Function at 0x18000d924
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x320
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1800ebed0]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
and qword [rsp + 0x58], 0
lea rdx, [rsp + 0xf0]
call fcn.18000d7f8
mov rbx, rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000d984
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x58], 0
test eax, eax
jne 0x18000dbfe
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x38]
call fcn.18000604c
and qword [rsp + 0x338], 0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x338]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000dc73
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xf0]
call fcn.18000e078
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.18000e0e4
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
and qword [rsp + 0x108], 0
mov qword [rsp + 0x110], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xf8], 0
mov bl, byte [rsp + 0xe0]
test bl, bl
jne 0x18000da79
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xc0]
call fcn.18000604c
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.18000d6f8
mov bl, 1
mov byte [rsp + 0xe0], bl
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb8]
call fcn.18000d6ac
nop
test al, al
je 0x18000db9f
test bl, bl
jne 0x18000dad7
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xc0]
call fcn.18000604c
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xb8]
call fcn.18000d6f8
mov byte [rsp + 0xe0], 1
lea rcx, [rsp + 0xb8]
call fcn.18000d924
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x30]
call fcn.18000e0e4
mov rbx, rax
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
lea rdx, [rax + 8]
lea rax, [rsp + 0x68]
cmp rax, rdx
je 0x18000db1c
xor r8d, r8d
lea rcx, [rsp + 0x68]
call fcn.180007418
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x88], rax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x90], eax
lea rdx, [rbx + 0x38]
lea rax, [rsp + 0x98]
cmp rax, rdx
je 0x18000db53
xor r8d, r8d
lea rcx, [rsp + 0x98]
call fcn.180007418
mov rax, qword [rbx + 0x58]
mov qword [rsp + 0xb8], rax
lea rdx, [rbx + 0x60]
lea rax, [rsp + 0xc0]
cmp rax, rdx
je 0x18000db80
xor r8d, r8d
lea rcx, [rsp + 0xc0]
call fcn.180007418
mov al, byte [rbx + 0x80]
mov byte [rsp + 0xe0], al
lea rcx, [rsp + 0x290]
call fcn.18000dc9c
jmp 0x18000da08
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000dbb9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x58], 0
test eax, eax
jne 0x18000dc25
lea rdx, [rdi + 8]
cmp qword [rdx + 0x18], 0x10
jb 0x18000dbc7
mov rdx, qword [rdx]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, 0xfffffffd
jne 0x18000dc4c
lea rcx, [rsp + 0x60]
call fcn.18000dc9c
jmp 0x18000dbe3
lea rcx, [rsp + 0x30]
call fcn.18000e078
mov rbx, qword [rsp + 0x330]
add rsp, 0x320
pop rdi
ret
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x128]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x128]
call fcn.18009edd8
nop
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x170]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x170]
call fcn.18009edd8
int3
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x1b8]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x1b8]
call fcn.18009edd8
nop
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x200]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x200]
call fcn.18009edd8
int3