Function at 0x14006e42c
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r12, rdx
xor r14d, r14d
mov r13, rcx
lea r8d, [r14 + 0x5c]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x70], r14
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, r12
mov rbx, rax
cmp rax, r14
jne 0x14006e68c
lea r8, [rsp + 0x70]
mov r9d, 0x2001b
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.14005a00c
mov edi, eax
cmp eax, r14d
jne 0x14006e708
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0xc0], r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
mov eax, dword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
cmp eax, dword [rsp + 0xc8]
cmovb eax, dword [rsp + 0xc8]
mov dword [rsp + 0xc0], eax
lea edx, [rax*4 + 8]
call fcn.140061584
cmp esi, r14d
jne 0x14006e627
mov ebp, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
dec ebp
cmp ebp, r14d
jl 0x14006e5b3
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp eax, r14d
jne 0x14006e5ae
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r14d
mov edi, eax
cmovne esi, eax
sub ebp, 1
jns 0x14006e54f
mov ebp, dword [rsp + 0x64]
dec ebp
cmp ebp, r14d
jl 0x14006e627
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp eax, r14d
je 0x14006e608
mov esi, eax
jmp 0x14006e622
cmp word [rbx], r14w
je 0x14006e622
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [0x1401313d0]
cmp eax, r14d
cmovne esi, eax
sub ebp, 1
jns 0x14006e5be
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [0x1401313d8]
cmp r11, r14
jne 0x14006e667
lea r8, [0x1401313d8]
lea rdx, [0x14011b5c0]
lea rcx, str.RegDeleteKeyExW
xor r9d, r9d
call fcn.14005a4a0
mov r11, qword [0x1401313d8]
cmp r11, r14
je 0x14006e678
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call r11
mov edi, eax
cmp edi, r14d
lea rcx, [rsp + 0x78]
cmovne esi, edi
call fcn.140058d88
mov eax, esi
jmp 0x14006e708
sub rax, r12
lea rcx, [rsp + 0xc0]
sar rax, 1
movsxd r8, eax
call fcn.14006cf2c
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov r9d, 2
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.14005a00c
mov edi, eax
cmp eax, r14d
je 0x14006e6dd
lea rcx, [rsp + 0xc0]
call fcn.140058d88
mov eax, edi
jmp 0x14006e708
mov rcx, qword [rsp + 0x70]
lea rdx, [rbx + 2]
call qword [0x1401313d0]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xc0]
call fcn.140058d88
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret