Function at 0x18e90bc
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x22c8
call fcn.01943ac0
sub rsp, rax
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov rax, rcx
mov qword [rsp + 0x70], rcx
mov ecx, dword [rsp + 0x2310]
mov dword [rsp + 0x90], ecx
xor ebx, ebx
mov rcx, rax
mov dword [rsp + 0x7c], r9d
mov qword [rsp + 0x80], r8
mov rbp, rdx
mov qword [rsp + 0x60], rbx
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9891
cmp word [rbp], 0x7d
je 0x18e988f
mov eax, 1
lea rdx, [0x018e4228]
mov rcx, rbp
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
test eax, eax
lea rdx, [0x018e4250]
mov rcx, rbp
sete dil
mov dword [rsp + 0x68], edi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18e916b
test edi, edi
je 0x18e9233
mov rdi, qword [rsp + 0x70]
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
cmp dword [rsp + 0x7c], 0
je 0x18e9238
movzx eax, word [rbp]
mov rcx, rbp
jmp 0x18e91ab
cmp ax, 0x5c
je 0x18e91b2
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x18e9199
jmp 0x18e91bb
test rcx, rcx
jne 0x18e9805
lea rdi, [0x018e4d90]
mov rdx, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18e9202
lea rax, [0x018e4df0]
add rdi, 8
cmp rdi, rax
jl 0x18e91c2
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
mov rdx, rbp
mov qword [rsp + 0x88], rax
call fcn.018e7cac
cmp dword [rsp + 0x68], 0
mov rdi, qword [rsp + 0x70]
je 0x18e9238
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
mov rdx, rbp
mov rcx, rdi
call fcn.018e8ba8
jmp 0x18e94e8
mov rdi, qword [rsp + 0x70]
lea rdx, [0x018e4238]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18e9265
and dword [rsp + 0x78], eax
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
lea rdx, [0x018e4268]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18e937e
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
cmp word [rbp], 0x3d
jne 0x18e9805
xor esi, esi
cmp dword [rsp + 0x7c], esi
je 0x18e92ef
mov rax, qword [rsp + 0x80]
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x88]
mov r9, rbp
mov rcx, rdi
mov qword [rsp + 0x88], rax
call fcn.018e877c
jmp 0x18e94e8
cmp dword [rsp + 0x2310], esi
jne 0x18e9364
cmp dword [rsp + 0x78], esi
je 0x18e9364
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x68]
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x18e9878
mov rdi, qword [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x18e9351
cmp eax, 2
jne 0x18e981a
cmp rdi, rsi
je 0x18e935f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x70]
mov rdx, rbp
mov rcx, rdi
call fcn.018e8ba8
test eax, eax
mov esi, eax
js 0x18e9881
jmp 0x18e97f5
movzx eax, word [rbp]
mov rcx, rbp
jmp 0x18e9399
cmp ax, 0x5c
je 0x18e93a0
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x18e9387
jmp 0x18e93a9
test rcx, rcx
jne 0x18e9805
cmp dword [rsp + 0x7c], 0
je 0x18e9545
mov rsi, qword [rsp + 0x80]
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov rcx, rsi
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18e9405
test rbx, rbx
je 0x18e93f3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbx
je 0x18e94b4
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18e944a
test rbx, rbx
je 0x18e943c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbx
je 0x18e94b4
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x94]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18e9833
test rbx, rbx
je 0x18e94a2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbx
jne 0x18e9833
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
cmp word [rbp], 0x3d
jne 0x18e94f2
lea rdx, [rsp + 0x60]
mov r9, rbp
xor r8d, r8d
mov rcx, rdi
call fcn.018e877c
mov rbx, qword [rsp + 0x60]
test eax, eax
mov esi, eax
js 0x18e9881
cmp word [rbp], 0x7b
jne 0x18e97f5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x18e97f5
mov r9d, dword [rsp + 0x7c]
and dword [rsp + 0x20], 0
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.018e90bc
test eax, eax
mov esi, eax
js 0x18e9881
mov rdx, rbp
mov rcx, rdi
call fcn.018e8604
jmp 0x18e936f
mov esi, dword [rsp + 0x2310]
test esi, esi
jne 0x18e959c
mov rcx, qword [rsp + 0x80]
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov edi, eax
jne 0x18e95a1
test rbx, rbx
je 0x18e9590
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rbx
jmp 0x18e95a1
mov edi, 2
mov eax, 1
test edi, edi
lea rcx, [rsp + 0xa0]
cmovne esi, eax
mov r8, rbp
mov edx, 0x104
or r9, 0xffffffffffffffff
mov dword [rsp + 0x2310], esi
call sub.msvcrt.dll_wcsncpy_s
test eax, eax
je 0x18e95f3
cmp eax, 0xc
je 0x18e9864
cmp eax, 0x16
je 0x18e9859
cmp eax, 0x22
je 0x18e9859
cmp eax, 0x50
jne 0x18e984e
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.018e8ba8
test eax, eax
mov esi, eax
js 0x18e9881
cmp word [rbp], 0x7b
jne 0x18e9683
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 1
cmp eax, ecx
jne 0x18e9683
mov eax, dword [rsp + 0x2310]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov r8, rbx
mov rdx, rbp
mov dword [rsp + 0x20], eax
call fcn.018e90bc
test eax, eax
mov esi, eax
jns 0x18e966c
cmp dword [rsp + 0x2310], 0
je 0x18e9881
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call fcn.018e8604
test eax, eax
mov esi, eax
js 0x18e9881
cmp edi, 2
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2310], eax
je 0x18e97f5
test edi, edi
je 0x18e96ad
test eax, eax
jne 0x18e97f5
mov ecx, edi
jmp 0x18e987a
xor edi, edi
cmp eax, edi
je 0x18e9761
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x18e9761
cmp dword [rsp + 0x68], edi
mov eax, edi
seta al
cmp eax, edi
je 0x18e9761
lea rdi, [0x018e4d90]
mov rdx, qword [rdi]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18e97f5
lea rax, [0x018e4df0]
add rdi, 8
cmp rdi, rax
jl 0x18e9711
cmp dword [rsp + 0x78], 0
je 0x18e97f5
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.018e7cac
mov rbx, qword [rsp + 0x60]
jmp 0x18e97f5
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x18e97af
cmp dword [rsp + 0x68], edi
seta dil
test rbx, rbx
je 0x18e97cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test eax, eax
mov qword [rsp + 0x60], rbx
jne 0x18e986f
cmp dword [rsp + 0x78], 0
je 0x18e97f5
test edi, edi
jne 0x18e97f5
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x18e9878
cmp word [rbp], 0x7d
je 0x18e9881
jmp 0x18e912a
test rbx, rbx
je 0x18e9813
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x18e9891
mov ecx, eax
call fcn.018e7c98
test rdi, rdi
mov esi, eax
je 0x18e9881
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18e9881
mov ecx, eax
call fcn.018e7c98
test rbx, rbx
mov edi, eax
je 0x18e984a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x18e9891
mov ecx, 0x80004005
call fcn.018e7be8
int3
mov ecx, 0x80070057
call fcn.018e7be8
int3
mov ecx, 0x8007000e
call fcn.018e7be8
int3
mov ecx, eax
call fcn.018e7c98
jmp 0x18e9891
mov ecx, eax
call fcn.018e7c98
mov esi, eax
test rbx, rbx
je 0x18e988f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.018fdad0
add rsp, 0x22c8
pop rdi
pop rsi
pop rbp
pop rbx
ret