Function at 0x1400ab570
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x890
mov rax, qword [0x1401ad1c0]
xor rax, rsp
mov qword [rsp + 0x888], rax
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x71]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_1026
rep stosb byte [rdi], al
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x480], 0
lea rax, [rsp + 0x481]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_1026
rep stosb byte [rdi], al
mov dword [rsp + 0x470], 0x400
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x8a8]
mov r8d, dword [rax + 0x60]
lea rdx, [0x1401b17c8]
lea rcx, [rsp + 0x70]
call sub.MSVCR110.dll_sprintf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20007
xor r8d, r8d
lea rdx, [0x1401b17d8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400ab6e4
cmp qword [rsp + 0x8a0], 0
je 0x1400ab6d1
mov rax, qword [rsp + 0x8a0]
cmp dword [rax + 0x88], 0
je 0x1400ab67c
xor eax, eax
test eax, eax
je 0x1400ab67c
mov rax, qword [rsp + 0x8a0]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x880], eax
jmp 0x1400ab687
mov dword [rsp + 0x880], 0xffffff86
mov rax, qword [rsp + 0x8a0]
mov ecx, dword [rsp + 0x880]
mov dword [rax + 0x88], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x267
mov edx, 0xffffff86
mov rcx, qword [rsp + 0x8a0]
call fcn.14006e450
mov rax, qword [rsp + 0x8a0]
mov eax, dword [rax + 0x88]
jmp 0x1400ab854
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x884], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x470]
lea r8, [rsp + 0x480]
mov edx, dword [rsp + 0x884]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [rsp + 0x50]
add ecx, 1
mov dword [rsp + 0x50], ecx
test eax, eax
jne 0x1400ab847
movsxd rax, dword [rsp + 0x470]
mov byte [rsp + rax + 0x480], 0
lea rax, [rsp + 0x480]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
jmp 0x1400ab77a
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x48], 0
je 0x1400ab7b5
cmp dword [rsp + 0x40], 2
jge 0x1400ab7b5
mov edx, 0x2d
mov rcx, qword [rsp + 0x48]
call sub.MSVCR110.dll_strchr
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400ab7b3
mov rax, qword [rsp + 0x48]
add rax, 1
mov qword [rsp + 0x48], rax
jmp 0x1400ab76f
cmp qword [rsp + 0x48], 0
je 0x1400ab837
lea rcx, [rsp + 0x70]
call sub.MSVCR110.dll_strlen
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x480]
call sub.MSVCR110.dll_strncmp
test eax, eax
jne 0x1400ab837
mov rax, qword [rsp + 0x8a8]
add rax, 8
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call sub.MSVCR110.dll_strcmp
test eax, eax
jne 0x1400ab837
lea rdx, [rsp + 0x480]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea rdx, [0x1401b1800]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rdx, qword [rsp + 0x8a8]
mov rcx, qword [rsp + 0x8a0]
call fcn.1400ab880
mov dword [rsp + 0x470], 0x400
jmp 0x1400ab6e4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x888]
xor rcx, rsp
call fcn.14006b6a0
add rsp, 0x890
pop rdi
ret