Function at 0x1400030e0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbx
push r14
sub rsp, 0x78
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor edi, edi
mov qword [rax - 0x18], r12
mov r14d, edi
mov qword [rax - 0x20], r13
mov r12, rdx
mov r13, r8
mov qword [rax - 0x28], r15
lea r8, [rax - 0x30]
mov qword [rax - 0x50], rdi
lea rdx, [rax - 0x38]
mov qword [rax - 0x40], rdi
mov esi, edi
mov qword [rax - 0x48], rdi
mov ebp, edi
call fcn.140004560
test eax, eax
jne 0x140003275
mov r15, qword [rsp + 0x50]
test r15, r15
je 0x140003275
mov rbx, qword [rsp + 0x58]
cmp rbx, 0x8000000
ja 0x140003275
lea edx, [rdi + 1]
lea ecx, [rdi + 0x48]
call fcn.140036a5c
mov rsi, rax
test rax, rax
je 0x140003273
lea r8d, [rdi + 1]
mov qword [rax + 0x20], rbx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x18], rbx
mov rcx, rax
mov qword [rax + 0x28], rbx
mov dword [rax + 0x30], 1
mov dword [rax + 0x38], 1
mov qword [rax + 0x40], rdi
mov qword [rax + 8], r15
mov qword [rax], rdi
call fcn.140006130
mov rcx, rsi
mov ebx, eax
call fcn.140003f20
mov rbp, qword [rsp + 0x40]
test ebx, ebx
jne 0x140003273
mov rcx, rbp
call fcn.140005cc0
mov r14, rax
test rax, rax
je 0x14000326d
cmp dword [r13 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rcx
mov ebx, edi
jg 0x140003230
mov rcx, qword [r13 + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1400031f7
mov esi, ebx
jmp 0x140003280
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov ecx, 0xf003f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
test eax, eax
je 0x140003221
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.1400039b0
or ebx, 0xffffffff
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
test ebx, ebx
jne 0x14000326d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov r9d, 0x10109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000326d
mov rcx, qword [rsp + 0x48]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeA]
test eax, eax
jne 0x14000326d
lea esi, [rax + 1]
mov eax, edi
jmp 0x14000327a
mov ebx, edi
mov esi, edi
jmp 0x140003280
mov esi, edi
mov eax, 1
mov ebx, edi
test eax, eax
jne 0x1400032be
mov edx, 1
mov rcx, r12
call fcn.1400040f0
test eax, eax
jne 0x1400032b1
mov rcx, qword [r12 + 0x18]
mov rdi, qword [r12]
add rdi, rcx
test esi, esi
lea rax, [rcx + 1]
mov qword [r12 + 0x18], rax
setne al
add al, 5
mov byte [rdi], al
jmp 0x1400032c1
js 0x1400032be
test esi, esi
setne al
add al, 5
mov byte [rdi], al
jmp 0x1400032c1
or ebx, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
test rbp, rbp
je 0x1400032ed
mov rcx, rbp
call fcn.1400054d0
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x90]
test rcx, rcx
je 0x140003305
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003315
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r14, r14
je 0x140003322
mov rcx, r14
call fcn.140031820
mov eax, ebx
add rsp, 0x78
pop r14
pop rbx
ret