Function at 0x140068158
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r12, rdx
xor r14d, r14d
mov r13, rcx
lea r8d, [r14 + 0x5c]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x70], r14
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, r12
mov rbx, rax
cmp rax, r14
jne 0x1400683b8
lea r8, [rsp + 0x70]
mov r9d, 0x2001b
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.140055328
mov edi, eax
cmp eax, r14d
jne 0x140068434
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0xc0], r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
mov eax, dword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
cmp eax, dword [rsp + 0xc8]
cmovb eax, dword [rsp + 0xc8]
mov dword [rsp + 0xc0], eax
lea edx, [rax*4 + 8]
call fcn.14005bf78
cmp esi, r14d
jne 0x140068353
mov ebp, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
dec ebp
cmp ebp, r14d
jl 0x1400682df
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp eax, r14d
jne 0x1400682da
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r14d
mov edi, eax
cmovne esi, eax
sub ebp, 1
jns 0x14006827b
mov ebp, dword [rsp + 0x64]
dec ebp
cmp ebp, r14d
jl 0x140068353
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, r14d
je 0x140068334
mov esi, eax
jmp 0x14006834e
cmp word [rbx], r14w
je 0x14006834e
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [0x14011b230]
cmp eax, r14d
cmovne esi, eax
sub ebp, 1
jns 0x1400682ea
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [0x14011b238]
cmp r11, r14
jne 0x140068393
lea r8, [0x14011b238]
lea rdx, [0x140105bc8]
lea rcx, str.RegDeleteKeyExW
xor r9d, r9d
call fcn.1400556c0
mov r11, qword [0x14011b238]
cmp r11, r14
je 0x1400683a4
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call r11
mov edi, eax
cmp edi, r14d
lea rcx, [rsp + 0x78]
cmovne esi, edi
call fcn.140054110
mov eax, esi
jmp 0x140068434
sub rax, r12
lea rcx, [rsp + 0xc0]
sar rax, 1
movsxd r8, eax
call fcn.140066bc8
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov r9d, 2
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.140055328
mov edi, eax
cmp eax, r14d
je 0x140068409
lea rcx, [rsp + 0xc0]
call fcn.140054110
mov eax, edi
jmp 0x140068434
mov rcx, qword [rsp + 0x70]
lea rdx, [rbx + 2]
call qword [0x14011b230]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xc0]
call fcn.140054110
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret