Function at 0x14000b600
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x2e0
mov rax, qword [0x1401aa0c0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
call fcn.14000b1c0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderReporting
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
test eax, eax
jne 0x14000b721
lea ebx, [rax + 3]
nop dword [rax]
mov dword [rsp + 0x88], 0x100
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000b70a
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14000b6d7
lea rdx, str.Exclu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x14000b6e5
lea rdx, str.Erro_ao_excluir:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140015130
lea rdx, [rsp + 0xd0]
mov rcx, rax
call fcn.140015130
lea rdx, [0x140015310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
sub rbx, 1
jne 0x14000b670
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000b744
lea rdx, str.Erro_ao_abrir_a_chave_do_registro
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140015130
lea rdx, [0x140015310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movabs rax, 0xaea5db6d03da998e
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
movabs rax, 0xa0cf69c3b52a9eb1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
movabs rax, 0xb3bf58cead4d8721
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movabs rcx, 0x6be85c3b5a08722a
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
movabs rax, 0xaec4db0003a999e3
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
movabs rax, 0xa0bc69edb5449ed8
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb8], rax
movabs rax, 0xb3bf58cead2f8745
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xc8], rax
vmovdqu ymm0, ymmword [rsp + 0x40]
vpxor ymm1, ymm0, ymmword [rsp + 0xb0]
vmovdqu ymmword [rsp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x90], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0xa0], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000b850
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.140015ca0
nop
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 7
cmova rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
lea rsi, [rdx + rax*2]
lea rdi, [rsp + 0x90]
cmova rdi, qword [rsp + 0x90]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movabs r15, 0x7fffffffffffffff
cmp rdi, rsi
jne 0x14000b8d6
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
jmp 0x14000b9ed
mov rax, rsi
sub rax, rdi
sar rax, 1
mov rdx, r14
mov qword [rsp + 0x78], rdx
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x80], rbx
cmp rax, r15
ja 0x14000bb22
cmp rax, rbx
jbe 0x14000b9a0
mov rbx, rax
or rbx, 0xf
cmp rbx, r15
jbe 0x14000b94a
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14011c118
mov rcx, rax
test rax, rax
je 0x14000ba87
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x78]
jmp 0x14000b986
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000b972
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000bb28
jmp 0x14000b923
test rcx, rcx
je 0x14000b983
call fcn.14011c118
mov rdx, qword [rsp + 0x78]
jmp 0x14000b986
mov rax, r14
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x68]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x68]
movzx eax, byte [rdi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x78]
inc rdx
mov qword [rsp + 0x78], rdx
add rdi, 2
cmp rdi, rsi
je 0x14000b9d5
mov rbx, qword [rsp + 0x80]
jmp 0x14000b9a0
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov byte [rdx + rax], 0
lea rcx, [rsp + 0x68]
call fcn.14000aee0
lea rcx, [rsp + 0x88]
call fcn.140005cb0
movabs r8, 0x7ffffffed5fa0dff
mov rax, qword [rsp + 0x88]
cmp rax, r8
je 0x14000ba40
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x14000ba40
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rsp + 0x60], rcx
jmp 0x14000ba45
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.140016870
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000ba93
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c110
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x14000baf4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000baef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000baef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c110
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14011c0f0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
call fcn.140004d80
nop
call fcn.140004ce0
int3