Function at 0x14006c1a1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rax
pushf
mov eax, 0xe34210b9
pushf
not eax
add eax, 0x27d533a
xor eax, 0x27bd4fdd
rol eax, 0x62
popf
pushf
not eax
add eax, 0x21db050e
xor eax, 0x2d533383
rol eax, 0x22
popf
pushf
not eax
add eax, 0x5335354d
xor eax, 0x8ed44e4
rol eax, 0xa9
popf
cmp eax, 0
jne 0x14006c1f1
popf
pop rax
jmp 0x14006c2d2
cmp eax, 0xf
jne 0x14006c200
popf
pop rax
jmp 0x14006cb88
cmp eax, 0xb
jne 0x14006c20f
popf
pop rax
jmp 0x14006c8f3
cmp eax, 2
jne 0x14006c21e
popf
pop rax
jmp 0x14006c45a
cmp eax, 0xc
jne 0x14006c22d
popf
pop rax
jmp 0x14006c9a1
cmp eax, 0xe
jne 0x14006c23c
popf
pop rax
jmp 0x14006cb04
cmp eax, 4
jne 0x14006c24b
popf
pop rax
jmp 0x14006c53c
cmp eax, 0xa
jne 0x14006c25a
popf
pop rax
jmp 0x14006c851
cmp eax, 3
jne 0x14006c269
popf
pop rax
jmp 0x14006c4ef
cmp eax, 7
jne 0x14006c278
popf
pop rax
jmp 0x14006c69c
cmp eax, 1
jne 0x14006c287
popf
pop rax
jmp 0x14006c36a
cmp eax, 6
jne 0x14006c296
popf
pop rax
jmp 0x14006c60b
cmp eax, 8
jne 0x14006c2a5
popf
pop rax
jmp 0x14006c71e
cmp eax, 5
jne 0x14006c2b4
popf
pop rax
jmp 0x14006c5d0
cmp eax, 9
jne 0x14006c2c3
popf
pop rax
jmp 0x14006c814
cmp eax, 0xd
jne 0x14006c2d2
popf
pop rax
jmp 0x14006ca93
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rsi, rdx
mov r14, rcx
jmp 0x14006c2f4
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ebx, ebx
test eax, eax
je 0x14006c337
push rax
pushf
mov eax, 0x9889cc1e
pushf
not eax
add eax, 0x337b2279
xor eax, 0x35cc7fd5
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x58e4429a
xor eax, 0x26ee5ad4
rol eax, 0xfb
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0xe2fd362d
pushf
not eax
add eax, 0x71e2da08
xor eax, 0x380911e0
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x4adcb74a
xor eax, 0x592a7c93
rol eax, 9
popf
jmp 0x14006c1e2
lea rax, [rbp + 0x1a8]
mov r9d, 0x6115ce68
pushf
not r9d
add r9d, 0x61411aed
xor r9d, 0x2aab291b
rol r9d, 0xff
popf
pushf
not r9d
add r9d, 0x2015e3c8
xor r9d, 0x70191830
rol r9d, 0x50
popf
pushf
not r9d
add r9d, 0x4b293419
xor r9d, 0x200ebf47
rol r9d, 0x7d
popf
pushf
not r9d
add r9d, 0x7199bf90
xor r9d, 0x94b8ace
rol r9d, 0xb6
popf
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
jmp 0x14006c3ea
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006c427
push rax
pushf
mov eax, 0x3a609d2e
pushf
not eax
add eax, 0x3f19a5f
xor eax, 0x608ee1b6
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x2df641e3
xor eax, 0x6a6564bf
rol eax, 0x96
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0xbfda1dc8
pushf
not eax
add eax, 0x3e031541
xor eax, 0x10c237f
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x36ade1fb
xor eax, 0x4660a183
rol eax, 0x89
popf
jmp 0x14006c1e2
cmp eax, 2
je 0x14006c4a9
push rax
pushf
mov eax, 0x8703b21b
pushf
not eax
add eax, 0x6fe2e7a5
xor eax, 0x50934f1a
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x717cade9
xor eax, 0x265043bb
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x33e7efc7
xor eax, 0x12662fd
rol eax, 0x87
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0x31a55c14
pushf
not eax
add eax, 0x2a24ba90
xor eax, 0x533e8788
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x74e51002
xor eax, 0x30416e61
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x2f334ca0
xor eax, 0x170b79f
rol eax, 0xee
popf
jmp 0x14006c1e2
xor eax, eax
jmp 0x14006cb88
mov rdi, rsi
test rsi, rsi
jne 0x14006c59d
push rax
pushf
mov eax, 0xf7cad621
pushf
not eax
add eax, 0x470d9812
xor eax, 0x4a1fc430
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x54d28708
xor eax, 0x7322f26b
rol eax, 0xea
popf
pushf
not eax
add eax, 0x7744f019
xor eax, 0x29a68be0
rol eax, 9
popf
pushf
not eax
add eax, 0x451c20d0
xor eax, 0x76b76db3
rol eax, 0x48
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0x2b2b8a76
pushf
not eax
add eax, 0x51915c0c
xor eax, 0x64b4a53
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x3c76a30
xor eax, 0x123f5289
rol eax, 0xd7
popf
jmp 0x14006c1e2
mov rdi, rbx
jmp 0x14006c71e
cmp word [rsi], bx
je 0x14006c656
push rax
pushf
mov eax, 0xe2ecfabc
pushf
not eax
add eax, 0xd4a42d1
xor eax, 0x53580251
rol eax, 0x79
popf
pushf
not eax
add eax, 0x500e5ea1
xor eax, 0x100cdd62
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x30f7e91e
xor eax, 0x43a56087
rol eax, 0x31
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0x312d4448
pushf
not eax
add eax, 0x41065fe
xor eax, 0x54a0dd9f
rol eax, 0x43
popf
pushf
not eax
add eax, 0x215572e0
xor eax, 0x3b7f2e6
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x6ec0a99d
xor eax, 0x2272ec0c
rol eax, 0x6e
popf
jmp 0x14006c1e2
add rdi, 2
cmp word [rdi], bx
jne 0x14006c6eb
push rax
pushf
mov eax, 0xa0350d54
pushf
not eax
add eax, 0x2ab0376e
xor eax, 0x68daceb0
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x56088747
xor eax, 0x211b1f58
rol eax, 0x25
popf
pushf
not eax
add eax, 0x10d43fe5
xor eax, 0xf4f1c60
rol eax, 0x1a
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0x6364c2d
pushf
not eax
add eax, 0x770b744
xor eax, 0x63a7ab85
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x5419b178
xor eax, 0xba86297
rol eax, 0xea
popf
jmp 0x14006c1e2
mov eax, 0x4ea120d0
pushf
not eax
add eax, 0x6a5c7c63
xor eax, 0x147d71a8
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x7be8ddf1
xor eax, 0x4a71e583
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x48752d83
xor eax, 0x187fac39
rol eax, 0x29
popf
cmp word [rdi - 2], ax
je 0x14006c7bb
push rax
pushf
mov eax, 0x5785e6cc
pushf
not eax
add eax, 0x1029620a
xor eax, 0x3e7e033c
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x72d2fb73
xor eax, 0x14b439
rol eax, 0x19
popf
pushf
not eax
add eax, 0x6c65581d
xor eax, 0x53af1a74
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x1c08fc4e
xor eax, 0x4b5977d6
rol eax, 0x6f
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0xe7d1662b
pushf
not eax
add eax, 0x59d9642d
xor eax, 0x45e5cd9c
rol eax, 0x98
popf
pushf
not eax
add eax, 0x40fd58e5
xor eax, 0x4d753d1f
rol eax, 0x11
popf
pushf
not eax
add eax, 0x2848cccf
xor eax, 0x71551b3
rol eax, 0xab
popf
pushf
not eax
add eax, 0x2c3adaa6
xor eax, 0x643ede6
rol eax, 0x86
popf
jmp 0x14006c1e2
mov word [rdi], ax
add rdi, 2
mov word [rdi], bx
push rax
pushf
mov eax, 0x602a3733
pushf
not eax
add eax, 0x24a81b65
xor eax, 0x648d4460
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x35fc6d39
xor eax, 0x45d39cc0
rol eax, 0xe4
popf
jmp 0x14006c1e2
mov r15d, 0xa5ce7e22
pushf
not r15d
add r15d, 0xf9ee751
xor r15d, 0x359a59f7
rol r15d, 0x11
popf
pushf
not r15d
add r15d, 0x6d4efa03
xor r15d, 0xaa1dc59
rol r15d, 0x81
popf
pushf
not r15d
add r15d, 0x36af431f
xor r15d, 0x5424dfb5
rol r15d, 0x81
popf
pushf
not r15d
add r15d, 0x1bc12ad1
xor r15d, 0x53bf7cc6
rol r15d, 0xed
popf
jmp 0x14006c9a1
mov r9, r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rdi
call fcn.140041f26
mov rdx, rsi
mov rcx, r14
call fcn.14006c1a1
test eax, eax
je 0x14006c95b
push rax
pushf
mov eax, 0x9aabf626
pushf
not eax
add eax, 0x7cc0081
xor eax, 0x50efd535
rol eax, 0xb
popf
pushf
not eax
add eax, 0x3a17d49a
xor eax, 0x301c1cfb
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x33a00cb1
xor eax, 0x1077c728
rol eax, 0x5f
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0x1d2a32e7
pushf
not eax
add eax, 0x947483b
xor eax, 0x5d908f5
rol eax, 0x19
popf
pushf
not eax
add eax, 0x71ccab59
xor eax, 0x6cb3bfb9
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x254e06dc
xor eax, 0x5da8b888
rol eax, 0x63
popf
jmp 0x14006c1e2
mov rcx, qword [rbp + 0x1a8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1a0]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x1a0], r15d
jmp 0x14006c9d7
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14006ca3a
push rax
pushf
mov eax, 0xad3fb5db
pushf
not eax
add eax, 0x607d1ae
xor eax, 0x21c43df8
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x3efa6f36
xor eax, 0x7737de5e
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x437ace97
xor eax, 0x155b374e
rol eax, 4
popf
pushf
not eax
add eax, 0x73430b6d
xor eax, 0x2fd1f925
rol eax, 0xd7
popf
jmp 0x14006c1e2
push rax
pushf
mov eax, 0xc56b0bf4
pushf
not eax
add eax, 0x572d6bac
xor eax, 0x69cca9ae
rol eax, 0x28
popf
pushf
not eax
add eax, 0x5726cd4a
xor eax, 0x2e32f844
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x7cd4e5a6
xor eax, 0x64058a5e
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x3f7e76b4
xor eax, 0x9ad5e6
rol eax, 0xb5
popf
jmp 0x14006c1e2
mov rcx, qword [rbp + 0x1a8]
mov word [rdi - 2], bx
jmp 0x14006ca9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
jmp 0x14006caac
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
mov eax, ebx
jmp 0x14006cb88
mov eax, 0x33be69d8
pushf
not eax
add eax, 0x2a2d6da1
xor eax, 0x4a932e94
rol eax, 3
popf
pushf
not eax
add eax, 0x54f9e473
xor eax, 0x4d18798d
rol eax, 0x63
popf
push rax
pushf
mov eax, 0x3c4b75bd
pushf
not eax
add eax, 0x63a89404
xor eax, 0x37d6ddbd
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x7788ed85
xor eax, 0xb7524ce
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x41a588a1
xor eax, 0x4585f1ce
rol eax, 0x36
popf
pushf
not eax
add eax, 0x7a7116de
xor eax, 0x22a1e3e
rol eax, 9
popf
jmp 0x14006c1e2
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret