Function at 0x140035ec0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rdx
mov qword [rsp + 0x98], rdx
mov rsi, rcx
mov qword [rsp + 0x68], rcx
mov qword [r11 - 0x50], 7
xor ebp, ebp
mov qword [r11 - 0x58], rbp
mov word [r11 - 0x68], bp
lea r8d, [rbp + 0x1a]
lea rdx, str.DeleteDriverKeysForUpgrade
lea rcx, [r11 - 0x70]
call fcn.140001870
nop
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0x32]
lea r8d, [rbp + 1]
mov rcx, rsi
call fcn.1400144a0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14003649f
mov r14d, ebp
cmp dword [rsp + 0x64], ebp
je 0x1400364eb
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140067ea4
mov r12, rax
test rax, rax
jne 0x14003603c
lea r14d, [rbp + 9]
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
lea rax, str.Insufficient_memory
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0xa]
lea r8d, [rbp + 1]
mov rcx, rsi
call fcn.1400144a0
jmp 0x1400364eb
mov ecx, 8
call fcn.140065e94
test rax, rax
je 0x140036058
lea rcx, [rsp + 0xa8]
mov qword [rax], rcx
jmp 0x14003605b
mov rax, rbp
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.140038cb0
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
mov r8d, 9
lea rdx, str.ImagePath
lea rcx, [rsp + 0x70]
call fcn.140001870
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa8]
call fcn.140009190
nop
cmp qword [rsp + 0x90], 8
jb 0x140036101
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
mov r8d, 5
lea rdx, str.Start
lea rcx, [rsp + 0x70]
call fcn.140001870
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa8]
call fcn.140009190
nop
cmp qword [rsp + 0x90], 8
jb 0x14003615a
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
mov r8d, 4
lea rdx, str.Type
lea rcx, [rsp + 0x70]
call fcn.140001870
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa8]
call fcn.140009190
nop
cmp qword [rsp + 0x90], 8
jb 0x1400361b3
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov r13d, dword [rsp + 0x64]
dec r13d
js 0x140036416
lea rdi, str.RegEnumValue
lea r15, str.Error___i__return_by_function___s_
nop
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0xa0], eax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0xa0]
mov r8, r12
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14003624e
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
mov r14d, 4
jmp 0x14003640c
xor bpl, bpl
mov rcx, qword [rsp + 0xc0]
mov rbx, rcx
mov rsi, qword [rsp + 0xc8]
cmp rcx, rsi
jbe 0x14003627e
call fcn.1400679f0
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rbx
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0xf0], xmm0
mov rdi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
cmp rcx, rsi
jbe 0x1400362c1
call fcn.1400679f0
test rdi, rdi
je 0x1400362d0
cmp rdi, qword [rsp + 0xa8]
je 0x1400362d5
call fcn.1400679f0
cmp rbx, rsi
je 0x140036355
test bpl, bpl
jne 0x1400363ce
test rdi, rdi
jne 0x1400362f2
call fcn.1400679f0
xor r11d, r11d
jmp 0x1400362f5
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x20]
jb 0x140036300
call fcn.1400679f0
cmp qword [rbx + 0x20], 8
jb 0x14003630d
mov rdx, qword [rbx + 8]
jmp 0x140036311
lea rdx, [rbx + 8]
mov rcx, r12
call fcn.1400668a8
test eax, eax
sete bpl
test rdi, rdi
jne 0x14003632e
call fcn.1400679f0
xor r11d, r11d
jmp 0x140036331
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x20]
jb 0x14003633c
call fcn.1400679f0
add rbx, 0x28
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
jmp 0x1400362b7
test bpl, bpl
jne 0x1400363e6
mov rdx, r12
mov rbx, qword [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400363fe
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
lea rcx, str.RegDeleteValue
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov edx, 0xa
lea r8d, [rdx - 9]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call fcn.1400144a0
xor ebp, ebp
lea r14d, [rbp + 4]
lea rdi, str.RegEnumValue
jmp 0x14003640c
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x98]
xor ebp, ebp
lea rdi, str.RegEnumValue
jmp 0x14003640c
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x98]
xor ebp, ebp
lea rdi, str.RegEnumValue
jmp 0x14003640c
mov rsi, qword [rsp + 0x68]
xor ebp, ebp
lea rdi, str.RegEnumValue
sub r13d, 1
jns 0x1400361d0
mov rcx, r12
call fcn.140067eac
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x140036478
mov rdi, qword [rsp + 0xc8]
cmp rcx, rdi
je 0x140036473
lea rbx, [rcx + 0x20]
nop dword [rax]
cmp qword [rbx], 8
jb 0x14003644f
mov rcx, qword [rbx - 0x18]
call fcn.140065920
mov qword [rbx], 7
mov qword [rbx - 8], rbp
mov word [rbx - 0x18], bp
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x140036440
mov rcx, qword [rsp + 0xc0]
call fcn.140065920
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rbp
mov rcx, qword [rsp + 0xa8]
call fcn.140065920
jmp 0x1400364eb
mov r14d, 4
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
lea rcx, str.RegQueryInfoKey
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea r15, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], r15
lea edx, [r14 + 6]
lea r8d, [r14 - 3]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
mov dword [rsp + 0x28], r14d
lea rax, str.Return_code___i_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae r9, qword [rsp + 0x110]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rsi
call fcn.1400144a0
nop
cmp qword [rsp + 0x128], 8
jb 0x14003657c
mov rcx, qword [rsp + 0x110]
call fcn.140065920
mov eax, r14d
jmp 0x14003657f
mov eax, r14d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret