Function at 0x1400078a4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x98
xor r12d, r12d
mov rdi, r9
mov dword [rbp - 0x15], r12d
mov rsi, rdx
mov qword [rbp - 9], r12
mov r14, rcx
mov dword [rbp - 0x11], r12d
mov dword [rbp - 0x19], r12d
test rcx, rcx
je 0x140007bef
test rdx, rdx
je 0x140007bef
test r9, r9
je 0x140007bef
mov r9d, dword [r9 + 0x8c]
lea rax, [rbp - 9]
or r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140007bf4
mov rcx, qword [rbp - 9]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x58], r12
xor r9d, r9d
mov qword [rsp + 0x50], r12
xor r8d, r8d
mov qword [rsp + 0x48], r12
xor edx, edx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400079a5
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140007bf4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 9], r12
jmp 0x140007bf4
cmp dword [rbp - 0x11], r12d
jne 0x1400079e7
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400079c4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 9], r12
mov r8d, dword [rdi + 0x8c]
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140007bf4
mov eax, dword [rbp - 0x19]
test eax, eax
jne 0x1400079f7
mov dword [rbp - 0x19], 0x100
jmp 0x140007a03
cmp eax, 0x100
jae 0x140007a03
add eax, eax
mov dword [rbp - 0x19], eax
call fcn.14000ecac
mov qword [rbp - 1], rax
mov r14, rax
test rax, rax
jne 0x140007a37
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140007a2d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 9], r12
mov ebx, 0xe
jmp 0x140007bf4
mov ecx, dword [rbp - 0x19]
inc ecx
mov dword [rbp - 0x19], ecx
lea ecx, [rcx*2 + 4]
call fcn.14000c800
mov qword [rbp + 7], rax
mov r13, rax
test rax, rax
jne 0x140007a7b
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140007a70
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 9], r12
lea rcx, [rbp - 1]
call fcn.14000ecdc
jmp 0x140007a2d
xor esi, esi
xor r15d, r15d
lea ebx, [rsi + 0xe]
cmp dword [rbp - 0x11], esi
jbe 0x140007ae4
mov eax, dword [rbp - 0x19]
lea r9, [rbp - 0x15]
mov ecx, eax
mov dword [rbp - 0x15], eax
xor eax, eax
add rcx, rcx
and qword [rsp + 0x38], rax
mov rdi, r13
and qword [rsp + 0x30], rax
mov r8, r13
and qword [rsp + 0x28], rax
mov edx, r12d
and qword [rsp + 0x20], rax
rep stosb byte [rdi], al
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
jne 0x140007afc
mov rdx, r13
mov rcx, r14
call fcn.14000ee68
cmp eax, 0xffffffff
jne 0x140007b01
mov esi, ebx
mov r15d, ebx
lea rcx, [rbp + 7]
call fcn.14000cca4
xor r12d, r12d
cmp dword [r14], 9
jne 0x140007b0f
mov edi, dword [r14 + 4]
jmp 0x140007b12
test esi, esi
cmove esi, eax
inc r12d
cmp r12d, dword [rbp - 0x11]
jae 0x140007ae4
jmp 0x140007a88
mov edi, r12d
cmp r15d, ebx
je 0x140007b9d
test edi, edi
je 0x140007b9d
mov r13d, dword [rbp + 0x77]
mov ebx, r12d
mov r15, qword [rbp + 0x7f]
mov esi, r12d
mov dword [rbp - 0x15], r12d
xor r8d, r8d
mov edx, esi
mov rcx, r14
call fcn.14000f370
test rax, rax
jne 0x140007b47
xor edx, edx
jmp 0x140007b54
cmp dword [rax + 4], 0x20000
jne 0x140007b43
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 9]
lea r8d, [r13 + 1]
mov r9, r15
call fcn.1400078a4
test eax, eax
je 0x140007b73
test ebx, ebx
jne 0x140007b6e
mov ebx, eax
mov eax, dword [rbp - 0x15]
jmp 0x140007b7b
mov eax, dword [rbp - 0x15]
inc eax
mov dword [rbp - 0x15], eax
inc esi
cmp esi, edi
jb 0x140007b31
xor r12d, r12d
test eax, eax
je 0x140007ba7
cmp edi, dword [rbp - 0x11]
jne 0x140007b96
cmp eax, edi
jne 0x140007b96
mov ebx, r12d
jmp 0x140007ba7
mov ebx, 0x80030201
jmp 0x140007ba7
mov r15, qword [rbp + 0x7f]
mov ebx, esi
mov r13d, dword [rbp + 0x77]
lea rcx, [rbp - 1]
call fcn.14000ecdc
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140007bc9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 9], r12
test ebx, ebx
jne 0x140007bf8
mov r8d, dword [r15 + 0x8c]
xor r9d, r9d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140007bf8
mov ebx, 0x57
mov r13d, dword [rbp + 0x77]
test r13d, r13d
jne 0x140007c56
test ebx, ebx
je 0x140007c38
cmp ebx, 0x80030201
jne 0x140007c20
xor r8d, r8d
mov edx, 0x8d
call fcn.14000d054
mov rcx, rax
call fcn.14000df80
jmp 0x140007c27
mov ecx, ebx
call fcn.140002874
mov ecx, 2
call fcn.140001978
mov edx, 0x20001
jmp 0x140007c4e
xor ecx, ecx
call fcn.140002874
mov ecx, 1
call fcn.140001978
mov edx, 0x20000
mov rcx, rax
call fcn.14000e1ac
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret