Function at 0x140078d00
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
movaps xmmword [rsp + 0x2a0], xmm7
movaps xmmword [rsp + 0x290], xmm6
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022a038]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.1400fc630
test eax, eax
jg 0x14007921a
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x130]
mov qword [rcx + 0x10], r12
movaps xmm6, xmmword [0x140206780]
movaps xmmword [rcx], xmm6
call fcn.1400abe90
mov dword [rsp + 0x12c], 0
mov ecx, 0x40
call fcn.140148440
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
mov qword [rax + 0x38], rcx
mov qword [rsp + 0x120], rax
cmp rax, rsi
je 0x140078de9
cmp byte [rax + 0x17], 0
movzx r8d, byte [rsi + 0x17]
js 0x14007951b
test r8b, r8b
jns 0x140078ddb
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rax
call fcn.14008fde0
jmp 0x140078de9
mov rcx, qword [rsi + 0x10]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
mov r9d, 0x3001f
or r9d, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
mov r8, rsi
jns 0x140078dff
mov r8, qword [rsi]
mov rdx, qword [rdi + 0x20]
lea rcx, [rsp + 0x130]
call fcn.1400abf90
cmp eax, 5
je 0x140078e62
test eax, eax
jne 0x140078f02
mov rcx, qword [0x14023b228]
test rcx, rcx
jne 0x140078e38
call fcn.14005f340
mov rcx, rax
mov qword [0x14023b228], rax
xor eax, eax
cmp dword [rdi + 0x40], 0x200
sete al
lea r8d, [rax*8 + 4]
mov rdx, rbx
mov r9d, 0x30019
call fcn.14005f620
test al, al
jne 0x140078f51
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.1400fc630
test eax, eax
jg 0x14007926f
mov rcx, qword [0x14023b228]
test rcx, rcx
jne 0x140078e96
call fcn.14005f340
mov rcx, rax
mov qword [0x14023b228], rax
mov rax, qword [rsp + 0x120]
add rax, 0x20
xor edx, edx
cmp dword [rdi + 0x40], 0x200
sete dl
lea r8d, [rdx*8 + 4]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov ebp, 0x3001f
mov rdx, rbx
mov r9d, 0x3001f
call fcn.14005fe30
test al, al
je 0x140079048
or ebp, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
mov r8, rsi
jns 0x140078eea
mov r8, qword [rsi]
mov rdx, qword [rdi + 0x20]
lea rcx, [rsp + 0x130]
mov r9d, ebp
call fcn.1400abf90
test eax, eax
je 0x140078f51
mov ecx, 2
call fcn.1400fc600
test al, al
je 0x1400791ac
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, VarR8FromUI1
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_open_key
mov r8d, shutdown
jmp 0x140079194
mov rcx, qword [rsp + 0x130]
lea r9, [rsp + 0x12c]
mov edx, reloc.WS2_32.dll_shutdown
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x140078f7c
cmp eax, 0x7a
jne 0x140079097
mov r14, qword [rsp + 0x120]
mov ecx, dword [rsp + 0x12c]
call fcn.1401484bc
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 0x18], rax
test rcx, rcx
je 0x140078fae
call fcn.1401484c4
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x130]
lea r9, [rsp + 0x12c]
mov edx, reloc.WS2_32.dll_shutdown
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
je 0x1400790e6
mov ecx, 2
call fcn.1400fc600
test al, al
je 0x1400791ac
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x64
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_security_descriptor_for
mov r8d, 0x29
call fcn.140185b20
mov rcx, rax
mov rdx, rbx
call fcn.1400987b0
lea rdx, str._but_we_succeeded_earlier_
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
mov rcx, rax
call fcn.140185b20
jmp 0x1400791a4
mov ecx, 2
call fcn.1400fc600
test al, al
je 0x1400791ac
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x41
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Unable_to_obtain_sufficient_permissions_on_key
mov r8d, 0x2e
jmp 0x140079194
mov ecx, 2
call fcn.1400fc600
test al, al
je 0x1400791ac
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x54
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_security_descriptor_for
mov r8d, 0x29
jmp 0x140079194
mov eax, 0xaaaaaaaa
lea rdx, [rsp + 0x11c]
mov dword [rdx], eax
lea r8, [rsp + 0x118]
mov dword [r8], eax
lea r9, [rsp + 0x114]
mov dword [r9], eax
mov rcx, qword [rsp + 0x130]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400792b9
mov ecx, 2
call fcn.1400fc600
test al, al
je 0x1400791ac
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, WSAStartup
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_key_info_for
mov r8d, 0x1e
call fcn.140185b20
mov rcx, rax
mov rdx, rbx
call fcn.1400987b0
mov rcx, rsi
call fcn.140098280
xor esi, esi
mov rdi, qword [rsp + 0x120]
mov qword [rsp + 0x120], 0
test rdi, rdi
je 0x1400791d7
mov rcx, rdi
call fcn.140079f60
mov rcx, rdi
call fcn.14014847c
lea rcx, [rsp + 0x130]
call fcn.1400ac010
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140148f60
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
movaps xmm7, xmmword [rsp + 0x2a0]
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x26
mov r9d, 0xffffffff
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.DeleteAndSaveRecursive_:
mov r8d, SafeArrayCopy
call fcn.140185b20
mov rcx, rax
mov rdx, rsi
call fcn.1400987b0
mov rcx, r14
call fcn.140098280
jmp 0x140078d57
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x3a
mov r9d, 0xffffffff
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Insufficient_permissions_on_the_key
mov r8d, 0x23
call fcn.140185b20
mov rcx, r14
call fcn.140098280
jmp 0x140078e7b
lea rcx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov edx, 0x4f
call fcn.1400fc630
test eax, eax
jg 0x140079984
mov ecx, dword [rsp + 0x118]
inc ecx
mov dword [rsp + 0x118], ecx
add rcx, rcx
call fcn.1401484bc
mov qword [rsp + 0x70], rax
mov ecx, dword [rsp + 0x114]
call fcn.1401484bc
mov r15, rax
cmp dword [rsp + 0x11c], 0
jle 0x1400794e4
lea rdx, [rsp + 0xd0]
lea r14, [rsp + 0xb0]
lea r9, [rsp + 0xf0]
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xorps xmm7, xmm7
xor ebp, ebp
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0xb0], 0xaaaaaaaa
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov edx, ebp
mov r13, qword [rsp + 0x70]
mov r8, r13
call r10
test eax, eax
jne 0x1400794cb
mov dword [rsp + 0x68], ebp
mov rbp, r14
mov ecx, 0x30
call fcn.140148440
mov r14, r13
mov r13, rax
movups xmmword [rax], xmm7
xor eax, eax
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x20], rax
mov qword [rsp + 0x150], r13
mov eax, dword [rsp + 0xb0]
mov dword [r13 + 0x18], eax
test r14, r14
je 0x140079aef
mov rcx, r14
call fcn.140170424
mov rcx, r13
mov rdx, r14
mov r8, rax
call fcn.14008f650
mov ecx, dword [rsp + 0xd0]
mov rax, qword [rsp + 0x150]
mov dword [rax + 0x28], ecx
mov r13, qword [rax + 0x20]
mov qword [rax + 0x20], r15
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rcx + 0x30]
cmp rdx, qword [rcx + 0x38]
jae 0x140079433
test rdx, rdx
je 0x140079ac3
mov r14, rbp
mov qword [rsp + 0x150], 0
mov qword [rdx], rax
add rdx, 8
mov qword [rcx + 0x30], rdx
jmp 0x140079447
add rcx, 0x28
lea rdx, [rsp + 0x150]
call fcn.14007a100
mov r14, rbp
mov ebp, dword [rsp + 0x68]
lea r9, [rsp + 0xf0]
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r15, qword [rsp + 0x150]
mov qword [rsp + 0x150], 0
test r15, r15
je 0x1400794af
mov rcx, qword [r15 + 0x20]
mov qword [r15 + 0x20], 0
test rcx, rcx
je 0x140079489
call fcn.1401484c4
cmp byte [r15 + 0x17], 0
jns 0x140079498
mov rcx, qword [r15]
call fcn.14014847c
mov rcx, r15
call fcn.14014847c
lea r9, [rsp + 0xf0]
mov r10, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebp
mov r15, r13
cmp ebp, dword [rsp + 0x11c]
lea rdx, [rsp + 0xd0]
jl 0x140079330
jmp 0x1400794e7
mov ecx, 2
call fcn.1400fc600
test al, al
jne 0x1400799dd
xor esi, esi
jmp 0x14007994d
mov r13, r15
mov rax, qword [rdi + 0x30]
cmp rax, qword [rdi + 0x38]
jae 0x140079530
test rax, rax
je 0x140079ac3
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x120], 0
mov qword [rax], rcx
add rax, 8
mov qword [rdi + 0x30], rax
jmp 0x140079541
test r8b, r8b
jns 0x140079970
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
jmp 0x140079977
lea rcx, [rdi + 0x28]
lea rdx, [rsp + 0x120]
call fcn.14007a2d0
mov qword [rsp + 0x100], r12
movaps xmmword [rsp + 0xf0], xmm6
cmp byte [rsi + 0x17], 0
js 0x140079a31
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xf0], xmm0
movzx eax, byte [rsp + 0x107]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsp + 0xf8]
cmovs rdx, rcx
test rdx, rdx
je 0x1400795b7
test al, al
jns 0x140079a9f
test rcx, rcx
je 0x140079b1b
mov rdx, qword [rsp + 0xf0]
cmp word [rdx + rcx*2 - 2], 0x5c
jne 0x140079a63
mov qword [rsp + 0xe0], r12
movaps xmmword [rsp + 0xd0], xmm6
cmp byte [rbx + 0x17], 0
js 0x140079a4a
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0xd0], xmm0
mov al, byte [rsp + 0xe7]
movzx r8d, al
mov ecx, r8d
and ecx, 0x7f
test r8b, r8b
mov rdx, qword [rsp + 0xd8]
mov r9, rcx
cmovs r9, rdx
test r9, r9
je 0x140079639
test al, al
jns 0x140079ab4
test rdx, rdx
je 0x140079b1b
mov r9, qword [rsp + 0xd0]
mov r8, rdx
cmp word [r9 + r8*2 - 2], 0x5c
jne 0x140079a79
movzx r8d, byte [rsp + 0x107]
test r8b, r8b
mov qword [rsp + 0x68], r13
jns 0x140079656
mov r8, qword [rsp + 0xf8]
jmp 0x14007965a
and r8d, 0x7f
test al, al
cmovs rcx, rdx
movsxd rax, r8d
mov qword [rsp + 0x80], rax
movsxd rax, ecx
mov qword [rsp + 0x78], rax
xorps xmm6, xmm6
lea r13, [rsp + 0xb0]
lea rbp, [rsp + 0xcc]
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rbx, [rsp + 0x150]
mov dword [rsp + 0xcc], 0x104
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], 0
mov edx, 0x104
mov rcx, r13
call fcn.1400aa560
mov rcx, qword [rsp + 0x130]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, rbp
call r15
mov r12d, 5
cmp eax, 0x103
je 0x140079707
test eax, eax
je 0x14007972c
mov ecx, 2
call fcn.1400fc600
mov r12d, 1
test al, al
jne 0x14007985a
cmp byte [rsp + 0xc7], 0
jns 0x14007971e
mov rcx, qword [rsp + 0xb0]
call fcn.14014847c
test r12d, r12d
je 0x140079695
jmp 0x1400798d4
mov edx, dword [rsp + 0xcc]
mov rcx, r13
xor r8d, r8d
call fcn.1400fa130
lea r14, [rsp + 0xf0]
mov rcx, r14
mov rdx, qword [rsp + 0x80]
xor r8d, r8d
call fcn.1400fa130
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x78]
xor r8d, r8d
call fcn.1400fa130
mov r8d, 0x104
mov rcx, rbx
mov dl, 0xaa
call fcn.14014bec0
movzx eax, byte [rsp + 0x107]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0xf0]
cmovns rax, r14
mov qword [rsp + 0x88], rax
cmovs rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x90], rcx
lea r12, [rsp + 0x98]
mov rcx, r12
lea rdx, [rsp + 0x88]
call fcn.1400a1d60
cmp byte [rsp + 0xaf], 0
jns 0x1400797dc
mov r12, qword [rsp + 0x98]
mov r8d, 0x104
mov rcx, rbx
mov rdx, r12
call fcn.1401065a0
cmp byte [rsp + 0xaf], 0
jns 0x140079804
mov rcx, qword [rsp + 0x98]
call fcn.14014847c
mov rcx, rbx
call fcn.1400e6530
movzx eax, byte [rsp + 0xc7]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
cmovns rdx, r13
mov rcx, r14
call fcn.14008fa00
movzx r8d, byte [rsp + 0xc7]
test r8b, r8b
jns 0x14007989c
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
jmp 0x1400798a3
mov rcx, rbx
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
mov r8d, 0xa7
mov r9d, 2
call fcn.140097d90
mov r8d, SafeArrayCopy
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_read_a_subkey
call fcn.140185b20
mov rcx, rbx
call fcn.140098280
jmp 0x140079707
and r8d, 0x7f
mov rdx, r13
lea rbx, [rsp + 0xd0]
mov rcx, rbx
call fcn.14008fa00
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.140078d00
xor al, 1
movzx r12d, al
lea rbx, [rsp + 0x150]
jmp 0x140079707
cmp r12d, 5
jne 0x140079913
lea rcx, [rsp + 0x130]
call fcn.1401b1890
mov r8d, dword [rdi + 0x40]
cmp byte [rsi + 0x17], 0
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
jns 0x1400798fe
mov rsi, qword [rsi]
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov sil, 1
jmp 0x14007991f
xor esi, esi
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
cmp byte [rsp + 0xe7], 0
jns 0x140079936
mov rcx, qword [rsp + 0xd0]
call fcn.14014847c
cmp byte [rsp + 0x107], 0
jns 0x14007994d
mov rcx, qword [rsp + 0xf0]
call fcn.14014847c
test r15, r15
je 0x14007995a
mov rcx, r15
call fcn.1401484c4
test r13, r13
je 0x1400791ae
mov rcx, r13
call fcn.1401484c4
jmp 0x1400791ae
and r8d, 0x7f
mov rdx, rsi
mov rcx, rax
call fcn.14008fcf0
jmp 0x140078de9
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea r14, [rsp + 0x150]
mov rcx, r14
mov r8d, 0x75
mov r9d, 0xffffffff
call fcn.140097d90
lea rcx, [rsp + 0x160]
mov edx, dword [rsp + 0x11c]
call fcn.14003a070
lea rdx, str._values
mov r8d, 7
mov rcx, rax
call fcn.140185b20
mov rcx, r14
call fcn.140098280
jmp 0x1400792d2
lea rdx, str.....operadesktopwindowsinstaller_transactionsdelete_reg_key_operation.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x84
mov r9d, 2
call fcn.140097d90
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_obtain_value_nr
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
call fcn.140185b20
mov rcx, rax
mov edx, ebp
call fcn.140039e30
mov rcx, rsi
call fcn.140098280
jmp 0x1400794dd
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0xf0]
call fcn.14008f3a0
jmp 0x140079572
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0xd0]
call fcn.14008f3a0
jmp 0x1400795e8
lea rcx, [rsp + 0xf0]
mov dx, 0x5c
call fcn.1400f9f10
jmp 0x1400795b7
lea rbx, [rsp + 0xd0]
mov rcx, rbx
mov dx, 0x5c
call fcn.1400f9f10
movzx eax, byte [rbx + 0x17]
mov rdx, qword [rbx + 8]
mov ecx, eax
and ecx, 0x7f
jmp 0x140079639
test rax, rax
je 0x140079b1b
lea rdx, [rsp + 0xf0]
mov rcx, rax
jmp 0x1400795ab
je 0x140079b1b
lea r9, [rsp + 0xd0]
jmp 0x14007962c
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140186340
lea rax, str.string::assign_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xa70
call fcn.140186340
lea rax, str.string::back__:_string_is_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0x4c8
call fcn.140186340
int3