Function at 0x140044900
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4140]
mov eax, 0x4240
call fcn.140051f80
sub rsp, rax
mov rax, qword [0x1400b8040]
xor rax, rsp
mov qword [rbp + 0x4130], rax
mov r15, rdx
mov qword [rsp + 0x78], rdx
mov rbx, rcx
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400adcb0]
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp - 0x20], r12b
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
cmp rdi, 0xf
jbe 0x140044975
mov rcx, qword [rcx]
mov qword [rsp + 0x20], 0x12
lea r9, str.HKEY_LOCAL_MACHINE
mov rdx, rsi
call fcn.14004cbb0
test rax, rax
jne 0x1400449d8
mov r14, 0xffffffff80000002
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rsi, 0x13
jb 0x140045360
lea rax, [rsi - 0x13]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp rdi, 0xf
jbe 0x1400449cf
mov rbx, qword [rbx]
lea rdx, [rbx + 0x13]
jmp 0x140044b98
mov rcx, rbx
cmp rdi, 0xf
jbe 0x1400449e4
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0x11
lea r9, str.HKEY_CURRENT_USER
mov rdx, rsi
call fcn.14004cbb0
test rax, rax
jne 0x140044a47
mov r14, 0xffffffff80000001
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rsi, 0x12
jb 0x140045360
lea rax, [rsi - 0x12]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp rdi, 0xf
jbe 0x140044a3e
mov rbx, qword [rbx]
lea rdx, [rbx + 0x12]
jmp 0x140044b98
mov rcx, rbx
cmp rdi, 0xf
jbe 0x140044a53
mov rcx, qword [rbx]
mov rdi, rsi
mov qword [rsp + 0x20], 0x11
lea r9, str.HKEY_CLASSES_ROOT
mov rdx, rsi
call fcn.14004cbb0
test rax, rax
jne 0x140044aba
mov r14, 0xffffffff80000000
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rsi, 0x12
jb 0x140045360
lea rax, [rsi - 0x12]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x140044a3e
mov rbx, qword [rbx]
lea rdx, [rbx + 0x12]
jmp 0x140044b98
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0xf
jbe 0x140044aca
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0xa
lea r9, str.HKEY_USERS
mov rdx, rdi
call fcn.14004cbb0
test rax, rax
jne 0x140044b2a
mov r14, 0xffffffff80000003
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rdi, 0xb
jb 0x140045360
lea rax, [rdi - 0xb]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp rsi, 0xf
jbe 0x140044b24
mov rbx, qword [rbx]
lea rdx, [rbx + 0xb]
jmp 0x140044b98
mov rcx, rbx
cmp rsi, 0xf
jbe 0x140044b36
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0x13
lea r9, str.HKEY_CURRENT_CONFIG
mov rdx, rdi
call fcn.14004cbb0
test rax, rax
jne 0x1400452eb
mov r14, 0xffffffff80000005
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rdi, 0x14
jb 0x140045360
lea rax, [rdi - 0x14]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp rsi, 0xf
jbe 0x140044b94
mov rbx, qword [rbx]
lea rdx, [rbx + 0x14]
lea rcx, [rsp + 0x48]
call fcn.14004cf30
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140044bdd
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044bd8
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400452d1
call fcn.14005025c
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm1
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400452eb
mov sil, 1
mov dword [rsp + 0x68], esi
mov r14d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rbp - 0x24], pe_nt_image_headers64
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
mov qword [rbp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x24]
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140044ede
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140044ca0
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x78]
call fcn.14004cf30
cmp qword [r15 + 0x18], 0xf
jbe 0x140044cca
mov r12, qword [r15]
mov r9, r12
add r12, qword [r15 + 0x10]
jmp 0x140044cd4
mov r12, qword [r15 + 0x10]
add r12, r15
mov r9, r15
mov qword [rsp + 0x70], r9
lea rcx, [rbp - 0x78]
mov r8, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
cmova rcx, r8
mov rbx, qword [rbp - 0x68]
add rbx, rcx
lea r15, [rbp - 0x78]
cmp rdx, 0xf
cmova r15, r8
mov rcx, r12
sub rcx, r9
mov rax, rbx
sub rax, r15
cmp rax, rcx
jl 0x140044d69
mov rax, rbx
sub rax, rcx
mov qword [rbp - 0x80], rax
mov r14, r9
mov r13, r15
cmp r9, r12
je 0x140044d61
sub r15, r9
nop dword [rax]
movsx esi, byte [r14]
movsx ecx, byte [r14 + r15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov edi, eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
cmp edi, eax
jne 0x140044e24
inc r14
cmp r14, r12
jne 0x140044d30
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x78]
mov rbx, r13
mov r14d, dword [rsp + 0x40]
lea rcx, [rbp - 0x78]
cmp rdx, 0xf
cmova rcx, r8
mov rdi, qword [rbp - 0x68]
add rdi, rcx
cmp rdx, 0xf
jbe 0x140044db2
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x140044daa
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044fbd
mov rcx, r8
call fcn.14005025c
xor r12d, r12d
cmp rbx, rdi
je 0x140044e95
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140044de0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14004cf30
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, qword [rbp + 0x28]
je 0x140044e4a
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rsp + 0x48], 0
add qword [rbp + 0x20], 0x20
jmp 0x140044e5d
cmp r13, qword [rbp - 0x80]
je 0x140044e3d
inc r13
mov r15, r13
mov r9, qword [rsp + 0x70]
mov r14, r9
jmp 0x140044d26
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x78]
jmp 0x140044d64
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.14004de20
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140044e95
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044e90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045277
call fcn.14005025c
inc r14d
mov dword [rsp + 0x40], r14d
mov dword [rbp - 0x24], pe_nt_image_headers64
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x24]
lea r8, [rbp + 0x30]
mov edx, r14d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov r15, qword [rsp + 0x78]
test eax, eax
je 0x140044c80
mov esi, dword [rsp + 0x68]
mov rdi, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x18]
cmp rbx, rdi
je 0x140044f1e
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140044efd
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
movzx esi, sil
test eax, eax
cmovne esi, r12d
add rbx, 0x20
cmp rbx, rdi
jne 0x140044ef0
mov dword [rsp + 0x68], esi
mov r13d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rbp - 0x28], 0x4000
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov qword [rbp + 0x10], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
lea r8, [rbp + 0x130]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1400451eb
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
lea rax, [rbp + 0x130]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140044f90
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x58]
call fcn.14004cf30
cmp qword [r15 + 0x18], 0xf
jbe 0x140044fc4
mov r12, qword [r15]
mov r9, r12
add r12, qword [r15 + 0x10]
jmp 0x140044fce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r12, qword [r15 + 0x10]
add r12, r15
mov r9, r15
mov qword [rsp + 0x70], r9
lea rcx, [rbp - 0x58]
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
cmova rcx, r8
mov rbx, qword [rbp - 0x48]
add rbx, rcx
lea r15, [rbp - 0x58]
cmp rdx, 0xf
cmova r15, r8
mov rcx, r12
sub rcx, r9
mov rax, rbx
sub rax, r15
cmp rax, rcx
jl 0x14004506a
mov rax, rbx
sub rax, rcx
mov qword [rbp - 0x80], rax
mov rdi, r9
mov r13, r15
cmp r9, r12
je 0x140045062
sub r15, r9
nop dword [rax]
nop word [rax + rax]
movsx r14d, byte [rdi]
movsx ecx, byte [r15 + rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov esi, eax
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
cmp esi, eax
jne 0x140045127
inc rdi
cmp rdi, r12
jne 0x140045030
mov rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x58]
mov rbx, r13
mov r13d, dword [rsp + 0x40]
lea rcx, [rbp - 0x58]
cmp rdx, 0xf
cmova rcx, r8
mov rdi, qword [rbp - 0x48]
add rdi, rcx
cmp rdx, 0xf
jbe 0x1400450b3
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x1400450ab
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400451dd
mov rcx, r8
call fcn.14005025c
xor r12d, r12d
cmp rbx, rdi
je 0x140045194
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rax, [rbp + 0x130]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x1400450e0
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x48]
call fcn.14004cf30
nop
mov rdx, qword [rbp + 8]
cmp rdx, qword [rbp + 0x10]
je 0x14004514d
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rsp + 0x48], 0
add qword [rbp + 8], 0x20
jmp 0x140045160
cmp r13, qword [rbp - 0x80]
je 0x140045140
inc r13
mov r15, r13
mov r9, qword [rsp + 0x70]
mov rdi, r9
jmp 0x140045020
mov rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x58]
jmp 0x140045065
lea r8, [rsp + 0x48]
lea rcx, [rbp]
call fcn.14004de20
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140045194
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004518f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400451e4
call fcn.14005025c
inc r13d
mov dword [rsp + 0x40], r13d
mov dword [rbp - 0x28], 0x4000
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
lea r8, [rbp + 0x130]
mov edx, r13d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1400451eb
mov r15, qword [rsp + 0x78]
jmp 0x140044f70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdi, qword [rbp + 8]
mov rbx, qword [rbp]
mov esi, dword [rsp + 0x68]
cmp rbx, rdi
je 0x14004522a
nop dword [rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004520d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
movzx esi, sil
test eax, eax
cmovne esi, r12d
add rbx, 0x20
cmp rbx, rdi
jne 0x140045200
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x14004528f
mov rdx, qword [rbp + 8]
call fcn.14004d030
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004527e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004527e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005025c
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400452ee
mov rdx, qword [rbp + 0x20]
call fcn.14004d030
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400452d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400452d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005025c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r12
jmp 0x1400452ee
xor sil, sil
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004532c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045327
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005025c
movzx eax, sil
mov rcx, qword [rbp + 0x4130]
xor rcx, rsp
call fcn.14004ffa0
lea r11, [rsp + 0x4240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004b980
nop
int3