Function at 0x140004bb0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140094040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rdx
mov rbx, rcx
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x140004bfb
mov rdx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004e54
xor ebx, ebx
mov r13d, ebx
mov dword [rsp + 0x48], 0xff
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140004e37
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140004c81
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ce40
nop
mov r11, qword [r12 + 0x10]
mov rbx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140004cb0
mov rbx, qword [r12]
lea rsi, [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
cmp r15, 7
cmova rsi, rdi
mov rax, qword [rsp + 0x60]
cmp r11, rax
ja 0x140004dbf
sub rax, r11
test r11, r11
je 0x140004d64
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140004d1c
cmp word [rax], r10w
je 0x140004d19
cmp rcx, 1
je 0x140004d1c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140004d06
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140004dbf
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140004d58
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140004e44
add rdx, 2
sub r8, 1
jne 0x140004d40
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140004dbf
lea rdx, str.Deleting_value:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000bf20
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14000d930
lea rdx, [0x14000c100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
inc r13d
mov dword [rsp + 0x48], 0xff
cmp r15, 7
jbe 0x140004e01
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004df9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e4d
mov rcx, rdi
call fcn.140044800
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140004c63
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004e89
add rax, 2
jmp 0x140004cf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000c140
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x140004e6e
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14000d930
lea rdx, [0x14000c100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400447e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret