Function at 0x18000c8c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x180044360]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov qword [rbp + 0x1f], 7
xor esi, esi
mov qword [rbp + 0x17], rsi
mov word [rbp + 7], si
lea r8d, [rsi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp + 7]
call fcn.180002000
nop
lea r8d, [rsi + 0x26]
lea rdx, str.23CEF317_1910_4fa2_9987_839EFBEDB48F
lea rcx, [rbp + 7]
call fcn.180006450
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.180001ec0
nop
lea r8d, [rsi + 0xf]
lea rdx, str.InprocServer32
lea rcx, [rbp - 0x19]
call fcn.180006450
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000c9e2
lea rdx, str.23CEF317_1910_4fa2_9987_839EFBEDB48F
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.18000bf00
mov rdi, rax
mov rbx, qword [rax]
movabs r14, 0x7fffffffffffffff
cmp rbx, qword [rax + 8]
je 0x18000cbf3
cmp qword [rbx + 0x18], 8
jb 0x18000ca0d
mov rdx, qword [rbx]
jmp 0x18000ca10
mov rdx, rbx
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rsi
mov word [rbp + 0x27], si
cmp word [rdx], 0
jne 0x18000ca2b
mov r8, rsi
jmp 0x18000ca3b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000ca30
lea rcx, [rbp + 0x27]
call fcn.180002000
nop
movzx eax, word [str._shellexContextMenuHandlersPuddingZip]
neg ax
sbb r8, r8
and r8d, 0x27
lea rdx, str._shellexContextMenuHandlersPuddingZip
lea rcx, [rbp + 0x27]
call fcn.180006450
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x18000ca8d
mov rdx, qword [rbx]
jmp 0x18000ca90
mov rdx, rbx
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
cmp word [rdx], 0
jne 0x18000caab
mov r8, rsi
jmp 0x18000cabb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000cab0
lea rcx, [rbp - 0x39]
call fcn.180002000
nop
movzx eax, word [str._shellexDragDropHandlersPuddingZip]
neg ax
sbb r8, r8
and r8d, 0x24
lea rdx, str._shellexDragDropHandlersPuddingZip
lea rcx, [rbp - 0x39]
call fcn.180006450
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rax, qword [rbp - 0x21]
cmp rax, 8
jb 0x18000cb54
inc rax
mov rcx, qword [rbp - 0x39]
cmp rax, r14
ja 0x18000cbcf
add rax, rax
cmp rax, 0x1000
jb 0x18000cb4f
test cl, 0x1f
jne 0x18000cbc9
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000cbc3
sub rcx, rax
cmp rcx, 8
jb 0x18000cbbd
cmp rcx, 0x27
ja 0x18000cbb7
mov rcx, rax
call fcn.1800179b0
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], rsi
mov word [rbp - 0x39], si
mov rax, qword [rbp + 0x3f]
cmp rax, 8
jb 0x18000cbaa
inc rax
mov rcx, qword [rbp + 0x27]
cmp rax, r14
ja 0x18000cbed
add rax, rax
cmp rax, 0x1000
jb 0x18000cba5
test cl, 0x1f
jne 0x18000cbe7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000cbe1
sub rcx, rax
cmp rcx, 8
jb 0x18000cbdb
cmp rcx, 0x27
ja 0x18000cbd5
mov rcx, rax
call fcn.1800179b0
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jmp 0x18000c9fb
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
nop
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
int3
call fcn.18001c054
nop
mov rax, qword [rbp - 1]
cmp rax, 8
jb 0x18000cc58
inc rax
mov rcx, qword [rbp - 0x19]
cmp rax, r14
jbe 0x18000cc0f
call fcn.18001c054
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000cc53
test byte [rbp - 0x19], 0x1f
je 0x18000cc26
call fcn.18001c054
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000cc35
call fcn.18001c054
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000cc44
call fcn.18001c054
int3
cmp rcx, 0x27
jbe 0x18000cc50
call fcn.18001c054
int3
mov rcx, rax
call fcn.1800179b0
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
mov rax, qword [rbp + 0x1f]
cmp rax, 8
jb 0x18000cccd
inc rax
mov rcx, qword [rbp + 7]
cmp rax, r14
jbe 0x18000cc84
call fcn.18001c054
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000ccc8
test byte [rbp + 7], 0x1f
je 0x18000cc9b
call fcn.18001c054
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000ccaa
call fcn.18001c054
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000ccb9
call fcn.18001c054
int3
cmp rcx, 0x27
jbe 0x18000ccc5
call fcn.18001c054
int3
mov rcx, rax
call fcn.1800179b0
mov eax, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180017a50
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret