Function at 0x18000c260
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3f8]
sub rsp, 0x4f0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x18003b080]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.18000f7e0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.18000f7e0
lea r9, str.BarleyShop
lea r8, str._shellexContextMenuHandlers_
lea rdx, str._s_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.BarleyShop
lea r8, str._shellexDragDropHandlers_
lea rdx, str._s_s
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp - 0x68], 7
xor esi, esi
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
lea r8d, [rsi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x80]
call fcn.1800017f0
nop
lea r8d, [rsi + 0x26]
lea rdx, str.694AF4FD_C1D3_4796_AB62_0302B9EC2247
lea rcx, [rbp - 0x80]
call fcn.1800042f0
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1800016b0
nop
lea r8d, [rsi + 0xf]
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x60]
call fcn.1800042f0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000c3fa
lea rdx, str.694AF4FD_C1D3_4796_AB62_0302B9EC2247
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.18000b790
mov rdi, rax
mov rbx, qword [rax]
movabs r14, 0x7fffffffffffffff
cmp rbx, qword [rax + 8]
je 0x18000c645
cmp qword [rbx + 0x18], 8
jb 0x18000c425
mov rdx, qword [rbx]
jmp 0x18000c428
mov rdx, rbx
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
cmp word [rdx], 0
jne 0x18000c443
mov r8, rsi
jmp 0x18000c45b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000c450
lea rcx, [rbp - 0x60]
call fcn.1800017f0
nop
cmp word [rbp - 0x40], 0
jne 0x18000c471
mov r8, rsi
jmp 0x18000c48b
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000c480
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1800042f0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x18000c4bf
mov rdx, qword [rbx]
jmp 0x18000c4c2
mov rdx, rbx
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp word [rdx], 0
jne 0x18000c4e0
mov r8, rsi
jmp 0x18000c4ef
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000c4e4
lea rcx, [rsp + 0x40]
call fcn.1800017f0
nop
cmp word [rbp + 0x1d0], 0
jne 0x18000c509
mov r8, rsi
jmp 0x18000c51f
lea rax, [rbp + 0x1d0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000c514
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x40]
call fcn.1800042f0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x18000c5a3
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, r14
ja 0x18000c621
add rax, rax
cmp rax, 0x1000
jb 0x18000c59e
test cl, 0x1f
jne 0x18000c61b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000c615
sub rcx, rax
cmp rcx, 8
jb 0x18000c60f
cmp rcx, 0x27
ja 0x18000c609
mov rcx, rax
call fcn.18000d9cc
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x18000c5fc
inc rax
mov rcx, qword [rbp - 0x60]
cmp rax, r14
ja 0x18000c63f
add rax, rax
cmp rax, 0x1000
jb 0x18000c5f7
test cl, 0x1f
jne 0x18000c639
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000c633
sub rcx, rax
cmp rcx, 8
jb 0x18000c62d
cmp rcx, 0x27
ja 0x18000c627
mov rcx, rax
call fcn.18000d9cc
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jmp 0x18000c413
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
nop
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
int3
call fcn.180011fc4
nop
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x18000c6ad
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, r14
jbe 0x18000c663
call fcn.180011fc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000c6a8
test byte [rsp + 0x60], 0x1f
je 0x18000c67b
call fcn.180011fc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000c68a
call fcn.180011fc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000c699
call fcn.180011fc4
int3
cmp rcx, 0x27
jbe 0x18000c6a5
call fcn.180011fc4
int3
mov rcx, rax
call fcn.18000d9cc
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x18000c725
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, r14
jbe 0x18000c6dc
call fcn.180011fc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000c720
test byte [rbp - 0x80], 0x1f
je 0x18000c6f3
call fcn.180011fc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000c702
call fcn.180011fc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000c711
call fcn.180011fc4
int3
cmp rcx, 0x27
jbe 0x18000c71d
call fcn.180011fc4
int3
mov rcx, rax
call fcn.18000d9cc
mov eax, 1
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.18000dae0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret