Function at 0x180002760
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x180], rbx
mov rax, qword [0x180058040]
xor rax, rbp
mov qword [rbp + 0x130], rax
xor esi, esi
mov r14d, r8d
mov qword [rbp + 0x10], rsi
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180002d32
mov eax, dword [0x180019470]
cmp dword [rcx], eax
jne 0x1800027d3
mov eax, dword [0x180019474]
cmp dword [rcx + 4], eax
jne 0x1800027d3
mov eax, dword [0x180019478]
cmp dword [rcx + 8], eax
jne 0x1800027d3
mov eax, dword [0x18001947c]
cmp dword [rcx + 0xc], eax
je 0x180002d32
xor edx, edx
lea rax, [rbp + 0x10]
lea r9, [0x1800538f0]
mov qword [rsp + 0x20], rax
lea rcx, [0x180019490]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180002d32
mov ecx, dword [rdi]
test ecx, ecx
je 0x18000286a
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x18]
mov r8d, 1
mov rdx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
test r14d, r14d
je 0x18000284b
cmp ecx, r8d
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x18000283e
call qword [rax + 0x28]
jmp 0x180002841
call qword [rax + 0x38]
test eax, eax
js 0x180002d34
jmp 0x18000285f
cmp ecx, 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
jne 0x18000285c
call qword [rax + 0x30]
jmp 0x18000285f
call qword [rax + 0x40]
mov ecx, dword [rdi + 0x10]
add rdi, 0x10
test ecx, ecx
jne 0x180002810
test r14d, r14d
jne 0x180002d36
lea r8d, [r14 + 0x40]
mov rcx, rbx
lea rdx, [rbp + 0xb0]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x180002894
lea eax, [r14 + 0xd]
jmp 0x180002d34
mov rbx, rsi
lea rcx, [rbp + 0xb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1800028a5
inc eax
mov ecx, 0xffffffff
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
cmp rax, rcx
ja 0x18000296e
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x18000290a
mov rcx, rdi
call fcn.180003e00
test al, al
je 0x18000290a
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1800028f7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.180017380
sub rsp, rax
lea rdi, [rsp + 0x60]
jmp 0x180002932
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x180002d77
lea rcx, [rdi + 0x10]
call fcn.18000d308
test rax, rax
je 0x18000296e
mov qword [rax], rsi
lea rdi, [rax + 0x10]
mov rbx, rax
test rdi, rdi
je 0x18000296e
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0xb0]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov byte [rdi], sil
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rsi
jmp 0x180002971
mov rdi, rsi
test rdi, rdi
je 0x180002d1b
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.18000e094
test eax, eax
je 0x1800029b7
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
mov r8, rdi
lea rcx, [rbp + 0x30]
mov edx, 0x80
call fcn.18000e0f4
test eax, eax
je 0x1800029f0
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
lea r8, [0x180053900]
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.18000e0f4
test eax, eax
je 0x180002a2d
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
lea rax, [rbp]
mov dword [rbp + 8], esi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp], rsi
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
mov r14, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180002b33
mov r14, qword [rbp]
lea rax, [rbp + 8]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov rcx, r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r15d, eax
test r14, r14
je 0x180002ab7
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rsi
test r15d, r15d
jne 0x180002b33
cmp dword [rbp + 8], esi
jne 0x180002b33
cmp byte [0x18005a018], sil
jne 0x180002b0c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002afc
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18005a010], rax
mov byte [0x18005a018], 1
jmp 0x180002b13
mov rax, qword [0x18005a010]
mov byte [0x18005a018], 1
jmp 0x180002b13
mov rax, qword [0x18005a010]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x180002b2d
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180002b33
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.18000e094
test eax, eax
je 0x180002b70
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
mov r8, rdi
lea rcx, [rbp + 0x30]
mov edx, 0x80
call fcn.18000e0f4
test eax, eax
je 0x180002ba9
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp + 0x30]
call fcn.18000e0f4
test eax, eax
je 0x180002be6
cmp eax, 0xc
je 0x180002d6c
cmp eax, 0x16
je 0x180002d8d
cmp eax, 0x22
je 0x180002d8d
cmp eax, 0x50
jne 0x180002d82
lea rax, [rbp]
mov qword [rbp], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180002d00
mov eax, esi
test r14, r14
je 0x180002c25
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp]
test eax, eax
jne 0x180002d00
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x38], rsi
mov rcx, r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, eax
test r14, r14
je 0x180002c81
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rsi
test edi, edi
jne 0x180002d0e
cmp dword [rbp + 8], esi
jne 0x180002d00
cmp byte [0x18005a018], sil
jne 0x180002cd9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002cc9
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18005a010], rax
mov byte [0x18005a018], 1
jmp 0x180002ce0
mov rax, qword [0x18005a010]
mov byte [0x18005a018], 1
jmp 0x180002ce0
mov rax, qword [0x18005a010]
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x180002cfa
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180002d00
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test r14, r14
je 0x180002d0e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x180002d36
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.18000d2e0
test rbx, rbx
jne 0x180002d20
jmp 0x180002d36
mov eax, esi
mov esi, eax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x180002d45
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.1800069e0
mov rbx, qword [rbp + 0x180]
lea rsp, [rbp + 0x140]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180001160
int3
mov ecx, 0x80070216
call fcn.180001160
int3
mov ecx, 0x80004005
call fcn.180001160
int3
mov ecx, 0x80070057
call fcn.180001160
int3