Function at 0x1800057d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, dword [0x18000e390]
lea rdx, str.SYSTEMCurrentControlSetControlLSAOfflineProvisioning
movaps xmm0, xmmword [0x18000e340]
mov r15d, ecx
movaps xmm1, xmmword [0x18000e350]
mov r9d, 0x20019
and qword [rbp - 0x51], 0
xor r8d, r8d
and qword [rbp - 0x39], 0
mov rcx, 0xffffffff80000002
and dword [rbp - 0x55], 0
xor r14b, r14b
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x18000e360]
mov dword [rbp + 0x27], eax
movzx eax, word [0x18000e394]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x18000e380]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x18000e370]
mov word [rbp + 0x2b], ax
lea rax, [rbp - 0x51]
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 7], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180005892
mov eax, 0xa9a
jmp 0x180005a2f
call fcn.1800084e0
lea rdx, [rbp - 0x29]
lea rcx, str._ws:_n
call fcn.180008608
mov edx, r15d
lea rcx, str._tContext:__d_n
call fcn.180008608
lea r8, [rbp - 0x39]
xor ecx, ecx
lea rdx, [rbp - 0x55]
call fcn.180007214
mov ecx, 3
call fcn.180006abc
mov ebx, eax
test eax, eax
jne 0x18000598f
mov rcx, qword [rbp - 0x51]
lea rdx, [rbp - 0x49]
call fcn.180005a5c
mov ebx, eax
test eax, eax
jne 0x180005985
mov rdi, qword [rbp - 0x49]
lea rax, [rbp - 0x49]
cmp rdi, rax
je 0x18000597c
call fcn.1800023f0
mov r10, qword [rdi + 0x20]
test eax, eax
jne 0x180005924
mov rax, qword [r10 + 0x10]
cmp rax, qword [0x18000ce50]
jne 0x180005924
mov rax, qword [r10 + 0x18]
cmp rax, qword [0x18000ce58]
je 0x180005969
mov r8d, dword [rbp - 0x55]
lea r9, [rbp - 0x59]
mov rcx, qword [rdi + 0x18]
mov edx, r15d
mov rax, qword [r10 + 0x58]
call qword [0x18000bb10]
mov ecx, dword [rdi + 0x28]
and ecx, 1
je 0x180005953
test eax, eax
jne 0x180005951
cmp ebx, 0xa99
je 0x18000596e
mov ebx, eax
test eax, eax
je 0x18000596e
cmp eax, 0xa99
je 0x18000596e
test ecx, ecx
jne 0x180005979
mov dword [rdi + 0x30], eax
mov byte [rdi + 0x2c], 1
mov rdi, qword [rdi]
jmp 0x1800058f4
cmp byte [rbp - 0x59], 0
je 0x180005962
mov r14b, 1
jmp 0x180005969
mov r14b, 1
lea rcx, [rbp - 0x49]
call fcn.180006000
mov ecx, 3
call fcn.180006d68
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x180005a15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test r14b, r14b
jne 0x1800059fb
test ebx, ebx
je 0x1800059bc
lea rcx, str._ws:_Provisioning_package_installation_completed_with_error_s_._n
cmp ebx, 0xa99
jne 0x1800059c3
lea rcx, str._ws:_Provisioning_package_installation_completed_successfully._n
lea rdx, [rbp - 0x29]
call fcn.180008608
lea rdx, str.SYSTEMCurrentControlSetControlLSAOfflineProvisioning
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [rbp - 0x29]
lea rcx, str._ws:_delete_OP_state_key_status:_0x_x._n
call fcn.180008608
jmp 0x180005a15
cmp r15d, 2
jne 0x180005a15
test ebx, ebx
jne 0x180005a15
cmp dword [rbp - 0x55], ebx
je 0x180005a15
cmp dword [rbp - 0x55], 6
je 0x180005a15
call fcn.1800060e0
mov r8d, ebx
lea rdx, [rbp - 0x29]
lea rcx, str._ws:_status:_0x_x._n
call fcn.180008608
call fcn.180008584
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180009470
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret