Function at 0x140059edc
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r12, rdx
xor r14d, r14d
mov r13, rcx
lea r8d, [r14 + 0x5c]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x70], r14
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, r12
mov rbx, rax
cmp rax, r14
jne 0x14005a13c
lea r8, [rsp + 0x70]
mov r9d, 0x2001b
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.140045d00
mov edi, eax
cmp eax, r14d
jne 0x14005a1b8
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0xc0], r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
mov esi, eax
cmp edx, dword [rsp + 0xc8]
cmovb edx, dword [rsp + 0xc8]
mov dword [rsp + 0xc0], edx
lea edx, [rdx*4 + 8]
call fcn.14004bedc
cmp esi, r14d
jne 0x14005a0d7
mov ebp, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
dec ebp
cmp ebp, r14d
jl 0x14005a063
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp eax, r14d
jne 0x14005a05e
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r14d
mov edi, eax
cmovne esi, eax
sub ebp, 1
jns 0x140059fff
mov ebp, dword [rsp + 0x64]
dec ebp
cmp ebp, r14d
jl 0x14005a0d7
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, r14d
je 0x14005a0b8
mov esi, eax
jmp 0x14005a0d2
cmp word [rbx], r14w
je 0x14005a0d2
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [0x1400f2060]
cmp eax, r14d
cmovne esi, eax
sub ebp, 1
jns 0x14005a06e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [0x1400f2068]
cmp r11, r14
jne 0x14005a117
lea r8, [0x1400f2068]
lea rdx, str.Advapi32.dll
lea rcx, [0x1400de510]
xor r9d, r9d
call fcn.140046024
mov r11, qword [0x1400f2068]
cmp r11, r14
je 0x14005a128
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call r11
mov edi, eax
cmp edi, r14d
lea rcx, [rsp + 0x78]
cmovne esi, edi
call fcn.140044f24
mov eax, esi
jmp 0x14005a1b8
mov r8, rax
lea rcx, [rsp + 0xc0]
sub r8, r12
sar r8, 1
call fcn.140058944
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov r9d, 2
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.140045d00
mov edi, eax
cmp eax, r14d
je 0x14005a18d
lea rcx, [rsp + 0xc0]
call fcn.140044f24
mov eax, edi
jmp 0x14005a1b8
mov rcx, qword [rsp + 0x70]
lea rdx, [rbx + 2]
call qword [0x1400f2060]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xc0]
call fcn.140044f24
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret