Function at 0x140005030
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14001c030]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r14, r8
mov r12, rdx
mov rdi, rcx
mov al, byte [rcx + 0x40]
xor r13d, r13d
test al, al
je 0x140005074
xor eax, eax
jmp 0x1400055fe
mov eax, 1
xchg byte [rcx + 0x40], al
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x70], 0x30
mov qword [rbp - 0x78], 0x200
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jns 0x1400050e0
lfence
jmp 0x1400055fe
cmp dword [rsp + 0x50], 2
je 0x1400050ee
mov ebx, 0xc0000034
jmp 0x140005134
lea rdx, [0x140016ed0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x140005146
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x1400055fe
mov esi, dword [rsp + 0x40]
mov ebx, esi
mov ecx, esi
call fcn.140013434
mov r15, rax
test rax, rax
je 0x14000516a
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140016c80
jmp 0x14000516d
mov r15, r13
mov qword [rbp - 0x60], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, r15
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
mov rcx, qword [rsp + 0x48]
test eax, eax
jns 0x1400051ae
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1400055ef
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rbp], r13
mov esi, 0xf
mov qword [rbp + 8], rsi
mov byte [rbp - 0x10], r13b
lea rcx, [rbp - 0x10]
cmp rbx, rsi
ja 0x1400051ef
mov qword [rbp], rbx
mov r8, rbx
mov rdx, r15
call fcn.1400169c0
mov byte [rbp + rbx - 0x10], r13b
jmp 0x140005200
lfence
mov r9, r15
mov r8b, r13b
mov rdx, rbx
call fcn.140001098
lea rbx, [rdi + 0x48]
lea rax, [rbp - 0x10]
cmp rbx, rax
je 0x140005237
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140005222
inc rdx
mov rcx, qword [rbx]
call fcn.140001064
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp]
movups xmmword [rbx + 0x10], xmm1
mov byte [rbp - 0x10], r13b
jmp 0x14000523b
mov rsi, qword [rbp + 8]
cmp rsi, 0x10
jb 0x140005273
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000526e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005625
call fcn.14001343c
lfence
mov rdx, r14
lea rcx, [rbp + 0x28]
call fcn.140011230
mov rsi, rax
lea rbx, [rdi + 0x68]
cmp rbx, rax
je 0x1400052d3
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400052a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
call fcn.140001064
mov qword [rbx + 0x10], r13
mov eax, 7
mov qword [rbx + 0x18], rax
mov word [rbx], r13w
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rax
mov word [rsi], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x1400052ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
call fcn.140001064
mov qword [rdi + 0x88], r12
mov rcx, rdi
call fcn.140003ab4
mov esi, eax
test eax, eax
js 0x1400055ef
mov eax, dword [0x14001c980]
lea rsi, [0x14001c960]
mov ebx, 1
test bl, al
jne 0x14000533a
or eax, ebx
mov dword [0x14001c980], eax
mov rcx, rsi
call fcn.140002cd0
lea rcx, [0x140017e10]
call fcn.140014100
nop
mov rcx, rsi
call fcn.1400019a0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x20], eax
or eax, 0xffffffff
mov dword [rbp + 0x18], eax
mov dword [rbp + 0x10], eax
mov eax, dword [0x14001c980]
test bl, al
jne 0x14000537f
or eax, ebx
mov dword [0x14001c980], eax
mov rcx, rsi
call fcn.140002cd0
lea rcx, [0x140017e10]
call fcn.140014100
nop
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.140002d2c
mov eax, dword [0x14001c9f0]
test bl, al
jne 0x1400053b6
or eax, ebx
mov dword [0x14001c9f0], eax
lea rcx, [0x14001c990]
call fcn.14000867c
lea rcx, [0x140017e40]
call fcn.140014100
nop
lea rcx, [0x14001c990]
call fcn.140008bb4
mov eax, dword [0x14001c900]
lea r12, [0x14001c680]
test bl, al
jne 0x1400053f0
or eax, ebx
mov dword [0x14001c900], eax
mov rcx, r12
call fcn.14000b518
lea rcx, [0x140017de0]
call fcn.140014100
nop
mov rcx, r12
call fcn.14000c478
mov esi, eax
test eax, eax
js 0x1400055ef
lfence
mov eax, dword [0x14001c958]
lea r14, [0x14001c910]
test bl, al
jne 0x140005433
or eax, ebx
mov dword [0x14001c958], eax
mov rcx, r14
call fcn.140001e84
lea rcx, [0x140017e00]
call fcn.140014100
nop
mov rdx, qword [rdi + 0x90]
mov rcx, r14
call fcn.140002638
mov esi, eax
test eax, eax
js 0x1400055ef
lfence
mov eax, dword [0x14001ca08]
test bl, al
jne 0x14000547a
or eax, ebx
mov dword [0x14001ca08], eax
lea rcx, [0x14001c9f8]
call fcn.140007f20
lea rcx, [0x140017e30]
call fcn.140014100
nop
mov eax, dword [0x14001ca20]
test bl, al
jne 0x1400054a5
or eax, ebx
mov dword [0x14001ca20], eax
lea rcx, [0x14001ca10]
call fcn.14000dc00
lea rcx, [0x140017e50]
call fcn.140014100
nop
mov eax, dword [0x14001ca40]
test bl, al
jne 0x1400054d0
or eax, ebx
mov dword [0x14001ca40], eax
lea rcx, [0x14001ca28]
call fcn.140005d60
lea rcx, [0x140017e20]
call fcn.140014100
nop
mov eax, dword [0x14001c958]
test bl, al
jne 0x1400054f7
or eax, ebx
mov dword [0x14001c958], eax
mov rcx, r14
call fcn.140001e84
lea rcx, [0x140017e00]
call fcn.140014100
nop
mov eax, dword [0x14001c900]
test bl, al
jne 0x14000551e
or eax, ebx
mov dword [0x14001c900], eax
mov rcx, r12
call fcn.14000b518
lea rcx, [0x140017de0]
call fcn.140014100
nop
mov rdx, r12
mov rcx, r14
call fcn.140002550
mov eax, dword [0x14001c958]
test bl, al
jne 0x140005550
or eax, ebx
mov dword [0x14001c958], eax
mov rcx, r14
call fcn.140001e84
lea rcx, [0x140017e00]
call fcn.140014100
nop
mov rdx, rdi
mov rcx, r14
call fcn.140002550
mov r12d, 0xe8
mov ecx, r12d
call fcn.1400133f8
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14000559f
lea rcx, [0x1400188d0]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rdi
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x18], rcx
lea r8, [rbp - 0x50]
mov edx, 0x3e8
mov rcx, rax
call fcn.1400119b8
mov rbx, rax
jmp 0x1400055a2
mov rbx, r13
add rdi, 0xc8
lea rax, [rsp + 0x58]
cmp rdi, rax
je 0x1400055ce
lfence
mov r14, qword [rdi]
mov qword [rdi], rbx
test r14, r14
je 0x1400055e6
mov rcx, r14
call fcn.140011ac0
mov rcx, r14
jmp 0x1400055de
test rbx, rbx
je 0x1400055e6
mov rcx, rbx
call fcn.140011ac0
mov rcx, rbx
mov rdx, r12
call fcn.14001343c
mov rcx, qword [rdi]
call fcn.140011bf8
nop
test r15, r15
je 0x1400055fc
mov rcx, r15
call fcn.14001343c
mov eax, esi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400167f0
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001344c
nop
int3