Function at 0x100020bac
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8e0
mov rax, qword [0x100036110]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
xor r14d, r14d
mov ebx, 0x3fe
lea rcx, [r11 - 0x836]
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
mov word [r11 - 0x838], r14w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4d2]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x4d0], r14w
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], r14d
mov r13d, r14d
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x50], r14
lea r15, [0x1000034e0]
cmp dword [0x1000361bc], r14d
je 0x100020ca3
lea rax, [rsp + 0x40]
lea rsi, [0x100003420]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020e82
lea r8, [0x1000034b8]
mov edx, 0x6c0
jmp 0x100020e75
lea rcx, [0x100003500]
mov dword [rsp + 0x38], r14d
call fcn.10002232c
cmp eax, r14d
mov ebx, eax
jge 0x100020ccc
lea r8, [0x100003520]
mov edx, 0x6c7
jmp 0x100020e75
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, r14d
jne 0x100020d15
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003548]
mov edx, 0x6ca
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
jmp 0x100020e75
mov ecx, dword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, r14d
jne 0x100020d66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rsp + 0x38]
lea r8, [0x100003568]
movzx ebx, ax
mov edx, 0x6cd
mov rcx, r15
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
call fcn.1000267e8
jmp 0x1000210be
xor edx, edx
lea rcx, [rsp + 0x81]
mov byte [rsp + 0x80], r14b
lea r8d, [rdx + 0x47]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x48
call fcn.1000224dc
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, r14d
jne 0x100020de1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003598]
mov edx, 0x6d3
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, r14d
cmovge ebx, eax
jmp 0x100020e75
mov rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020e31
mov r9, qword [rsp + 0x30]
lea r8, [0x1000035b8]
mov edx, 0x6d7
jmp 0x10002103c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
lea rsi, [0x100003420]
mov rdx, rsi
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x100020e82
lea r8, [0x1000035e0]
mov edx, 0x6db
mov rcx, r15
call fcn.1000267e8
jmp 0x1000210be
mov rdx, qword [0x100036218]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r14d
jne 0x10002106d
mov r9, qword [rsp + 0x30]
cmp dword [0x1000361bc], r14d
mov rax, qword [0x100036218]
mov qword [rsp + 0x28], rax
lea r12, [0x100003608]
lea r8, [0x100003618]
mov edx, 0x6e2
mov rcx, r15
cmovne r9, r12
mov qword [rsp + 0x20], rsi
call fcn.1000267e8
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xd0]
mov r9d, 0x200
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000210be
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x10002105c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x100021046
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4d0]
lea rdx, [0x1000034a0]
xor r8d, r8d
mov dword [rsp + 0x58], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
mov ebp, eax
cmp rcx, r14
je 0x100020f9e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
cmp ebp, r14d
jne 0x10002100b
mov rdx, qword [0x100036218]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100021010
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r9, qword [rsp + 0x30]
mov rcx, r15
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
lea rax, [rsp + 0xd0]
cmp ebx, r14d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
jge 0x100021018
lea r8, [0x1000036d0]
mov edx, 0x71b
jmp 0x1000210ae
cmp ebp, 2
jne 0x100021029
inc r13d
jmp 0x100020ed9
lea r8, [0x1000036f8]
mov edx, 0x71c
jmp 0x1000210ae
lea r9, [0x1000034a0]
lea r8, [0x1000036a8]
mov edx, 0x710
mov rcx, r15
call fcn.1000267e8
jmp 0x1000210be
lea r9, [rsp + 0xd0]
lea r8, [0x100003688]
mov edx, 0x6fa
jmp 0x10002103c
mov r9, rsi
lea r8, [0x100003670]
mov edx, 0x6f5
jmp 0x10002103c
cmp eax, 2
je 0x1000210be
movzx ebx, ax
or ebx, edi
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jge 0x1000210f5
mov rax, qword [0x100036218]
mov r9, qword [rsp + 0x30]
lea r12, [0x100003608]
mov qword [rsp + 0x28], rax
lea r8, [0x100003640]
mov edx, 0x6e7
mov qword [rsp + 0x20], rsi
mov rcx, r15
cmp dword [0x1000361bc], r14d
cmovne r9, r12
call fcn.1000267e8
cmp ebx, r14d
jge 0x1000210f5
lea rdx, [rsp + 0x70]
mov ecx, ebx
mov qword [rsp + 0x70], r14
call fcn.100021dec
mov r11, qword [rsp + 0x70]
lea r8, [0x100001b60]
mov r9d, ebx
mov edx, 0x721
mov rcx, r15
mov qword [rsp + 0x20], r11
call fcn.1000267e8
mov rcx, qword [rsp + 0x50]
call fcn.100020838
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x100021114
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x100021129
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x30], r14
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x10002113e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x100021153
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x100021163
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.100033670
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret