Function at 0x1400019d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400c77d8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rcx
lea r13, [0x1400c8f30]
xor r15d, r15d
mov rbx, r13
mov qword [rsp + 0x48], rbx
mov rcx, 0xffffffffffffffff
mov esi, 0x80070057
mov r12d, 0x7ffffffe
test r14, r14
je 0x140001ad8
mov rdi, rcx
nop dword [rax + rax]
inc rdi
cmp word [r14 + rdi*2], r15w
jne 0x140001a40
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ecd8
mov r11, rax
test rax, rax
je 0x140001aa3
lea rax, [rdi - 1]
cmp rax, r12
ja 0x140001a95
mov r9, r14
mov rdx, rdi
mov rcx, r11
call fcn.1400109d0
mov r14d, eax
test r14d, r14d
js 0x140001aa9
mov rbx, r11
mov r11, r15
mov qword [rsp + 0x48], rbx
jmp 0x140001aba
mov r14d, esi
test rdi, rdi
je 0x140001a83
mov word [r11], r15w
jmp 0x140001aa9
mov r14d, 0x8007000e
lea rax, [0x1400c8f32]
cmp r11, r13
je 0x140001ac9
cmp r11, rax
je 0x140001ac9
mov rcx, r11
call fcn.14000eccc
lea rax, [0x1400c8f32]
test r14d, r14d
jns 0x140001ae0
mov rbx, rax
mov qword [rsp + 0x48], rax
jmp 0x140001ae0
mov rdx, r13
call fcn.14004388c
mov rcx, 0xffffffffffffffff
mov r13, r15
mov rdi, rcx
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], r13w
jne 0x140001af0
add rdi, 0x26
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ecd8
mov r14, rax
test rax, rax
je 0x140001c04
lea rax, [rdi - 1]
cmp rax, r12
ja 0x140001bea
xor r8d, r8d
sub r12, rdi
mov r9, rbx
mov rcx, rdi
sub r9, r14
mov rdx, r14
nop dword [rax]
lea rax, [r12 + rcx]
test rax, rax
je 0x140001b63
movzx eax, word [r9 + rdx]
test ax, ax
je 0x140001b63
mov word [rdx], ax
inc r8
add rdx, 2
sub rcx, 1
jne 0x140001b40
test rcx, rcx
lea rax, [rdx - 2]
mov esi, 0x8007007a
mov r15, rdi
cmovne rax, rdx
xor r12d, r12d
test rcx, rcx
cmovne esi, r12d
mov word [rax], r12w
lea rax, [r8 - 1]
cmovne rax, r8
sub r15, rax
lea r13, [r14 + rax*2]
test esi, esi
js 0x140001c0c
mov rdx, r15
call fcn.140010ae4
mov esi, eax
test eax, eax
js 0x140001bf8
lea r9, str.Local_SettingsPrintersPropertyBags
mov rdx, r15
mov rcx, r13
call fcn.1400109d0
mov esi, eax
test eax, eax
js 0x140001c0c
lea rax, [0x1400c8f30]
cmp rbx, rax
je 0x140001bdd
lea rax, [0x1400c8f32]
cmp rbx, rax
je 0x140001bdd
mov rcx, rbx
call fcn.14000eccc
mov rbx, r14
mov r14, r12
mov qword [rsp + 0x48], rbx
jmp 0x140001c24
xor r12d, r12d
test rdi, rdi
je 0x140001b93
mov word [r14], r12w
jmp 0x140001c0c
test r15, r15
je 0x140001bb7
mov word [r13], r12w
jmp 0x140001c0c
mov esi, 0x8007000e
xor r12d, r12d
lea rax, [0x1400c8f30]
cmp r14, rax
je 0x140001c2c
lea rax, [0x1400c8f32]
cmp r14, rax
je 0x140001c2c
mov rcx, r14
call fcn.14000eccc
test esi, esi
js 0x140001d5c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov r9d, 0x1000b
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001d52
xor edx, edx
lea rcx, [0x1400bbf48]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], r12
mov rbx, rax
call fcn.140077c9c
test rbx, rbx
je 0x140001d43
lea rdx, str.SplIsValidUserPropertyBag
mov qword [rsp + 0x58], rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140001d48
mov ebx, r12d
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov edx, ebx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001d48
movabs r10, 0xaaed3f023adb1270
lea rcx, [rsp + 0x60]
mov rax, rdi
call qword [0x1400a83f0]
test al, al
jne 0x140001d3f
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
inc ebx
jmp 0x140001cd0
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x58]
call fcn.14007771c
lea rcx, [rsp + 0x50]
call fcn.14004acd8
lea rcx, [rsp + 0x48]
call fcn.14004f870
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14000f060
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret