Function at 0x140083ab0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
movaps xmmword [rsp + 0x2a0], xmm7
movaps xmmword [rsp + 0x290], xmm6
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140241038]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.14011e510
test eax, eax
jg 0x1400847e9
movaps xmm6, xmmword [0x1402184a0]
lea rcx, [rsp + 0x130]
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
call fcn.1400a13e0
mov dword [rsp + 0x12c], 0
mov ecx, 0x40
call fcn.1401536a0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
mov qword [rax + 0x38], rcx
mov qword [rsp + 0x120], rax
cmp rax, rsi
je 0x140083b83
cmp byte [rax + 0x17], 0
movzx r8d, byte [rsi + 0x17]
js 0x14008483e
test r8b, r8b
jns 0x140083cc0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rax
call fcn.14009afc0
mov r9d, 0x3001f
or r9d, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
mov r8, rsi
jns 0x140083b99
mov r8, qword [rsi]
mov rdx, qword [rdi + 0x20]
lea rcx, [rsp + 0x130]
call fcn.1400a0c10
cmp eax, 5
je 0x140083bfc
test eax, eax
jne 0x140083cfe
mov rcx, qword [0x140257930]
test rcx, rcx
jne 0x140083bd2
call fcn.140069580
mov rcx, rax
mov qword [0x140257930], rax
xor eax, eax
cmp dword [rdi + 0x40], 0x200
sete al
lea r8d, [rax*8 + 4]
mov rdx, rbx
mov r9d, 0x30019
call fcn.140069870
test al, al
jne 0x140083d7e
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.14011e510
test eax, eax
jg 0x140083fcd
mov rcx, qword [0x140257930]
test rcx, rcx
jne 0x140083c30
call fcn.140069580
mov rcx, rax
mov qword [0x140257930], rax
mov rax, qword [rsp + 0x120]
add rax, 0x20
xor edx, edx
cmp dword [rdi + 0x40], 0x200
sete dl
lea r8d, [rdx*8 + 4]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov ebp, 0x3001f
mov rdx, rbx
mov r9d, 0x3001f
call fcn.140069ff0
test al, al
jne 0x140083cd3
mov ecx, 2
call fcn.14011e4e0
test al, al
je 0x140083d10
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x41
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Unable_to_obtain_sufficient_permissions_on_key
mov r8d, 0x2e
jmp 0x140083e31
mov rcx, qword [rsi + 0x10]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
jmp 0x140083b83
or ebp, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
mov r8, rsi
jns 0x140083ce2
mov r8, qword [rsi]
mov rdx, qword [rdi + 0x20]
lea rcx, [rsp + 0x130]
mov r9d, ebp
call fcn.1400a0c10
test eax, eax
je 0x140083d7e
mov ecx, 2
call fcn.14011e4e0
test al, al
jne 0x140083df9
xor esi, esi
mov rdi, qword [rsp + 0x120]
mov qword [rsp + 0x120], 0
test rdi, rdi
je 0x140083d3b
mov rcx, rdi
call fcn.140084d00
mov rcx, rdi
call fcn.1401536dc
lea rcx, [rsp + 0x130]
call fcn.1400a1420
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1401542e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
movaps xmm7, xmmword [rsp + 0x2a0]
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x138]
lea r9, [rsp + 0x12c]
mov edx, reloc.WS2_32.dll_shutdown
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x140083e4e
cmp eax, 0x7a
je 0x140083e4e
mov ecx, 2
call fcn.14011e4e0
test al, al
je 0x140083d10
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x54
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_security_descriptor_for
mov r8d, 0x29
jmp 0x140083e31
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, VarR8FromUI1
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_open_key
mov r8d, shutdown
call fcn.140191ff0
mov rcx, rax
mov rdx, rbx
call fcn.1400b4a20
mov rcx, rsi
call fcn.1400b4390
jmp 0x140083d10
mov r14, qword [rsp + 0x120]
mov ecx, dword [rsp + 0x12c]
call fcn.14015371c
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 0x18], rax
test rcx, rcx
je 0x140083e80
call fcn.140153724
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x138]
lea r9, [rsp + 0x12c]
mov edx, reloc.WS2_32.dll_shutdown
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x140083f16
mov ecx, 2
call fcn.14011e4e0
test al, al
je 0x140083d10
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x64
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_security_descriptor_for
mov r8d, 0x29
call fcn.140191ff0
mov rcx, rax
mov rdx, rbx
call fcn.1400b4a20
lea rdx, str._but_we_succeeded_earlier_
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
mov rcx, rax
call fcn.140191ff0
jmp 0x140083e41
mov eax, 0xaaaaaaaa
lea rdx, [rsp + 0x11c]
mov dword [rdx], eax
lea r8, [rsp + 0x118]
mov dword [r8], eax
lea r9, [rsp + 0x114]
mov dword [r9], eax
mov rcx, qword [rsp + 0x138]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14008406d
mov ecx, 2
call fcn.14011e4e0
test al, al
je 0x140083d10
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, WSAStartup
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_key_info_for
mov r8d, 0x1e
jmp 0x140083e31
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x3a
mov r9d, 0xffffffff
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Insufficient_permissions_on_the_key
mov r8d, 0x23
call fcn.140191ff0
mov rcx, r14
call fcn.1400b4390
jmp 0x140083c15
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x75
mov r9d, 0xffffffff
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
mov edx, dword [rsp + 0x11c]
call fcn.140038850
lea rdx, str._values
mov r8d, 7
mov rcx, rax
call fcn.140191ff0
mov rcx, r14
call fcn.1400b4390
jmp 0x140084082
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.14011e510
test eax, eax
jg 0x140084017
mov ecx, dword [rsp + 0x118]
inc ecx
mov dword [rsp + 0x118], ecx
add rcx, rcx
call fcn.14015371c
mov qword [rsp + 0x70], rax
mov ecx, dword [rsp + 0x114]
call fcn.14015371c
mov r15, rax
cmp dword [rsp + 0x11c], 0
jle 0x140084278
lea rdx, [rsp + 0xd0]
lea r14, [rsp + 0xb0]
lea r12, [rsp + 0xf0]
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xorps xmm7, xmm7
xor ebp, ebp
jmp 0x14008416b
add rcx, 0x28
lea rdx, [rsp + 0x150]
call fcn.140084eb0
mov r12, rbp
mov ebp, dword [rsp + 0x68]
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r15, qword [rsp + 0x150]
mov qword [rsp + 0x150], 0
test r15, r15
je 0x140084151
mov rcx, qword [r15 + 0x20]
mov qword [r15 + 0x20], 0
test rcx, rcx
je 0x140084133
call fcn.140153724
cmp byte [r15 + 0x17], 0
jns 0x140084142
mov rcx, qword [r15]
call fcn.1401536dc
mov rcx, r15
call fcn.1401536dc
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebp
mov r15, r13
cmp ebp, dword [rsp + 0x11c]
lea rdx, [rsp + 0xd0]
jge 0x14008427b
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0xb0], 0xaaaaaaaa
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov edx, ebp
mov r13, qword [rsp + 0x70]
mov r8, r13
mov r9, r12
call r10
test eax, eax
jne 0x1400845b4
mov dword [rsp + 0x68], ebp
mov rbp, r12
mov ecx, 0x30
call fcn.1401536a0
mov r12, r13
mov r13, rax
movups xmmword [rax], xmm7
xor eax, eax
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x20], rax
mov qword [rsp + 0x150], r13
mov eax, dword [rsp + 0xb0]
mov dword [r13 + 0x18], eax
test r12, r12
je 0x14008488c
mov rcx, r12
call fcn.14017c094
mov rcx, r13
mov rdx, r12
mov r8, rax
call fcn.14009a810
mov ecx, dword [rsp + 0xd0]
mov rax, qword [rsp + 0x150]
mov dword [rax + 0x28], ecx
mov r13, qword [rax + 0x20]
mov qword [rax + 0x20], r15
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rcx + 0x30]
cmp rdx, qword [rcx + 0x38]
jae 0x1400840e5
test rdx, rdx
je 0x140084860
mov r12, rbp
mov qword [rsp + 0x150], 0
mov qword [rdx], rax
add rdx, 8
mov qword [rcx + 0x30], rdx
jmp 0x1400840f9
mov r13, r15
mov rax, qword [rdi + 0x30]
cmp rax, qword [rdi + 0x38]
jae 0x1400842db
test rax, rax
je 0x140084860
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x120], 0
mov qword [rax], rcx
add rax, 8
mov qword [rdi + 0x30], rax
jmp 0x1400842ec
lea rcx, [rsp + 0xf0]
mov dx, 0x5c
call fcn.140104a00
jmp 0x140084368
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0xf0]
call fcn.14009a550
jmp 0x140084323
lea rcx, [rdi + 0x28]
lea rdx, [rsp + 0x120]
call fcn.140085080
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x100], r15
movaps xmmword [rsp + 0xf0], xmm6
cmp byte [rsi + 0x17], 0
js 0x1400842c5
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xf0], xmm0
movzx eax, byte [rsp + 0x107]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsp + 0xf8]
cmovs rdx, rcx
test rdx, rdx
je 0x140084368
test al, al
jns 0x1400847aa
test rcx, rcx
je 0x1400848b8
mov rdx, qword [rsp + 0xf0]
cmp word [rdx + rcx*2 - 2], 0x5c
jne 0x1400842af
mov qword [rsp + 0xe0], r15
movaps xmmword [rsp + 0xd0], xmm6
cmp byte [rbx + 0x17], 0
js 0x1400843f6
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0xd0], xmm0
mov al, byte [rsp + 0xe7]
movzx r8d, al
mov ecx, r8d
and ecx, 0x7f
test r8b, r8b
mov rdx, qword [rsp + 0xd8]
mov r9, rcx
cmovs r9, rdx
test r9, r9
je 0x1400843e2
test al, al
jns 0x14008440c
test rdx, rdx
je 0x1400848b8
mov r9, qword [rsp + 0xd0]
mov r8, rdx
cmp word [r9 + r8*2 - 2], 0x5c
jne 0x1400847c3
movzx r8d, byte [rsp + 0x107]
test r8b, r8b
js 0x14008441c
and r8d, 0x7f
jmp 0x140084424
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0xd0]
call fcn.14009a550
jmp 0x140084395
je 0x1400848b8
lea r9, [rsp + 0xd0]
jmp 0x1400843d5
mov r8, qword [rsp + 0xf8]
lea rbx, [rsp + 0xb0]
test al, al
cmovs rcx, rdx
movsxd rax, r8d
mov qword [rsp + 0x68], rax
movsxd rax, ecx
mov qword [rsp + 0x80], rax
xorps xmm6, xmm6
lea rbp, [rsp + 0xcc]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x14008446f
mov rcx, qword [rsp + 0xb0]
call fcn.1401536dc
test r15d, r15d
jne 0x140084545
mov dword [rsp + 0xcc], 0x104
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], 0
mov edx, 0x104
mov rcx, rbx
call fcn.1400a32d0
mov rcx, qword [rsp + 0x138]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, rbp
call r12
mov r15d, 5
cmp eax, 0x103
je 0x1400844e1
test eax, eax
je 0x1400845eb
mov ecx, 2
call fcn.14011e4e0
mov r15d, 1
test al, al
jne 0x1400844f4
cmp byte [rsp + 0xc7], 0
jns 0x140084466
jmp 0x140084459
mov qword [rsp + 0x78], r13
lea r13, [rsp + 0x150]
mov rcx, r13
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov r8d, 0xa7
mov r9d, 2
call fcn.1400b3eb0
mov r8d, SafeArrayCopy
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_read_a_subkey
call fcn.140191ff0
mov rcx, r13
mov r13, qword [rsp + 0x78]
call fcn.1400b4390
jmp 0x1400844e1
cmp r15d, 5
je 0x14008454f
xor esi, esi
jmp 0x14008457c
lea rcx, [rsp + 0x130]
call fcn.1401be650
mov r8d, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
jns 0x140084569
mov rsi, qword [rsi]
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov sil, 1
cmp byte [rsp + 0xe7], 0
jns 0x140084593
mov rcx, qword [rsp + 0xd0]
call fcn.1401536dc
cmp byte [rsp + 0x107], 0
jns 0x1400845aa
mov rcx, qword [rsp + 0xf0]
call fcn.1401536dc
mov r15, r13
mov r13, qword [rsp + 0x70]
jmp 0x1400845c8
mov ecx, 2
call fcn.14011e4e0
test al, al
jne 0x140084756
xor esi, esi
test r15, r15
je 0x1400845d5
mov rcx, r15
call fcn.140153724
test r13, r13
je 0x140083d12
mov rcx, r13
call fcn.140153724
jmp 0x140083d12
mov edx, dword [rsp + 0xcc]
mov rcx, rbx
xor r8d, r8d
call fcn.140104c10
lea r14, [rsp + 0xf0]
mov rcx, r14
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
call fcn.140104c10
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x80]
xor r8d, r8d
call fcn.140104c10
mov r8d, 0x104
lea rcx, [rsp + 0x150]
mov dl, 0xaa
call fcn.140157270
movzx eax, byte [rsp + 0x107]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0xf0]
cmovns rax, r14
mov qword [rsp + 0x88], rax
cmovs rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x90], rcx
lea r15, [rsp + 0x98]
mov rcx, r15
lea rdx, [rsp + 0x88]
call fcn.140112800
cmp byte [rsp + 0xaf], 0
mov rdx, r15
jns 0x1400846a3
mov rdx, qword [rsp + 0x98]
mov r8d, 0x104
lea r15, [rsp + 0x150]
mov rcx, r15
call fcn.1401149f0
cmp byte [rsp + 0xaf], 0
jns 0x1400846d0
mov rcx, qword [rsp + 0x98]
call fcn.1401536dc
mov rcx, r15
call fcn.1400e7eb0
movzx eax, byte [rsp + 0xc7]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
cmovns rdx, rbx
mov rcx, r14
call fcn.14009abd0
movzx r8d, byte [rsp + 0xc7]
test r8b, r8b
js 0x14008471d
and r8d, 0x7f
mov rdx, rbx
jmp 0x14008472d
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
lea r15, [rsp + 0xd0]
mov rcx, r15
call fcn.14009abd0
mov rcx, rdi
mov rdx, r14
mov r8, r15
call fcn.140083ab0
xor al, 1
movzx r15d, al
jmp 0x1400844e1
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x84
mov r9d, 2
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_value_nr
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
call fcn.140191ff0
mov rcx, rax
mov edx, ebp
call fcn.140038610
mov rcx, rsi
call fcn.1400b4390
jmp 0x1400845c6
test rax, rax
je 0x1400848b8
lea rdx, [rsp + 0xf0]
mov rcx, rax
jmp 0x14008435c
lea rbx, [rsp + 0xd0]
mov rcx, rbx
mov dx, 0x5c
call fcn.140104a00
movzx eax, byte [rbx + 0x17]
mov rdx, qword [rbx + 8]
mov ecx, eax
and ecx, 0x7f
jmp 0x1400843e2
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x26
mov r9d, 0xffffffff
call fcn.1400b3eb0
lea rcx, [rsp + 0x160]
lea rdx, str.DeleteAndSaveRecursive_:
mov r8d, SafeArrayCopy
call fcn.140191ff0
mov rcx, rax
mov rdx, rsi
call fcn.1400b4a20
mov rcx, r14
call fcn.1400b4390
jmp 0x140083b07
test r8b, r8b
js 0x14008484c
and r8d, 0x7f
mov rdx, rsi
jmp 0x140084853
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, rax
call fcn.14009aed0
jmp 0x140083b83
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140194730
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0x9dc
call fcn.140194730
lea rax, str.string::back__:_string_is_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0x501
call fcn.140194730
int3