Function at 0x140029820
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x21c8]
mov eax, 0x22c8
call fcn.14002fa50
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x21b0], rax
mov dword [rsp + 0x44], r9d
mov qword [rsp + 0x68], r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x70], rcx
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
cmp word [rdi], 0x7d
je 0x1400299f2
mov eax, 1
mov dword [rsp + 0x40], eax
lea rdx, str.Delete
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
xor ecx, ecx
mov ebx, ecx
test eax, eax
sete bl
mov dword [rsp + 0x48], ebx
lea rdx, str.ForceRemove
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x140041a1e
test ebx, ebx
jne 0x140041a1e
xor ebx, ebx
lea rdx, str.NoRemove
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x140041b1d
lea rdx, [0x140095cd0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x140041b3d
mov edx, 0x5c
mov rcx, rdi
call fcn.14002a130
test rax, rax
jne 0x140041d9e
cmp dword [rsp + 0x44], ebx
jne 0x140041bf5
mov ebx, dword [rbp + 0x2210]
test ebx, ebx
jne 0x140041ced
mov r9d, 0x20019
mov r8, rdi
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14002a044
mov esi, eax
mov eax, ebx
test esi, esi
mov ecx, 1
cmovne eax, ecx
mov dword [rsp + 0x48], eax
or r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp - 0x60]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
test eax, eax
jne 0x140041cf7
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140029dcc
mov ebx, eax
xor ecx, ecx
test eax, eax
js 0x1400299f2
cmp word [rdi], 0x7b
jne 0x140029a19
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], cx
jne 0x1400299b0
cmp rax, 1
jne 0x140029a19
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140029820
mov ebx, eax
xor eax, eax
test ebx, ebx
jns 0x140041d26
cmp dword [rsp + 0x48], eax
jne 0x140041d26
lea rcx, [rsp + 0x78]
call fcn.14002a094
mov eax, ebx
mov rcx, qword [rbp + 0x21b0]
xor rcx, rsp
call fcn.14002cdb0
add rsp, 0x22c8
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp esi, 2
je 0x140041cd9
test esi, esi
jne 0x140041d44
cmp dword [rbp + 0x2210], ecx
jne 0x140041d52
mov rdx, qword [rsp + 0x78]
call fcn.140029e54
mov esi, eax
lea rcx, [rsp + 0x78]
call fcn.14002a094
xor ecx, ecx
test eax, eax
jne 0x140029ab5
cmp dword [rsp + 0x40], ecx
je 0x140041cd9
test esi, esi
jne 0x140041cd9
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.14002a0bc
mov esi, eax
xor eax, eax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.14002a094
test esi, esi
je 0x140029aab
mov ecx, esi
call fcn.14002a178
mov ebx, eax
jmp 0x1400299f2
mov rsi, qword [rsp + 0x70]
jmp 0x140041c7e
mov ecx, eax
jmp 0x140029a9f
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
xor ebx, ebx
cmp dword [rsp + 0x44], ebx
je 0x1400298d8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea edx, [rbx + 0x5c]
mov rcx, rdi
call fcn.14002a130
test rax, rax
jne 0x140041d94
mov rdx, rdi
call fcn.140054c20
test eax, eax
je 0x140041a8a
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400569a0
mov qword [rsp + 0x50], rbx
cmp dword [rsp + 0x48], ebx
je 0x140041b0d
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x140041db1
mov rdx, rdi
mov rcx, rsi
call fcn.140029dcc
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.14002a094
xor edx, edx
jmp 0x140041b00
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov r9, rdi
lea r8, [rbp + 0x1b0]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400545c4
mov ebx, eax
xor eax, eax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.14002a094
xor edx, edx
test ebx, ebx
js 0x1400299f2
jmp 0x140041c80
lea rcx, [rsp + 0x50]
call fcn.14002a094
nop
jmp 0x1400298d8
mov dword [rsp + 0x40], ebx
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
xor ebx, ebx
jmp 0x1400298f0
lea rdx, [rbp + 0x1b0]
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x1400299f2
cmp word [rdi], 0x3d
jne 0x140041d9e
cmp dword [rsp + 0x44], eax
jne 0x140041ac0
cmp dword [rbp + 0x2210], eax
jne 0x140041be5
cmp dword [rsp + 0x40], eax
je 0x140041be5
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14002a044
test eax, eax
jne 0x140041da8
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, 0xfffffffd
jne 0x140041da8
lea rcx, [rsp + 0x50]
call fcn.14002a094
mov rdx, rdi
mov rcx, rsi
call fcn.140029dcc
jmp 0x140041ccf
mov r9d, 0x2001f
mov r8, rdi
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14002a044
test eax, eax
je 0x140041c46
mov r9d, 0x20019
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14002a044
test eax, eax
je 0x140041c46
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140054ea8
test eax, eax
jne 0x140029ab5
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
cmp word [rdi], 0x3d
jne 0x140041c7e
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400545c4
mov ebx, eax
test eax, eax
js 0x1400299f2
xor edx, edx
mov ecx, dword [rsp + 0x44]
test ecx, ecx
je 0x140041cd9
cmp word [rdi], 0x7b
jne 0x140041cd9
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], dx
jne 0x140041c92
cmp rax, 1
jne 0x140041cd9
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, rsi
call fcn.140029820
mov ebx, eax
test eax, eax
js 0x1400299f2
mov rdx, rdi
mov rcx, rsi
call fcn.140029eb8
mov ebx, eax
test eax, eax
js 0x1400299f2
cmp word [rdi], 0x7d
je 0x1400299f2
mov rsi, qword [rsp + 0x70]
jmp 0x140029890
mov esi, 2
jmp 0x140029950
cmp eax, 0xc
je 0x140041dcc
cmp eax, 0x16
je 0x140041dc1
cmp eax, 0x22
je 0x140041dc1
cmp eax, 0x50
je 0x14002997e
mov ecx, 0x80004005
call fcn.14004a3b0
int3
mov rdx, rdi
mov rcx, qword [rsp + 0x70]
call fcn.140029eb8
mov ebx, eax
xor ecx, ecx
test eax, eax
js 0x1400299f2
jmp 0x140029a19
cmp dword [rbp + 0x2210], ecx
je 0x140029a9d
jmp 0x140041cd9
mov rdx, qword [rsp + 0x78]
call fcn.140029e54
test eax, eax
je 0x140029a36
lea rdx, [rbp - 0x60]
call fcn.140054c20
xor ecx, ecx
test eax, eax
je 0x140041cd9
cmp dword [rsp + 0x40], ecx
je 0x140041cd9
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.1400569a0
jmp 0x140041cd9
lea rcx, [rsp + 0x50]
call fcn.14002a094
mov ebx, 0x80020009
jmp 0x1400299f2
mov ecx, eax
call fcn.14002a178
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.14002a094
nop
jmp 0x1400299f2
mov ecx, 0x80070057
call fcn.14004a3b0
int3
mov ecx, 0x8007000e
call fcn.14004a3b0
int3