Function at 0x1400048a0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140094040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rdx
mov rbx, rcx
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x1400048eb
mov rdx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004b44
xor ebx, ebx
mov r13d, ebx
mov dword [rsp + 0x48], 0xff
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140004b27
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140004971
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ce40
nop
mov r11, qword [r12 + 0x10]
mov rbx, r12
cmp qword [r12 + 0x18], 7
jbe 0x1400049a0
mov rbx, qword [r12]
lea rsi, [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
cmp r15, 7
cmova rsi, rdi
mov rax, qword [rsp + 0x60]
cmp r11, rax
ja 0x140004aaf
sub rax, r11
test r11, r11
je 0x140004a54
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140004a0c
cmp word [rax], r10w
je 0x140004a09
cmp rcx, 1
je 0x140004a0c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x1400049f6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140004aaf
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140004a48
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140004b34
add rdx, 2
sub r8, 1
jne 0x140004a30
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140004aaf
lea rdx, str.Deleting_value:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000bf20
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14000d930
lea rdx, [0x14000c100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
inc r13d
mov dword [rsp + 0x48], 0xff
cmp r15, 7
jbe 0x140004af1
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004ae9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b3d
mov rcx, rdi
call fcn.140044800
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140004953
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004b79
add rax, 2
jmp 0x1400049e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000c140
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x140004b5e
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14000d930
lea rdx, [0x14000c100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400447e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret