Function at 0x14000d0d0
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x338
lea rbp, [rsp + 0x60]
mov rax, qword [0x1400a3318]
xor rax, rbp
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 8], r9d
mov qword [rbp + 0x30], r8
mov r14, rdx
mov r12, rcx
xor r15d, r15d
mov ebx, r15d
mov qword [rbp + 0x10], rbx
mov esi, r15d
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
mov r13d, r15d
mov dword [rbp + 0x38], 1
mov eax, dword [rbp + 0x340]
mov dword [rbp + 0x3c], eax
call fcn.14000b420
mov edi, eax
test eax, eax
jns 0x14000d144
jmp 0x14000db23
cmp word [r14], 0x7d
je 0x14000daec
lea rdx, str.Delete
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
sete r15b
lea rdx, str.ForceRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x14000d18e
test r15d, r15d
je 0x14000d269
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000dae9
xor edi, edi
cmp dword [rbp + 8], edi
je 0x14000d269
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rdi
mov rcx, r14
movzx eax, word [r14]
jmp 0x14000d1db
cmp ax, 0x5c
je 0x14000d1e2
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x14000d1c3
jmp 0x14000d1eb
test rcx, rcx
jne 0x14000d93b
lea rdi, str.CLSID
mov rdx, qword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x14000d232
add rdi, 8
lea rax, [0x140064a40]
cmp rdi, rax
jl 0x14000d1f2
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x48], rax
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.14000c518
xor eax, eax
mov qword [rbp + 0x48], rax
test r15d, r15d
je 0x14000d269
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
xor r15d, r15d
test eax, eax
js 0x14000d975
mov rdx, r14
mov rcx, r12
call fcn.14000f76c
mov edi, eax
test eax, eax
js 0x14000daec
jmp 0x14000d8dc
lea rdx, str.NoRemove
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x14000d29f
mov dword [rbp + 0x38], r15d
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000daec
lea rdx, [0x140067460]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d411
lea rdx, [rbp + 0xb0]
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000daec
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000daec
cmp word [r14], 0x3d
jne 0x14000d9de
cmp dword [rbp + 8], r15d
je 0x14000d356
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r15
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x60], rax
mov byte [rsp + 0x20], r15b
mov r9, r14
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x60]
mov rcx, r12
call fcn.140005aa0
mov edi, eax
mov qword [rbp + 0x60], r15
test eax, eax
jns 0x14000d8dc
test rsi, rsi
je 0x14000d351
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
jmp 0x14000d990
xor eax, eax
cmp dword [rbp + 0x340], eax
jne 0x14000d3f7
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], r15
mov qword [rbp], r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000d9ce
mov r15, qword [rbp]
mov qword [rbp + 0x90], r15
lea rdx, [rbp + 0xb0]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov edi, eax
test eax, 0xfffffffd
jne 0x14000d99a
test r15, r15
je 0x14000d3f7
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor r15d, r15d
mov qword [rbp + 0x90], r15
mov rdx, r14
mov rcx, r12
call fcn.14000f76c
mov edi, eax
test eax, eax
js 0x14000daec
jmp 0x14000d144
mov rcx, r14
movzx eax, word [r14]
jmp 0x14000d432
cmp ax, 0x5c
je 0x14000d439
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
movzx eax, word [rax]
test ax, ax
jne 0x14000d41a
jmp 0x14000d442
test rcx, rcx
jne 0x14000da18
cmp dword [rbp + 8], r15d
je 0x14000d5e5
mov qword [rbp], r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r14
mov rdi, qword [rbp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d4a7
mov eax, r15d
test rsi, rsi
je 0x14000d497
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
mov rsi, qword [rbp]
mov qword [rbp + 0x18], rsi
test eax, eax
je 0x14000d56d
mov qword [rbp], r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d4fa
mov eax, r15d
test rsi, rsi
je 0x14000d4ee
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
mov rsi, qword [rbp]
mov qword [rbp + 0x18], rsi
test eax, eax
je 0x14000d56d
mov qword [rbp], r15
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000da52
mov eax, r15d
test rsi, rsi
je 0x14000d55d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
mov rsi, qword [rbp]
mov qword [rbp + 0x18], rsi
test eax, eax
jne 0x14000da52
movzx eax, word [r14]
sub ax, 0x4c
mov ecx, 0xffdf
test cx, ax
jne 0x14000d5a4
lea rdx, str.LocalServer32
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
movzx r15d, r15b
test eax, eax
mov eax, 1
cmove r15d, eax
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000dae9
cmp word [r14], 0x3d
jne 0x14000d8d9
mov byte [rsp + 0x20], r15b
mov r9, r14
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, r12
call fcn.140005aa0
xor r15d, r15d
mov edi, eax
jmp 0x14000d25c
mov r15d, dword [rbp + 0x340]
xor edi, edi
test r15d, r15d
jne 0x14000d654
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d646
mov eax, edi
test rsi, rsi
je 0x14000d63a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], rdi
mov rsi, qword [rbp]
mov qword [rbp + 0x18], rsi
test eax, eax
je 0x14000d654
mov eax, 1
mov r15d, eax
mov dword [rbp + 0x340], eax
test r13, r13
jne 0x14000d6af
mov ecx, 0x208
call fcn.140010600
test al, al
je 0x14000d67d
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea r13, [rsp + 0x60]
mov eax, dword [r13]
jmp 0x14000d6a6
mov ecx, 0x218
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14000d698
mov r13, rdi
jmp 0x14000d6a6
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 0x10], rax
lea r13, [rax + 0x10]
test r13, r13
je 0x14000da89
mov r8d, 0x104
mov rdx, r14
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
nop dword [rax + rax]
test r15d, r15d
jne 0x14000d72b
mov dword [rbp], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
js 0x14000d71b
cmp dword [rbp], edi
ja 0x14000d72b
mov rdx, rsi
call fcn.14000842c
test eax, eax
je 0x14000d85e
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000dae9
mov rdx, r14
mov rcx, r12
call fcn.14000f76c
mov edi, eax
xor eax, eax
test edi, edi
js 0x14000dae9
cmp word [r14], 0x7b
jne 0x14000d7ab
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.14000d0d0
mov edi, eax
xor eax, eax
test edi, edi
js 0x14000dae9
test r15d, r15d
je 0x14000d7b4
mov eax, dword [rbp + 0x3c]
mov dword [rbp + 0x340], eax
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
xor r15d, r15d
test eax, eax
js 0x14000daec
jmp 0x14000d3f7
test r15d, r15d
jne 0x14000d933
mov dword [rbp], eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
js 0x14000d855
cmp dword [rbp], ecx
jbe 0x14000d855
lea rdi, str.CLSID
xor r15d, r15d
mov rdx, qword [rdi]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
nop dword [rax + rax]
test eax, eax
je 0x14000d845
add rdi, 8
lea rax, [0x140064a40]
cmp rdi, rax
jl 0x14000d80f
mov rdx, r13
lea rcx, [rbp + 0x18]
call fcn.14000c518
mov rsi, qword [rbp + 0x18]
mov rdx, r14
mov rcx, r12
call fcn.14000b420
jmp 0x14000d402
test r15d, r15d
jne 0x14000d933
xor r15d, r15d
test rsi, rsi
je 0x14000d884
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov esi, r15d
mov qword [rbp + 0x18], r15
test eax, eax
jne 0x14000dac5
cmp dword [rbp + 0x38], r15d
je 0x14000d8b4
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r15
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x78], rax
mov rdx, r13
lea rcx, [rbp + 0x78]
call fcn.140007fe8
mov qword [rbp + 0x78], r15
mov rdx, r14
mov rcx, r12
call fcn.14000b420
mov edi, eax
test eax, eax
js 0x14000daec
mov rdx, r14
mov rcx, r12
call fcn.14000f76c
jmp 0x14000d5de
xor r15d, r15d
mov ecx, dword [rbp + 8]
test ecx, ecx
je 0x14000d144
cmp word [r14], 0x7b
jne 0x14000d144
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r15w
jne 0x14000d8f6
mov edx, 1
cmp rax, rdx
jne 0x14000d144
mov dword [rsp + 0x20], r15d
mov r9d, ecx
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.14000d0d0
mov edi, eax
test eax, eax
js 0x14000daec
jmp 0x14000d845
xor r15d, r15d
jmp 0x14000d144
test rsi, rsi
je 0x14000d953
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], rdi
jmp 0x14000d96b
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000d955
jmp 0x14000dae2
jmp 0x14000daec
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000d97a
jmp 0x14000db21
test edi, edi
jle 0x14000d9a7
movzx edi, di
or edi, 0x80070000
test r15, r15
je 0x14000dae9
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor r15d, r15d
mov qword [rbp + 0x90], r15
jmp 0x14000daec
jle 0x14000d9d9
movzx edi, ax
or edi, 0x80070000
jmp 0x14000daec
test rsi, rsi
je 0x14000d9f6
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
jmp 0x14000da0e
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000d9f8
jmp 0x14000dae2
test rsi, rsi
je 0x14000da30
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
jmp 0x14000da48
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000da32
jmp 0x14000dae2
test rsi, rsi
je 0x14000da6a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
jmp 0x14000da82
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000da6c
jmp 0x14000dae2
test rsi, rsi
je 0x14000daa1
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], rdi
jmp 0x14000dab9
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000daa3
mov eax, 0x8007000e
jmp 0x14000db23
jmp 0x14000dadd
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000dac7
mov eax, 0x80020009
jmp 0x14000db23
xor r15d, r15d
test rsi, rsi
je 0x14000db04
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
jmp 0x14000db1c
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
jne 0x14000db06
mov eax, edi
mov rcx, qword [rbp + 0x2c0]
xor rcx, rbp
call fcn.140002290
lea rsp, [rbp + 0x2d8]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret