Function at 0x1800bb050
Capabilities:
Delete registry key

Disassembly:
jmp 0x1800bb050
mov byte [rsp + 8], cl
push rdi
sub rsp, 0x160
lea rdi, [rsp + 0x40]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x170]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x40], 0xc0000001
movzx eax, byte [rsp + 0x170]
test eax, eax
je 0x1800bb1d5
lea rcx, [0x18059b900]
call fcn.180006dd0
mov qword [rsp + 0x78], rax
call sym.ProcessMonitor.dll_PhGetApplicationFileName
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x78]
call sym.ProcessMonitor.dll_PhGetBaseDirectory
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.180003fd0
mov rcx, qword [rsp + 0x98]
call sym.ProcessMonitor.dll_PhGetBaseName
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.180003fd0
mov rax, qword [rsp + 0x98]
mov r9, qword [rax + 8]
lea r8, [0x18039d090]
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 8]
mov ecx, 3
call sym.ProcessMonitor.dll_PhConcatStrings
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0x98]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov rcx, qword [rsp + 0x78]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
mov r9, rax
mov r8, 0xfffffffffffffffd
mov edx, 0x20006
lea rcx, [rsp + 0x58]
call sym.ProcessMonitor.dll_PhCreateKey
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1800bb1c3
movabs rax, 0x1111011100111000
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0xd8]
mov r8d, 0xb
lea rdx, [0x18059b970]
mov rcx, qword [rsp + 0x58]
call sym.ProcessMonitor.dll_PhSetValueKey
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0xb8]
call sym.ProcessMonitor.dll_PhDereferenceObject
jmp 0x1800bb394
lea rcx, [0x18059b900]
call fcn.180006dd0
mov qword [rsp + 0x78], rax
call sym.ProcessMonitor.dll_PhGetApplicationFileName
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x78]
call sym.ProcessMonitor.dll_PhGetBaseDirectory
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.180003fd0
mov rcx, qword [rsp + 0x98]
call sym.ProcessMonitor.dll_PhGetBaseName
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.180003fd0
mov rax, qword [rsp + 0x98]
mov r9, qword [rax + 8]
lea r8, [0x18039d090]
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 8]
mov ecx, 3
call sym.ProcessMonitor.dll_PhConcatStrings
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0x98]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov rcx, qword [rsp + 0x78]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov rax, qword [rsp + 0xb8]
mov dword [rsp + 0x20], 0x80
mov r9, rax
mov r8, 0xfffffffffffffffd
mov edx, 0x10000
lea rcx, [rsp + 0x58]
call sym.ProcessMonitor.dll_PhOpenKey
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1800bb2ba
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
cmp dword [rsp + 0x40], 0xc0000034
jne 0x1800bb2cc
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 0
jl 0x1800bb387
mov rax, qword [rsp + 0xb8]
lea rcx, [rsp + 0x128]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xf8]
mov r8b, 1
lea rdx, [0x18059b950]
mov rcx, rax
call sym.ProcessMonitor.dll_PhSplitStringRefAtString
movzx eax, al
test eax, eax
je 0x1800bb387
lea r8, [rsp + 0x128]
lea rdx, [0x18059b960]
lea rcx, [rsp + 0xf8]
call sym.ProcessMonitor.dll_PhConcatStringRef3
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180003fd0
mov rax, qword [rsp + 0xb8]
mov dword [rsp + 0x20], 0x80
mov r9, rax
mov r8, 0xfffffffffffffffd
mov edx, 0x10000
lea rcx, [rsp + 0x58]
call sym.ProcessMonitor.dll_PhOpenKey
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1800bb387
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0xb8]
call sym.ProcessMonitor.dll_PhDereferenceObject
cmp dword [rsp + 0x40], 0xc0000034
jne 0x1800bb3a6
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18047e870]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x160
pop rdi
ret