Function at 0x180001d70
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x790]
sub rsp, 0x890
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rdi, rdx
mov rax, rcx
jb 0x180001da4
mov rdx, qword [rdx]
lea rcx, [rsp + 0x48]
mov r9d, 9
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000206c
mov rcx, qword [rsp + 0x48]
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x888], rsi
mov qword [rsp + 0x20], rax
mov esi, eax
mov dword [rsp + 0x40], 0x400
mov byte [rbp + 0x7c8], al
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18000203b
or rcx, 0xffffffffffffffff
xor edi, edi
nop word [rax + rax]
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
xor eax, eax
lea rdi, [rbp - 0x80]
lea rdx, [rbp - 0x80]
inc esi
repne scasw ax, word [rdi]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x70], 7
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.180005cb0
cmp qword [rbx + 0x18], 8
mov r11, qword [rbx + 0x10]
jb 0x180001e67
mov r10, qword [rbx]
jmp 0x180001e6a
mov r10, rbx
test r11, r11
je 0x180001f70
mov r9, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x58]
test r9, r9
je 0x180001ecb
cmp r11, r9
ja 0x180001ecb
sub r9, r11
lea rbx, [rsp + 0x58]
inc r9
cmp rsi, 8
cmovae rbx, rax
nop
mov rax, r9
mov r8, rbx
test r9, r9
je 0x180001ebf
movzx ecx, word [r10]
nop
cmp word [r8], cx
je 0x180001f22
add r8, 2
dec rax
jne 0x180001eb0
mov rbx, qword [rbp + 0x7c0]
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x40], 0x400
cmp rsi, 8
jb 0x180001ee1
mov rcx, rax
call fcn.180012658
mov esi, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov edx, esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x180002034
or rcx, 0xffffffffffffffff
jmp 0x180001e20
test r8, r8
je 0x180001ebf
mov rcx, r11
mov rdx, r10
mov rdi, r8
test r11, r11
je 0x180001f4a
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x180001f83
add rdi, 2
add rdx, 2
dec rcx
jne 0x180001f35
mov rbx, qword [rbp + 0x7c0]
cmp rsi, 8
lea rax, [rsp + 0x58]
cmovae rax, qword [rsp + 0x58]
sub r8, rax
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x180001ec6
mov rdi, qword [rbp + 0x7b8]
cmp qword [rdi + 0x18], 8
jb 0x180001fb1
mov rdx, qword [rdi]
jmp 0x180001fb4
cmp word [rdi], ax
mov ecx, 1
mov rax, 0xffffffffffffffff
cmovb ecx, eax
test ecx, ecx
je 0x180001f4a
mov rcx, r8
sub rcx, rbx
lea rbx, [r8 + 2]
sar rcx, 1
sub rax, rcx
add r9, rax
jmp 0x180001ea0
mov rdx, rdi
mov rsi, qword [rbp + 0x7b0]
lea rax, [rbp + 0x7b8]
mov r9d, 3
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180002019
cmp qword [rsp + 0x70], 8
mov rcx, qword [rbp + 0x7b8]
lea rdx, [rsp + 0x58]
cmovae rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x18000200c
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x70], 8
mov byte [rbp + 0x7c8], 1
jb 0x180002042
mov rcx, qword [rsp + 0x58]
call fcn.180012658
jmp 0x180002042
mov rdi, qword [rbp + 0x7b8]
mov rsi, qword [rbp + 0x7b0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rbp + 0x7c8], 0
je 0x180002064
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.180001d70
mov rsi, qword [rsp + 0x888]
add rsp, 0x890
pop rdi
pop rbx
pop rbp
ret