Function at 0x1400019d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1400c87d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdi, [0x1400c9f10]
mov r13d, 0x80070057
mov rsi, rcx
mov rbx, rdi
mov r15, 0xffffffffffffffff
mov r12d, 0x7ffffffe
lea r14d, [r13 - 0x49]
test rcx, rcx
je 0x1400118e7
mov rdi, r15
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x140001a31
inc rdi
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.14000df2c
xor r9d, r9d
mov r8, rax
test rax, rax
je 0x140001cda
lea rax, [rdi - 1]
cmp rax, r12
ja 0x1400118ca
mov rdx, r12
mov rax, r8
sub rdx, rdi
mov ebp, r9d
sub rsi, r8
nop dword [rax]
lea rcx, [rdi + rdx]
test rcx, rcx
je 0x140001aad
movzx ecx, word [rsi + rax]
test cx, cx
je 0x140001aa4
mov word [rax], cx
add rax, 2
sub rdi, 1
jne 0x140001a80
jmp 0x1400118bc
test rdi, rdi
je 0x1400118bc
mov word [rax], r9w
test ebp, ebp
js 0x140001c90
mov rbx, r8
mov r8, r9
mov rcx, r8
call fcn.14000df6c
xor r9d, r9d
lea rax, [0x1400c9f12]
test ebp, ebp
js 0x1400118df
mov rdi, r9
mov rsi, r9
mov rbp, r15
inc rbp
cmp word [rbx + rbp*2], 0
jne 0x140001ae2
add rbp, 0x26
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.14000df2c
xor r11d, r11d
mov r15, rax
test rax, rax
je 0x140001cb5
lea rax, [rbp - 1]
cmp rax, r12
ja 0x14001190a
mov r9, r12
mov r10, rbx
sub r9, rbp
mov rcx, rbp
sub r10, r15
mov rdx, r15
mov r8d, r11d
lea rax, [rcx + r9]
test rax, rax
je 0x140001b66
movzx eax, word [rdx + r10]
test ax, ax
je 0x140001b5d
mov word [rdx], ax
inc r8
add rdx, 2
sub rcx, 1
jne 0x140001b35
jmp 0x1400118f7
test rcx, rcx
je 0x1400118f7
mov word [rdx], r11w
mov r14d, r11d
mov rsi, rbp
lea rdi, [r15 + r8*2]
sub rsi, r8
test r14d, r14d
js 0x140001cb5
lea rax, [rsi - 1]
cmp rax, r12
ja 0x14001192e
sub r12, rsi
lea rcx, str.Local_SettingsPrintersPropertyBags
sub rcx, rdi
mov r13d, r11d
nop dword [rax]
lea rax, [rsi + r12]
test rax, rax
je 0x140001bcd
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140001bc4
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x140001ba0
jmp 0x14001191f
test rsi, rsi
je 0x14001191f
mov word [rdi], r11w
mov r14d, r13d
test r13d, r13d
js 0x140001cb5
lea rax, [0x1400c9f10]
cmp rbx, rax
je 0x140001c00
lea rax, [0x1400c9f12]
cmp rbx, rax
je 0x140001c00
mov rcx, rbx
call fcn.14000df6c
xor r11d, r11d
mov rbx, r15
mov r15, r11
mov rcx, r15
call fcn.14000df6c
xor r11d, r11d
mov rdx, rbx
test r14d, r14d
js 0x140001c59
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r11
mov r9d, 0x1000b
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140011943
lea rcx, [rsp + 0x50]
call fcn.14004b888
mov rdx, rbx
call fcn.14004443c
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000e2c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rax, [0x1400c9f10]
cmp r8, rax
lea rax, [0x1400c9f12]
je 0x140001ad1
cmp r8, rax
jne 0x140001abf
jmp 0x140001ad1
lea rax, [0x1400c9f10]
cmp r15, rax
je 0x140001c11
lea rax, [0x1400c9f12]
cmp r15, rax
jne 0x140001c06
jmp 0x140001c11
mov ebp, r14d
jmp 0x140001c90
sub rax, 2
mov ebp, 0x8007007a
jmp 0x140001aad
mov ebp, r13d
test rdi, rdi
je 0x140001ab1
mov word [r8], r9w
jmp 0x140001c90
mov rbx, rax
jmp 0x140001ad9
mov rdx, rdi
call fcn.14004443c
xor r9d, r9d
jmp 0x140001ad9
dec r8
mov word [rdx - 2], r11w
mov r14d, 0x8007007a
jmp 0x140001b6d
mov r14d, r13d
test rbp, rbp
je 0x140001b77
mov word [r15], r11w
jmp 0x140001cb5
sub rdi, 2
mov r13d, 0x8007007a
jmp 0x140001bcd
mov r14d, r13d
test rsi, rsi
je 0x140001bd1
mov word [rdi], r11w
jmp 0x140001cb5
xor edx, edx
lea rcx, [0x1400bcf38]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
xor ebp, ebp
lea rcx, [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x40], rbp
call fcn.14007880c
test rdi, rdi
je 0x140011a13
lea rdx, str.SplIsValidUserPropertyBag
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140011a18
mov edi, ebp
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140011a18
movabs r10, 0xaaed3f023adb1270
lea rcx, [rsp + 0x60]
mov rax, rsi
call qword [0x1400a9400]
test al, al
jne 0x140011a0f
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
inc edi
jmp 0x1400119a0
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x40]
call fcn.14007880c
nop
jmp 0x140001c4c