Function at 0x1400af520
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov dword [rsp + 0x10], edx
push r14
sub rsp, 0x1c0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov esi, edx
xor ebx, ebx
mov qword [r11 - 0x118], rbx
mov qword [r11 - 0x120], rbx
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0x98], ebx
movdqa xmm0, xmmword [0x140324140]
movdqu xmmword [r11 - 0x68], xmm0
mov word [r11 - 0x78], bx
movdqu xmmword [rsp + 0x140], xmm0
mov word [rsp + 0x130], bx
movdqu xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x110], bx
movdqu xmmword [rsp + 0x100], xmm0
mov word [rsp + 0xf0], bx
mov qword [r11 - 0x138], rbx
xor edx, edx
lea rcx, [r11 - 0x138]
call fcn.14006e14c
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAppListBackup
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov dword [rsp + 0x84], eax
test eax, eax
jne 0x1400af90c
mov dword [rsp + 0x84], 8
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r14d, [rbx + 0x40]
mov r9d, r14d
lea r8, str.LastRun
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rsp + 0x80], eax
mov edi, 0x490
test eax, eax
je 0x1400af68a
cmp eax, edi
je 0x1400af68a
cmp eax, 2
je 0x1400af68a
lea r8, [rsp + 0x80]
lea rdx, str.LastRun
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
mov dword [rsp + 0x84], 8
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
lea r8, str.LastAppBackupListenerStartTime
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400af703
cmp eax, edi
je 0x1400af703
cmp eax, 2
je 0x1400af703
lea r8, [rsp + 0x80]
lea rdx, str.LastAppBackupListenerStartTime
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
mov r14d, 4
mov dword [rsp + 0x84], r14d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9d, [r14 + 0xc]
lea r8, str.IsMSAAttached
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400af780
cmp eax, edi
je 0x1400af780
cmp eax, 2
je 0x1400af780
lea r8, [rsp + 0x80]
lea rdx, str.hx1_
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
mov dword [rsp + 0x84], r14d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.IsBackupEnabledAndMSAAttached
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400af7f9
cmp eax, edi
je 0x1400af7f9
cmp eax, 2
je 0x1400af7f9
lea r8, [rsp + 0x80]
lea rdx, str.IsBackupEnabledAndMSAAttached
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
lea rdx, str.BackupProfileId
lea rcx, [rsp + 0x190]
call fcn.14005c5d0
nop
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x190]
mov rdx, qword [rsp + 0x90]
call fcn.1400b0b14
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400af85a
cmp eax, edi
je 0x1400af85a
cmp eax, 2
je 0x1400af85a
lea r8, [rsp + 0x80]
lea rdx, str.BackupProfileId
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
lea rdx, str.RestoreProfileId
lea rcx, [rsp + 0x170]
call fcn.14005c5d0
nop
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x170]
mov rdx, qword [rsp + 0x90]
call fcn.1400b0b14
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1400af8bb
cmp eax, edi
je 0x1400af8bb
cmp eax, 2
je 0x1400af8bb
lea r8, [rsp + 0x80]
lea rdx, str.RestoreProfileId
lea rcx, str.RegGetValueW_failed_for:
call fcn.1400ae8c0
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x110]
mov rdx, qword [rsp + 0x90]
call fcn.1400afc54
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x170]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x190]
call fcn.14000a8ac
jmp 0x1400af928
lea r8, [rsp + 0x84]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAppListBackup
lea rcx, str.RegOpenKeyEx_failed_for:
call fcn.1400ae8c0
nop
lea rcx, [rsp + 0x90]
call fcn.14009a144
nop
jmp 0x1400af93f
call fcn.1400b0cf8
mov edi, eax
cmp eax, 0xf
sete r14b
call fcn.1401ca460
mov rcx, rax
cmp dword [rax], 5
jbe 0x1400afb04
movabs rdx, 0x800000000000
call fcn.14004c478
test al, al
je 0x1400afb04
mov qword [rsp + 0xb8], 0x1000000
mov byte [rsp + 0x88], r14b
mov dword [rsp + 0x84], edi
lea rax, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rax, qword [rsp + 0xf0]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae rax, qword [rsp + 0x110]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rax, qword [rsp + 0x130]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rax, qword [rsp + 0x150]
mov qword [rsp + 0xd8], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0x90], esi
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rdx, [0x14032a9e6]
call fcn.140001f8c
nop
lea rcx, [rsp + 0xf0]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x110]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x130]
call fcn.14000a8ac
nop
lea rcx, [rsp + 0x150]
call fcn.14000a8ac
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret