Function at 0x140001f70
Capabilities:
Delete registry key
Get common file path
Get session user name
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
xorps xmm0, xmm0
xor ebx, ebx
xor r9d, r9d
mov qword [rax + 0x18], rbx
xor r8d, r8d
mov qword [rax + 0x10], rbx
xor ecx, ecx
mov qword [rax - 0x78], rbx
lea edx, [rbx + 0xe]
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0xa0]
mov dword [rsp + 0xa0], ebx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0xa0], ebx
call fcn.140001360
mov ecx, dword [rsp + 0xa0]
add ecx, eax
mov dword [rsp + 0xa0], ecx
cmp ecx, 0x491fd3a1
ja 0x140002000
lea rcx, [rsp + 0xa0]
call fcn.140001f40
mov ecx, dword [rsp + 0xa0]
cmp ecx, 0xffffff
jae 0x140002124
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400021a8
lea rcx, [0x140005090]
call fcn.140001390
test eax, eax
je 0x1400021a8
lea rcx, [0x140005100]
call fcn.1400014c0
test eax, eax
je 0x1400021a8
xor ecx, ecx
mov ebx, 0x5b
call fcn.140001000
mov rcx, rax
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
movzx edx, bx
call fcn.140002c20
test eax, eax
je 0x1400021a8
mov r8d, dword [rsp + 0xa8]
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0xb0]
call fcn.140001430
test eax, eax
je 0x1400021a8
lea rcx, [rsp + 0x40]
call fcn.1400021c0
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x90
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x90
pop rbx
ret