Function at 0x14006c1a4
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r12, rdx
xor r14d, r14d
mov r13, rcx
lea r8d, [r14 + 0x5c]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x70], r14
call qword [sym.imp.SHLWAPI.DLL_StrRChrW]
mov rdx, r12
mov rbx, rax
cmp rax, r14
jne 0x14006c404
lea r8, [rsp + 0x70]
mov r9d, 0x2001b
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.1400589d4
mov edi, eax
cmp eax, r14d
jne 0x14006c480
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0xc0], r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r14d
call qword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyW]
mov esi, eax
mov eax, dword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
cmp eax, dword [rsp + 0xc8]
cmovb eax, dword [rsp + 0xc8]
mov dword [rsp + 0xc0], eax
lea edx, [rax*4 + 8]
call fcn.14005fa8c
cmp esi, r14d
jne 0x14006c39f
mov ebp, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
dec ebp
cmp ebp, r14d
jl 0x14006c32b
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.DLL_RegEnumValueW]
mov edi, eax
cmp eax, r14d
jne 0x14006c326
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov esi, r14d
call qword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
cmp eax, r14d
mov edi, eax
cmovne esi, eax
sub ebp, 1
jns 0x14006c2c7
mov ebp, dword [rsp + 0x64]
dec ebp
cmp ebp, r14d
jl 0x14006c39f
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x68]
mov r8, rbx
mov dword [rsp + 0x68], eax
mov word [rbx], r14w
mov rcx, qword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.DLL_RegEnumKeyExW]
mov edi, eax
cmp eax, r14d
je 0x14006c380
mov esi, eax
jmp 0x14006c39a
cmp word [rbx], r14w
je 0x14006c39a
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [0x14012d3b0]
cmp eax, r14d
cmovne esi, eax
sub ebp, 1
jns 0x14006c336
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov r11, qword [0x14012d3b8]
cmp r11, r14
jne 0x14006c3df
lea r8, [0x14012d3b8]
lea rdx, [0x1401173b0]
lea rcx, [0x14010f7f0]
xor r9d, r9d
call fcn.140058e24
mov r11, qword [0x14012d3b8]
cmp r11, r14
je 0x14006c3f0
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call r11
mov edi, eax
cmp edi, r14d
lea rcx, [rsp + 0x78]
cmovne esi, edi
call fcn.140057768
mov eax, esi
jmp 0x14006c480
sub rax, r12
lea rcx, [rsp + 0xc0]
sar rax, 1
movsxd r8, eax
call fcn.14006acbc
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov r9d, 2
mov rcx, r13
mov dword [rsp + 0x20], 4
call fcn.1400589d4
mov edi, eax
cmp eax, r14d
je 0x14006c455
lea rcx, [rsp + 0xc0]
call fcn.140057768
mov eax, edi
jmp 0x14006c480
mov rcx, qword [rsp + 0x70]
lea rdx, [rbx + 2]
call qword [0x14012d3b0]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea rcx, [rsp + 0xc0]
call fcn.140057768
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret