Function at 0x140035b30
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx r14d, r8b
mov r12, rdx
mov rsi, rcx
mov qword [r11 - 0x50], 7
xor r15d, r15d
mov qword [r11 - 0x58], r15
mov word [r11 - 0x68], r15w
lea r8d, [r15 + 0xd]
lea rdx, str.DeleteSubKeys
lea rcx, [r11 - 0x70]
call fcn.140001870
nop
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [r15 + 0x32]
lea r8d, [r15 + 1]
mov rcx, rsi
call fcn.1400144a0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140035dab
mov edi, r15d
cmp dword [rsp + 0x64], r15d
je 0x140035df5
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140067ea4
mov rbp, rax
test rax, rax
jne 0x140035c9c
lea edi, [rax + 9]
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rax, str.Insufficient_memory
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0xa]
lea r8d, [r15 + 1]
mov rcx, rsi
call fcn.1400144a0
jmp 0x140035df5
mov ebx, dword [rsp + 0x64]
dec ebx
js 0x140035da1
lea r13, str.Error___i__return_by_function___s_
nop
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8, rbp
mov edx, ebx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140035d30
mov edi, 4
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rcx, str.RegEnumKeyEx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
lea edx, [rdi + 6]
lea r8d, [rdi - 3]
mov rcx, rsi
call fcn.1400144a0
jmp 0x140035d98
movzx r9d, r14b
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call fcn.140034db0
test al, al
jne 0x140035d98
mov edi, 4
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rax, str.EliminarArbolRegistro
mov qword [rsp + 0x30], rax
lea rax, str.pSubClave
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
lea edx, [rdi + 6]
lea r8d, [rdi - 3]
mov rcx, rsi
call fcn.1400144a0
sub ebx, 1
jns 0x140035cb0
mov rcx, rbp
call fcn.140067eac
jmp 0x140035df5
mov edi, 4
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rcx, str.RegQueryInfoKey
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea r13, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], r13
lea edx, [rdi + 6]
lea r8d, [rdi - 3]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
mov dword [rsp + 0x28], edi
lea rax, str.Return_code___i_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r9, qword [rsp + 0x90]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rsi
call fcn.1400144a0
nop
cmp qword [rsp + 0xa8], 8
jb 0x140035e84
mov rcx, qword [rsp + 0x90]
call fcn.140065920
mov eax, edi
jmp 0x140035e86
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret