Function at 0x140034db0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r9b
mov byte [rsp + 0x60], bl
mov rbp, r8
mov qword [rsp + 0x90], r8
mov rdi, rdx
mov qword [rsp + 0x80], rdx
mov rsi, rcx
mov qword [r11 - 0x40], 7
xor eax, eax
mov qword [r11 - 0x48], rax
mov word [r11 - 0x58], ax
lea r8d, [rax + 0x15]
lea rdx, str.EliminarArbolRegistro
lea rcx, [r11 - 0x60]
call fcn.140001870
nop
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rsi
call fcn.1400144a0
mov eax, 0x20b
mov r9d, 0xb
test bl, bl
cmovne r9d, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400352b6
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
lea rbp, str.Error___i__return_by_function___s_
test eax, eax
jne 0x1400351d9
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140067ea4
mov rbp, rax
test rax, rax
jne 0x140034f69
mov ebx, 8
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], rbx
cmovae r9, qword [rsp + 0xb0]
lea rax, str.Insufficient_memory
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0xa]
lea r8d, [rbp + 1]
mov rcx, rsi
call fcn.1400144a0
lea rbp, str.Error___i__return_by_function___s_
jmp 0x14003523b
mov edi, dword [rsp + 0x88]
test edi, edi
je 0x140035067
dec edi
js 0x140035067
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8, rbp
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test eax, eax
jne 0x140035020
mov rdx, rbp
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
jne 0x140034fd7
sub edi, 1
jns 0x140034f80
jmp 0x140035067
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegDeleteValue
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
jmp 0x140035067
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegEnumValue
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
mov rcx, rbp
call fcn.140067eac
cmp dword [rsp + 0x7c], 0
je 0x14003522c
test ebx, ebx
jne 0x14003521b
mov ecx, dword [rsp + 0x68]
inc ecx
mov dword [rsp + 0x68], ecx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140067ea4
mov rbp, rax
test rax, rax
jne 0x1400350fc
mov ebx, 8
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], rbx
cmovae r9, qword [rsp + 0xb0]
lea rax, str.Insufficient_memory
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0xa]
lea r8d, [rbp + 1]
mov rcx, rsi
call fcn.1400144a0
lea rbp, str.Error___i__return_by_function___s_
mov rdi, qword [rsp + 0x80]
jmp 0x14003523b
mov edi, dword [rsp + 0x7c]
dec edi
js 0x1400351c0
nop dword [rax + rax]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8, rbp
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jne 0x140035179
movzx r9d, byte [rsp + 0x60]
mov r8, rbp
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.140034db0
test al, al
je 0x140035172
sub edi, 1
jns 0x140035110
jmp 0x1400351c0
mov ebx, 1
jmp 0x1400351c0
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegEnumKeyEx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
mov rcx, rbp
call fcn.140067eac
lea rbp, str.Error___i__return_by_function___s_
mov rdi, qword [rsp + 0x80]
jmp 0x14003523b
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegQueryInfoKey
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
jmp 0x14003523b
lea rbp, str.Error___i__return_by_function___s_
mov rdi, qword [rsp + 0x80]
jmp 0x14003523b
lea rbp, str.Error___i__return_by_function___s_
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140035308
mov rdx, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x140035308
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegDeleteKey
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
jmp 0x140035308
cmp eax, 2
jne 0x1400352c1
xor ecx, ecx
mov ebx, ecx
jmp 0x140035308
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.RegOpenKeyEx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
mov dword [rsp + 0x28], ebx
lea rax, str.Return_code__0x_x_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r9, qword [rsp + 0xb0]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rsi
call fcn.1400144a0
test ebx, ebx
sete bl
cmp qword [rsp + 0xc8], 8
jb 0x1400353a3
mov rcx, qword [rsp + 0xb0]
call fcn.140065920
mov al, bl
jmp 0x1400353a5
mov al, bl
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140064b70
add rsp, 0xe8
pop rdi
pop rsi
pop rbp
pop rbx
ret