Function at 0x140002ff0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbx
push r14
sub rsp, 0x78
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor edi, edi
mov qword [rax - 0x18], r12
mov r14d, edi
mov qword [rax - 0x20], r13
mov r12, rdx
mov r13, r8
mov qword [rax - 0x28], r15
lea r8, [rax - 0x30]
mov qword [rax - 0x50], rdi
lea rdx, [rax - 0x38]
mov qword [rax - 0x40], rdi
mov esi, edi
mov qword [rax - 0x48], rdi
mov ebp, edi
call fcn.1400088d0
test eax, eax
jne 0x140003185
mov r15, qword [rsp + 0x50]
test r15, r15
je 0x140003185
mov rbx, qword [rsp + 0x58]
cmp rbx, 0x8000000
ja 0x140003185
lea edx, [rdi + 1]
lea ecx, [rdi + 0x48]
call fcn.1400200e4
mov rsi, rax
test rax, rax
je 0x140003183
lea r8d, [rdi + 1]
mov qword [rax + 0x20], rbx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x18], rbx
mov rcx, rax
mov qword [rax + 0x28], rbx
mov dword [rax + 0x30], 1
mov dword [rax + 0x38], 1
mov qword [rax + 0x40], rdi
mov qword [rax + 8], r15
mov qword [rax], rdi
call fcn.14000b2d0
mov rcx, rsi
mov ebx, eax
call fcn.1400082a0
mov rbp, qword [rsp + 0x40]
test ebx, ebx
jne 0x140003183
mov rcx, rbp
call fcn.140009dd0
mov r14, rax
test rax, rax
je 0x14000317d
cmp dword [r13 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rcx
mov ebx, edi
jg 0x140003140
mov rcx, qword [r13 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140003107
mov esi, ebx
jmp 0x140003190
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140003131
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.140007d10
or ebx, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
jne 0x14000317d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov r9d, 0x10109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000317d
mov rcx, qword [rsp + 0x48]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
test eax, eax
jne 0x14000317d
lea esi, [rax + 1]
mov eax, edi
jmp 0x14000318a
mov ebx, edi
mov esi, edi
jmp 0x140003190
mov esi, edi
mov eax, 1
mov ebx, edi
test eax, eax
jne 0x1400031ce
mov edx, 1
mov rcx, r12
call fcn.140008460
test eax, eax
jne 0x1400031c1
mov rcx, qword [r12 + 0x18]
mov rdi, qword [r12]
add rdi, rcx
test esi, esi
lea rax, [rcx + 1]
mov qword [r12 + 0x18], rax
setne al
add al, 5
mov byte [rdi], al
jmp 0x1400031d1
js 0x1400031ce
test esi, esi
setne al
add al, 5
mov byte [rdi], al
jmp 0x1400031d1
or ebx, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
test rbp, rbp
je 0x1400031fd
mov rcx, rbp
call fcn.140009590
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x90]
test rcx, rcx
je 0x140003215
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003225
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x140003232
mov rcx, r14
call fcn.14001da20
mov eax, ebx
add rsp, 0x78
pop r14
pop rbx
ret