Function at 0x140170a84
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1178]
mov eax, 0x1238
call fcn.140cd95f0
sub rsp, rax
mov rsi, r8
mov rcx, rdx
xor r15d, r15d
mov edi, r15d
mov dword [rbp + 0x1180], r15d
mov dword [rsp + 0x60], 0x104
mov dword [rbp + 0x1198], 0x1000
mov dword [rsp + 0x64], r15d
lea rax, [rbp + 0x1198]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1401711ee
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x140170b37
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140159cd4
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.14016d918
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140170b9b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170b96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171226
call fcn.140cd8948
mov eax, dword [rsp + 0x68]
dec eax
xorps xmm0, xmm0
cmp eax, 1
jbe 0x140170bc6
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], r15b
lea rax, [rbp - 0x30]
or edi, 1
jmp 0x140170c08
mov r8d, dword [rbp + 0x1198]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x40]
call fcn.140159cd4
nop
or edi, 2
mov dword [rbp + 0x1180], edi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14016d918
or edi, 4
mov dword [rbp + 0x1180], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
test dil, 4
je 0x140170c97
and edi, 0xfffffffb
mov dword [rbp + 0x1180], edi
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140170c87
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170c82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017120e
call fcn.140cd8948
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], r15b
test dil, 2
je 0x140170ce4
and edi, 0xfffffffd
mov dword [rbp + 0x1180], edi
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140170ce4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170cde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171214
call fcn.140cd8948
nop
test dil, 1
je 0x140170d2e
and edi, 0xfffffffe
mov dword [rbp + 0x1180], edi
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140170d2e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170d29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017121a
call fcn.140cd8948
mov rbx, qword [rsi + 0x10]
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140170d3f
mov r9, qword [rsi]
lea rcx, [rbp - 0x50]
mov r14, qword [rbp - 0x38]
cmp r14, 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov r12, qword [rbp - 0x40]
mov rdx, r12
call fcn.140172fd4
cmp rax, 0xffffffffffffffff
jne 0x140170ece
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140170d7b
mov r9, qword [rsi]
lea rcx, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r13, qword [rbp - 0x78]
cmp r13, 0xf
cmova rcx, rsi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
call fcn.140172fd4
cmp rax, 0xffffffffffffffff
jne 0x140170ece
lea rbx, [rbp - 0x50]
cmp r14, 0xf
cmova rbx, qword [rbp - 0x50]
cmp r12, 3
jb 0x140170e07
lea r15, [r12 + rbx]
lea r8, [r15 - 2]
sub r8, rbx
mov rcx, rbx
jmp 0x140170de9
cmp word [rax], 0x6d63
jne 0x140170ddc
cmp byte [rax + 2], 0x64
je 0x140170dfa
inc rax
lea r8, [r15 - 2]
sub r8, rax
mov rcx, rax
mov edx, 0x63
call fcn.140da1370
test rax, rax
jne 0x140170dcf
jmp 0x140170e07
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140170ecb
lea rbx, [rsp + 0x70]
cmp r13, 0xf
cmova rbx, rsi
mov rax, qword [rbp - 0x80]
cmp rax, 3
jb 0x140170e62
lea r15, [rax + rbx]
lea r8, [r15 - 2]
sub r8, rbx
mov rcx, rbx
jmp 0x140170e48
cmp word [rax], 0x6d63
jne 0x140170e3b
cmp byte [rax + 2], 0x64
je 0x140170e59
inc rax
lea r8, [r15 - 2]
sub r8, rax
mov rcx, rax
mov edx, 0x63
call fcn.140da1370
test rax, rax
jne 0x140170e2e
jmp 0x140170e62
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140170ecb
lea rbx, [rbp - 0x50]
cmp r14, 0xf
cmova rbx, qword [rbp - 0x50]
cmp r12, 6
jb 0x140170fcb
lea r15, [r12 + rbx]
lea r8, [r15 - 5]
sub r8, rbx
mov r12d, WSASetLastError
mov rcx, rbx
jmp 0x140170eac
cmp dword [rax], 0x64616f6c
jne 0x140170e9f
cmp word [rax + 4], 0x7265
je 0x140170ebe
inc rax
lea r8, [r15 - 5]
sub r8, rax
mov rcx, rax
mov edx, r12d
call fcn.140da1370
test rax, rax
jne 0x140170e8f
jmp 0x140170fd1
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140170fd1
xor r15d, r15d
lea rdx, [rbp + 0x20]
mov r12, qword [rbp + 0x1188]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
test eax, eax
jne 0x140171134
lea r8d, [rax + 0x1e]
lea rdx, str.___Deleted_registry_value:_
call fcn.140159cd4
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 8], rax
and qword [rbp - 0x68], 0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 2
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx]
call fcn.14017426c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140170fbc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171220
call fcn.140cd8948
mov r14, qword [rbp - 0x38]
mov r13, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x70]
jmp 0x140171030
mov r12d, WSASetLastError
lea rbx, [rsp + 0x70]
cmp r13, 0xf
cmova rbx, rsi
mov rax, qword [rbp - 0x80]
cmp rax, 6
jb 0x140171026
lea r15, [rax + rbx]
lea r8, [r15 - 5]
sub r8, rbx
mov rcx, rbx
jmp 0x140171019
cmp dword [rax], 0x64616f6c
jne 0x14017100c
cmp word [rax + 4], 0x7265
je 0x14017111f
inc rax
lea r8, [r15 - 5]
sub r8, rax
mov rcx, rax
mov edx, r12d
call fcn.140da1370
test rax, rax
jne 0x140170ff8
xor r15d, r15d
mov r12, qword [rbp + 0x1188]
mov ebx, dword [rsp + 0x64]
inc ebx
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x60], 0x104
mov dword [rbp + 0x1198], 0x1000
cmp r13, 0xf
jbe 0x140171087
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14017107b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171226
mov rcx, rsi
call fcn.140cd8948
mov r14, qword [rbp - 0x38]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], r15b
cmp r14, 0xf
jbe 0x1401710d0
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401710cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171202
call fcn.140cd8948
lea rax, [rbp + 0x1198]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x20]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1401711ee
mov rsi, qword [rbp + 0x1190]
jmp 0x140170b1d
sub rax, rbx
xor r15d, r15d
cmp rax, 0xffffffffffffffff
je 0x140171029
jmp 0x140170ece
mov r8d, 0x23
lea rdx, str.Failed_to_delete_registry_value:_
call fcn.140159cd4
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x18], rax
and qword [rbp - 0x68], 0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 3
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx]
call fcn.14017426c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140170fbc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140171208
jmp 0x140170fb7
add rsp, 0x1238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3