Function at 0x140018f10
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x308
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov ebp, r9d
mov byte [rsp + 0x21], r8b
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x20], 0
xor eax, eax
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rsp + 0x60], rsi
lea rcx, [0x140067960]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp ebp, 0x400
jne 0x140018fa1
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 8
jne 0x140018fbf
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 4
jne 0x140018fdd
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x2000
jne 0x140018ffe
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x40
jne 0x14001901c
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x80
jne 0x14001903d
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x100
jne 0x14001905e
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x200
jne 0x14001907f
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x800
jne 0x1400190a0
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
cmp ebp, 0x10
jne 0x1400190be
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, 1
jmp 0x1400195eb
lea rcx, str.parseRegistry:_n
call fcn.1400154e0
mov ecx, ebp
call fcn.140015680
lea rdx, [0x140062e94]
mov rax, qword [rsp + 0x48]
test rax, rax
cmovne rdx, rax
lea rcx, str.parseRegistry:_Registry_rootkeypath_S_n
call fcn.1400154e0
mov r11, qword [rbx]
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call qword [r11 + 0x160]
test eax, eax
js 0x140019232
cmp word [rsp + 0x70], 1
je 0x140019232
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x140019148
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rsi, rax
mov qword [rsp + 0x60], rax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
jne 0x14001915a
xor eax, eax
jmp 0x140019163
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, 5
jbe 0x1400191a8
mov r8d, 5
lea rdx, str.HKLM_
mov rcx, rsi
call fcn.14004f0e4
test eax, eax
jne 0x1400191a8
lea r9, [rsi + 0xa]
lea r8, [0x140067910]
mov edx, 0x12c
lea rcx, [rsp + 0x90]
call fcn.140039220
mov rbx, qword [rsp + 0x30]
jmp 0x140019269
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400191c3
lea rcx, str.ERROR:_parseRegistry:_no_rootKeyPath__n
call fcn.1400154e0
jmp 0x1400195c2
mov r9, rax
lea r8, [0x140067910]
mov edx, 0x12c
lea rcx, [rsp + 0x90]
call fcn.140039220
lea rcx, [rsp + 0x90]
call fcn.140036f80
cmp word [rsp + rax*2 + 0x90], 0x5c
je 0x140019216
cmp word [rsi], 0x5c
je 0x140019216
lea r8, [0x140063c7c]
mov edx, 0x12c
lea rcx, [rsp + 0x90]
call fcn.140038380
mov r8, rsi
mov edx, 0x12c
lea rcx, [rsp + 0x90]
call fcn.140038380
mov rbx, qword [rsp + 0x30]
jmp 0x140019269
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14001924d
lea rcx, str.ERROR:_parseRegistry:_no_rootKeyPath__n
call fcn.1400154e0
jmp 0x1400195c2
mov r9, rax
lea r8, [0x140067910]
mov edx, 0x12c
lea rcx, [rsp + 0x90]
call fcn.140039220
lea rdx, [rsp + 0x90]
lea rcx, str.Registry_key_path_set_to__S_n
call fcn.1400154e0
mov eax, ebp
and eax, 1
mov dword [rsp + 0x5c], eax
je 0x1400192c8
lea rdx, [rsp + 0x90]
mov rcx, 0xffffffff80000002
call fcn.140039650
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400192c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, str.ERROR:_parseRegistry:_Failed_to_open_or_create__S:__u_n
call fcn.1400154e0
jmp 0x1400195b0
mov rax, qword [rbx]
lea rdx, [rsp + 0x24]
mov rcx, rbx
call qword [rax + 0xb0]
test eax, eax
js 0x1400194bb
cmp word [rsp + 0x24], 0xffff
jne 0x1400194bb
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 0x60]
test eax, eax
js 0x1400194aa
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400194aa
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x48]
test eax, eax
js 0x1400194c0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400194c0
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x50]
test eax, eax
js 0x1400194c0
cmp dword [rsp + 0x58], 1
jne 0x140019420
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140019379
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [0x1400666f8]
call qword [rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [rax + 0x38]
test eax, eax
js 0x140019484
lea rdx, str.Value
mov rcx, qword [rsp + 0x38]
call fcn.14004d5a4
test eax, eax
jne 0x1400193c9
mov r9d, ebp
movzx r8d, byte [rsp + 0x21]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x90]
call fcn.140017e00
mov byte [rsp + 0x20], al
test al, al
jne 0x1400193c9
cmp ebp, 2
jne 0x14001943a
lea rdx, str.Registry
mov rcx, qword [rsp + 0x38]
call fcn.14004d5a4
test eax, eax
jne 0x140019406
mov r9d, ebp
movzx r8d, byte [rsp + 0x21]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x90]
call fcn.140018f10
mov byte [rsp + 0x20], al
test al, al
jne 0x140019406
cmp ebp, 2
jne 0x14001945f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jne 0x14001942a
nop
mov rcx, qword [rsp + 0x40]
jmp 0x140019311
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
jmp 0x140019311
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400195b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400195b0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400195b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400195b0
lea rcx, str.ERROR:_parseRegistry:_Failed_to_get_child_elements_name_n
call fcn.1400154e0
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400195b0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400195b0
lea rcx, str.ERROR:_parseRegistry:_Failed_to_get_elements_child_nodes_n
call fcn.1400154e0
jmp 0x1400195b0
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400194d9
mov rcx, rax
call fcn.140039380
xor eax, eax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x21], 0
je 0x1400195b0
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400195b0
test rsi, rsi
je 0x1400195b0
cmp dword [rsp + 0x5c], 0
je 0x14001951a
mov rdx, qword [0x14008cd30]
lea rcx, [rsp + 0x90]
call fcn.140012320
mov byte [rsp + 0x20], al
cmp ebp, 2
jne 0x1400195b0
mov rdx, qword [0x14008cd30]
lea rcx, [rsp + 0x90]
call fcn.140012360
mov byte [rsp + 0x20], al
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.14000e600
test eax, eax
jne 0x1400195b0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.1400393b0
mov rbp, rax
test rax, rax
je 0x1400195b0
call fcn.140006520
mov rbx, rax
mov rcx, rax
call fcn.140006680
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x140019594
mov rdx, rsi
lea rcx, str.INFO:_parseRegistry:_Failed_to_delete_fully_dereferenced_tree__S_n
call fcn.1400154e0
mov rcx, rbp
call fcn.140039380
test rbx, rbx
je 0x1400195b0
cmp rbx, 0xffffffffffffffff
je 0x1400195b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400195c2
mov rcx, rax
call fcn.140039380
movzx ebx, byte [rsp + 0x20]
mov edx, ebx
lea rcx, str.parseRegistry:_exit_u_n
call fcn.1400154e0
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, bl
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x308
pop rdi
pop rsi
pop rbp
pop rbx
ret