Function at 0x14002b1d0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14008a9a8], eax
jle 0x14002b27e
lea rcx, [0x14008a9a8]
call fcn.14003ec18
cmp dword [0x14008a9a8], 0xffffffff
jne 0x14002b27e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x14008a9b0], xmm0
movups xmmword [0x14008a9c0], xmm0
movups xmmword [0x14008a9d0], xmm0
movups xmmword [0x14008a9e0], xmm0
movups xmmword [0x14008a9f0], xmm0
mov qword [0x14008aa00], rax
xor r9d, r9d
lea r8, str.ProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [0x14008a9b0]
call fcn.14000ef70
lea rcx, [0x1400630f0]
call fcn.14003eeb8
nop
lea rcx, [0x14008a9a8]
call fcn.14003ebac
xor edi, edi
mov dword [rsp + 0x60], edi
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, str.ShouldDeleteUseGlobalTimerRes
lea rcx, [0x14008a9b0]
call fcn.14000fb80
test al, al
je 0x14002b4e4
cmp dword [rsp + 0x60], edi
je 0x14002b464
mov eax, dword [rbx]
cmp dword [0x14008a94c], eax
jle 0x14002b335
lea rcx, [0x14008a94c]
call fcn.14003ec18
cmp dword [0x14008a94c], 0xffffffff
jne 0x14002b335
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x14008a950], xmm0
movups xmmword [0x14008a960], xmm0
movups xmmword [0x14008a970], xmm0
movups xmmword [0x14008a980], xmm0
movups xmmword [0x14008a990], xmm0
mov qword [0x14008a9a0], rax
xor r9d, r9d
lea r8, str.ProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [0x14008a950]
call fcn.14000ef70
lea rcx, [0x140063000]
call fcn.14003eeb8
nop
lea rcx, [0x14008a94c]
call fcn.14003ebac
mov dword [rsp + 0x60], edi
mov eax, dword [0x14008a958]
or eax, 2
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x14008a960]
mov rcx, qword [0x14008a950]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002b3b5
lea rdx, str.ShouldDeleteUseGlobalTimerRes
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14002b3aa
lea rdx, str.ShouldDeleteUseGlobalTimerRes
lea rcx, [0x14008a950]
call fcn.14000f0a0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Managerkernel
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002b464
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.GlobalTimerResolutionRequests
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002b464
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 2]
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Managerkernel
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002b464
lea rdx, str.GlobalTimerResolutionRequests
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x60], edi
mov eax, dword [0x14008a9b8]
or eax, 2
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x14008a9c0]
mov rcx, qword [0x14008a9b0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002b4e4
lea rdx, str.ShouldDeleteUseGlobalTimerRes
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14002b4d9
lea rdx, str.ShouldDeleteUseGlobalTimerRes
lea rcx, [0x14008a9b0]
call fcn.14000f0a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003f1d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret