Function at 0x14008497c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x390
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r12, rdx
mov r15, rcx
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov qword [rsp + 0x68], r13
mov ebx, r13d
mov qword [rsp + 0x70], rbx
mov esi, r13d
mov qword [rsp + 0x78], r13
mov dword [rbp - 0x78], 1
lea rax, fcn.140084fd0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], r13
mov byte [rbp - 0x68], 1
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, r12
call fcn.14008699c
test eax, eax
jne 0x140084ea1
mov edi, r13d
mov r14d, 0x1000
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x80]
call fcn.140238d40
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x80]
mov edx, edi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x140084bab
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x60], rax
lea rax, str.KeyLength
mov qword [rbp - 0x58], rax
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x50], eax
mov word [rbp - 0x4c], r13w
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, str.Long_named_key_encountered.
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
mov ecx, 0x2001814
mov r8d, 0xf
call fcn.140021310
mov ecx, dword [rsp + 0x40]
lea eax, [rcx + 1]
mov dword [rsp + 0x50], eax
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov edx, ecx
test ecx, ecx
jne 0x140084ae4
mov qword [rbp + 0x50], rcx
mov word [rbp + rcx*2 + 0x40], r13w
jmp 0x140084af1
xor r8d, r8d
lea rcx, [rbp + 0x40]
call fcn.14000b13c
nop
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r8, qword [rbp + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
mov edx, edi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140084f12
cmp rsi, rbx
je 0x140084b50
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.14000b494
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x140084b6b
lea r8, [rbp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14003d204
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rax, qword [rbp + 0x58]
cmp rax, 8
jb 0x140084c3c
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x140084c36
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140084f09
jmp 0x140084c36
test eax, eax
jne 0x140084c7d
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.14001a8a0
cmp qword [rbp + 0x70], r13
je 0x140084c44
mov rax, qword [r15 + 8]
cmp qword [r15 + 0x10], rax
je 0x140084bf3
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.14000b494
add qword [r15 + 8], 0x20
jmp 0x140084c03
lea r8, [rbp + 0x60]
mov rdx, rax
mov rcx, r15
call fcn.14003d204
nop
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x140084c3c
mov rcx, qword [rbp + 0x60]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x140084c36
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140084f6a
call fcn.140261814
nop
inc rdi
jmp 0x140084a17
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x140084c7d
mov rcx, qword [rbp + 0x60]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x140084c77
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140084f73
call fcn.140261814
nop
mov rdi, qword [rsp + 0x68]
cmp rdi, rbx
je 0x140084ea1
mov r14, rdi
cmp qword [rdi + 0x18], 8
jb 0x140084c98
mov r14, qword [rdi]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], r13w
jne 0x140084c9c
test rsi, rsi
je 0x140084ef9
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140238d40
mov byte [rbp + 0x30], r13b
lea rax, [rbp - 0x10]
mov qword [rbp + 0x18], rax
mov r9, rsi
mov r8, r14
mov rdx, r12
lea rcx, [rbp - 0x10]
call fcn.14008cc50
mov al, byte [rbp + 0x30]
neg al
sbb rsi, rsi
lea rax, [rbp + 8]
and rsi, rax
mov rcx, rsi
call fcn.14008c068
test eax, eax
jne 0x140084e72
test rsi, rsi
jne 0x140084d0a
mov esi, 0xa0
jmp 0x140084e6e
mov dword [rsp + 0x44], r13d
mov rax, qword [rsi + 0x10]
test byte [rax + 0xa], 0x1f
jne 0x140084d00
lea rax, [0x1403ce9a8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rsp + 0x60], eax
test eax, eax
jne 0x140084d56
cmp dword [rsp + 0x64], r13d
jne 0x140084f7c
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x64], eax
mov ebx, r13d
cmp ebx, 4
jge 0x140084e5b
mov r14b, r13b
mov qword [rsp + 0x48], r13
mov rdx, qword [rsi + 0x10]
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov rdx, qword [rdx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400896c4
mov ecx, dword [rax]
mov dword [rsp + 0x44], ecx
mov rcx, qword [rax + 8]
mov qword [rax + 8], r13
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rcx
test rdx, rdx
je 0x140084db7
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140084dd9
mov qword [rbp - 0x28], r13
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rsp + 0x48]
cmp dword [rsp + 0x44], r13d
jne 0x140084e38
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x44], eax
cmp eax, 0x3f2
je 0x140084e08
cmp eax, 0x3fa
je 0x140084e08
cmp eax, 6
jne 0x140084e2a
mov rcx, qword [rsi + 0x10]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
lea rdx, [0x1403c35d0]
mov qword [rax + rdx], r13
call fcn.140084fdc
mov r14b, 1
mov rcx, qword [rsi + 0x10]
call fcn.140084fdc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140084e50
mov qword [rsp + 0x48], r13
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
inc ebx
test r14b, r14b
jne 0x140084d59
mov esi, dword [rsp + 0x44]
lea rcx, [rsp + 0x58]
call fcn.1400261e0
mov rbx, qword [rsp + 0x70]
test esi, esi
je 0x140084e8f
lea r9, str.Failed_to_remove_long_named_key.
mov edx, 0x3a7
mov ecx, 0x2001817
mov r8d, 0xa
call fcn.140143574
nop
lea rcx, [rbp - 0x10]
call fcn.14002792c
add rdi, 0x20
jmp 0x140084c82
lea rax, fcn.140084fd0
mov qword [rbp - 0x80], rax
cmp byte [rbp - 0x68], r13b
je 0x140084ec2
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140084ec2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x68]
call fcn.1400135d8
mov rax, r15
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x178525c
call fcn.140025d34
nop
jmp 0x140084f08
nop
call fcn.140261a5c
nop
jmp 0x140084f11
nop
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x48], rcx
lea rcx, str.Result
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0x38], eax
mov word [rbp - 0x34], r13w
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_get_the_key_name.
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
mov ecx, 0x2001815
mov r8d, 0xa
call fcn.140021310
xor edx, edx
mov ecx, 0x2001816
call fcn.140025d34
nop
jmp 0x140084f69
nop
call fcn.140261a5c
nop
jmp 0x140084f72
nop
call fcn.140261a5c
nop
jmp 0x140084f7b
nop
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
nop
jmp 0x140084f8c
nop
nop
nop
nop
push rbx
sub rsp, 0x20
mov rbx, rcx
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140084fbd
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
mov rcx, rbx
call fcn.140261814
add rsp, 0x20
pop rbx
ret