Function at 0x18000a500
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1801a70c0]
xor rax, rsp
mov qword [rbp + 0x340], rax
movabs rax, 0xcf06692a2a55435f
movabs r13, 0xe55024eca8a05ba8
mov qword [rbp + 0x110], rax
movabs r12, 0xcf6369472a3a4331
mov rax, qword [rbp + 0x110]
movabs r15, 0xa3d77b729c0d99de
mov qword [rbp + 0xa0], rax
movabs r14, 0x86718b1dee6a3e3
movabs rax, 0xa3f77b1d9c6999fe
movabs rsi, 0x1e664764cbc68dc0
mov qword [rbp + 0x110], rax
movabs rdi, 0xbc8a8fb384c8e05
mov rax, qword [rbp + 0x110]
movabs rbx, 0xcb238c566192bc22
mov qword [rbp + 0xa8], rax
movabs r11, 0x7b3536f5ab058a57
movabs rax, 0x81218c0de94a382
movabs r10, 0xad4e39c8267d5b64
mov qword [rbp + 0x110], rax
movabs r9, 0xe9fe472f183439b9
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xb0], rax
movabs rax, 0x1e46470bcbb08da9
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xb8], rax
movabs rax, 0xbe8a89e38398e74
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xc0], rax
movabs rax, 0xcb528c7661e7bc56
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xc8], rax
movabs rax, 0x7b153687ab608a22
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xd0], rax
movabs rax, 0xad3e39a526145b08
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xd8], rax
movabs rax, 0xe99b470f184639d8
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xe0], rax
movabs rax, 0xa876a19a46bc74de
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xe8], rax
movabs rax, 0x9490c04dfad4562e
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x110], r13
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x110], r12
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x110], r15
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x110], r14
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x110], rsi
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x110], rdi
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x110], rbx
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x110], r11
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x110], r10
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x110], r9
movabs r8, 0xa822a1ba468674a6
mov rax, qword [rbp + 0x110]
movabs rdx, 0x94d5c019fa87566b
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x110], r8
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x110], rdx
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x110], r13
mov rax, qword [rbp + 0x110]
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqu ymm0, ymmword [rbp + 0xc0]
mov qword [rbp + 0x178], rax
movabs rax, 0xcf3769012a754362
vmovdqa ymmword [rbp + 0xa0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xe0], ymm1
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp], rax
movabs rax, 0xa3927b209c4c9989
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 8], rax
movabs rax, 0x80418d8deaba3bf
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x10], rax
movabs rax, 0x1e094717cba98db2
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x18], rax
movabs rax, 0xb9fa8a738388e63
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x20], rax
movabs rax, 0xcb4c8c3261fcbc4b
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x28], rax
movabs rax, 0x7b7636a9ab768a20
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x30], rax
movabs rax, 0xad2b39ba260f5b11
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x38], rax
movabs rax, 0xe99b4779184039d7
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x40], rax
movabs rax, 0xa84da1d346f574d4
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x48], rax
movabs rax, 0x94adc05cfadb5605
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x50], rax
movabs rax, 0xe5222483a8cc5bd8
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x58], rax
movabs rax, 0x73ea191f678874e8
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x60], rax
movabs rax, 0xd91dc48a7374042f
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x68], rax
movabs rax, 0x4df4be8350b048d
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
movabs rcx, 0xfce6559458ef3150
mov qword [rbp + 0x70], rax
movabs rax, 0x20f9c675c4d659cd
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x78], rax
movabs rax, 0x81f9460781baf380
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x80], rax
movabs rax, 0x567d58d6c293c019
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x88], rax
movabs rax, 0xf8f0b854432ca9b
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x110], rcx
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x110], r12
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x110], r15
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x110], r14
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x110], rsi
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x110], rdi
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x110], rbx
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x110], r11
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x110], r10
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x110], r9
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x110], r8
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x110], rdx
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x110], r13
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x178], rax
movabs rax, 0x73ac194367fa748d
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x180], rax
movabs rax, 0xd968c4fe7315044a
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x188], rax
movabs rax, 0x4ac4bbd356e04ff
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x190], rax
movabs rax, 0x20a5c610c4b159ac
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x198], rax
movabs rax, 0x81aa467781caf3c1
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x561e58a2c2fac06e
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp]
movabs rax, 0xf8f0be14457caf3
mov r9d, 9
mov qword [rbp + 0x110], rax
xor r8d, r8d
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x110], rcx
mov rcx, 0xffffffff80000001
mov rax, qword [rbp + 0x110]
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqu ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x40], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rbp + 0x1b8], rax
lea rax, [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rsp + 0x20], rax
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000ae16
mov rcx, qword [rbp + 0x100]
lea r9, [rbp + 0x110]
xor edi, edi
mov dword [rbp + 0x110], 0x104
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x120]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18000ae09
nop dword [rax]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x120]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000adc4
lea rax, [rbp + 0x108]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000adc4
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x100]
lea r9, [rbp + 0x110]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x120]
mov qword [rsp + 0x30], rdi
inc ebx
mov qword [rsp + 0x28], rdi
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x110], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x18000ad60
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.18011a420
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret