Function at 0x140001970
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdi, [0x1400c8ea0]
mov r13d, 0x80070057
mov rsi, rcx
mov rbx, rdi
mov r15, 0xffffffffffffffff
mov r12d, 0x7ffffffe
lea r14d, [r13 - 0x49]
test rcx, rcx
je 0x14000ffe7
mov rdi, r15
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400019d1
inc rdi
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.14000d114
xor r9d, r9d
mov r8, rax
test rax, rax
je 0x140001c7a
lea rax, [rdi - 1]
cmp rax, r12
ja 0x14000ffca
mov rdx, r12
mov rax, r8
sub rdx, rdi
mov ebp, r9d
sub rsi, r8
nop dword [rax]
lea rcx, [rdi + rdx]
test rcx, rcx
je 0x140001a4d
movzx ecx, word [rsi + rax]
test cx, cx
je 0x140001a44
mov word [rax], cx
add rax, 2
sub rdi, 1
jne 0x140001a20
jmp 0x14000ffbc
test rdi, rdi
je 0x14000ffbc
mov word [rax], r9w
test ebp, ebp
js 0x140001c30
mov rbx, r8
mov r8, r9
mov rcx, r8
call fcn.14000d154
xor r9d, r9d
lea rax, [0x1400c8ea2]
test ebp, ebp
js 0x14000ffdf
mov rdi, r9
mov rsi, r9
mov rbp, r15
inc rbp
cmp word [rbx + rbp*2], 0
jne 0x140001a82
add rbp, 0x26
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.14000d114
xor r11d, r11d
mov r15, rax
test rax, rax
je 0x140001c55
lea rax, [rbp - 1]
cmp rax, r12
ja 0x14001000a
mov r9, r12
mov r10, rbx
sub r9, rbp
mov rcx, rbp
sub r10, r15
mov rdx, r15
mov r8d, r11d
lea rax, [rcx + r9]
test rax, rax
je 0x140001b06
movzx eax, word [rdx + r10]
test ax, ax
je 0x140001afd
mov word [rdx], ax
inc r8
add rdx, 2
sub rcx, 1
jne 0x140001ad5
jmp 0x14000fff7
test rcx, rcx
je 0x14000fff7
mov word [rdx], r11w
mov r14d, r11d
mov rsi, rbp
lea rdi, [r15 + r8*2]
sub rsi, r8
test r14d, r14d
js 0x140001c55
lea rax, [rsi - 1]
cmp rax, r12
ja 0x14001002e
sub r12, rsi
lea rcx, str.Local_SettingsPrintersPropertyBags
sub rcx, rdi
mov r13d, r11d
nop dword [rax]
lea rax, [rsi + r12]
test rax, rax
je 0x140001b6d
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140001b64
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x140001b40
jmp 0x14001001f
test rsi, rsi
je 0x14001001f
mov word [rdi], r11w
mov r14d, r13d
test r13d, r13d
js 0x140001c55
lea rax, [0x1400c8ea0]
cmp rbx, rax
je 0x140001ba0
lea rax, [0x1400c8ea2]
cmp rbx, rax
je 0x140001ba0
mov rcx, rbx
call fcn.14000d154
xor r11d, r11d
mov rbx, r15
mov r15, r11
mov rcx, r15
call fcn.14000d154
xor r11d, r11d
mov rdx, rbx
test r14d, r14d
js 0x140001bf9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r11
mov r9d, 0x1000b
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140010043
lea rcx, [rsp + 0x50]
call fcn.14004a5e0
mov rdx, rbx
call fcn.14004326c
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000d4b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rax, [0x1400c8ea0]
cmp r8, rax
lea rax, [0x1400c8ea2]
je 0x140001a71
cmp r8, rax
jne 0x140001a5f
jmp 0x140001a71
lea rax, [0x1400c8ea0]
cmp r15, rax
je 0x140001bb1
lea rax, [0x1400c8ea2]
cmp r15, rax
jne 0x140001ba6
jmp 0x140001bb1
mov ebp, r14d
jmp 0x140001c30
sub rax, 2
mov ebp, 0x8007007a
jmp 0x140001a4d
mov ebp, r13d
test rdi, rdi
je 0x140001a51
mov word [r8], r9w
jmp 0x140001c30
mov rbx, rax
jmp 0x140001a79
mov rdx, rdi
call fcn.14004326c
xor r9d, r9d
jmp 0x140001a79
dec r8
mov word [rdx - 2], r11w
mov r14d, 0x8007007a
jmp 0x140001b0d
mov r14d, r13d
test rbp, rbp
je 0x140001b17
mov word [r15], r11w
jmp 0x140001c55
sub rdi, 2
mov r13d, 0x8007007a
jmp 0x140001b6d
mov r14d, r13d
test rsi, rsi
je 0x140001b71
mov word [rdi], r11w
jmp 0x140001c55
xor edx, edx
lea rcx, [0x1400bbe30]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
xor ebp, ebp
lea rcx, [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x40], rbp
call fcn.1400775a8
test rdi, rdi
je 0x140010113
lea rdx, str.SplIsValidUserPropertyBag
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140010118
mov edi, ebp
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140010118
movabs r10, 0xaaed3f023adb1270
lea rcx, [rsp + 0x60]
mov rax, rsi
call qword [0x1400a8400]
test al, al
jne 0x14001010f
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
inc edi
jmp 0x1400100a0
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x40]
call fcn.1400775a8
nop
jmp 0x140001bec