Function at 0x180013f20
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [0x1800ae370]
mov edx, 1
call fcn.180015300
mov edi, eax
test eax, eax
js 0x18001440b
mov qword [rsp + 0xe0], rbx
lea rax, [rsp + 0x38]
lea rdx, str._shellexContextMenuHandlers_
mov qword [rsp + 0xe8], rsi
xor esi, esi
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov rbx, rsi
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800140c5
mov rbx, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
je 0x180013fbe
cmp eax, 2
jne 0x180014371
cmp byte [0x1800ae3c0], sil
jne 0x180014009
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180013ff9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x180014010
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x180014010
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x180014029
lea rdx, [0x18008a558]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
jmp 0x180014039
lea rdx, [0x18008a558]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp byte [0x1800ae3c0], sil
jne 0x180014084
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180014074
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x18001408b
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x18001408b
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x1800140a6
lea rdx, [0x18008a578]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
mov edi, eax
jmp 0x1800140b8
lea rdx, [0x18008a578]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x1800140c5
cmp edi, 2
jne 0x180014371
lea rax, [rsp + 0x48]
lea rdx, str.directory_shellexContextMenuHandlers_
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001421d
mov eax, esi
test rbx, rbx
je 0x180014109
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x18001421d
cmp byte [0x1800ae3c0], sil
jne 0x180014161
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180014151
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x180014168
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x180014168
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x180014181
lea rdx, [0x18008a5f0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
jmp 0x180014191
lea rdx, [0x18008a5f0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp byte [0x1800ae3c0], sil
jne 0x1800141dc
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800141cc
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x1800141e3
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x1800141e3
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x1800141fe
lea rdx, [0x18008a610]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
mov edi, eax
jmp 0x180014210
lea rdx, [0x18008a610]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x18001421d
cmp edi, 2
jne 0x180014371
lea rax, [rsp + 0x30]
lea rdx, [0x18008a630]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180014376
mov eax, esi
test rbx, rbx
je 0x180014261
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x180014376
cmp byte [0x1800ae3c0], sil
jne 0x1800142b9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800142a9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x1800142c0
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x1800142c0
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x1800142d9
lea rdx, str.KuaiyaShlExt
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
jmp 0x1800142e9
lea rdx, str.KuaiyaShlExt
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp byte [0x1800ae3c0], sil
jne 0x180014334
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180014324
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x18001433b
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x18001433b
mov rax, qword [0x1800ae3b8]
test rax, rax
je 0x180014356
lea rdx, str.KuaiZipShlExt
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rax
mov edi, eax
jmp 0x180014368
lea rdx, str.KuaiZipShlExt
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x180014376
cmp edi, 2
je 0x180014376
test rbx, rbx
jmp 0x1800143ee
lea rdx, [rsp + 0x50]
lea rcx, [0x18008be48]
mov r8d, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.ole32.dll_StringFromGUID2]
call qword [sym.imp.KERNEL32.dll_GetVersion]
bt eax, 0x1f
jb 0x1800143eb
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800143eb
mov rsi, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rsi, rsi
je 0x1800143eb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x1800143f9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov eax, edi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18005f4d0
add rsp, 0xd0
pop rdi
ret