Function at 0x1800cf100
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x180], rbx
mov rax, qword [0x1800f1040]
xor rax, rbp
mov qword [rbp + 0x130], rax
xor esi, esi
mov r14d, r8d
mov qword [rbp + 0x10], rsi
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800cf6d2
mov eax, dword [0x1800e5470]
cmp dword [rcx], eax
jne 0x1800cf173
mov eax, dword [0x1800e5474]
cmp dword [rcx + 4], eax
jne 0x1800cf173
mov eax, dword [0x1800e5478]
cmp dword [rcx + 8], eax
jne 0x1800cf173
mov eax, dword [0x1800e547c]
cmp dword [rcx + 0xc], eax
je 0x1800cf6d2
xor edx, edx
lea rax, [rbp + 0x10]
lea r9, [0x1800eccb0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800e5490]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800cf6d2
mov ecx, dword [rdi]
test ecx, ecx
je 0x1800cf20a
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x18]
mov r8d, 1
mov rdx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
test r14d, r14d
je 0x1800cf1eb
cmp ecx, r8d
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x1800cf1de
call qword [rax + 0x28]
jmp 0x1800cf1e1
call qword [rax + 0x38]
test eax, eax
js 0x1800cf6d4
jmp 0x1800cf1ff
cmp ecx, 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x1800cf1fc
call qword [rax + 0x30]
jmp 0x1800cf1ff
call qword [rax + 0x40]
mov ecx, dword [rdi + 0x10]
add rdi, 0x10
test ecx, ecx
jne 0x1800cf1b0
test r14d, r14d
jne 0x1800cf6d6
lea r8d, [r14 + 0x40]
mov rcx, rbx
lea rdx, [rbp + 0xb0]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x1800cf234
lea eax, [r14 + 0xd]
jmp 0x1800cf6d4
mov rbx, rsi
lea rcx, [rbp + 0xb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1800cf245
inc eax
mov ecx, 0xffffffff
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
cmp rax, rcx
ja 0x1800cf30e
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x1800cf2aa
mov rcx, rdi
call fcn.1800d07a0
test al, al
je 0x1800cf2aa
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1800cf297
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800e3720
sub rsp, rax
lea rdi, [rsp + 0x60]
jmp 0x1800cf2d2
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x1800cf717
lea rcx, [rdi + 0x10]
call fcn.1800d9bf8
test rax, rax
je 0x1800cf30e
mov qword [rax], rsi
lea rdi, [rax + 0x10]
mov rbx, rax
test rdi, rdi
je 0x1800cf30e
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0xb0]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov byte [rdi], sil
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rsi
jmp 0x1800cf311
mov rdi, rsi
test rdi, rdi
je 0x1800cf6bb
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1800da4ec
test eax, eax
je 0x1800cf357
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
mov r8, rdi
lea rcx, [rbp + 0x30]
mov edx, 0x80
call fcn.1800da54c
test eax, eax
je 0x1800cf390
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
lea r8, [0x1800eccc0]
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1800da54c
test eax, eax
je 0x1800cf3cd
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
lea rax, [rbp]
mov dword [rbp + 8], esi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp], rsi
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
mov r14, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800cf4d3
mov r14, qword [rbp]
lea rax, [rbp + 8]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov rcx, r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r15d, eax
test r14, r14
je 0x1800cf457
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rsi
test r15d, r15d
jne 0x1800cf4d3
cmp dword [rbp + 8], esi
jne 0x1800cf4d3
cmp byte [0x1800f2fe8], sil
jne 0x1800cf4ac
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800cf49c
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f2fe0], rax
mov byte [0x1800f2fe8], 1
jmp 0x1800cf4b3
mov rax, qword [0x1800f2fe0]
mov byte [0x1800f2fe8], 1
jmp 0x1800cf4b3
mov rax, qword [0x1800f2fe0]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x1800cf4cd
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1800cf4d3
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1800da4ec
test eax, eax
je 0x1800cf510
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
mov r8, rdi
lea rcx, [rbp + 0x30]
mov edx, 0x80
call fcn.1800da54c
test eax, eax
je 0x1800cf549
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.1800da54c
test eax, eax
je 0x1800cf586
cmp eax, 0xc
je 0x1800cf70c
cmp eax, 0x16
je 0x1800cf72d
cmp eax, 0x22
je 0x1800cf72d
cmp eax, 0x50
jne 0x1800cf722
lea rax, [rbp]
mov qword [rbp], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800cf6a0
mov eax, esi
test r14, r14
je 0x1800cf5c5
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp]
test eax, eax
jne 0x1800cf6a0
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x38], rsi
mov rcx, r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, eax
test r14, r14
je 0x1800cf621
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rsi
test edi, edi
jne 0x1800cf6ae
cmp dword [rbp + 8], esi
jne 0x1800cf6a0
cmp byte [0x1800f2fe8], sil
jne 0x1800cf679
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800cf669
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f2fe0], rax
mov byte [0x1800f2fe8], 1
jmp 0x1800cf680
mov rax, qword [0x1800f2fe0]
mov byte [0x1800f2fe8], 1
jmp 0x1800cf680
mov rax, qword [0x1800f2fe0]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x1800cf69a
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1800cf6a0
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test r14, r14
je 0x1800cf6ae
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x1800cf6d6
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.1800d9bd0
test rbx, rbx
jne 0x1800cf6c0
jmp 0x1800cf6d6
mov eax, esi
mov esi, eax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1800cf6e5
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.1800d32d0
mov rbx, qword [rbp + 0x180]
lea rsp, [rbp + 0x140]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180001160
int3
mov ecx, 0x80070216
call fcn.180001160
int3
mov ecx, 0x80004005
call fcn.180001160
int3
mov ecx, 0x80070057
call fcn.180001160
int3