Function at 0x12cc4
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
xor r15d, r15d
mov rbp, rcx
lea rcx, [rsp + 0x58]
lea ebx, [r15 + 0x28]
xor edx, edx
mov dword [rax + 8], r15d
mov r8, rbx
mov dword [rsp + 0x50], r15d
call fcn.000407c0
lea rcx, [rsp + 0x88]
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x80], r15d
call fcn.000407c0
lea eax, [rbx - 0x14]
lea r11d, [r15 + 0x12]
mov word [rsp + 0x42], ax
lea rax, [0x00040d70]
mov word [rsp + 0x40], r11w
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x30], r15w
mov word [rsp + 0x20], r15w
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
cmp rbp, r15
je 0x13175
cmp word [rbp], r15w
je 0x13175
cmp word [rbp + 2], r15w
je 0x13175
cmp qword [rbp + 8], r15
je 0x13175
lea rdx, [0x00040ce0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx r11d, word [rsp + 0x32]
movzx eax, word [rbp + 2]
lea r14d, [r15 + 0x20]
add r11d, eax
mov r13d, 0x6e65654b
movsxd rbx, r11d
mov esi, r14d
lea rdx, [rbx + 0x10]
mov r8d, r13d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r15
jne 0x12de3
add esi, 0xffffffff
jne 0x12dbf
mov rdi, r15
jmp 0x12df1
lea r8, [rbx + 0x10]
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp rdi, r15
jne 0x12e00
mov eax, 0xc000009a
jmp 0x1317a
movzx eax, word [rbp]
lea rdx, [rsp + 0x30]
mov rcx, rdi
add ax, word [rsp + 0x30]
mov word [rdi], ax
movzx eax, word [rsp + 0x32]
add ax, word [rbp + 2]
mov word [rdi + 2], ax
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r15d
mov ebx, eax
jl 0x12f32
lea rdx, [0x00040e00]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx r11d, word [rsp + 0x22]
movzx eax, word [rbp + 2]
add r11d, eax
mov esi, r14d
movsxd rbx, r11d
lea rdx, [rbx + 0x50]
mov r8d, r13d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
cmp rax, r15
jne 0x12e8f
add esi, 0xffffffff
jne 0x12e6b
mov r12, r15
jmp 0x12e9d
lea r8, [rbx + 0x50]
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp r12, r15
jne 0x12eac
mov ebx, 0xc000009a
jmp 0x12f32
movzx eax, word [rbp]
mov ecx, 0x50
lea rdx, [rsp + 0x20]
add ax, word [rsp + 0x20]
add ax, cx
mov word [r12], ax
movzx eax, word [rsp + 0x22]
add ax, word [rbp + 2]
add ax, cx
mov rcx, r12
mov word [r12 + 2], ax
lea rax, [r12 + 0x10]
mov qword [r12 + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r15d
mov ebx, eax
jl 0x12f26
lea rdx, [0x00040d90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r15d
mov ebx, eax
jge 0x12f45
mov edx, r13d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1317a
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
call fcn.00016aac
mov ebx, eax
cmp eax, 0xc0000023
jne 0x13142
mov esi, dword [rsp + 0x110]
cmp esi, r15d
je 0x12f26
mov rbx, rsi
mov r8d, r13d
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r13, rax
cmp rax, r15
jne 0x12fa3
add r14d, 0xffffffff
mov r13d, 0x6e65654b
jne 0x12f79
mov r13, r15
jmp 0x12fb0
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp r13, r15
jne 0x12fbf
mov ebx, 0xc000009a
jmp 0x13137
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x40]
mov r9, r13
mov rcx, rdi
mov dword [rsp + 0x110], esi
call fcn.00016aac
cmp eax, r15d
mov ebx, eax
jl 0x13129
lea rcx, [rsp + 0x20]
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, 0x240
mov r11d, 0x30
lea rax, [rsp + 0x20]
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x98], ecx
lea rcx, [rsp + 0x20]
mov r8b, 1
mov rdx, r12
mov dword [rsp + 0x50], r11d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x80], r11d
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r12
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
cmp al, r15b
jne 0x1307d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.00012578
mov ebx, eax
cmp ebx, r15d
jl 0x13129
xor edx, edx
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x110], r15
lea r8d, [rdx + 0x28]
call fcn.000407c0
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x110]
mov rcx, rdi
call fcn.0001676c
cmp eax, r15d
mov esi, eax
jl 0x13103
mov rax, qword [0x0006a6a0]
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x40]
cmp rax, r15
je 0x130dd
call rax
jmp 0x130e3
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x110]
mov esi, eax
mov rax, qword [0x0006a6e0]
cmp rax, r15
je 0x130fd
call rax
jmp 0x13103
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, r15d
mov ebx, esi
jl 0x13129
call fcn.00011c74
cmp eax, r15d
mov ebx, eax
jge 0x1311f
cmp dword [0x00062968], 1
jne 0x13129
mov rcx, rbp
call fcn.00012148
mov ebx, eax
mov edx, 0x6e65654b
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r13d, 0x6e65654b
jmp 0x12f26
cmp eax, 0xc0000034
jne 0x12f26
call fcn.00011c74
cmp eax, r15d
mov ebx, eax
jge 0x13166
cmp dword [0x00062968], 1
jne 0x12f26
mov rcx, rbp
call fcn.00012148
mov ebx, eax
jmp 0x12f26
mov eax, 0xc000000d
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret