Function at 0x140071980
Capabilities:
Delete registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r14d, r14d
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x61], rcx
xorps xmm0, xmm0
mov qword [rbp - 0x59], r14
mov rdi, rdx
mov qword [rbp - 0x51], r14
mov esi, r14d
mov dword [rbp - 0x49], 2
mov ebx, r14d
mov r12d, r14d
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
test rcx, rcx
je 0x140071e38
cmp qword [rcx + 8], rbx
je 0x140071e38
test rdx, rdx
je 0x140071e38
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x140071e38
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140071e38
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140071a20
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rdx + rcx], bl
jne 0x140071a30
inc rax
add rax, rcx
cmp rax, 0x7fff
ja 0x140071e38
mov rcx, rdx
mov qword [rsp + 0xf0], r15
call fcn.14006b870
mov r15, rax
test rax, rax
jne 0x140071a8a
lea eax, [r15 + 6]
mov r15, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0xf8
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rdi + 0x50]
mov qword [rsp + 0x140], r13
call fcn.14006b870
mov r13, rax
test rax, rax
jne 0x140071aab
lea edi, [rax + 6]
jmp 0x140071dd4
mov edi, 1
lea rdx, str.Restoring_registry_key:___s_s_
mov ecx, edi
mov r9, r13
mov r8, r15
call fcn.14006e290
lea r14, str.HKEY_LOCAL_MACHINE
nop dword [rax + rax]
mov rcx, qword [r14]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x140071ae0
mov r8, rbx
mov rdx, r15
call fcn.140307f40
test eax, eax
je 0x140071b06
inc rsi
add r14, 0x10
cmp rsi, 0xa
jb 0x140071ad0
cmp rsi, 0xa
jne 0x140071b2e
lea rdx, str.Unknown_predefined_key_in_registry_key_name:___s_
mov r8, r15
mov ecx, 3
call fcn.14006e290
xor r14d, r14d
mov rbx, r12
mov rsi, r12
jmp 0x140071dd4
movzx eax, word [r15 + rbx*2]
lea rdx, [r15 + rbx*2]
cmp ax, 0x5c
je 0x140071b51
test ax, ax
je 0x140071b4b
lea rdx, str.Unexpected_predefined_key_in_registry_key_name:___s_
jmp 0x140071b13
cmp ax, 0x5c
jne 0x140071b5f
movzx eax, word [rdx + 2]
add rdx, 2
cmp ax, 0x5c
je 0x140071b51
add rsi, rsi
test ax, ax
lea rax, str.HKEY_LOCAL_MACHINE
mov rsi, qword [rax + rsi*8 + 8]
je 0x140071bc4
test rdx, rdx
je 0x140071bc4
lea rax, [rbp - 0x59]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140071bbe
mov r9d, eax
lea rdx, str.Unable_to_open_registry_key_for_writing__key:___s___winError:__d_
mov r8, r15
mov ecx, 3
call fcn.14006e290
xor r14d, r14d
mov edi, ntohs
mov rbx, r12
jmp 0x140071dd4
mov rcx, qword [rbp - 0x59]
jmp 0x140071bcb
mov rcx, rsi
mov qword [rbp - 0x59], rcx
lea rax, [rbp - 0x51]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140071c28
mov r9, r13
lea rdx, str.The_registry_key_to_be_restored_already_exists:___s_s_
mov r8, r15
lea ecx, [rax + 2]
call fcn.14006e290
mov r8, qword [rbp - 0x69]
mov rdx, r15
mov r9, qword [rbp - 0x61]
mov rcx, qword [rbp - 0x51]
mov qword [rsp + 0x20], r8
mov r8, r13
call fcn.1400713e0
mov edi, eax
xor r14d, r14d
mov ebx, r14d
jmp 0x140071dd4
mov rcx, qword [rbp - 0x59]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
xor r14d, r14d
lea rax, [rbp - 0x51]
mov dword [rbp - 0x49], edi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, r13
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140071c8f
mov r9, r13
mov dword [rsp + 0x20], eax
mov r8, r15
lea rdx, str.Unable_to_create_registry_key:___s_s___winError:__d_
lea ecx, [r14 + 3]
call fcn.14006e290
lea edi, [r14 + 3]
mov rbx, r12
jmp 0x140071dd4
lea rax, [0x14006cf40]
mov qword [rbp - 0x11], 0xffffffffffffffff
mov qword [rbp - 0x31], rax
lea rbx, [rbp - 0x39]
lea rax, [0x14006ced0]
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
lea rax, [0x14006cf50]
mov qword [rbp - 9], r14
mov qword [rbp - 0x21], rax
lea rax, [0x14006cfc0]
mov qword [rbp - 0x19], rax
mov rax, qword [rbp - 0x51]
mov qword [rbp + 7], rax
mov qword [rbp - 1], r14
mov qword [rbp + 0xf], r14
call fcn.140070b70
test al, al
jne 0x140071cff
mov rcx, qword [rbp - 9]
call fcn.1402ff780
mov edi, 3
jmp 0x140071dba
mov r8, qword [rbp - 0x69]
lea rdx, [rbp - 0x39]
mov rcx, qword [rbp - 0x61]
mov r9d, edi
call fcn.14006c380
mov rcx, qword [rbp - 9]
mov edi, eax
test eax, eax
jne 0x140071db5
test rcx, rcx
jne 0x140071d35
call fcn.1402ff780
mov edi, 3
jmp 0x140071dba
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x140071d4f
mov rcx, qword [rbp - 9]
call fcn.1402ff780
mov edi, 3
jmp 0x140071dba
mov ecx, dword [rbp - 1]
call fcn.1402ff830
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140071d74
mov rcx, qword [rbp - 9]
call fcn.1402ff780
lea edi, [rbx + 6]
mov rbx, qword [rbp - 0x79]
jmp 0x140071dba
mov r8d, dword [rbp - 1]
mov rcx, rax
mov rdx, qword [rbp - 9]
call fcn.1402f4a50
mov rcx, qword [rbp - 9]
call fcn.1402ff780
mov rcx, qword [rbp + 7]
mov r8, rbx
mov edx, 4
mov qword [rbp - 1], r14
mov qword [rbp - 9], r14
call fcn.140074c90
mov rbx, qword [rbp - 0x79]
test eax, eax
je 0x140071dd4
mov edi, 3
jmp 0x140071dc2
call fcn.1402ff780
mov qword [rbp - 1], r14
mov qword [rbp - 9], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140071dd4
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, r12
call fcn.1402ff780
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140071df0
cmp rcx, rsi
je 0x140071df0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140071dff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140071e19
mov rcx, qword [rbx + 0x30]
call fcn.1402ff780
mov qword [rbx + 0x38], 0
mov qword [rbx + 0x30], r14
mov rcx, r15
call fcn.1402ff780
mov rcx, r13
call fcn.1402ff780
mov r13, qword [rsp + 0x140]
mov eax, edi
jmp 0x140071a66
mov eax, 1
jmp 0x140071a6e