Function at 0x18000a510
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x180], rbx
mov rax, qword [0x180243280]
xor rax, rbp
mov qword [rbp + 0x130], rax
mov r14d, r8d
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov qword [rbp + 0x10], rdi
test rdx, rdx
je 0x18000aaf2
mov eax, dword [0x1801e8cc0]
cmp dword [rcx], eax
jne 0x18000a583
mov eax, dword [0x1801e8cc4]
cmp dword [rcx + 4], eax
jne 0x18000a583
mov eax, dword [0x1801e8cc8]
cmp dword [rcx + 8], eax
jne 0x18000a583
mov eax, dword [0x1801e8ccc]
cmp dword [rcx + 0xc], eax
je 0x18000aaf2
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x180200798]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1801e8ce0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000aaf2
mov ecx, dword [rsi]
test ecx, ecx
je 0x18000a619
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
lea r9, [rbp + 0x18]
mov r8d, 1
mov rdx, rbx
test r14d, r14d
je 0x18000a5fb
cmp ecx, r8d
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x18000a5ee
call qword [rax + 0x28]
jmp 0x18000a5f1
call qword [rax + gethostname]
test eax, eax
js 0x18000aaf4
jmp 0x18000a60f
cmp ecx, 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x18000a60c
call qword [rax + 0x30]
jmp 0x18000a60f
call qword [rax + 0x40]
add rsi, 0x10
mov ecx, dword [rsi]
test ecx, ecx
jne 0x18000a5c0
test r14d, r14d
jne 0x18000aaf6
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x18000a643
lea eax, [r14 + 0xd]
jmp 0x18000aaf4
mov rbx, rdi
lea rcx, [rbp + 0xb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x18000a654
inc eax
cdqe
lea r15, [rax + rax]
mov eax, 0x80000000
add rax, r15
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x18000a71d
movsxd rsi, r15d
cmp r15d, 0x400
jg 0x18000a6b9
mov rcx, rsi
call fcn.180006c30
test al, al
je 0x18000a6b9
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x18000a6a6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18017bc70
sub rsp, rax
lea r14, [rsp + 0x60]
jmp 0x18000a6e1
mov rax, rsi
not rax
cmp rax, 0x10
jb 0x18000ab38
lea rcx, [rsi + 0x10]
call fcn.1801bfe80
test rax, rax
je 0x18000a71d
mov qword [rax], rdi
mov rbx, rax
lea r14, [rax + 0x10]
test r14, r14
je 0x18000a71d
mov byte [r14], dil
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
mov r9d, 0xffffffff
lea r8, [rbp + 0xb0]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove r14, rdi
jmp 0x18000a720
mov r14, rdi
test r14, r14
je 0x18000aad4
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801be380
test eax, eax
je 0x18000a766
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
mov r8, r14
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801bef50
test eax, eax
je 0x18000a79f
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801bef50
test eax, eax
je 0x18000a7dc
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
mov dword [rbp + 8], edi
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, rdi
test eax, eax
cmove rsi, qword [rbp]
mov ecx, edi
cmovne ecx, eax
test ecx, ecx
jne 0x18000a8ec
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r15d, eax
test rsi, rsi
je 0x18000a86e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
test r15d, r15d
jne 0x18000a8ec
cmp dword [rbp + 8], r15d
jne 0x18000a8ec
cmp byte [0x180254710], r15b
jne 0x18000a8c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000a8b4
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180254718], rax
mov byte [0x180254710], 1
jmp 0x18000a8cb
mov rax, qword [0x180254718]
mov byte [0x180254710], 1
jmp 0x18000a8cb
mov rax, qword [0x180254718]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x18000a8e5
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x18000a8ec
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801be380
test eax, eax
je 0x18000a929
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
mov r8, r14
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801bef50
test eax, eax
je 0x18000a962
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1801bef50
test eax, eax
je 0x18000a99f
cmp eax, 0xc
je 0x18000ab2d
cmp eax, 0x16
je 0x18000ab4e
cmp eax, 0x22
je 0x18000ab4e
cmp eax, 0x50
jne 0x18000ab43
mov qword [rbp], rdi
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000a9de
mov eax, edi
test rsi, rsi
je 0x18000a9da
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp]
test eax, eax
jne 0x18000aab9
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r14d, eax
test rsi, rsi
je 0x18000aa37
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
test r14d, r14d
jne 0x18000aac7
cmp dword [rbp + 8], r14d
jne 0x18000aab9
cmp byte [0x180254710], r14b
jne 0x18000aa91
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000aa81
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180254718], rax
mov byte [0x180254710], 1
jmp 0x18000aa98
mov rax, qword [0x180254718]
mov byte [0x180254710], 1
jmp 0x18000aa98
mov rax, qword [0x180254718]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x18000aab2
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x18000aab9
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
test rsi, rsi
je 0x18000aac7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x18000aaf6
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1801b2680
test rbx, rbx
jne 0x18000aae0
jmp 0x18000aaf6
mov eax, edi
mov edi, eax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18000ab06
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
nop
mov eax, edi
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.18017ae80
mov rbx, qword [rbp + 0x180]
lea rsp, [rbp + 0x140]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180001b00
int3
mov ecx, 0x80070216
call fcn.180001b00
int3
mov ecx, 0x80004005
call fcn.180001b00
int3
mov ecx, 0x80070057
call fcn.180001b00
int3