Function at 0x14003184c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
push r12
push r14
sub rsp, 0x9e0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x9d0], rax
mov r12, rcx
lea r8, str.CRegistryUninstaller::DeleteUserSettings____n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
mov byte [rsp + 0xc0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xc1]
call fcn.1400988d0
mov ecx, 8
call fcn.140061238
test rax, rax
je 0x1400318d6
lea rcx, [rsp + 0x38]
mov qword [rax], rcx
jmp 0x1400318d8
xor eax, eax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.140005ed4
mov qword [rsp + 0x60], rax
and qword [rsp + 0x68], 0
mov qword [rsp + 0xb8], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0xb0], 0
mov byte [rsp + 0xa0], 0
lea rcx, str.Scrubber.RegistryUninstaller.UserSettings
call fcn.1400980d0
mov r8, rax
lea rdx, str.Scrubber.RegistryUninstaller.UserSettings
lea rcx, [rsp + 0x98]
call fcn.14000352c
nop
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0x10
cmovae rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [r12 + 0xd0]
call fcn.14003e968
mov ebx, 1
mov edx, ebx
mov rcx, qword [r12 + 0x88]
call fcn.14003ebb0
test eax, eax
je 0x1400319a3
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0x10
cmovae rcx, qword [rsp + 0xa0]
mov r9d, ebx
lea r8, [rsp + 0x38]
mov edx, ebx
call fcn.14003ef14
cmp qword [rsp + 0x68], 0
je 0x140031b3f
mov byte [rsp + 0x1d0], 0
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rsp + 0x1d1]
call fcn.1400988d0
and qword [rsp + 0x30], 0
xor ebp, ebp
mov r9d, 0x103
lea r8, [rsp + 0xc0]
xor edx, edx
mov r14, 0xffffffff80000003
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140031b3f
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsi]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x70], xmm0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
test rdi, rdi
je 0x140031a3b
cmp rdi, rax
je 0x140031a40
call fcn.14009861c
cmp rbx, rsi
je 0x140031b1c
test rdi, rdi
jne 0x140031a58
call fcn.14009861c
xor r11d, r11d
jmp 0x140031a5b
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140031a66
call fcn.14009861c
cmp qword [rbx + 0x30], 0x10
jb 0x140031a73
mov rax, qword [rbx + 0x18]
jmp 0x140031a77
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0]
lea r8, [0x1400c63b8]
mov edx, 0x800
lea rcx, [rsp + 0x1d0]
call fcn.14009841c
and dword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x1d0]
mov rcx, r14
call fcn.14004e070
test eax, eax
jne 0x140031aed
mov rcx, qword [rsp + 0x30]
call fcn.14004e608
lea r9, [rsp + 0x1d0]
lea r8, str.HKEY_USERS
mov rdx, r14
mov rcx, r12
call fcn.14002ffb0
test rdi, rdi
jne 0x140031afc
call fcn.14009861c
xor r11d, r11d
jmp 0x140031aff
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x140031b0a
call fcn.14009861c
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
jmp 0x140031a31
inc ebp
mov r9d, 0x103
lea r8, [rsp + 0xc0]
mov edx, ebp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1400319fc
lea r8, str.CRegistryUninstaller::DeleteUserSettings____n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
nop
cmp qword [rsp + 0xb8], 0x10
jb 0x140031b70
mov rcx, qword [rsp + 0xa0]
call fcn.14006127c
mov qword [rsp + 0xb8], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0xb0], 0
mov byte [rsp + 0xa0], 0
lea rcx, [rsp + 0x38]
call fcn.140007328
mov rcx, qword [rsp + 0x60]
call fcn.14006127c
and qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
call fcn.14006127c
xor eax, eax
mov rcx, qword [rsp + 0x9d0]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret