Function at 0x140102460
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140214ba0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], r8d
mov r12, rdx
mov r13, rcx
test rdx, rdx
jne 0x1401024c5
lea rax, [0x1401cddf0]
lea r9d, [rdx + 0x25]
mov qword [rsp + 0x20], rax
lea r8, str.NWebAdvisor::NXmlUpdater::parse_and_execute
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterdelete_registry_tree_command.cpp
mov ecx, 1
call fcn.1400ebbc0
xor al, al
jmp 0x14010277e
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 7
lea r8d, [rax + 3]
lea rdx, [0x1401ccdf8]
lea rcx, [rsp + 0x48]
call fcn.1400260f0
mov r15, qword [r13]
mov r10, qword [r15 + 8]
mov rsi, r15
mov ebx, 0xffffffff
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
cmp byte [r10 + 0x19], 0
jne 0x1401025bb
nop dword [rax]
lea r9, [r10 + 0x20]
lea rax, [rsp + 0x48]
cmp r14, 8
cmovae rax, rbp
mov r11, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x14010253f
mov r9, qword [r9]
mov rcx, r11
cmp rdi, r11
cmovb rcx, rdi
test rcx, rcx
je 0x14010258c
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140102591
sub r9, rax
cmp dx, r8w
ja 0x140102585
cmp rcx, 1
je 0x14010258c
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140102563
mov eax, ebx
jmp 0x14010259d
mov eax, 1
jmp 0x14010259d
cmp r11, rdi
jae 0x140102595
mov eax, ebx
jmp 0x14010259d
xor eax, eax
cmp r11, rdi
seta al
shr eax, 0x1f
test al, al
je 0x1401025aa
mov r10, qword [r10 + 0x10]
jmp 0x1401025b0
mov rsi, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x140102520
cmp byte [rsi + 0x19], 0
jne 0x14010263a
lea rax, [rsi + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1401025d3
mov rax, qword [rax]
lea r9, [rsp + 0x48]
cmp r14, 8
cmovae r9, rbp
mov r8, rdi
cmp r10, rdi
cmovb r8, r10
test r8, r8
je 0x140102626
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140102633
sub r9, rax
cmp cx, dx
ja 0x14010261f
cmp r8, 1
je 0x140102626
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140102601
jmp 0x140102633
mov ebx, 1
jmp 0x140102633
cmp rdi, r10
jb 0x140102633
xor ebx, ebx
cmp rdi, r10
seta bl
shr ebx, 0x1f
test bl, bl
je 0x14010263d
mov rsi, r15
cmp r14, 8
jb 0x140102678
lea rdx, [r14*2 + 2]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140102670
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401027ea
mov rcx, rbp
call fcn.14014f900
cmp rsi, qword [r13]
jne 0x140102690
lea rax, str.Unable_to_read_Key_for_DEL_REG_TREE_command
mov r9d, 0x2c
jmp 0x1401024a1
lea rbx, [rsi + 0x40]
mov rdx, rbx
mov rcx, r12
call fcn.1400e43f0
test al, al
jne 0x1401026b5
lea rax, str.Unable_to_substitute_variables_for_the_DEL_REG_TREE_command
mov r9d, 0x32
jmp 0x1401024a1
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140102714
mov dword [rsp + 0x28], eax
lea rax, str.Error_opening_HKLM_registry_key:__d
mov qword [rsp + 0x20], rax
mov r9d, 0x3a
lea r8, str.NWebAdvisor::NXmlUpdater::parse_and_execute
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterdelete_registry_tree_command.cpp
lea ecx, [r9 - 0x39]
call fcn.1400ebbc0
xor bl, bl
jmp 0x14010276b
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140102721
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
cmp eax, 2
jne 0x1401027a6
cmp qword [rbx + 0x18], 8
jb 0x14010273b
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Cannnot_delete_registry_key._Not_found:__s
mov qword [rsp + 0x20], rax
mov r9d, 0x42
lea r8, str.NWebAdvisor::NXmlUpdater::parse_and_execute
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterdelete_registry_tree_command.cpp
lea ecx, [r9 - 0x3e]
call fcn.1400ebbc0
mov bl, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14010277b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014f8e0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test eax, eax
je 0x140102769
cmp qword [rbx + 0x18], 8
jb 0x1401027b4
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rax, str.Error___d__deleting_registry_key_tree:__s
mov qword [rsp + 0x20], rax
mov r9d, 0x46
lea r8, str.NWebAdvisor::NXmlUpdater::parse_and_execute
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterdelete_registry_tree_command.cpp
lea ecx, [r9 - 0x45]
call fcn.1400ebbc0
xor bl, bl
jmp 0x14010276b
call fcn.140156b00
int3