Function at 0x180065d90
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerToolbar
xor esi, esi
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180065de1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180065df6
lea rdx, [0x180100260]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180065df6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, [0x180142f20]
mov edx, 1
call fcn.180066630
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerDiscardablePostSetupComponent_Categories00021493_0000_0000_C000_000000000046
mov r9d, 0x2001f
mov edi, eax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rbx, rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180065edb
mov rbx, qword [rsp + 0x58]
cmp byte [0x180142d29], sil
jne 0x180065ea4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180065e94
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180142d29], 1
mov qword [0x180142d30], rax
jmp 0x180065eab
mov rax, qword [0x180142d30]
mov byte [0x180142d29], 1
jmp 0x180065eab
mov rax, qword [0x180142d30]
lea rdx, str.Enum
mov rcx, rbx
test rax, rax
je 0x180065ec4
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180065eca
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x180065edb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerDiscardablePostSetupComponent_Categories00021494_0000_0000_C000_000000000046
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180065fae
mov eax, esi
test rbx, rbx
je 0x180065f1f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x180065fae
cmp byte [0x180142d29], sil
jne 0x180065f77
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180065f67
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180142d29], 1
mov qword [0x180142d30], rax
jmp 0x180065f7e
mov rax, qword [0x180142d30]
mov byte [0x180142d29], 1
jmp 0x180065f7e
mov rax, qword [0x180142d30]
lea rdx, str.Enum
mov rcx, rbx
test rax, rax
je 0x180065f97
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180065f9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x180065fae
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test edi, edi
js 0x18006602d
mov rax, qword [0x1801408f0]
mov rax, qword [rax + 8]
cmp qword [rax], rsi
je 0x180065fca
mov rax, qword [rax]
mov r8, qword [rax]
jmp 0x180065fcd
mov r8, rsi
mov rcx, qword [0x180142df0]
lea rdx, [0x1801408f0]
call qword [sym.imp.RPCRT4.dll_NdrDllRegisterProxy]
mov edi, eax
test eax, eax
js 0x18006602d
mov rax, qword [0x1801408f0]
mov rax, qword [rax + 8]
cmp qword [rax], rsi
je 0x180065fff
mov rax, qword [rax]
mov r8, qword [rax]
jmp 0x180066002
mov r8, rsi
mov rcx, qword [0x180142df0]
lea rdx, [0x1801408f0]
call qword [sym.imp.RPCRT4.dll_NdrDllUnregisterProxy]
mov rcx, qword [rsp + 0x50]
mov edi, eax
test rcx, rcx
je 0x18006602d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
test rbx, rbx
je 0x18006603b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret