Function at 0x180004450
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov r12d, ecx
xor r13d, r13d
mov dword [rbp + 0x6f], r13d
call fcn.1800029b0
mov rcx, rax
test rax, rax
je 0x180004b63
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
call fcn.1800029b0
mov rcx, rax
test rax, rax
je 0x180004b6e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov dword [rbp + 0x77], r13d
xor r9d, r9d
lea r8, [rbp + 0x77]
xor edx, edx
xor ecx, ecx
call fcn.180002a90
call fcn.1800029b0
mov rcx, rax
cmp dword [rbp + 0x77], r13d
je 0x180004539
test rax, rax
je 0x180004b79
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rdx, str.SmallTreesShell_x64.dll
lea rdi, [r13 - 1]
cmp rdx, 0x10000
jae 0x18000451b
movzx edx, dx
lea rcx, [rbp + 0x7f]
call fcn.180003790
jmp 0x180004537
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x180004520
mov r8d, eax
lea rcx, [rbp + 0x7f]
call fcn.180004be0
nop
jmp 0x180004597
test rax, rax
je 0x180004b84
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rdx, [0x180022a58]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x180004575
movzx edx, dx
lea rcx, [rbp + 0x7f]
call fcn.180003790
jmp 0x180004597
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x180004580
mov r8d, eax
lea rcx, [rbp + 0x7f]
call fcn.180004be0
nop
mov dword [rbp + 0x6f], 1
lea rcx, [rbp + 0x17]
call fcn.180002620
nop
lea r8, [rbp + 0x7f]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.1800013d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x180004610
cmp dword [rbx + 0x10], 0
jl 0x180004602
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x180004602
call fcn.180001660
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1800045f8
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x61], rax
jmp 0x180004610
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x61]
call fcn.180004be0
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000462e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000464c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180004669
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.1800029b0
mov rcx, rax
test rax, rax
je 0x180004b8f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
lea rdx, str.CLSID_
cmp rdx, 0x10000
jae 0x1800046a6
movzx edx, dx
lea rcx, [rbp - 0x59]
call fcn.180003790
jmp 0x1800046c7
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800046b0
mov r8d, eax
lea rcx, [rbp - 0x59]
call fcn.180004be0
nop
mov rsi, qword [section..data]
mov rbx, qword [rbp - 0x59]
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x1800046ec
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1800046fd
call fcn.1800029b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180004b9a
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov dword [rbp + 0x6f], 3
test rsi, rsi
jne 0x180004725
mov eax, r13d
jmp 0x18000473a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x180004730
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1800016f0
mov rdx, qword [rbp - 0x51]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x69]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x1800047af
cmp dword [rsi + 0x10], 0
jl 0x1800047a2
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x1800047a2
mov rcx, rbx
call fcn.180001660
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x180004798
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x69], rax
jmp 0x1800047af
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x69]
call fcn.180004be0
mov dword [rbp + 0x6f], 1
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1800047cf
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1800047e8
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
test r12d, r12d
je 0x180004a17
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], r13d
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov dword [rbp - 0x19], r13d
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov dword [rbp - 1], r13d
mov qword [rbp + 7], r13
mov r9d, 0xf013f
mov rbx, qword [rbp - 0x69]
mov r8, rbx
mov rdx, 0xffffffff80000000
lea rcx, [rbp - 0x39]
call fcn.1800040f0
test eax, eax
je 0x180004870
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffff80000000
lea rcx, [rbp - 0x39]
call fcn.1800017c0
test eax, eax
je 0x180004870
mov r14, qword [rbp - 0x39]
jmp 0x1800049d2
mov dword [rsp + 0x28], 0x20
lea r15, [0x180022c08]
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov r14, qword [rbp - 0x39]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r9d, 0xf013f
lea r8, str.InprocServer32
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.1800040f0
test eax, eax
je 0x1800048f3
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.InprocServer32
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.1800017c0
test eax, eax
je 0x1800048f3
mov rsi, qword [rbp - 0x21]
jmp 0x1800049c4
mov rsi, qword [rbp - 0x21]
mov rax, qword [rbp - 0x61]
test rax, rax
je 0x180004932
mov rcx, rdi
lea rcx, [rcx + 1]
cmp word [rax + rcx*2], 0
jne 0x180004903
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x14
lea rax, str.Apartment
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r9d, 0xf013f
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.1800040f0
test eax, eax
je 0x1800049e3
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.1800017c0
test eax, eax
je 0x1800049e3
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1800049c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x1800049d2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x180004b08
mov rcx, r14
jmp 0x180004b01
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, qword [section..data]
mov r15, qword [rbp - 9]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r15, r15
je 0x1800049c4
mov rcx, r15
jmp 0x1800049be
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x180004a32
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x180004a43
call fcn.1800029b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180004b58
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
mov dword [rbp + 0x6f], 5
mov dword [rsp + 0x20], 0xe
lea r9, str.InprocServer32
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1800016f0
mov rbx, qword [rbp - 0x49]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180004aae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x69]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180004b08
mov rdx, qword [section..data]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180004b22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180004b3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
int3
mov ecx, 0x80004005
call fcn.180001600
int3
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
int3