Function at 0x14000ae2c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401cd010]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r15, rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov qword [rsp + 0x68], r12
mov ebx, r12d
mov qword [rsp + 0x70], rbx
mov esi, r12d
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x78], 1
lea rax, fcn.14000b480
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], r12
mov byte [rbp - 0x68], 1
lea r8, [rbp - 0x70]
xor edx, edx
lea rcx, [0x1401475b0]
call fcn.14000d748
test eax, eax
jne 0x14000b368
mov edi, r12d
lea r13, [0x14013c220]
mov r14d, 0x1000
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x80]
mov edx, edi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x14000b05c
mov qword [rbp - 0x60], r13
lea rax, str.KeyLength
mov qword [rbp - 0x58], rax
mov eax, dword [rsp + 0x40]
mov dword [rbp - 0x50], eax
mov word [rbp - 0x4c], r12w
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, str.Long_named_key_encountered.
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
mov ecx, 0x2001814
mov r8d, 0xf
call fcn.14000b6e4
mov ecx, dword [rsp + 0x40]
lea eax, [rcx + 1]
mov dword [rsp + 0x50], eax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
mov edx, ecx
test ecx, ecx
jne 0x14000af9b
mov qword [rbp + 0x50], rcx
mov word [rbp + rcx*2 + 0x40], r12w
jmp 0x14000afa8
xor r8d, r8d
lea rcx, [rbp + 0x40]
call fcn.140009d80
nop
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r8, qword [rbp + 0x40]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov edx, edi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000b3e7
cmp rsi, rbx
je 0x14000afff
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.140007a9c
add rbx, 0x20
mov qword [rsp + 0x70], rbx
jmp 0x14000b01a
lea r8, [rbp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000b48c
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rax, qword [rbp + 0x58]
cmp rax, 8
jb 0x14000b0e2
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x14000b0db
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14000b0db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test eax, eax
jne 0x14000b137
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.14000b76c
cmp qword [rbp + 0x70], r12
je 0x14000b0f1
mov rax, qword [r15 + 8]
cmp qword [r15 + 0x10], rax
je 0x14000b09c
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.140007a9c
add qword [r15 + 8], 0x20
jmp 0x14000b0ac
lea r8, [rbp + 0x60]
mov rdx, rax
mov rcx, r15
call fcn.14000b48c
nop
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x14000b0e2
mov rcx, qword [rbp + 0x60]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x14000b0db
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14000b0ea
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
inc rdi
jmp 0x14000aed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x14000b137
mov rcx, qword [rbp + 0x60]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, r14
jb 0x14000b130
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14000b130
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rdi, qword [rsp + 0x68]
cmp rdi, rbx
je 0x14000b368
mov r13d, 0xa0
mov r14, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000b158
mov r14, qword [rdi]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], r12w
jne 0x14000b15c
test rsi, rsi
je 0x14000b3d6
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x30], r12b
lea rax, [rbp - 0x10]
mov qword [rbp + 0x18], rax
mov r9, rsi
mov r8, r14
lea rdx, [0x1401475b0]
lea rcx, [rbp - 0x10]
call fcn.140011ce8
mov al, byte [rbp + 0x30]
neg al
sbb rsi, rsi
lea rax, [rbp + 8]
and rsi, rax
mov rcx, rsi
call fcn.140010c10
test eax, eax
jne 0x14000b335
test rsi, rsi
jne 0x14000b1cc
mov esi, r13d
jmp 0x14000b331
mov dword [rsp + 0x44], r12d
mov rax, qword [rsi + 0x10]
test byte [rax + 0xa], 0x1f
jne 0x14000b1c4
lea rax, [0x1401d1ff8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rsp + 0x60], eax
test eax, eax
jne 0x14000b219
cmp dword [rsp + 0x64], r12d
jne 0x14000b3c6
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rsp + 0x64], eax
mov ebx, r12d
cmp ebx, 4
jge 0x14000b31e
mov r14b, r12b
mov qword [rsp + 0x48], r12
mov rdx, qword [rsi + 0x10]
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov rdx, qword [rdx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.14000e2fc
mov ecx, dword [rax]
mov dword [rsp + 0x44], ecx
mov rcx, qword [rax + 8]
mov qword [rax + 8], r12
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rcx
test rdx, rdx
je 0x14000b27a
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14000b29c
mov qword [rbp - 0x28], r12
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
mov rcx, qword [rsp + 0x48]
cmp dword [rsp + 0x44], r12d
jne 0x14000b2fb
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x44], eax
cmp eax, 0x3f2
je 0x14000b2cb
cmp eax, 0x3fa
je 0x14000b2cb
cmp eax, 6
jne 0x14000b2ed
mov rcx, qword [rsi + 0x10]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
lea rdx, [0x1401cd7f0]
mov qword [rax + rdx], r12
call fcn.14000b808
mov r14b, 1
mov rcx, qword [rsi + 0x10]
call fcn.14000b808
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000b313
mov qword [rsp + 0x48], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
nop
inc ebx
test r14b, r14b
jne 0x14000b21c
mov esi, dword [rsp + 0x44]
lea rcx, [rsp + 0x58]
call fcn.14000ba40
mov rbx, qword [rsp + 0x70]
test esi, esi
je 0x14000b352
lea r9, str.Failed_to_remove_long_named_key.
mov edx, 0x3a7
mov ecx, 0x2001817
mov r8d, 0xa
call fcn.140122aa8
nop
lea rcx, [rbp - 0x10]
call fcn.140009fe8
add rdi, 0x20
cmp rdi, rbx
jne 0x14000b14b
lea rax, fcn.14000b480
mov qword [rbp - 0x80], rax
cmp byte [rbp - 0x68], r12b
je 0x14000b389
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000b389
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x68]
call fcn.140008b74
mov rax, r15
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.14012aa20
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.14000ad28
nop
jmp 0x14000b3d5
nop
xor edx, edx
mov ecx, 0x178525c
call fcn.14000ad28
nop
jmp 0x14000b3e6
nop
mov qword [rbp - 0x48], r13
lea rcx, [0x140145800]
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0x38], eax
mov word [rbp - 0x34], r12w
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_get_the_key_name.
mov qword [rsp + 0x20], rax
mov edx, 0x3a7
mov ecx, 0x2001815
mov r8d, 0xa
call fcn.14000b6e4
xor edx, edx
mov ecx, 0x2001816
call fcn.14000ad28
nop
jmp 0x14000b437
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rbx
sub rsp, 0x20
mov rbx, rcx
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b46e
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x10]
call qword [case.0x1400ee2b6.0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x20
pop rbx
ret