Function at 0x14002be10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd8
xor esi, esi
mov dword [rbp + 0x77], 2
xorps xmm0, xmm0
mov qword [rbp - 0x41], rsi
mov rax, rcx
mov qword [rbp - 0x59], rsi
xor ecx, ecx
mov qword [rbp - 0x49], rsi
mov qword [rbp + 0x17], rcx
mov r13, rdx
mov r14d, esi
mov r15d, esi
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
test rax, rax
je 0x14002c26e
cmp qword [rax + 8], rcx
je 0x14002c26e
test rdx, rdx
je 0x14002c26e
mov rcx, qword [rdx + 0x48]
test rcx, rcx
je 0x14002c26e
mov rdx, qword [rdx + 0x50]
test rdx, rdx
je 0x14002c26e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], sil
jne 0x14002bea5
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], sil
jne 0x14002beb5
inc rax
add rax, rdx
cmp rax, 0x7fff
ja 0x14002c26e
mov qword [rsp + 0xd0], r12
call fcn.14002c9a0
mov r12, rax
test rax, rax
jne 0x14002bf03
lea eax, [r12 + 6]
mov r12, qword [rsp + 0xd0]
add rsp, 0xd8
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [r13 + 0x50]
mov qword [rsp + 0x118], rdi
call fcn.14002c9a0
mov qword [rbp + 0x7f], rax
mov rdi, rax
test rax, rax
jne 0x14002bf28
lea ebx, [rax + 6]
jmp 0x14002c164
mov rdi, rsi
lea rsi, str.HKEY_LOCAL_MACHINE
mov rcx, qword [rsi]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], r14w
jne 0x14002bf40
mov r8, rbx
mov rdx, r12
call fcn.14021f144
test eax, eax
je 0x14002bf66
inc rdi
add rsi, 0x10
cmp rdi, 0xa
jb 0x14002bf32
cmp rdi, 0xa
jne 0x14002bf76
lea ebx, [rdi - 9]
xor esi, esi
jmp 0x14002c160
movzx eax, word [r12 + rbx*2]
lea rdx, [r12 + rbx*2]
cmp ax, 0x5c
je 0x14002bfa0
test ax, ax
je 0x14002bf96
mov ebx, 1
xor esi, esi
jmp 0x14002c160
cmp ax, 0x5c
jne 0x14002bfae
nop dword [rax]
movzx eax, word [rdx + 2]
add rdx, 2
cmp ax, 0x5c
je 0x14002bfa0
add rdi, rdi
lea rsi, str.HKEY_LOCAL_MACHINE
mov rsi, qword [rsi + rdi*8 + 8]
mov qword [rbp - 0x41], rsi
test ax, ax
je 0x14002bffc
test rdx, rdx
je 0x14002bffc
lea rax, [rbp - 0x59]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14002bff6
mov ebx, recv
xor esi, esi
jmp 0x14002c160
mov rcx, qword [rbp - 0x59]
jmp 0x14002c003
mov rcx, rsi
mov qword [rbp - 0x59], rcx
mov rdi, qword [rbp + 0x7f]
lea rax, [rbp - 0x49]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c047
mov r9, qword [rbp + 0x67]
mov r8, rdi
mov rcx, qword [rbp - 0x49]
mov rdx, r12
mov qword [rsp + 0x20], r13
call fcn.14002b200
mov ebx, eax
xor esi, esi
jmp 0x14002c176
mov rcx, qword [rbp - 0x59]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
xor esi, esi
lea rax, [rbp - 0x49]
mov ebx, 1
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, rdi
mov dword [rsp + 0x20], esi
mov dword [rbp + 0x77], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002c093
lea ebx, [rsi + 3]
jmp 0x14002c164
mov rcx, qword [rbp - 0x49]
lea rax, [0x140029da0]
mov qword [rbp - 0x31], rax
lea rax, [0x140029d30]
mov qword [rbp - 0x29], rax
lea rax, [0x140029db0]
mov qword [rbp - 0x21], rax
lea rax, [0x140029e20]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x11], rax
lea r14, [rbp - 0x39]
mov qword [rbp + 0x17], 0xffffffffffffffff
mov qword [rbp - 9], rcx
mov qword [rbp - 0x51], rsi
test rcx, rcx
je 0x14002c125
lea rax, [rbp - 0x51]
mov edx, 4
mov qword [rsp + 0x38], rax
call fcn.140027f20
test eax, eax
jne 0x14002c125
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov ecx, eax
mov edi, eax
call fcn.1402122d0
mov qword [rbp + 7], rax
test rax, rax
jne 0x14002c1e1
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 3
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14002c138
call fcn.1402122e0
mov qword [rbp + 0xf], 0
mov qword [rbp + 7], rsi
test ebx, ebx
jne 0x14002c160
mov rcx, qword [rbp - 9]
lea edx, [rbx + 4]
mov r8, r15
call fcn.140027d60
test eax, eax
je 0x14002c176
mov ebx, 3
mov rdi, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14002c176
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, r15
call fcn.1402122e0
mov rcx, qword [rbp - 0x59]
mov rdi, qword [rsp + 0x118]
test rcx, rcx
je 0x14002c19b
cmp rcx, qword [rbp - 0x41]
je 0x14002c19b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14002c1aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14002c1c9
mov rcx, qword [r14 + 0x40]
test rcx, rcx
je 0x14002c1bd
call fcn.1402122e0
mov qword [r14 + 0x48], 0
mov qword [r14 + 0x40], rsi
mov rcx, r12
call fcn.1402122e0
mov rcx, qword [rbp + 0x7f]
call fcn.1402122e0
mov eax, ebx
jmp 0x14002beea
mov rdx, qword [rbp - 0x51]
mov r8, rdi
mov rcx, rax
call fcn.14020d920
mov rcx, qword [rbp - 0x51]
mov dword [rbp + 0xf], edi
mov dword [rbp + 0x13], esi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp - 0x39]
mov r9d, ebx
mov r8, r13
call fcn.140028440
mov ebx, eax
test eax, eax
jne 0x14002c12a
mov rcx, qword [rbp + 7]
test rcx, rcx
jne 0x14002c233
mov qword [rbp + 0xf], rsi
mov qword [rbp + 7], rsi
jmp 0x14002c15b
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je 0x14002c125
mov ecx, dword [rbp + 0xf]
call fcn.1402122d0
mov r15, rax
test rax, rax
jne 0x14002c259
lea ebx, [rax + 6]
jmp 0x14002c12a
mov r8d, dword [rbp + 0xf]
mov rcx, rax
mov rdx, qword [rbp + 7]
call fcn.14020d920
jmp 0x14002c12a
mov eax, 1
add rsp, 0xd8
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret