Function at 0x180017fb0
Capabilities:
Delete registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x180125780]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
xor r13d, r13d
mov qword [rsp + 0x60], r13
test rdx, rdx
jne 0x180018003
jmp 0x180018455
mov eax, dword [0x1801170f0]
cmp dword [rcx], eax
jne 0x180018033
mov eax, dword [0x1801170f4]
cmp dword [rcx + 4], eax
jne 0x180018033
mov eax, dword [0x1801170f8]
cmp dword [rcx + 8], eax
jne 0x180018033
mov eax, dword [0x1801170fc]
cmp dword [rcx + 0xc], eax
jne 0x180018033
jmp 0x180018455
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x180048868]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1801170e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x180018060
jmp 0x180018455
cmp dword [rbx], 0
je 0x1800180d9
mov rcx, qword [rbx + 8]
mov eax, dword [rcx]
mov dword [rbp - 0x50], eax
mov eax, dword [rcx + 4]
mov dword [rbp - 0x4c], eax
mov eax, dword [rcx + 8]
mov dword [rbp - 0x48], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x44], eax
mov rcx, qword [rsp + 0x60]
lea r9, [rbp - 0x50]
mov r8d, 1
mov rdx, rdi
mov rax, qword [rcx]
test r12d, r12d
je 0x1800180af
cmp dword [rbx], r8d
jne 0x1800180a4
call qword [rax + 0x28]
jmp 0x1800180a7
call qword [rax + 0x38]
mov esi, eax
test eax, eax
js 0x1800180c2
jmp 0x1800180bc
cmp dword [rbx], 1
jne 0x1800180b9
call qword [rax + 0x30]
jmp 0x1800180bc
call qword [rax + 0x40]
add rbx, 0x10
jmp 0x180018060
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800180d2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x180018467
test r12d, r12d
jne 0x180018455
lea r8d, [r12 + 0x40]
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov qword [rbp - 0x58], r13
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d62c
test eax, eax
je 0x180018149
cmp eax, 0xc
je 0x18001813e
cmp eax, 0x16
je 0x180018133
cmp eax, 0x22
je 0x180018133
cmp eax, 0x50
je 0x180018149
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
lea r8, [rbp + 0xc0]
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d698
test eax, eax
je 0x180018197
cmp eax, 0xc
je 0x18001818c
cmp eax, 0x16
je 0x180018181
cmp eax, 0x22
je 0x180018181
cmp eax, 0x50
je 0x180018197
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d698
test eax, eax
je 0x1800181e5
cmp eax, 0xc
je 0x1800181da
cmp eax, 0x16
je 0x1800181cf
cmp eax, 0x22
je 0x1800181cf
cmp eax, 0x50
je 0x1800181e5
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
mov qword [rbp - 0x78], 0xffffffff80000000
mov dword [rbp - 0x70], r13d
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x78], r13d
mov qword [rbp - 0x80], r13
mov dword [rsp + 0x68], r13d
mov r9d, 0x20019
lea r8, [rbp - 0x40]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x70]
call fcn.180012a20
test eax, eax
jne 0x1800182a1
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x180018280
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x78], r13d
test rdi, rdi
jne 0x1800182a1
cmp dword [rsp + 0x68], edi
jne 0x1800182a1
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d62c
test eax, eax
je 0x1800182ef
cmp eax, 0xc
je 0x1800182e4
cmp eax, 0x16
je 0x1800182d9
cmp eax, 0x22
je 0x1800182d9
cmp eax, 0x50
je 0x1800182ef
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
lea r8, [rbp + 0xc0]
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d698
test eax, eax
je 0x18001833d
cmp eax, 0xc
je 0x180018332
cmp eax, 0x16
je 0x180018327
cmp eax, 0x22
je 0x180018327
cmp eax, 0x50
je 0x18001833d
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x40]
call fcn.18002d698
test eax, eax
je 0x18001838b
cmp eax, 0xc
je 0x180018380
cmp eax, 0x16
je 0x180018375
cmp eax, 0x22
je 0x180018375
cmp eax, 0x50
je 0x18001838b
mov ecx, 0x80004005
call fcn.180011520
int3
mov ecx, 0x80070057
call fcn.180011520
int3
mov ecx, 0x8007000e
call fcn.180011520
int3
mov r9d, 0x20019
lea r8, [rbp - 0x40]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x70]
call fcn.180012a20
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x180018428
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x180018406
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], r13d
test rdi, rdi
jne 0x180018428
cmp dword [rsp + 0x68], edi
jne 0x180018428
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test rbx, rbx
je 0x18001843b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x78], r13d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x70], r13d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180018465
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18002c920
mov rbx, qword [rsp + 0x290]
add rsp, 0x250
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret