Function at 0x180073ba0
Capabilities:
Delete registry key
Open recentdocs registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rcx, str.del__s__f__q__temp_.
call fcn.180137a70
lea rcx, str.DEL__S__Q_C:WindowsPrefetch
call fcn.180137a70
lea rcx, str.RD__S__Q_C:WindowsPrefetch
call fcn.180137a70
lea rcx, str.del__s__f__q_C:Users_username_AppDataLocalCrashDumps_.dmp
call fcn.180137a70
lea rcx, str.deltree__y_C:Windows_tempor1
call fcn.180137a70
lea rcx, str.deltree__y_C:WindowsTemp.
call fcn.180137a70
lea rcx, str.deltree__y_C:Windows_temp
call fcn.180137a70
lea rcx, str.deltree__y_C:Windows_tmp
call fcn.180137a70
lea rcx, str.deltree__y_C:Windows_ff.tmp
call fcn.180137a70
lea rcx, str.deltree__y_C:Windowshistory
call fcn.180137a70
lea rcx, str.deltree__y_C:Windowscookies
call fcn.180137a70
lea rcx, str.del__s__f__q_C:WindowsLOGIN
call fcn.180137a70
lea rcx, str.deltree__y_C:WindowsLOGIN
call fcn.180137a70
lea rcx, str.DEL__S__Q_C:WindowsLOGIN
call fcn.180137a70
lea rcx, str.del__s__q_C:WindowsLOGIN
call fcn.180137a70
lea rcx, str.rd__s__q_C:WindowsLOGIN
call fcn.180137a70
lea rcx, str.del__s__f__q_C:WindowsTemp
call fcn.180137a70
lea rcx, str.deltree__y_C:WindowsTemp
call fcn.180137a70
lea rcx, str.DEL__S__Q_C:WindowsTemp
call fcn.180137a70
lea rcx, str.del__s__q_C:WindowsTemp
call fcn.180137a70
lea rcx, str.rd__s__q_C:WindowsTemp
call fcn.180137a70
lea rcx, str.sc_stop_Dusmsvc
call fcn.180137a70
lea rcx, str.sc_stop_pcasvc
call fcn.180137a70
lea rcx, str.sc_stop_dps
call fcn.180137a70
lea rcx, str.sc_stop_sysmain
call fcn.180137a70
lea rcx, str.sc_stop_bam
call fcn.180137a70
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call fcn.180137a70
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
call fcn.180137a70
lea rcx, str.del__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call fcn.180137a70
lea rcx, str.rd__s__q_C:Users_username_AppDataRoamingMicrosoftWindowsRecentCustomDestinations
call fcn.180137a70
lea rcx, str.sc_start_pcasvc
call fcn.180137a70
lea rcx, str.sc_start_dps
call fcn.180137a70
lea rcx, str.sc_start_sysmain
call fcn.180137a70
lea rcx, str.sc_start_bam
call fcn.180137a70
lea rcx, str.fsutil_usn_deletejournal__n_c:
call fcn.180137a70
lea rcx, str.fsutil_usn_deletejournal__n_d:
call fcn.180137a70
lea rcx, str.fsutil_usn_deletejournal__n_e:
call fcn.180137a70
lea rcx, str.fsutil_usn_deletejournal__n_f:
call fcn.180137a70
lea rcx, str.fsutil_usn_deletejournal__d_c:
call fcn.180137a70
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_C:
call fcn.180137a70
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_D:
call fcn.180137a70
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_E:
call fcn.180137a70
lea rcx, str.fsutil_usn_createJournal_m__2147483648_a__1_F:
call fcn.180137a70
lea rcx, str.del__s__q_C:WindowsSystem32RenamedFiles.txt
call fcn.180137a70
lea rcx, str.del__s__q_C:WindowsSystem32DeletedFiles.txt
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareGuna___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWARE7___ZipFM___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREWinRARArcHistory___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32CIDSizeMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBagMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsShellBags___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession_ManagerAppCompatCache___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectInput___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAppletsRegedit___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMMountedDevices___f
call fcn.180137a70
lea rcx, str.reg_DELETE__HKEY_LOCAL_MACHINESYSTEMControlSet001Services_bamStateUserSettings___f
call fcn.180137a70
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180073ffa
mov rcx, qword [rsp + 0x40]
lea rdx, [0x18019ea64]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret