Function at 0x180001b80
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x178]
sub rsp, 0x260
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r14d, r8d
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov qword [rsp + 0x68], rdi
test rdx, rdx
je 0x18000210a
mov eax, dword [0x18000c450]
cmp dword [rcx], eax
jne 0x180001bfe
mov eax, dword [0x18000c454]
cmp dword [rcx + 4], eax
jne 0x180001bfe
mov eax, dword [0x18000c458]
cmp dword [rcx + 8], eax
jne 0x180001bfe
mov eax, dword [0x18000c45c]
cmp dword [rcx + 0xc], eax
je 0x18000210a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x18000ca10]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18000c470]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000210a
cmp dword [rbx], 0
je 0x180001c82
nop
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
mov rcx, qword [rsp + 0x68]
lea r9, [rbp - 0x48]
mov r8d, 1
mov rdx, rsi
mov rax, qword [rcx]
test r14d, r14d
je 0x180001c6c
cmp dword [rbx], r8d
jne 0x180001c5f
call qword [rax + 0x28]
jmp 0x180001c62
call qword [rax + 0x38]
test eax, eax
js 0x18000210c
jmp 0x180001c79
cmp dword [rbx], 1
jne 0x180001c76
call qword [rax + 0x30]
jmp 0x180001c79
call qword [rax + 0x40]
add rbx, 0x10
cmp dword [rbx], 0
jne 0x180001c30
test r14d, r14d
jne 0x18000210e
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov qword [rbp - 0x58], rdi
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscpy_s]
test eax, eax
je 0x180001cf2
cmp eax, 0xc
je 0x180001ce7
cmp eax, 0x16
je 0x180001cdc
cmp eax, 0x22
je 0x180001cdc
cmp eax, 0x50
je 0x180001cf2
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
lea r8, [rbp + 0xd0]
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscat_s]
test eax, eax
je 0x180001d41
cmp eax, 0xc
je 0x180001d36
cmp eax, 0x16
je 0x180001d2b
cmp eax, 0x22
je 0x180001d2b
cmp eax, 0x50
je 0x180001d41
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscat_s]
test eax, eax
je 0x180001d90
cmp eax, 0xc
je 0x180001d85
cmp eax, 0x16
je 0x180001d7a
cmp eax, 0x22
je 0x180001d7a
cmp eax, 0x50
je 0x180001d90
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
mov qword [rbp - 0x70], 0xffffffff80000000
mov dword [rbp - 0x68], edi
mov qword [rbp - 0x60], rdi
mov rbx, rdi
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], edi
mov qword [rbp - 0x78], rdi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001ec3
mov dword [rbp - 0x80], edi
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rsi, eax
test rbx, rbx
je 0x180001e4a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], edi
test rsi, rsi
jne 0x180001ec3
cmp dword [rsp + 0x60], esi
jne 0x180001ec3
cmp byte [0x1800156e8], sil
jne 0x180001e9c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001e8c
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800156e0], rax
jmp 0x180001e93
mov rax, qword [0x1800156e0]
mov byte [0x1800156e8], 1
jmp 0x180001ea3
mov rax, qword [0x1800156e0]
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x180001ebd
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180001ec3
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscpy_s]
test eax, eax
je 0x180001f12
cmp eax, 0xc
je 0x180001f07
cmp eax, 0x16
je 0x180001efc
cmp eax, 0x22
je 0x180001efc
cmp eax, 0x50
je 0x180001f12
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
lea r8, [rbp + 0xd0]
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscat_s]
test eax, eax
je 0x180001f61
cmp eax, 0xc
je 0x180001f56
cmp eax, 0x16
je 0x180001f4b
cmp eax, 0x22
je 0x180001f4b
cmp eax, 0x50
je 0x180001f61
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCR120.dll_wcscat_s]
test eax, eax
je 0x180001fb0
cmp eax, 0xc
je 0x180001fa5
cmp eax, 0x16
je 0x180001f9a
cmp eax, 0x22
je 0x180001f9a
cmp eax, 0x50
je 0x180001fb0
mov ecx, 0x80004005
call fcn.180003be0
int3
mov ecx, 0x80070057
call fcn.180003be0
int3
mov ecx, 0x8007000e
call fcn.180003be0
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180002002
mov eax, edi
test rbx, rbx
je 0x180001ff2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov dword [rbp - 0x80], edi
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], edi
cdqe
test rax, rax
jne 0x1800020de
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rsi, eax
test rbx, rbx
je 0x180002064
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
mov qword [rsp + 0x78], rbx
mov dword [rbp - 0x80], edi
test rsi, rsi
jne 0x1800020de
cmp dword [rsp + 0x60], esi
jne 0x1800020de
cmp byte [0x1800156e8], sil
jne 0x1800020b6
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800020a6
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800156e0], rax
jmp 0x1800020ad
mov rax, qword [0x1800156e0]
mov byte [0x1800156e8], 1
jmp 0x1800020bd
mov rax, qword [0x1800156e0]
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x1800020d7
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1800020de
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
test rbx, rbx
je 0x1800020f1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov dword [rbp - 0x80], edi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x70], rdi
mov dword [rbp - 0x68], edi
jmp 0x18000210e
mov eax, edi
mov edi, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000211e
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180008f70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret