Function at 0x408500
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x408
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r13
mov qword [r11 - 0x18], r14
mov qword [r11 - 0x20], r15
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov byte [r11 - 0x358], r15b
xor edx, edx
mov r8d, 0xfe
lea rcx, [r11 - 0x357]
call fcn.004255a0
mov byte [rsp + 0x2c0], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2c1]
call fcn.004255a0
mov dword [rsp + 0x84], 0x104
mov dword [rsp + 0x60], r15d
call fcn.00418c7c
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x4085b8
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
lea r12, [0x0044146f]
mov rsi, r12
mov r13, 0xffffffffffffffff
shr rsi, 0x10
jne 0x408608
movzx edi, r12w
mov ecx, edi
call fcn.00418c68
test rax, rax
je 0x40862b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.00402b90
mov rbx, qword [rsp + 0x68]
jmp 0x40862b
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.00402d30
mov rbx, qword [rsp + 0x68]
call fcn.00418c7c
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x40864b
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x70], rbp
test rsi, rsi
jne 0x408689
movzx edi, r12w
mov ecx, edi
call fcn.00418c68
test rax, rax
je 0x4086ac
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.00402b90
mov rbp, qword [rsp + 0x70]
jmp 0x4086ac
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.00402d30
mov rbp, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSet_services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408d3d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x84]
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x408d31
lea rdx, str.CleanDevRegServices
lea rcx, str._s_Number_of_subkeys_in_service:_d_n
call fcn.00404a90
mov r14d, r15d
cmp dword [rsp + 0x60], r15d
jbe 0x408d31
nop
mov dword [rsp + 0x80], 0xff
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xb0]
mov edx, r14d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x408cec
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x408855
lea rdx, [rbp - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x4088d2
cmp dword [rdx + 0x10], eax
jge 0x408824
cmp dword [rbp - 0xc], eax
jl 0x408cfe
mov dword [rbp - 0x10], r15d
mov byte [rbp], al
jmp 0x4088d2
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40883c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x70], rbp
mov rbx, qword [rsp + 0x68]
jmp 0x4088d2
mov esi, dword [rbp - 0x10]
lea r12, [rsp + 0xb0]
sub r12, rbp
mov ecx, 1
sub ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
sub eax, edi
or eax, ecx
jge 0x408885
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.00401fa0
mov rbp, qword [rsp + 0x70]
cmp r12, rsi
ja 0x4088a1
movsxd rsi, edi
lea r8, [r12 + rbp]
mov r9, rsi
mov rdx, rsi
mov rcx, rbp
call fcn.00426320
jmp 0x4088ba
movsxd rsi, edi
mov r9, rsi
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rbp
call fcn.00426220
test edi, edi
js 0x408d26
cmp edi, dword [rbp - 0xc]
jg 0x408d26
mov dword [rbp - 0x10], edi
mov byte [rsi + rbp], 0
lea rcx, [rbp - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x408936
cmp dword [rdi + 0x10], 0
jl 0x408920
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x408920
call fcn.00402000
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x408910
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x68], rbx
mov rbp, qword [rsp + 0x70]
jmp 0x408936
mov r8d, dword [rbp - 0x10]
mov rdx, rbp
lea rcx, [rsp + 0x68]
call fcn.00402d30
mov rbx, qword [rsp + 0x68]
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x40895c
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.00401fa0
mov rbx, qword [rsp + 0x68]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.00425f20
test eax, eax
je 0x408992
cmp eax, 0xc
je 0x408d15
cmp eax, 0x16
je 0x408d0f
cmp eax, 0x22
je 0x408d0f
cmp eax, 0x50
jne 0x408d09
test edi, edi
js 0x408d1b
cmp edi, dword [rbx - 0xc]
jg 0x408d1b
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
lea rdi, str.fcswitch
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.fcserial
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.ew_usbenumfilter
mov rsi, rbx
mov ecx, 0x11
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.mod7700
mov rsi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.ewusbmbb
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwdatacard
mov rsi, rbx
mov ecx, VariantTimeToDosDateTime
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.ewusbnet
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei
mov rsi, rbx
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_wwanecm
mov rsi, rbx
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_ext_ctrl
mov rsi, rbx
mov ecx, 0x10
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_cdcacm
mov rsi, rbx
mov ecx, 0xe
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_cdcecm
mov rsi, rbx
mov ecx, 0xe
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_enumerator
mov rsi, rbx
mov ecx, 0x12
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.ew_hwusbdev
mov rsi, rbx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.huawei_update
mov rsi, rbx
mov ecx, 0xe
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hw_usbdev
mov rsi, rbx
mov ecx, 0xa
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hw_quusbnet
mov rsi, rbx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwhandset
mov rsi, rbx
mov ecx, 0xa
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.qcusbser
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwusbdev
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwmobile
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwmcdcmdm0
mov rsi, rbx
mov ecx, VariantTimeToDosDateTime
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwusbapp
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwusbfake
mov rsi, rbx
mov ecx, 0xa
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwusbser
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwhandsetproline
mov rsi, rbx
mov ecx, 0x11
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.HWHandSetProLineProLine
mov rsi, rbx
mov ecx, 0x18
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.QuHandsetSerial
mov rsi, rbx
mov ecx, 0x10
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.diagswitchdrv
mov rsi, rbx
mov ecx, 0xe
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hw_ctrlfakedev
mov rsi, rbx
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.ew_usbccgpfilter
mov rsi, rbx
mov ecx, 0x11
repe cmpsb byte [rsi], byte [rdi]
je 0x408c6e
lea rdi, str.hwusb_cdcacm
mov rsi, rbx
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
jne 0x408cec
mov byte [rsp + 0x1b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x1b1]
call fcn.004255a0
mov r9, rbp
lea r8, str.SYSTEMCurrentControlSet_services_s
mov edx, 0x104
lea rcx, [rsp + 0x1b0]
call fcn.00401da0
lea rdx, [rsp + 0x1b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
jne 0x408cec
lea r8, [rsp + 0x1b0]
lea rdx, str.CleanDevRegServices
lea rcx, str._s_Found__s_in_Service_Delete_OK_n
call fcn.00404a90
add r14d, 0xffffffff
mov eax, dword [rsp + 0x60]
add eax, 0xffffffff
mov dword [rsp + 0x60], eax
jmp 0x408cf0
mov eax, dword [rsp + 0x60]
add r14d, 1
cmp r14d, eax
jae 0x408d31
jmp 0x408790
mov ecx, 0x80070057
call fcn.00401000
int3
call fcn.00418860
int3
call fcn.00418860
int3
call fcn.0041883c
int3
mov ecx, 0x80070057
call fcn.00401000
int3
mov ecx, 0x80070057
call fcn.00401000
int3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbp - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x408d5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x408d7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x410]
mov rbp, qword [rsp + 0x418]
mov rsi, qword [rsp + 0x420]
mov rdi, qword [rsp + 0x428]
mov r12, qword [rsp + 0x400]
mov r13, qword [rsp + 0x3f8]
mov r14, qword [rsp + 0x3f0]
mov r15, qword [rsp + 0x3e8]
add rsp, 0x408
ret