Function at 0x140014c60
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1d0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rbp + 0x1b0], rbx
mov rax, qword [0x14002a520]
xor rax, rbp
mov qword [rbp + 0x160], rax
mov r14d, r8d
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov qword [rbp + 8], rdi
test rdx, rdx
je 0x1400151b7
mov eax, dword [0x140020b68]
cmp dword [rcx], eax
jne 0x140014cdb
mov eax, dword [0x140020b6c]
cmp dword [rcx + 4], eax
jne 0x140014cdb
mov eax, dword [0x140020b70]
cmp dword [rcx + 8], eax
jne 0x140014cdb
mov eax, dword [0x140020b74]
cmp dword [rcx + 0xc], eax
je 0x1400151b7
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x140020880]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140020b98]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400151b7
cmp dword [rbx], 0
je 0x140014d61
nop dword [rax + rax]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 8]
lea r9, [rbp + 0x50]
mov r8d, 1
mov rdx, rsi
mov rax, qword [rcx]
test r14d, r14d
je 0x140014d4b
cmp dword [rbx], r8d
jne 0x140014d3e
call qword [rax + 0x28]
jmp 0x140014d41
call qword [rax + 0x38]
test eax, eax
js 0x1400151b9
jmp 0x140014d58
cmp dword [rbx], 1
jne 0x140014d55
call qword [rax + 0x30]
jmp 0x140014d58
call qword [rax + 0x40]
add rbx, 0x10
cmp dword [rbx], 0
jne 0x140014d10
test r14d, r14d
jne 0x1400151bb
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov rbx, rdi
mov qword [rbp + 0x28], rbx
lea rcx, [rbp + 0xe0]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x140014d93
inc eax
movsxd rsi, eax
add rsi, rsi
mov eax, 0x80000000
add rax, rsi
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14001519a
cmp esi, 0x400
jg 0x140014df8
movsxd r15, esi
mov rcx, r15
call fcn.14000daf0
test al, al
je 0x140014df8
lea rax, [r15 + 0xf]
cmp rax, r15
ja 0x140014de5
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140019e10
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x140014e2a
movsxd rcx, esi
sub r14, rcx
cmp r14, 0x10
jb 0x14001518f
add rcx, 0x10
call qword [sym.imp.MSVCR120.dll_malloc]
test rax, rax
jne 0x140014e1c
mov rcx, rdi
jmp 0x140014e2a
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 0x28], rax
lea rcx, [rax + 0x10]
mov r9d, 3
mov r8d, esi
lea rdx, [rbp + 0xe0]
call fcn.140004960
mov r15, rax
test rax, rax
je 0x14001519a
lea r8, [0x140020890]
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcpy_s]
test eax, eax
je 0x140014e9a
cmp eax, 0xc
je 0x140014e8f
cmp eax, 0x16
je 0x140014e84
cmp eax, 0x22
je 0x140014e84
cmp eax, 0x50
je 0x140014e9a
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
mov r8, r15
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcat_s]
test eax, eax
je 0x140014ee5
cmp eax, 0xc
je 0x140014eda
cmp eax, 0x16
je 0x140014ecf
cmp eax, 0x22
je 0x140014ecf
cmp eax, 0x50
je 0x140014ee5
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcat_s]
test eax, eax
je 0x140014f34
cmp eax, 0xc
je 0x140014f29
cmp eax, 0x16
je 0x140014f1e
cmp eax, 0x22
je 0x140014f1e
cmp eax, 0x50
je 0x140014f34
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
mov qword [rbp + 0x30], 0xffffffff80000000
mov dword [rbp + 0x38], edi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x18], edi
mov qword [rbp + 0x20], rdi
mov dword [rbp], edi
mov r9d, 0x20019
lea r8, [rbp + 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rbp + 0x10]
call fcn.14000a3f0
test eax, eax
jne 0x140014fe4
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rsi, rsi
je 0x140014fc5
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x18], edi
test r14, r14
jne 0x140014fe4
cmp dword [rbp], r14d
jne 0x140014fe4
lea rdx, [rbp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea r8, [0x140020890]
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcpy_s]
test eax, eax
je 0x140015033
cmp eax, 0xc
je 0x140015028
cmp eax, 0x16
je 0x14001501d
cmp eax, 0x22
je 0x14001501d
cmp eax, 0x50
je 0x140015033
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
mov r8, r15
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcat_s]
test eax, eax
je 0x14001507e
cmp eax, 0xc
je 0x140015073
cmp eax, 0x16
je 0x140015068
cmp eax, 0x22
je 0x140015068
cmp eax, 0x50
je 0x14001507e
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCR120.dll_strcat_s]
test eax, eax
je 0x1400150cd
cmp eax, 0xc
je 0x1400150c2
cmp eax, 0x16
je 0x1400150b7
cmp eax, 0x22
je 0x1400150b7
cmp eax, 0x50
je 0x1400150cd
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
mov r9d, 0x20019
lea r8, [rbp + 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rbp + 0x10]
call fcn.14000a3f0
mov rsi, qword [rbp + 0x10]
test eax, eax
jne 0x140015164
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rsi, rsi
je 0x140015144
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x18], edi
test r14, r14
jne 0x140015164
cmp dword [rbp], r14d
jne 0x140015164
lea rdx, [rbp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
test rsi, rsi
je 0x140015176
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x18], edi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], edi
jmp 0x14001519a
mov ecx, 0x80070216
call fcn.140004920
nop
test rbx, rbx
je 0x1400151bb
nop
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x28], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x1400151a0
jmp 0x1400151bb
mov eax, edi
mov edi, eax
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400151ca
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.140019e70
mov rbx, qword [rbp + 0x1b0]
lea rsp, [rbp + 0x170]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret