Function at 0x1400b2da8
Capabilities:
Delete registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, qword [rdx]
xor esi, esi
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov rdi, rcx
test rbx, rbx
je 0x1400b2e0e
mov byte [rbp - 0x29], sil
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rbx
mov dword [rbp - 0x25], eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [rbp - 0x29]
call fcn.1401040a0
mov qword [r14], rsi
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400b2e1e
mov rdx, qword [rdi]
mov r9d, r12d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400b3064
cmp eax, 5
jne 0x1400b3066
lea rdx, str.SeBackupPrivilege
lea rcx, [rbp - 9]
call fcn.14008c350
lea rcx, [rbp - 9]
call fcn.14025c4c4
lea rcx, [rbp - 9]
mov bl, al
call fcn.14007a7c0
test bl, bl
je 0x1400b305d
lea r9, [rbp - 0x21]
mov dword [rbp - 0x21], esi
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140103fe8
mov ebx, eax
test eax, eax
je 0x1400b2eea
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1400b2ee3
cmp qword [rdi + 0x18], 8
jb 0x1400b2ea4
mov rdi, qword [rdi]
lea rcx, str.Could_not_open_the_registry_key
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rcx
lea rdx, [0x14044c416]
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov dword [rbp - 0x29], ebx
call fcn.140008b90
mov eax, ebx
jmp 0x1400b3066
cmp dword [rbp - 0x21], 1
jne 0x1400b3064
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1400b2f4a
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x1400b2f0b
mov rcx, qword [rdi]
mov qword [rbp - 0x11], rcx
lea rdx, [0x14044c416]
lea rcx, str.Created_a_new_key_where_one_should_have_existed
mov dword [rbp - 0x29], esi
mov qword [rbp - 0x19], rcx
xor r8d, r8d
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140008b90
lea rdx, str.SeRestorePrivilege
lea rcx, [rbp - 9]
call fcn.14008c350
lea rcx, [rbp - 9]
call fcn.14025c4c4
lea rcx, [rbp - 9]
call fcn.14007a7c0
lea r9, [rbp - 0x21]
mov qword [r14], rsi
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140103fe8
mov ebx, eax
test eax, eax
je 0x1400b2fe1
mov r8d, eax
lea rcx, str.RegOpenKeyWithBackup_should_be_able_to_open_whatever_it_created.
mov edx, eax
call fcn.140315b50
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1400b2ee3
cmp qword [rdi + 0x18], 8
jb 0x1400b2fb0
mov rdi, qword [rdi]
lea rcx, str.Could_not_re_open_the_registry_key
mov qword [rbp - 0x11], rdi
mov qword [rbp - 0x19], rcx
lea rdx, [0x14044c416]
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x19]
jmp 0x1400b2ed0
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400b305d
call fcn.14007e73c
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1400b304e
cmp qword [rdi + 0x18], 8
jb 0x1400b300f
mov rdi, qword [rdi]
lea rcx, str.Could_not_delete_the_registry_key
mov qword [rbp - 0x11], rdi
mov qword [rbp - 0x19], rcx
lea rdx, [0x14044c416]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x29], ebx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140008b90
cmp ebx, 0xc0000022
setne sil
lea eax, [rsi + 5]
jmp 0x1400b3066
mov eax, 0xa
jmp 0x1400b3066
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140112420
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret