Function at 0x140002de0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xe8
mov qword [rax + 8], rbx
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r12d, ebx
mov qword [rax - 0x30], r14
mov r14d, ebx
mov qword [rax - 0x38], r15
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp - 0x41], rbx
mov dword [rbp + 0x7f], ebx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x21], rbx
call fcn.1400090c0
test eax, eax
je 0x140002e4e
mov r15d, ebx
jmp 0x140002e56
mov r15, qword [rdi + 0x10]
add r15, qword [rdi + 8]
lea rdx, [rbp - 0x41]
mov qword [rsp + 0xe0], rsi
mov rcx, rdi
call fcn.14000db80
mov r13, qword [rbp - 0x41]
test eax, eax
jne 0x14000310a
mov rcx, rdi
call fcn.1400090c0
test eax, eax
je 0x140002e87
mov rsi, rbx
jmp 0x140002e8f
mov rsi, qword [rdi + 0x10]
add rsi, qword [rdi + 8]
sub esi, r15d
je 0x14000310a
lea r8, [rbp + 0xf]
mov rcx, rdi
lea rdx, [rbp + 0x17]
call fcn.140009ac0
test eax, eax
jne 0x14000310a
xor eax, eax
lea r9, [rbp - 0x11]
mov qword [rbp - 0x11], rax
lea r8, [rbp - 9]
lea rcx, str.D:P_A___GA____SY__A___GA____BA_
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
lea edx, [rax + 1]
mov dword [rbp - 0x11], 0x18
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1400030d1
xor r9d, r9d
lea r8, [rbp + 7]
lea rdx, [rbp - 0x19]
mov rcx, r13
call fcn.14000ae70
test eax, eax
jne 0x1400030d1
mov rdi, qword [rbp + 0x77]
lea rax, [rbp - 0x41]
mov rcx, rdi
mov dword [rsp + 0x28], 1
lea r9, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r8d, esi
mov rdx, r15
call fcn.140002bc0
test eax, eax
jne 0x1400030cd
mov rcx, r13
call fcn.14000b260
mov r14, rax
test rax, rax
je 0x1400030cd
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.140002b20
test eax, eax
jne 0x1400030cd
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rbx
lea rdx, str.SOFTWAREOpenSSHAgentKeys
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rbp - 0x11]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400030cd
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x11]
mov rdx, r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400030cd
mov eax, dword [rbp - 0x41]
mov r9d, 3
mov r12, qword [rbp - 0x29]
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400030d1
mov eax, dword [rbp + 7]
lea rdx, [0x140039f18]
mov rcx, qword [rbp - 0x49]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400030d1
mov rcx, qword [rbp - 0x49]
lea r9d, [rax + 4]
mov dword [rsp + 0x28], 4
lea rdx, str.type
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400030d1
mov eax, dword [rbp + 0xf]
lea rdx, str.comment
mov rcx, qword [rbp - 0x49]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400030d1
lea rax, str.added_key_to_store
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.process_add_identity
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0xa9
mov dword [rsp + 0x20], 5
call fcn.140008ef0
mov eax, ebx
mov dword [rbp + 0x7f], 1
jmp 0x140003144
mov r12, qword [rbp - 0x29]
lea rax, str.failed_to_add_key_to_store
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.process_add_identity
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0xa5
mov dword [rsp + 0x20], 5
call fcn.140008ef0
mov edi, ebx
jmp 0x14000314a
lea rax, str.key_add_request_is_invalid
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.process_add_identity
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x93
mov dword [rsp + 0x20], 5
call fcn.140008ef0
mov eax, 1
mov edi, ebx
test eax, eax
jne 0x14000318f
mov rsi, qword [rbp + 0x6f]
mov edx, 1
mov rcx, rsi
call fcn.140009490
test eax, eax
jne 0x14000317f
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi]
add rbx, rcx
lea rax, [rcx + 1]
mov ecx, dword [rbp + 0x7f]
mov qword [rsi + 0x18], rax
test ecx, ecx
setne al
add al, 5
mov byte [rbx], al
jmp 0x140003195
js 0x14000318f
mov ecx, dword [rbp + 0x7f]
test ecx, ecx
setne al
add al, 5
mov byte [rbx], al
jmp 0x140003195
mov ecx, dword [rbp + 0x7f]
or edi, 0xffffffff
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0x100]
test ecx, ecx
jne 0x1400031d1
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1400031d1
test r14, r14
je 0x1400031d1
xor r9d, r9d
mov r8d, 0x100
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
test r12, r12
je 0x1400031de
mov rcx, r12
call fcn.140020360
mov rcx, qword [rbp - 9]
mov r12, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400031f5
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x140003202
mov rcx, r13
call fcn.14000a920
mov r13, qword [rsp + 0xd0]
test r14, r14
je 0x140003217
mov rcx, r14
call fcn.140020360
mov rcx, qword [rbp - 0x21]
mov r14, qword [rsp + 0xc8]
test rcx, rcx
je 0x14000322e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14000323d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14000324c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14000325a
call fcn.140020360
mov eax, edi
add rsp, 0xe8
pop rdi
pop rbp
ret