Function at 0x140059a70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rcx, [0x14019f240]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rdx, rdi
test rax, rax
je 0x140059b19
mov r8d, ebx
xor r9d, r9d
call rax
test eax, eax
je 0x140059b23
mov qword [rsp + 0x50], 0
mov r9d, ebx
or r9d, 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor esi, esi
mov rcx, rbp
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140059b2a
cmp eax, 2
je 0x140059f40
mov esi, eax
jmp 0x140059f40
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140059ada
xor esi, esi
jmp 0x140059f40
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x88], xmm0
mov word [rsp + 0x78], 0
mov rcx, rdi
call fcn.140185cb0
mov rsi, rax
cmp rax, 7
jbe 0x140059b6c
lea rcx, [rsp + 0x78]
mov rdx, rsi
mov r9, rdi
call fcn.140006120
jmp 0x140059b8e
mov qword [rsp + 0x88], rsi
mov r8, rsi
add r8, rsi
lea rcx, [rsp + 0x78]
mov rdx, rdi
call fcn.14016e8e0
mov word [rsp + rsi*2 + 0x78], 0
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140059bf9
mov rdx, qword [rsp + 0x90]
cmp rdx, 7
jbe 0x140059bd6
mov rcx, qword [rsp + 0x78]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140059bf9
cmp rax, rdx
jae 0x140059be5
lea rdx, [rax + 1]
mov qword [rsp + 0x88], rdx
mov word [rcx + rax*2], 0x5c
mov word [rcx + rax*2 + 2], 0
jmp 0x140059bf9
lea rcx, [rsp + 0x78]
cmp word [rcx + rax*2 - 2], 0x5c
jne 0x140059bb6
jmp 0x140059bf9
lea rcx, [rsp + 0x78]
mov edx, 1
mov r9w, 0x5c
call fcn.14000ea10
mov qword [rsp + 0x40], rdi
mov r12, qword [rsp + 0x88]
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], 0
lea r15, [rsp + 0x58]
xorps xmm6, xmm6
lea rdi, [rsp + 0x4c]
lea r14, [rsp + 0x78]
nop word cs:[rax + rax]
nop
mov dword [rsp + 0x4c], 0x104
mov edx, 0x104
mov rcx, r15
call fcn.14004bb40
mov rcx, qword [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140059e65
mov r13d, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x68]
cmp rax, r13
jae 0x140059cc0
mov r9, r13
sub r9, rax
mov rcx, qword [rsp + 0x70]
mov rdx, rcx
sub rdx, rax
cmp rdx, r9
jae 0x140059ce0
mov word [rsp + 0x20], 0
mov rcx, r15
mov rdx, r9
call fcn.14000eb40
jmp 0x140059d10
cmp qword [rsp + 0x70], 7
mov rax, r15
jbe 0x140059cd0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], r13
mov word [rax + r13*2], 0
jmp 0x140059d10
mov qword [rsp + 0x68], r13
mov rsi, r15
cmp rcx, 7
jbe 0x140059cf3
mov rsi, qword [rsp + 0x58]
test r9, r9
je 0x140059d09
lea rcx, [rsi + rax*2]
add r9, r9
xor edx, edx
mov r8, r9
call fcn.14016ed50
mov word [rsi + r13*2], 0
mov rax, qword [rsp + 0x88]
mov r9, r12
sub r9, rax
jbe 0x140059d50
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
sub rdx, rax
cmp rdx, r9
jae 0x140059d80
mov word [rsp + 0x20], 0
mov rcx, r14
mov rdx, r9
call fcn.14000eb40
jmp 0x140059db3
cmp qword [rsp + 0x90], 7
mov rax, r14
jbe 0x140059d63
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x88], r12
mov word [rax + r12*2], 0
jmp 0x140059db3
mov qword [rsp + 0x88], r12
mov rsi, r14
cmp rcx, 7
jbe 0x140059d96
mov rsi, qword [rsp + 0x78]
test r9, r9
je 0x140059dac
lea rcx, [rsi + rax*2]
add r9, r9
xor edx, edx
mov r8, r9
call fcn.14016ed50
mov word [rsi + r12*2], 0
mov r8, qword [rsp + 0x68]
cmp qword [rsp + 0x70], 7
mov r9, r15
jbe 0x140059dc8
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x140059e00
mov qword [rsp + 0x20], r8
mov rcx, r14
mov rdx, r8
call fcn.14000a090
jmp 0x140059e3f
mov r13, rbp
mov ebp, ebx
mov rbx, rdi
lea rsi, [rax + r8]
mov qword [rsp + 0x88], rsi
mov rdi, r14
cmp rcx, 7
jbe 0x140059e22
mov rdi, qword [rsp + 0x78]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, r9
call fcn.14016e8e0
mov word [rdi + rsi*2], 0
mov rdi, rbx
mov ebx, ebp
mov rbp, r13
cmp qword [rsp + 0x90], 7
mov rdx, r14
jbe 0x140059e52
mov rdx, qword [rsp + 0x78]
mov rcx, rbp
mov r8d, ebx
call fcn.140059a70
test eax, eax
je 0x140059c40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14019f240]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
test rax, rax
je 0x140059ea4
mov rdx, qword [rsp + 0x40]
mov r8d, ebx
xor r9d, r9d
call rax
jmp 0x140059eaf
mov rdx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x140059ef9
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140059ef4
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140059f6e
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014a880
mov rax, qword [rsp + 0x90]
cmp rax, 8
jb 0x140059f40
mov rcx, qword [rsp + 0x78]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140059f3b
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x140059f6e
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14014a880
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140178800
ud2