Function at 0x1400075f0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
sub rsp, 0x370
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140094840]
xor rax, rsp
mov qword [rbp + 0x300], rax
movabs rax, 0xae552476bcdd7c1c
movabs r8, 0xae312418bcb47c4b
mov qword [rbp + 0xc0], rax
movabs rdx, 0x104991b5429187e8
mov rax, qword [rbp + 0xc0]
mov qword [rbp], rax
movabs rax, 0x104991c642e68787
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xc0], r8
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xc0], rdx
mov rax, qword [rbp + 0xc0]
movdqa xmm0, xmmword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xae65245ebcfb7c18
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x20], rax
movabs rax, 0x100c91e742d087bf
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x28], rax
movabs rax, 0x63eb602714033821
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x30], rax
movabs rax, 0xb557fa28350c51f0
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x38], rax
movabs rax, 0x7d7c681023acedf9
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x40], rax
movabs rax, 0xbafcf40d9ee5cb45
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x48], rax
movabs rax, 0x16d4758ec3a09126
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x50], rax
movabs rax, 0x558bb66d906409b3
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x58], rax
movabs rax, 0x1e75a0b6761e961d
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x60], rax
movabs rax, 0x224b989434bbe602
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x68], rax
movabs rax, 0x364a27931080120b
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x70], rax
movabs rax, 0x9e3df82c203e089a
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x78], rax
movabs rax, 0xf11c46883a5925e2
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x80], rax
movabs rax, 0xfe4d89255f1bd131
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x88], rax
movabs rax, 0x53da8f4f59898aab
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x90], rax
movabs rax, 0xe8bfbae2117faaef
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
movabs rcx, 0x8b890d8b7d558912
mov qword [rbp + 0x98], rax
movabs rax, 0x8b757eb8ed298d1a
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xa0], rax
movabs rax, 0x35891411cafb0b8f
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xa8], rax
movabs rax, 0x69731e9a5b961865
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], rcx
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], r8
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xc0], rdx
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xe8], rax
movabs rax, 0x6388604e144e387d
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xf0], rax
movabs rax, 0xb538fa5b35635182
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xf8], rax
movabs rax, 0x7d2b684c23d8ed9f
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x100], rax
movabs rax, 0xba93f4699e8bcb2c
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x108], rax
movabs rax, 0x169775d2c3d39151
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x110], rax
movabs rax, 0x55eeb61f901609c6
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x118], rax
movabs rax, 0x1e10a0e0766a9673
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x120], rax
movabs rax, 0x222498fd34c8e670
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x128], rax
movabs rax, 0x363227d610dc1265
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x130], rax
movabs rax, 0x9e4ff843205208ea
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x138], rax
movabs rax, 0xf15a46d43a2b2587
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x140], rax
movabs rax, 0xfe3889515f7ad154
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x148], rax
movabs rax, 0x53a98f1a59ec8ad9
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x150], rax
movabs rax, 0xe8e3ba871118aa8e
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x158], rax
movabs rax, 0x8b267ec8ed598d5b
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0xc0]
mov r9d, 9
mov qword [rbp + 0x160], rax
xor r8d, r8d
movabs rax, 0x35ea1465ca920bf8
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x168], rax
movabs rax, 0x69731efe5bf3180d
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xc0], rcx
mov rcx, 0xffffffff80000001
mov rax, qword [rbp + 0xc0]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x40], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rbp + 0x178], rax
lea rax, [rbp + 0xd0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xa0], ymm1
mov qword [rsp + 0x20], rax
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007cd3
mov rcx, qword [rbp + 0xd0]
lea r9, [rbp + 0xc8]
xor edi, edi
mov dword [rbp + 0xc8], 0x104
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140007cc6
nop word [rax + rax]
lea rdx, [rbp]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140007c81
lea rax, [rbp + 0xc0]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007c81
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xd0]
lea r9, [rbp + 0xc8]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x30], rdi
inc ebx
mov qword [rsp + 0x28], rdi
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0xc8], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140007c20
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140071e50
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret