Function at 0x18006bd8c
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r12d, r12d
mov qword [rsp + 0x58], rdx
mov edi, r8d
mov dword [rsp + 0x54], r12d
mov r13, rdx
mov qword [rbp - 0x40], r12
mov r14, rcx
mov qword [rbp - 0x50], r12
lea rax, [0x18009dff0]
mov dword [rbp - 0x58], 0x2a
mov ebx, r12d
mov qword [rbp - 0x48], rax
xor edx, edx
mov qword [rbp - 0x78], rbx
mov r8d, 0xc0
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x20]
mov rsi, r9
mov r15d, r12d
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xorps xmm0, xmm0
lea rcx, [rbp + 0xa0]
xor edx, edx
mov r8d, 0xa2
movups xmmword [rbp - 0x38], xmm0
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
test byte [0x1800b78f3], 0x20
je 0x18006be58
mov eax, dword [rsi + 0x10]
mov r9, r13
mov dword [rsp + 0x38], eax
mov r8, r14
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edi
call fcn.18008e194
mov eax, dword [rsi + 0x10]
xor r9d, r9d
cmp qword [rsi + 0x18], r9
je 0x18006bf18
test eax, eax
jne 0x18006bf20
mov edi, 0x80070057
mov dword [rsp + 0x54], 0x146
lea r14, [0x18009dff0]
cmp qword [rbp - 0x50], r9
je 0x18006bea2
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
test byte [0x1800b78f3], 0x20
je 0x18006bebf
mov ecx, 0x1a
lea rdx, [0x18009f2c0]
mov r8d, edi
call fcn.1800876bc
xor r12d, r12d
test rbx, rbx
je 0x18006bed0
lea rcx, [rbp - 0x78]
call fcn.180030b30
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18006bee9
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rbp - 0x50], r12
lea rcx, [rbp - 0x48]
call fcn.180021be4
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test eax, eax
jne 0x18006be70
mov rax, qword [rsi + 8]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x18006bf34
cmp word [rax], r9w
jne 0x18006bf3d
lea rax, [rbp - 0x58]
mov qword [rsp + 0x78], rax
mov rdi, qword [rsi]
mov qword [rbp - 0x80], rdi
test rdi, rdi
je 0x18006bf4f
cmp word [rdi], r9w
jne 0x18006bf57
lea rax, [rbp - 0x58]
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
je 0x18006bf80
mov edi, 0x80070008
mov dword [rsp + 0x54], 0x15c
jmp 0x18006be7d
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x38]
call fcn.180027164
xor r9d, r9d
test eax, eax
jne 0x18006bfa9
mov edi, 0x80070008
mov dword [rsp + 0x54], 0x161
jmp 0x18006be7d
lea rcx, [rbp - 0x48]
call fcn.180026e74
lea rax, [0x18009f2b0]
mov dword [rsp + 0x68], 4
or r13, 0xffffffffffffffff
mov qword [rbp - 0x68], rax
mov rax, r13
lea rcx, [rbp + 0xa0]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x18006bfd3
lea rcx, [rbp + 0xa0]
mov dword [rsp + 0x6c], eax
lea r8d, [rax + 4]
mov qword [rbp - 0x60], rcx
lea rax, [rbp - 0x68]
mov edx, 2
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
call fcn.180026dac
mov edi, eax
xor r9d, r9d
test eax, eax
jns 0x18006c02b
mov r14, qword [rbp - 0x48]
mov dword [rsp + 0x54], 0x165
mov r13, qword [rsp + 0x58]
jmp 0x18006be84
test byte [0x1800b78f3], 0x20
mov r14, qword [rbp - 0x48]
mov qword [rsp + 0x60], r14
je 0x18006c054
mov ecx, 0x17
lea rdx, [0x18009f2c0]
mov r8, r14
call fcn.180087814
xor r9d, r9d
cmp dword [rsi + 0x20], r9d
jbe 0x18006c1ed
mov rcx, qword [rsi + 0x28]
mov edx, dword [rsi + 0x20]
mov r8, qword [rcx]
mov rax, r13
inc rax
cmp word [r8 + rax*2], r9w
jne 0x18006c06b
inc r12d
add rcx, 8
add r12d, eax
sub rdx, 1
jne 0x18006c065
test r12d, r12d
je 0x18006c1ed
inc r12d
mov dword [rbp - 0x6c], r9d
lea edx, [r12 + r12]
call fcn.180030af8
xor r9d, r9d
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x18006c0bc
mov edi, 0x8007000e
mov dword [rbp - 0x6c], 0x59
mov r14d, edi
jmp 0x18006c0d1
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rax, r9
mov edi, r9d
mov qword [rsp + 0x70], rax
mov r14d, r9d
test rax, rax
je 0x18006c0e3
lea rcx, [rsp + 0x70]
call fcn.180030b30
xor r9d, r9d
test r14d, r14d
jns 0x18006c0fa
mov dword [rsp + 0x54], 0x17d
mov r14, qword [rsp + 0x60]
jmp 0x18006c021
mov r14d, r9d
cmp dword [rsi + 0x20], r9d
jbe 0x18006c198
cmp r15d, r12d
jae 0x18006c1d3
mov edi, r12d
sub edi, r15d
test byte [0x1800b78f3], 0x20
mov r15d, r14d
je 0x18006c13e
mov r9, qword [rsi + 0x28]
lea rdx, [0x18009f2c0]
mov ecx, 0x18
mov r8d, r14d
mov r9, qword [r9 + r15*8]
call fcn.18008739c
mov r8, qword [rsi + 0x28]
mov eax, dword [rsp + 0x50]
mov edx, edi
mov r8, qword [r8 + r15*8]
lea rcx, [rbx + rax*2]
call fcn.180069504
xor r9d, r9d
mov edi, eax
test eax, eax
js 0x18006c1c6
mov rax, qword [rsi + 0x28]
mov rcx, qword [rax + r15*8]
mov rax, r13
inc rax
cmp word [rcx + rax*2], r9w
jne 0x18006c169
inc eax
add eax, dword [rsp + 0x50]
cmp eax, dword [rsp + 0x50]
jb 0x18006c1b4
cmp eax, r12d
jae 0x18006c1b4
inc r14d
mov dword [rsp + 0x50], eax
mov r15d, eax
cmp r14d, dword [rsi + 0x20]
jb 0x18006c107
mov r14, qword [rsp + 0x60]
cmp r15d, r12d
jb 0x18006c1e5
mov edi, 0x8007006f
mov dword [rsp + 0x54], 0x1a5
jmp 0x18006c021
mov edi, 0x8007006f
mov dword [rsp + 0x54], 0x199
jmp 0x18006c0f0
mov dword [rsp + 0x54], 0x192
jmp 0x18006c0f0
mov edi, 0x8007006f
mov dword [rsp + 0x54], 0x185
jmp 0x18006c0f0
mov eax, r15d
mov word [rbx + rax*2], r9w
mov rdx, qword [rsp + 0x78]
lea rax, str.AppId
mov qword [rbp - 0x20], rax
mov rax, r13
mov dword [rbp - 0x18], 1
mov qword [rbp - 0x10], rdx
inc rax
cmp word [rdx + rax*2], r9w
jne 0x18006c20b
mov r8, qword [rbp - 0x80]
lea eax, [rax*2 + 2]
mov dword [rbp - 8], eax
lea rax, str.Host
mov qword [rbp], rax
mov dword [rbp + 8], 1
mov qword [rbp + 0x10], r8
inc r13
cmp word [r8 + r13*2], r9w
jne 0x18006c239
mov r10d, 4
mov dword [rbp + 0x28], 7
lea eax, [r13*2 + 2]
mov qword [rbp + 0x30], rbx
mov dword [rbp + 0x18], eax
lea rcx, [rsi + 0x30]
lea rax, str.Connections
mov dword [rbp + 0x48], r10d
mov qword [rbp + 0x20], rax
lea eax, [r12 + r12]
mov dword [rbp + 0x38], eax
lea rax, str.RuleFlags
mov qword [rbp + 0x40], rax
lea rax, str.PolicyTag
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x70], rax
lea rax, str.AppSid
mov qword [rbp + 0x80], rax
mov rax, qword [rsi + 0x18]
mov qword [rbp + 0x90], rax
mov eax, dword [rsi + 0x10]
mov dword [rbp + 0x98], eax
mov qword [rbp + 0x50], rcx
mov dword [rbp + 0x58], r10d
mov dword [rbp + 0x68], r10d
mov dword [rbp + 0x78], r10d
mov dword [rbp + 0x88], 3
test byte [0x1800b78f3], 0x20
je 0x18006c302
mov eax, dword [rbp + 0x1c0]
mov r9, rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r8, r14
call fcn.18008dc08
xor r9d, r9d
mov r13, qword [rsp + 0x58]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], r9
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rdx, r14
mov qword [rsp + 0x30], r9
mov rcx, r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r9d
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
xor r9d, r9d
mov edi, eax
test eax, eax
jns 0x18006c355
mov dword [rsp + 0x54], 0x1de
jmp 0x18006be84
mov r14d, r9d
lea rsi, [rbp - 8]
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x18006c3a1
mov eax, dword [rsi]
xor r8d, r8d
mov r9d, dword [rsi - 0x10]
mov rdx, qword [rsi - 0x18]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
xor r9d, r9d
mov edi, eax
test eax, eax
jle 0x18006c39d
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x18006c3b4
inc r14d
add rsi, 0x20
cmp r14d, 6
jae 0x18006bea2
jmp 0x18006c35c
mov r14, qword [rsp + 0x60]
mov dword [rsp + 0x54], 0x1f0
jmp 0x18006be84