Function at 0x180018750
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x418]
sub rsp, 0x500
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180079370]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor esi, esi
xor eax, eax
mov qword [rbp - 0x3e], rax
mov dword [rbp - 0x38], 1
lea r15d, [rsi + 1]
mov dword [rbp - 0x40], 0x10001
mov dword [rbp - 0x3c], 0x10001
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.18003c5d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.18003c5d0
lea rbx, [0x180056cd0]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x40]
lea r8, str._shellexContextMenuHandlers_
lea rdx, str._s_s_s
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x40]
lea r8, str._shellexDragDropHandlers_
lea rdx, str._s_s_s
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
lea r8d, [rsi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x80]
call fcn.180009bb0
nop
lea r8d, [rsi + 0x26]
lea rdx, str.10E0D4AA_6A55_4E18_91FD_49C7023ACFB0
lea rcx, [rbp - 0x80]
call fcn.180009900
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180009a70
nop
lea r8d, [rsi + 0xf]
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x60]
call fcn.180009900
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180018914
lea rdx, str.10E0D4AA_6A55_4E18_91FD_49C7023ACFB0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.180017c60
mov rdi, rax
mov rbx, qword [rax]
movabs r14, 0x7fffffffffffffff
cmp rbx, qword [rax + 8]
je 0x180018b55
cmp qword [rbx + 0x18], 8
jb 0x18001893f
mov rdx, qword [rbx]
jmp 0x180018942
mov rdx, rbx
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
cmp word [rdx], 0
jne 0x18001895d
mov r8, rsi
jmp 0x18001896c
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180018961
lea rcx, [rbp - 0x60]
call fcn.180009bb0
nop
cmp word [rbp - 0x30], 0
jne 0x180018982
mov r8, rsi
jmp 0x18001899b
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180018990
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
call fcn.180009900
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x1800189cf
mov rdx, qword [rbx]
jmp 0x1800189d2
mov rdx, rbx
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp word [rdx], 0
jne 0x1800189f0
mov r8, rsi
jmp 0x1800189ff
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800189f4
lea rcx, [rsp + 0x40]
call fcn.180009bb0
nop
cmp word [rbp + 0x1e0], 0
jne 0x180018a19
mov r8, rsi
jmp 0x180018a2f
lea rax, [rbp + 0x1e0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180018a24
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x40]
call fcn.180009900
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x180018ab3
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, r14
ja 0x180018b31
add rax, rax
cmp rax, 0x1000
jb 0x180018aae
test cl, 0x1f
jne 0x180018b2b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180018b25
sub rcx, rax
cmp rcx, 8
jb 0x180018b1f
cmp rcx, 0x27
ja 0x180018b19
mov rcx, rax
call fcn.18001b21c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x180018b0c
inc rax
mov rcx, qword [rbp - 0x60]
cmp rax, r14
ja 0x180018b4f
add rax, rax
cmp rax, 0x1000
jb 0x180018b07
test cl, 0x1f
jne 0x180018b49
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180018b43
sub rcx, rax
cmp rcx, 8
jb 0x180018b3d
cmp rcx, 0x27
ja 0x180018b37
mov rcx, rax
call fcn.18001b21c
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jmp 0x18001892d
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
nop
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
int3
call fcn.18003dfc0
nop
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x180018bbd
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, r14
jbe 0x180018b73
call fcn.18003dfc0
int3
add rax, rax
cmp rax, 0x1000
jb 0x180018bb8
test byte [rsp + 0x60], 0x1f
je 0x180018b8b
call fcn.18003dfc0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018b9a
call fcn.18003dfc0
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018ba9
call fcn.18003dfc0
int3
cmp rcx, 0x27
jbe 0x180018bb5
call fcn.18003dfc0
int3
mov rcx, rax
call fcn.18001b21c
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x180018c35
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, r14
jbe 0x180018bec
call fcn.18003dfc0
int3
add rax, rax
cmp rax, 0x1000
jb 0x180018c30
test byte [rbp - 0x80], 0x1f
je 0x180018c03
call fcn.18003dfc0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018c12
call fcn.18003dfc0
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018c21
call fcn.18003dfc0
int3
cmp rcx, 0x27
jbe 0x180018c2d
call fcn.18003dfc0
int3
mov rcx, rax
call fcn.18001b21c
mov eax, r15d
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.18001b720
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret