Function at 0x1000040fc
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x22e8
call fcn.100008d30
sub rsp, rax
mov rax, qword [0x10000b108]
xor rax, rsp
mov qword [rsp + 0x22d0], rax
mov rax, rcx
mov qword [rsp + 0x68], rcx
mov ecx, dword [rsp + 0x2330]
xor ebp, ebp
mov dword [rsp + 0xb0], ecx
mov rcx, rax
mov rbx, rbp
mov dword [rsp + 0x74], r9d
mov qword [rsp + 0x78], r8
mov rsi, rdx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x80], rbx
call fcn.100003620
cmp eax, ebp
mov edi, eax
jl 0x1000048f0
cmp word [rsi], 0x7d
je 0x1000048ee
mov eax, 1
lea rdx, [0x100001b20]
mov rcx, rsi
mov dword [rsp + 0x70], eax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
cmp eax, edi
lea rdx, [0x100001b48]
mov rcx, rsi
mov ebp, edi
sete bpl
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x1000041bb
cmp ebp, edi
je 0x10000429a
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
cmp dword [rsp + 0x74], edx
je 0x100004298
movzx eax, word [rsi]
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
mov rcx, rsi
jmp 0x100004212
cmp ax, 0x5c
je 0x100004219
call qword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
mov rcx, rax
mov ax, word [rax]
cmp ax, dx
jne 0x1000041fe
jmp 0x100004222
cmp rcx, rdx
jne 0x10000490c
lea rdi, [0x100001bb0]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100004266
lea rax, [0x100001c10]
add rdi, 8
cmp rdi, rax
jl 0x100004229
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x98]
mov rdx, rsi
mov qword [rsp + 0x98], rax
call fcn.100002d58
xor edi, edi
cmp ebp, edi
je 0x10000429a
mov rbp, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
mov rdx, rsi
mov rcx, rbp
call fcn.100003bf0
jmp 0x100004576
xor edi, edi
lea rdx, [0x100001b30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rbp, qword [rsp + 0x68]
cmp eax, edi
jne 0x1000042d0
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x70], edi
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
xor edi, edi
lea rdx, [0x100001b60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
jne 0x1000043f6
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
mov rdx, rsi
mov rcx, rbp
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
cmp word [rsi], 0x3d
jne 0x10000490c
cmp dword [rsp + 0x74], edx
je 0x100004368
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0x98]
mov r9, rsi
mov rcx, rbp
mov qword [rsp + 0x98], rax
call fcn.1000037ac
jmp 0x100004576
cmp dword [rsp + 0x2330], edx
jne 0x1000043da
cmp dword [rsp + 0x70], edx
je 0x1000043da
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
jne 0x1000048d5
mov rbp, qword [rsp + 0x60]
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x1000043c7
cmp eax, 2
jne 0x100004921
cmp rbp, rdi
je 0x1000043d5
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.100003bf0
xor edx, edx
mov edi, eax
cmp eax, edx
jl 0x1000048e0
jmp 0x100004803
movzx eax, word [rsi]
mov rcx, rsi
jmp 0x100004410
cmp ax, 0x5c
je 0x100004417
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
cmp ax, di
jne 0x1000043fe
jmp 0x100004420
cmp rcx, rdi
jne 0x10000493c
cmp dword [rsp + 0x74], edi
je 0x1000045d7
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100004480
mov eax, ecx
cmp rbx, rcx
je 0x10000446b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, ecx
je 0x10000453b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x1000044cd
mov eax, ecx
cmp rbx, rcx
je 0x1000044bc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, ecx
je 0x10000453b
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x60], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edi, edi
cmp eax, edi
jne 0x100004941
mov eax, edi
cmp rbx, rdi
je 0x100004526
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
cmp eax, edi
jne 0x100004941
mov rdx, rsi
mov rcx, rbp
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
cmp word [rsi], 0x3d
jne 0x100004582
lea rdx, [rsp + 0x80]
mov r9, rsi
xor r8d, r8d
mov rcx, rbp
call fcn.1000037ac
mov rbx, qword [rsp + 0x80]
xor edx, edx
mov edi, eax
cmp eax, edx
jl 0x1000048e0
cmp word [rsi], 0x7b
jne 0x100004803
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x100004801
mov r9d, dword [rsp + 0x74]
xor eax, eax
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.1000040fc
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
mov rdx, rsi
mov rcx, rbp
call fcn.100003620
jmp 0x1000043e5
mov edi, dword [rsp + 0x2330]
xor eax, eax
cmp edi, eax
jne 0x100004635
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jne 0x10000463c
mov ebp, eax
cmp rbx, rax
je 0x100004626
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x80], rbx
jmp 0x10000463a
mov ebp, 2
cmp ebp, eax
mov eax, 1
lea rcx, [rsp + 0xc0]
mov r8, rsi
cmovne edi, eax
or r9, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0x2330], edi
call sub.msvcrt.dll_wcsncpy_s
xor ecx, ecx
cmp eax, ecx
je 0x10000468e
cmp eax, 0xc
je 0x100004967
cmp eax, 0x16
je 0x10000495c
cmp eax, 0x22
je 0x10000495c
cmp eax, 0x50
jne 0x100004951
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.100003bf0
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
cmp word [rsi], 0x7b
jne 0x100004728
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x100004726
mov eax, dword [rsp + 0x2330]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov dword [rsp + 0x20], eax
call fcn.1000040fc
xor edx, edx
cmp eax, edx
mov edi, eax
jge 0x10000470b
cmp dword [rsp + 0x2330], edx
je 0x1000048e0
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.100003620
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x1000048e0
jmp 0x100004728
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x2330], eax
cmp ebp, 2
je 0x100004803
cmp ebp, edx
je 0x100004752
cmp eax, edx
jne 0x100004803
mov ecx, ebp
jmp 0x1000048d7
cmp eax, edx
je 0x100004812
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
cmp eax, edx
jne 0x100004812
cmp dword [rsp + 0x60], edx
mov eax, edx
seta al
cmp eax, edx
je 0x100004812
lea rbp, [0x100001bb0]
mov rdx, qword [rbp]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
cmp eax, edx
je 0x100004803
lea rax, [0x100001c10]
add rbp, 8
cmp rbp, rax
jl 0x1000047b6
cmp dword [rsp + 0x70], edx
je 0x100004803
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.100002d58
mov rbx, qword [rsp + 0x80]
xor edx, edx
cmp word [rsi], 0x7d
je 0x1000048e0
jmp 0x10000417c
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
mov ebp, edx
cmp eax, edx
jne 0x100004864
cmp dword [rsp + 0x60], edx
seta bpl
cmp rbx, rdx
je 0x100004887
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rbx, rdx
mov qword [rsp + 0x80], rdx
cmp eax, edx
jne 0x100004972
cmp dword [rsp + 0x70], edx
je 0x100004803
cmp ebp, edx
jne 0x100004803
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], rdx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x98], rax
call fcn.100002ca8
xor edx, edx
cmp eax, edx
je 0x100004803
mov ecx, eax
call fcn.100002918
mov edi, eax
xor edx, edx
cmp rbx, rdx
je 0x1000048ee
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x22d0]
xor rcx, rsp
call fcn.1000084f0
add rsp, 0x22e8
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rbx, rdx
je 0x10000491a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x1000048f0
mov ecx, eax
call fcn.100002918
xor edx, edx
mov edi, eax
cmp rbp, rdx
je 0x1000048e0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000048de
cmp rbx, rdi
jmp 0x10000490f
mov ecx, eax
call fcn.100002918
mov edi, eax
xor eax, eax
cmp rbx, rax
jmp 0x1000048e3
mov ecx, 0x80004005
call fcn.100002898
int3
mov ecx, 0x80070057
call fcn.100002898
int3
mov ecx, 0x8007000e
call fcn.100002898
int3
mov ecx, eax
call fcn.100002918
jmp 0x1000048f0