Function at 0x140013a50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
mov rdi, rcx
xor ecx, ecx
lea rax, [0x14001d590]
mov qword [r11 - 0x68], rdi
mov qword [rbp - 0x18], rax
lea rax, [0x140021c80]
mov ebx, ecx
mov qword [r11 - 0x70], rax
mov dword [rbp + 0x30], ecx
mov qword [r11 - 0x78], rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x28], rcx
mov dword [rbp + 0x38], ecx
mov esi, ecx
mov dword [rbp + 0x40], ecx
mov qword [rbp - 0x30], rcx
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
lea ecx, [rbx + 1]
mov r8d, 0xfc
mov dword [rbp - 0x20], 0x40002
call fcn.14000944c
and dword [rsp + 0x20], ebx
lea rcx, [rbp - 0x38]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140013874
test eax, eax
jns 0x140013b11
lea rcx, [0x140021a90]
mov qword [rsp + 0x30], rdi
lea r9, [0x140021c90]
mov qword [rsp + 0x28], rcx
lea rdx, [0x140021a70]
lea ecx, [rbx + 7]
mov r8d, 0x106
mov dword [rsp + 0x20], eax
call fcn.14000944c
jmp 0x140013ece
mov r9d, dword [rbp + 0x38]
mov rcx, qword [rbp - 0x38]
xor r8d, r8d
lea rax, [rbp + 0x38]
lea edx, [r8 + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ecx, eax
cmp eax, 0xc0000023
jne 0x140013ea0
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x140013ea0
mov edx, eax
xor ecx, ecx
mov r8d, 0x414e4d5a
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x140013b7f
lea rax, [0x140021cc0]
mov r8d, 0x11b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140013eb6
mov r9d, dword [rbp + 0x38]
lea rcx, [rbp + 0x38]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x38]
mov edx, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
test eax, eax
jns 0x140013bcb
lea rcx, [0x140021cf0]
mov r8d, 0x123
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
jmp 0x140013ec4
mov rax, qword [rbp - 0x28]
mov r8d, 0x12b
mov ecx, 1
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x38], eax
lea rax, [0x140021d10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
call fcn.14000944c
mov rax, qword [rbp - 0x28]
mov edi, dword [rax + 0x14]
dec edi
mov rcx, qword [rbp - 0x38]
js 0x140013e74
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x140013c03
cmp eax, 0xc0000023
jne 0x140013e34
mov ecx, dword [rbp + 0x40]
test ecx, ecx
je 0x140013e34
mov edx, ecx
mov r8d, 0x414e4d5a
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x140013e00
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x40]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x40]
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
js 0x140013dcc
movzx edx, word [rsi + 0xc]
lea rcx, [rsi + 0x10]
xor r8d, r8d
xor r9d, r9d
call fcn.140005330
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140013db0
mov rax, qword [rbp + 0x28]
mov r8d, dword [rsi + 0xc]
xor r9d, r9d
movzx edx, word [rax]
mov rcx, qword [rax + 8]
shr r8d, 1
inc r8w
call fcn.140005330
mov rbx, rax
test rax, rax
je 0x140013d94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
js 0x140013d79
mov rdx, qword [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
js 0x140013d5e
mov rcx, rbx
call fcn.140013a50
test eax, eax
je 0x140013d3a
mov edx, 0x414e4d5a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 0x30]
xor esi, esi
call fcn.1400055cc
and qword [rbp - 0x30], rsi
mov rcx, rbx
call fcn.1400055cc
xor ebx, ebx
jmp 0x140013c03
mov qword [rsp + 0x30], rbx
lea rax, [0x140021ea0]
mov r8d, 0x188
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140013de6
lea rcx, [0x140021e70]
mov r8d, 0x17e
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
jmp 0x140013e1a
lea rcx, [0x140021e40]
mov r8d, 0x176
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
jmp 0x140013e1a
lea rax, [0x140021df0]
mov r8d, 0x16e
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140013e1a
lea rax, [0x140021dc0]
mov r8d, 0x161
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140013e1a
mov dword [rsp + 0x30], edi
lea rcx, [0x140021d90]
mov r8d, 0x155
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
mov ecx, 7
call fcn.14000944c
jmp 0x140013e6f
lea rax, [0x140021d60]
mov r8d, 0x14d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc000009a
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
mov ecx, 7
call fcn.14000944c
jmp 0x140013e6f
mov rcx, qword [rbp + 0x28]
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
mov qword [rsp + 0x38], rcx
lea rcx, [0x140021d30]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rcx
mov ecx, 7
mov r8d, 0x145
mov dword [rsp + 0x20], eax
call fcn.14000944c
mov edi, dword [rbp + 0x30]
jmp 0x140013ed0
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
test eax, eax
jns 0x140013e99
mov rcx, qword [rbp + 0x28]
mov r8d, 0x19e
mov qword [rsp + 0x30], rcx
lea rcx, [0x140021ec0]
jmp 0x140013ddd
mov edi, 1
jmp 0x140013ed0
lea rax, [0x140021ca0]
mov r8d, 0x10f
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r9, [0x140021c90]
lea rdx, [0x140021a70]
mov ecx, 7
call fcn.14000944c
mov edi, ebx
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140013edf
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rsi, rsi
je 0x140013ef2
mov edx, 0x414e4d5a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x140013f09
mov edx, 0x414e4d5a
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x140013f1a
mov rcx, rax
call fcn.1400055cc
test rbx, rbx
je 0x140013f27
mov rcx, rbx
call fcn.1400055cc
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret