmp 0x100015558
mov edi, 2
mov eax, 1
test edi, edi
lea rcx, [rsp + 0xa0]
cmovne esi, eax
mov r8, rbp
mov edx, 0x104
or r9, 0xffffffffffffffff
mov dword [rsp + 0x2310], esi
call sub.msvcrt.dll_wcsncpy_s
test eax, eax
je 0x1000155aa
cmp eax, 0xc
je 0x10001581d
cmp eax, 0x16
je 0x100015812
cmp eax, 0x22
je 0x100015812
cmp eax, 0x50
jne 0x100015807
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.1000013d9
test eax, eax
mov esi, eax
js 0x10001583a
cmp word [rbp], 0x7b
jne 0x10001563a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x10001563a
mov eax, dword [rsp + 0x2310]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
mov dword [rsp + 0x20], eax
call fcn.10000105a
test eax, eax
mov esi, eax
jns 0x100015623
cmp dword [rsp + 0x2310], 0
je 0x10001583a
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.1000013e3
test eax, eax
mov esi, eax
js 0x10001583a
cmp edi, 2
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2310], eax
je 0x1000157ac
test edi, edi
je 0x100015664
test eax, eax
jne 0x1000157ac
mov ecx, edi
jmp 0x100015833
xor edi, edi
cmp eax, edi
je 0x100015718
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x100015718
cmp dword [rsp + 0x60], edi
mov eax, edi
seta al
cmp eax, edi
je 0x100015718
lea rdi, [0x10000b040]
mov rdx, qword [rdi]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000157ac
lea rax, [0x10000b0a0]
add rdi, 8
cmp rdi, rax
jl 0x1000156c8
cmp dword [rsp + 0x78], 0
je 0x1000157ac
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.1000014bf
mov rbx, qword [rsp + 0x68]
jmp 0x1000157ac
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x100015766
cmp dword [rsp + 0x60], edi
seta dil
test rbx, rbx
je 0x100015783
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test eax, eax
mov qword [rsp + 0x68], rbx
jne 0x100015828
cmp dword [rsp + 0x78], 0
je 0x1000157ac
test edi, edi
jne 0x1000157ac
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x100015831
cmp word [rbp], 0x7d
je 0x10001583a
jmp 0x100015116
test rbx, rbx
je 0x1000157ca
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x10001584a
mov ecx, eax
call fcn.1000017cb
test rdi, rdi
mov esi, eax
je 0x10001583a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001583a
mov ecx, eax
call fcn.1000017cb
mov rcx, qword [rsp + 0x68]
test rcx, rcx
mov ebx, eax
je 0x100015803
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10001584a
mov ecx, 0x80004005
call fcn.10000110e
int3
mov ecx, 0x80070057
call fcn.10000110e
int3
mov ecx, 0x8007000e
call fcn.10000110e
int3
mov ecx, eax
call fcn.1000017cb
jmp 0x10001584a
mov ecx, eax
call fcn.1000017cb
mov esi, eax
test rbx, rbx
je 0x100015848
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x22c8
pop rdi
pop rsi
pop rbp
pop rbx
ret