Function at 0x180012840
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x88
mov rdi, r9
xor esi, esi
and qword [rbp - 1], rsi
xor r12d, r12d
and dword [rbp - 0x29], r12d
mov r9d, 0x20019
and qword [rbp - 9], rsi
mov r14, r8
mov ebx, 1
xor r13d, r13d
call fcn.180012b58
mov qword [rbp - 0x11], rax
test rax, rax
je 0x180012a5f
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x21]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rcx, r14
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180012b3d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r9d, 0x20006
mov rdx, rdi
mov rcx, r14
call fcn.180012b58
mov rdi, rax
neg rax
mov rsi, rdi
sbb r14d, r14d
and r14d, ebx
mov ebx, r14d
je 0x180012a3b
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp + 0x7f]
or dword [rbp + 0x7f], 0xffffffff
call fcn.18001206c
mov r15, rax
mov qword [rbp - 1], rax
mov eax, dword [rbp + 0x7f]
mov dword [rbp + 0x7f], eax
test r15, r15
je 0x18001297d
test eax, eax
je 0x18001297d
mov r9, qword [r15]
mov r8, rdi
mov eax, dword [rbp + 0x77]
mov rdx, r9
and dword [rsp + 0x28], r13d
mov rsi, rdi
mov rcx, qword [rbp - 0x11]
mov ebx, r14d
mov dword [rsp + 0x20], eax
call fcn.180012840
test eax, eax
je 0x180012a35
inc r12d
add r15, 0x20
cmp r12d, dword [rbp + 0x7f]
jb 0x180012944
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x21]
or dword [rbp - 0x21], 0xffffffff
call fcn.1800122c4
mov r13d, dword [rbp - 0x21]
mov qword [rbp - 9], rax
test rax, rax
je 0x180012b04
xor r14d, r14d
test r13d, r13d
je 0x180012b04
mov r15d, dword [rbp + 0x77]
lea rdi, [rax + 8]
and r15d, 4
and dword [rbp - 0x29], 0
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
test r15d, r15d
je 0x180012ac1
and dword [rbp - 0x15], 0
mov r9d, 1
and dword [rbp - 0x19], 0
mov rax, qword [rdi - 8]
mov qword [rbp - 0x21], rax
call fcn.180012b58
mov r12, rax
test rax, rax
je 0x180012a8e
mov rdx, qword [rbp - 0x21]
lea r9, [rbp - 0x19]
lea r8, [rbp - 0x15]
mov rcx, rax
call fcn.180012700
mov rcx, r12
mov qword [rbp - 0x21], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, qword [rbp - 0x21]
test rax, rax
je 0x180012a8e
mov rcx, rax
call sub.msvcrt.dll_free
mov ebx, 1
jmp 0x180012aec
xor ebx, ebx
mov r12d, dword [rbp + 0x7f]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rsi, rsi
je 0x180012a5f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov edx, r13d
lea rcx, [rbp - 9]
call fcn.180012d14
mov edx, r12d
lea rcx, [rbp - 1]
call fcn.180012c98
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9, qword [rdi + 8]
lea rax, [rbp - 0x29]
mov r8, qword [rdi - 8]
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x40], rax
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
call fcn.180012ba0
test eax, eax
jne 0x180012aec
xor ebx, ebx
jmp 0x180012aec
mov r9, qword [rdi + 8]
lea rax, [rbp - 0x29]
mov r8, qword [rdi - 8]
mov qword [rsp + 0x40], rax
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
call fcn.180012ba0
test eax, eax
je 0x180012a35
test ebx, ebx
je 0x180012a37
inc r14d
add rdi, 0x20
cmp r14d, r13d
jb 0x1800129b7
test byte [rbp + 0x77], 1
je 0x180012a37
mov rdx, qword [rbp + 0x5f]
mov rcx, qword [rbp + 0x57]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, eax
je 0x180012a37
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x180012a35
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor ebx, ebx
jmp 0x180012a3b