Function at 0x140048930
Capabilities:
Check for peb beingdebugged flag
Delete registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov r13d, 0x200
mov r8d, r13d
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140060530
lea rcx, [0x140070e80]
call fcn.1405eb60f
nop
mov rbx, rax
mov qword [rsp + 0x78], rax
lea r8, [0x140097f30]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004a5dc
mov edi, eax
mov rcx, rbx
call fcn.1405eb646
nop
or rsi, 0xffffffffffffffff
lea r15d, [rsi + 5]
xor r14d, r14d
test edi, edi
jle 0x140048af3
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x200]
mov edx, 0x2001f
lea rcx, [rbp - 0x50]
call fcn.14000c240
cmp dword [rbp + 0x1f0], r14d
jl 0x140048af3
mov rbx, qword [rbp + 0x200]
mov qword [rbp + 0x208], rbx
mov dword [rbp + 0x1f8], r14d
lea rcx, [0x140070f00]
call fcn.1405eb60f
nop
mov rdi, rax
mov qword [rbp - 0x80], rax
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r14w
jne 0x140048a02
add ax, ax
mov word [rsp + 0x40], ax
add ax, 2
mov word [rsp + 0x42], ax
mov qword [rsp + 0x48], rdi
mov eax, dword [0x1400920e8]
mov dword gs:[0x68], eax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005fa20
nop
mov rcx, rdi
call fcn.1405eb646
nop
mov dword [rbp + 0x1f8], r14d
lea rcx, [0x140070cb8]
call fcn.1405eb60f
nop
mov rdi, rax
mov qword [rbp - 0x78], rax
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r14w
jne 0x140048a7c
add ax, ax
mov word [rsp + 0x50], ax
add ax, 2
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], rdi
mov eax, dword [0x1400920e8]
mov dword gs:[0x68], eax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14005fa20
mov dword [rbp + 0x1f0], eax
mov rcx, rdi
call fcn.1405eb646
nop
nop
test rbx, rbx
je 0x140048af3
mov rcx, rbx
call qword [0x140068658]
mov qword [rbp + 0x208], r14
mov r8, r13
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140060530
lea rcx, [0x140070ce0]
call fcn.1405eb60f
nop
mov rbx, rax
mov qword [rbp - 0x70], rax
lea r8, [0x140097f30]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004a5dc
mov edi, eax
mov rcx, rbx
call fcn.1405eb646
nop
test edi, edi
jle 0x140048c03
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x200]
mov edx, 0x2001f
lea rcx, [rbp - 0x50]
call fcn.14000c240
cmp dword [rbp + 0x1f0], r14d
jl 0x140048c03
mov rbx, qword [rbp + 0x200]
mov qword [rsp + 0x30], rbx
mov dword [rbp + 0x1f8], 1
lea rcx, [0x140070d60]
call fcn.1405eb60f
nop
mov rdi, rax
mov qword [rbp - 0x68], rax
inc rsi
cmp word [rax + rsi*2], r14w
jne 0x140048b8e
add si, si
mov word [rsp + 0x60], si
add si, 2
mov word [rsp + 0x62], si
mov qword [rsp + 0x68], rdi
mov eax, dword [0x1400920e8]
mov dword gs:[0x68], eax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14005fa20
mov dword [rbp + 0x1f0], eax
mov rcx, rdi
call fcn.1405eb646
nop
nop
test rbx, rbx
je 0x140048c03
mov rcx, rbx
call qword [0x140068658]
mov qword [rsp + 0x30], r14
mov r8, r13
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140060530
lea rcx, [0x140070d90]
call fcn.1405eb60f
nop
mov rbx, rax
mov qword [rbp - 0x60], rax
lea r8, [0x140097f30]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004a5dc
mov edi, eax
mov rcx, rbx
call fcn.1405eb646
nop
test edi, edi
jle 0x140048c9b
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x200]
mov edx, 0x3001f
lea rcx, [rbp - 0x50]
call fcn.14000c240
cmp dword [rbp + 0x1f0], r14d
jl 0x140048c9b
mov rbx, qword [rbp + 0x200]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov rcx, qword [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
nop
test rbx, rbx
je 0x140048c9b
mov rcx, rbx
call qword [0x140068658]
mov qword [rsp + 0x38], r14
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret