Function at 0x18019ba40
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1802a60c0]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov byte [rbp + 0x138], 0xeb
mov byte [rbp + 0x139], 8
mov byte [rbp + 0x13a], 0x48
mov byte [rbp + 0x13b], Ordinal_143
mov byte [rbp + 0x13c], Ordinal_143
mov byte [rbp + 0x13d], Ordinal_41
mov byte [rbp + 0x13e], gethostname
mov byte [rbp + 0x13f], 0x5b
mov byte [rbp + 0x140], Ordinal_143
mov byte [rbp + 0x141], 0xc1
mov byte [rbp + 0x142], Ordinal_200
lea rax, [rsp + 0x1a8]
test rax, rax
jne 0x18019bad0
lea rax, [rbp + 0x138]
call rax
xor eax, eax
call rax
nop
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 0x14]
lea rcx, [rbp + 0x80]
call fcn.18019aaa0
mov rcx, rax
call fcn.18019c160
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x18019bb2d
xor al, al
jmp 0x18019be37
mov r8, qword [rsp + 0x1b0]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x108]
call fcn.18019b1b0
nop
lea rcx, [rbp + 0x108]
call fcn.180061f00
mov rdx, rax
lea rcx, [rbp + 0x128]
call sub.ntdll.dll_RtlInitUnicodeString
mov r8, qword [rsp + 0x1b0]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0xe8]
call fcn.18019b1b0
nop
lea rcx, [rbp + 0xe8]
call fcn.180061f00
lea r8, [rbp + 0xe0]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rbp + 0x10], eax
cmp dword [rbp + 0x10], 0
je 0x18019bbfe
cmp dword [rbp + 0x10], 2
jne 0x18019bbd8
mov byte [rbp + 2], 1
lea rcx, [rbp + 0xe8]
call fcn.1800469b0
nop
lea rcx, [rbp + 0x108]
call fcn.1800469b0
movzx eax, byte [rbp + 2]
jmp 0x18019be37
mov byte [rbp + 3], 0
lea rcx, [rbp + 0xe8]
call fcn.1800469b0
nop
lea rcx, [rbp + 0x108]
call fcn.1800469b0
movzx eax, byte [rbp + 3]
jmp 0x18019be37
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rbp + 4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 4]
movzx r8d, byte [rbp + 5]
movzx edx, byte [rbp + 0x15]
lea rcx, [rbp + 0x90]
call fcn.18019abf0
mov rcx, rax
call fcn.18019c160
mov rdx, rax
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x128]
call qword [rbp + Ordinal_50]
mov dword [rbp + 0x18], eax
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 6]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 6]
movzx r8d, byte [rbp + 7]
movzx edx, byte [rbp + 0x16]
lea rcx, [rbp + 0xa0]
call fcn.18019ad40
mov rcx, rax
call fcn.18019c2d0
mov qword [rbp + 0x38], rax
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
call fcn.18012e5f0
mov qword [rbp + 0x48], rax
lea rdx, [0x1800a9a60]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov qword [rbp + 0x50], rax
mov edx, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov qword [rbp + 0x58], rax
lea rdx, [0x18012ef50]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
cmp dword [rbp + 0x18], 0
je 0x18019bdce
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov qword [rbp + 0x68], rax
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 8]
movzx r8d, byte [rbp + 9]
movzx edx, byte [rbp + 0x17]
lea rcx, [rbp + 0xc0]
call fcn.18019ae70
mov rcx, rax
call fcn.18019c2d0
mov qword [rbp + 0x60], rax
mov rdx, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
call fcn.18012e5f0
mov qword [rbp + 0x70], rax
lea rdx, [0x18012ef50]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xe8]
call fcn.180061f00
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0x10], eax
mov byte [rbp + 0xa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800469b0
nop
lea rcx, [rbp + 0x108]
call fcn.1800469b0
movzx eax, byte [rbp + 0xa]
jmp 0x18019be37
lea rcx, [rbp + 0xe8]
call fcn.180061f00
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0x10], eax
cmp dword [rbp + 0x10], 0
je 0x18019be16
mov byte [rbp + 0xb], 0
lea rcx, [rbp + 0xe8]
call fcn.1800469b0
nop
lea rcx, [rbp + 0x108]
call fcn.1800469b0
movzx eax, byte [rbp + 0xb]
jmp 0x18019be37
mov byte [rbp + 0xc], 1
lea rcx, [rbp + 0xe8]
call fcn.1800469b0
nop
lea rcx, [rbp + 0x108]
call fcn.1800469b0
movzx eax, byte [rbp + 0xc]
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.1801f08c0
add rsp, 0x198
pop rdi
pop rbp
ret