Function at 0x18002bb20
Capabilities:
Create thread
Delete registry key

Disassembly:
mov dword [rsp + 0x20], r9d
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx edi, r8w
mov rbx, rcx
xor esi, esi
mov dword [0x18004c344], esi
mov dword [0x18004c340], esi
mov dword [0x18004c33c], esi
mov dword [0x18004c328], esi
mov dword [0x18004c324], esi
mov dword [0x18004c320], esi
mov dword [0x18004c314], esi
mov dword [0x18004c334], esi
mov dword [0x18004c338], esi
mov dword [0x18004c32c], esi
mov dword [0x18004c330], esi
mov rcx, qword [rcx + 0x2e1]
test rcx, rcx
je 0x18002bbb5
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x18002bbb5
cmp dword [rsp + 0x30], 0x103
je 0x18002bbb7
mov eax, esi
test eax, eax
je 0x18002bbc2
xor eax, eax
jmp 0x18002bf86
lea rdx, [0x180042c80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x18002bbea
call fcn.18002c240
jmp 0x18002bc03
mov qword [rbx + 0x2e1], rsi
mov dword [rbx + 4], esi
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x18002bf84
cmp si, di
je 0x18002bf84
mov rcx, rbx
call sym.PRDLL.dll_Undelete_Done
movzx edx, di
imul rdx, rdx, 0x126
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x2b5], rax
test rax, rax
je 0x18002bf86
mov word [rbx + 0x2af], si
mov word [rbx + 0x2ad], di
mov r12d, esi
movzx eax, di
mov dword [rsp + 0x90], eax
test eax, eax
je 0x18002beba
mov rdi, rsi
mov r14, r13
nop word [rax + rax]
mov rcx, qword [rbx + 0x2b5]
mov rax, qword [r14]
mov qword [rdi + rcx], rax
mov eax, dword [r14 + 8]
mov dword [rdi + rcx + 8], eax
mov rcx, qword [rbx + 0x2b5]
mov eax, dword [rdi + rcx + 4]
and eax, 0xffffff
je 0x18002bdc0
cmp eax, 1
jne 0x18002be38
mov r13d, dword [rdi + rcx]
and r13d, 0xffffff
imul r13, r13, 0x196
movzx eax, byte [r13 + rbx + 0x333]
mov byte [rdi + rcx + 0x26], al
mov rcx, qword [rbx + 0x2b5]
mov rax, qword [r13 + rbx + 0x323]
mov qword [rdi + rcx + 0x14], rax
mov rcx, qword [rbx + 0x2b5]
mov rax, qword [r13 + rbx + 0x32b]
mov qword [rdi + rcx + 0x1c], rax
mov r15d, r12d
imul r15, r15, 0x126
lea rdx, [r13 + rbx + 0x3b9]
mov rax, qword [rbx + 0x2b5]
lea rcx, [r15 + rax + 0x27]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx r11d, byte [r13 + rbx + 0x337]
test r11b, r11b
je 0x18002bd4e
movzx ecx, r11b
mov rax, qword [rbx + 0x2b5]
mov word [rdi + rax + 0x24], cx
mov rax, qword [rbx + 0x2b5]
lea rcx, [r15 + rax + 0xc]
test rcx, rcx
jne 0x18002bd63
mov eax, esi
jmp 0x18002bd68
call fcn.180001a60
test eax, eax
je 0x18002be55
movzx edx, byte [r13 + rbx + 0x333]
mov rcx, qword [rbx + 0x2b5]
xor r8d, r8d
mov rcx, qword [rdi + rcx + 0xc]
call fcn.180002620
test eax, eax
je 0x18002be55
mov rcx, qword [rbx + 0x2b5]
mov r8, qword [r13 + rbx + 0x32b]
mov rdx, qword [r13 + rbx + 0x323]
mov rcx, qword [rdi + rcx + 0xc]
call fcn.180002590
test eax, eax
je 0x18002be55
jmp 0x18002be38
movzx eax, byte [rdi + rcx]
add al, 0x41
mov byte [rdi + rcx + 0x27], al
mov rax, qword [rbx + 0x2b5]
mov byte [rdi + rax + 0x28], 0x3a
mov rax, qword [rbx + 0x2b5]
mov byte [rdi + rax + 0x29], 0
mov rcx, qword [rbx + 0x2b5]
movzx eax, byte [rdi + rcx + 0x27]
mov word [rdi + rcx + 0x24], ax
mov ecx, r12d
imul rcx, rcx, 0x126
mov rax, qword [rbx + 0x2b5]
lea rcx, [rcx + rax + 0xc]
test rcx, rcx
jne 0x18002be12
mov eax, esi
jmp 0x18002be17
call fcn.180001a60
test eax, eax
je 0x18002be85
mov rcx, qword [rbx + 0x2b5]
xor r8d, r8d
movzx edx, byte [rdi + rcx + 0x27]
mov rcx, qword [rdi + rcx + 0xc]
call fcn.180002220
test eax, eax
je 0x18002be85
inc r12d
add r14, 0xc
add rdi, 0x126
cmp r12d, dword [rsp + 0x90]
jae 0x18002be7b
jmp 0x18002bc90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea r8, [r13 + rbx + 0x3b9]
lea rdx, str.Undelete_SearchMultiple:_Unable_to_properly_open_drive__s._n
mov rcx, rbx
call fcn.180016b80
xor eax, eax
jmp 0x18002bf86
mov r13, qword [rsp + 0x98]
jmp 0x18002beba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov ecx, r12d
imul rcx, rcx, 0x126
mov rax, qword [rbx + 0x2b5]
movzx r8d, byte [rcx + rax + 0x27]
lea rdx, str.Undelete_SearchMultiple:_Unable_to_open_drive__c._n
mov rcx, rbx
call fcn.180016b80
xor eax, eax
jmp 0x18002bf86
mov eax, dword [rsp + 0xa8]
mov dword [rbx + 0x248], eax
mov ecx, dword [r13 + 8]
shl ecx, 3
xor ecx, eax
and ecx, 8
xor ecx, eax
mov dword [rbx + 0x248], ecx
mov rax, qword [rsp + 0xb0]
mov qword [rbx + 0x26c], rax
mov rax, qword [rsp + 0xb8]
mov qword [rbx + 0x274], rax
mov rax, qword [rsp + 0xc0]
mov qword [rbx + 0x254], rax
mov word [rbx + 0x2af], si
mov rcx, rbx
call fcn.18001a540
test eax, eax
jne 0x18002bf3c
lea rdx, str.Undelete_SearchMultiple:_Files_list_or_strings_storage_is_NOT_allocated._n
mov rcx, rbx
call fcn.180016b80
mov rcx, rbx
call sym.PRDLL.dll_Undelete_Done
mov dword [rbx], 0x20000008
xor eax, eax
jmp 0x18002bf86
mov qword [rbx + 0x284], rsi
and dword [rbx + 0x317], 0xfbffffff
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x18002a750]
mov edx, 0x800000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x2e1], rax
test rax, rax
setne sil
mov eax, esi
jmp 0x18002bf86
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret