Function at 0x140002e80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, dword [rcx + 0x38]
lea r15, [rcx + 0x40]
xor esi, esi
mov r14, rcx
mov ebp, 0xffffffff
test r15, r15
je 0x1400033fd
cmp rbx, 0x8000000
ja 0x1400033fd
mov edx, 1
mov ecx, 0x40
call fcn.14003d9fc
mov rdi, rax
test rax, rax
je 0x1400033fd
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x28], rbx
mov dword [rax + 0x30], 1
mov dword [rax + 0x34], 1
mov qword [rax + 0x38], rsi
mov qword [rax + 8], r15
mov qword [rax], rsi
call fcn.14001eea0
mov rbx, rax
test rax, rax
je 0x140003079
cmp dword [rdi + 0x30], esi
jne 0x140002f2b
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
jne 0x140002f6b
mov eax, dword [rdi + 0x34]
dec eax
cmp eax, 0xfffff
ja 0x140002f6b
cmp qword [rdi + 8], rsi
je 0x140002f6b
mov rax, qword [rdi + 0x20]
cmp rax, 0x8000000
ja 0x140002f6b
mov rcx, qword [rdi + 0x28]
cmp rcx, rax
ja 0x140002f6b
mov rax, qword [rdi + 0x18]
cmp rax, rcx
ja 0x140002f6b
cmp qword [rdi + 0x10], rax
ja 0x140002f6b
mov rbp, qword [rdi + 0x10]
add rbp, qword [rdi + 8]
jmp 0x140002f7f
mov ecx, 0xb
mov qword [0x1400a4e88], rsi
call fcn.1400407d4
mov rbp, rsi
mov edx, 1
mov rcx, rdi
call fcn.14001f590
test eax, eax
js 0x1400033f3
test rbp, rbp
je 0x1400033f3
movzx ebp, byte [rbp]
lea rax, str.process_agent_request_type__d
mov dword [rsp + 0x38], ebp
lea rdx, str.process_request
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentconnection.c
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov r8d, 0x87
mov dword [rsp + 0x20], 5
call fcn.14001ae20
lea eax, [rbp - 1]
cmp eax, 0x1a
ja case.0x140003001.2
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x3730]
mov ecx, dword [rdx + rax*4 + 0x3708]
add rcx, rdx
jmp rcx
lea rax, str.ssh_protocol_1_is_not_supported
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.process_unsupported_request
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0xe1
mov dword [rsp + 0x20], 5
call fcn.14001ae20
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rbx
call fcn.14001f460
test eax, eax
js 0x140003058
mov rax, qword [rsp + 0x48]
mov byte [rax], 5
mov eax, esi
neg eax
mov rcx, rdi
sbb ebp, ebp
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140003c70
mov ebp, eax
mov rcx, rdi
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
call fcn.140007190
mov rcx, rdi
mov ebp, eax
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140004ac0
mov rcx, rdi
mov ebp, eax
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.1400056a0
mov rcx, rdi
mov ebp, eax
call fcn.14001f200
jmp 0x140003405
cmp dword [r14 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rcx
mov ebp, esi
mov qword [rsp + 0x48], rsi
jg 0x14000316f
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400031b7
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140003160
mov dword [rsp + 0x38], eax
lea rdx, str.get_user_root
lea rax, str.unable_to_open_users_registry_hive__ERROR____d
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov qword [rsp + 0x28], rsi
mov r8d, 0x52
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov ebp, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebp, ebp
jne 0x1400031b7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x10109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgent
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400031b7
mov rcx, qword [rsp + 0x48]
lea rdx, str.Keys
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x48]
lea rdx, str.PKCS11_Providers
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbx
call fcn.14001f460
test eax, eax
js 0x1400031d7
mov rax, qword [rsp + 0x40]
mov byte [rax], 6
mov eax, esi
mov rcx, qword [rsp + 0x50]
neg eax
sbb ebp, ebp
test rcx, rcx
je 0x1400031eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003079
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140005b20
mov rcx, rdi
mov ebp, eax
call fcn.14001f200
jmp 0x140003405
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.140006a70
mov rcx, rdi
mov ebp, eax
call fcn.14001f200
jmp 0x140003405
lea rax, str.entering
mov r9d, 1
mov qword [rsp + 0x30], rax
lea rdx, str.process_extension
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x401
mov dword [rsp + 0x20], 6
mov r15d, esi
call fcn.14001ae20
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140020240
test eax, eax
je 0x1400032d6
mov ecx, eax
call fcn.140020e50
lea rcx, str.parse
mov r9d, 1
mov qword [rsp + 0x30], rcx
lea rdx, str.process_extension
mov qword [rsp + 0x28], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x403
mov dword [rsp + 0x20], 2
call fcn.14001ae20
jmp 0x140003343
mov rbp, qword [rsp + 0x40]
lea rdx, str.session_bind_openssh.com
mov rcx, rbp
call fcn.14004f7a0
test eax, eax
jne 0x1400032fe
mov rdx, r14
mov rcx, rdi
call fcn.140007640
mov r15d, eax
jmp 0x14000333b
mov qword [rsp + 0x38], rbp
lea rax, str.unsupported_extension___s_
mov qword [rsp + 0x30], rax
lea rdx, str.process_extension
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r9d, 1
mov dword [rsp + 0x20], 5
mov r8d, 0x409
call fcn.14001ae20
mov rcx, rbp
call fcn.14003d000
lea r8, [rsp + 0x40]
mov edx, 4
mov rcx, rbx
call fcn.14001f460
test eax, eax
jns 0x140003363
mov eax, 1
jmp 0x1400036c6
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbx
mov dword [rax], 0x1000000
call fcn.14001f460
test eax, eax
js 0x1400036c6
mov rax, qword [rsp + 0x40]
test r15d, r15d
setne cl
add cl, 5
neg r15d
mov byte [rax], cl
mov rcx, rdi
sbb ebp, ebp
neg ebp
dec ebp
call fcn.14001f200
jmp 0x140003405
mov dword [rsp + 0x38], ebp
lea rax, str.unknown_agent_request__d
mov qword [rsp + 0x30], rax
lea rdx, str.process_request
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentconnection.c
xor r9d, r9d
mov dword [rsp + 0x20], 5
mov r8d, 0xae
call fcn.14001ae20
mov rcx, rdi
mov ebp, 0xffffffff
call fcn.14001f200
jmp 0x140003405
mov eax, 0xffffffff
jmp 0x1400036a0
call fcn.14001eea0
mov rbx, rax
lea rcx, [r14 + 0x38]
xor edx, edx
mov r8d, 0x4000c
call fcn.14004f880
test ebp, ebp
jne 0x140003691
test rbx, rbx
je 0x140003470
cmp dword [rbx + 0x30], esi
jne 0x140003431
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x140003470
mov eax, dword [rbx + 0x34]
dec eax
cmp eax, 0xfffff
ja 0x140003470
cmp qword [rbx + 8], rsi
je 0x140003470
mov rax, qword [rbx + 0x20]
cmp rax, 0x8000000
ja 0x140003470
mov rcx, qword [rbx + 0x28]
cmp rcx, rax
ja 0x140003470
mov rax, qword [rbx + 0x18]
cmp rax, rcx
ja 0x140003470
cmp qword [rbx + 0x10], rax
ja 0x140003470
mov rcx, rax
sub rcx, qword [rbx + 0x10]
jmp 0x140003484
mov ecx, 0xb
mov qword [0x1400a4e88], rsi
call fcn.1400407d4
mov rcx, rsi
mov eax, ecx
mov byte [r14 + 0x43], cl
shr eax, 0x18
mov byte [r14 + 0x40], al
mov eax, ecx
shr eax, 0x10
mov byte [r14 + 0x41], al
mov eax, ecx
shr eax, 8
mov byte [r14 + 0x42], al
test rbx, rbx
je 0x1400034f8
cmp dword [rbx + 0x30], esi
jne 0x1400034b6
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x1400034f8
mov eax, dword [rbx + 0x34]
dec eax
cmp eax, 0xfffff
ja 0x1400034f8
cmp qword [rbx + 8], rsi
je 0x1400034f8
mov rax, qword [rbx + 0x20]
cmp rax, 0x8000000
ja 0x1400034f8
mov rcx, qword [rbx + 0x28]
cmp rcx, rax
ja 0x1400034f8
mov rax, qword [rbx + 0x18]
cmp rax, rcx
ja 0x1400034f8
cmp qword [rbx + 0x10], rax
ja 0x1400034f8
mov rdi, rax
mov rcx, rbx
sub rdi, qword [rbx + 0x10]
jmp 0x140003514
mov ecx, 0xb
mov qword [0x1400a4e88], rsi
call fcn.1400407d4
mov rdi, rsi
mov rcx, rbx
test rbx, rbx
je 0x140003562
cmp dword [rcx + 0x30], esi
jne 0x140003522
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
jne 0x140003562
mov eax, dword [rcx + 0x34]
dec eax
cmp eax, 0xfffff
ja 0x140003562
cmp qword [rcx + 8], rsi
je 0x140003562
mov rax, qword [rcx + 0x20]
cmp rax, 0x8000000
ja 0x140003562
mov rdx, qword [rcx + 0x28]
cmp rdx, rax
ja 0x140003562
mov rax, qword [rcx + 0x18]
cmp rax, rdx
ja 0x140003562
cmp qword [rcx + 0x10], rax
ja 0x140003562
mov r15, qword [rbx + 0x10]
add r15, qword [rbx + 8]
jmp 0x140003576
mov ecx, 0xb
mov qword [0x1400a4e88], rsi
call fcn.1400407d4
mov r15, rsi
lea rcx, [r14 + 0x44]
test rdi, rdi
je 0x140003627
test rcx, rcx
jne 0x14000359b
call fcn.14003d440
mov edi, socket
mov dword [rax], edi
call fcn.1400354bc
jmp 0x1400035e9
test r15, r15
je 0x1400035b6
cmp rdi, 0x3fffc
ja 0x1400035b6
mov r8, rdi
mov rdx, r15
call fcn.14004fc40
jmp 0x140003627
xor edx, edx
mov r8d, 0x3fffc
call fcn.14004f880
test r15, r15
je 0x140003588
cmp rdi, 0x3fffc
jbe 0x1400035e4
call fcn.14003d440
mov edi, 0x22
mov dword [rax], edi
call fcn.1400354bc
jmp 0x1400035e9
mov edi, socket
mov dword [rsp + 0x38], edi
lea rax, str.memcpy_s_failed_with_error:__d.
mov qword [rsp + 0x30], rax
lea rdx, str.process_request
mov qword [rsp + 0x28], rsi
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentconnection.c
xor r9d, r9d
mov dword [rsp + 0x20], 5
mov r8d, 0xbb
call fcn.14001ae20
mov ebp, 0xffffffff
test rbx, rbx
je 0x140003679
cmp dword [rbx + 0x30], esi
jne 0x14000363a
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x140003679
mov eax, dword [rbx + 0x34]
dec eax
cmp eax, 0xfffff
ja 0x140003679
cmp qword [rbx + 8], rsi
je 0x140003679
mov rax, qword [rbx + 0x20]
cmp rax, 0x8000000
ja 0x140003679
mov rcx, qword [rbx + 0x28]
cmp rcx, rax
ja 0x140003679
mov rax, qword [rbx + 0x18]
cmp rax, rcx
ja 0x140003679
cmp qword [rbx + 0x10], rax
ja 0x140003679
mov rsi, rax
sub rsi, qword [rbx + 0x10]
jmp 0x14000368a
mov ecx, 0xb
mov qword [0x1400a4e88], rsi
call fcn.1400407d4
lea eax, [rsi + 4]
mov dword [r14 + 0x38], eax
test rbx, rbx
je 0x14000369e
mov rcx, rbx
call fcn.14001f200
mov eax, ebp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400313f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.140020e50
lea rcx, str.compose
mov r9d, 1
mov qword [rsp + 0x30], rcx
lea rdx, str.process_extension
mov qword [rsp + 0x28], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agentkeyagent_request.c
mov r8d, 0x40e
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3