Function at 0x14006a790
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r15, rdx
mov rbx, rcx
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_296]
nop
mov r9, r15
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_s_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14006a805
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r14d, r14d
jmp 0x14006a9ed
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_4595]
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
mov rdx, rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a9e7
lea rcx, [rbp - 0x28]
call sub.mfc110u.dll_Ordinal_956
nop
mov rsi, qword [rbp - 0x38]
xor r14d, r14d
mov ebx, r14d
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rbp - 0x28]
call sub.mfc110u.dll_Ordinal_13418
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.Sources
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a9d3
cmp dword [rbp + 0x48], 7
jne 0x14006a9c8
mov ecx, dword [rbp + 0x40]
add ecx, 2
call sub.mfc110u.dll_Ordinal_265
mov rdi, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.Sources
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a932
mov ecx, dword [rbp + 0x40]
mov byte [rcx + rdi], bl
mov eax, dword [rbp + 0x40]
inc eax
mov byte [rax + rdi], bl
mov rbx, rdi
cmp word [rdi], r14w
je 0x14006a92d
nop word [rax + rax]
mov r8, rbx
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
call sub.mfc110u.dll_Ordinal_12753
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rbx + rax*2], r14w
jne 0x14006a914
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r14w
jne 0x14006a900
mov ebx, 1
mov rcx, rdi
call sub.mfc110u.dll_Ordinal_266
test ebx, ebx
je 0x14006a9d3
mov esi, r14d
mov edi, r14d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jle 0x14006a9d3
test esi, esi
jne 0x14006a9af
movsxd rbx, edi
test edi, edi
js 0x14006a9a9
cmp rbx, rcx
jge 0x14006a9a9
mov rax, qword [rbp - 0x20]
lea rcx, [rax + rbx*8]
mov rdx, r15
call qword [sym.imp.mfc110u.dll_Ordinal_2848]
mov esi, r14d
test eax, eax
sete sil
test esi, esi
je 0x14006a995
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp - 0x28]
call sub.mfc110u.dll_Ordinal_12157
inc edi
movsxd rax, edi
mov rcx, qword [rbp - 0x18]
cmp rax, rcx
jl 0x14006a955
test esi, esi
je 0x14006a9d3
jmp 0x14006a9af
call sub.mfc110u.dll_Ordinal_2290
int3
xor r9d, r9d
lea r8, [rbp - 0x28]
lea rdx, str.Sources
mov rcx, qword [rbp - 0x38]
call fcn.14006a600
jmp 0x14006a9d3
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x28]
call sub.mfc110u.dll_Ordinal_1419
mov r14d, 1
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
mov eax, r14d
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret