Function at 0x180019d70
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x408]
sub rsp, 0x500
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x18005c800]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.18001e750
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.18001e750
lea rbx, str.WanNengZip
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 1
lea r8, str._shellexContextMenuHandlers_
lea rdx, str._s_c_c_c_c_s
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 1
lea r8, str._shellexDragDropHandlers_
lea rdx, str._s_c_c_c_c_s
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp - 0x58], 7
xor esi, esi
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x70], si
lea r8d, [rsi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x70]
call fcn.180002540
nop
lea r8d, [rsi + 0x26]
lea rdx, str.3D28BC15_93A7_4112_9320_17CBCAB64250
lea rcx, [rbp - 0x70]
call fcn.180008dd0
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.180002400
nop
lea r8d, [rsi + 0xf]
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x70]
call fcn.180008dd0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180019f46
lea rdx, str.3D28BC15_93A7_4112_9320_17CBCAB64250
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1800192e0
mov rdi, rax
mov rbx, qword [rax]
movabs r14, 0x7fffffffffffffff
cmp rbx, qword [rax + 8]
je 0x18001a185
cmp qword [rbx + 0x18], 8
jb 0x180019f71
mov rdx, qword [rbx]
jmp 0x180019f74
mov rdx, rbx
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
cmp word [rdx], 0
jne 0x180019f8f
mov r8, rsi
jmp 0x180019f9e
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180019f93
lea rcx, [rbp - 0x50]
call fcn.180002540
nop
cmp word [rbp - 0x30], 0
jne 0x180019fb4
mov r8, rsi
jmp 0x180019fcb
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180019fc0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.180008dd0
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x180019fff
mov rdx, qword [rbx]
jmp 0x18001a002
mov rdx, rbx
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
cmp word [rdx], 0
jne 0x18001a020
mov r8, rsi
jmp 0x18001a02f
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18001a024
lea rcx, [rsp + 0x50]
call fcn.180002540
nop
cmp word [rbp + 0x1e0], 0
jne 0x18001a049
mov r8, rsi
jmp 0x18001a05f
lea rax, [rbp + 0x1e0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001a054
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x50]
call fcn.180008dd0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x18001a0e3
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, r14
ja 0x18001a161
add rax, rax
cmp rax, 0x1000
jb 0x18001a0de
test cl, 0x1f
jne 0x18001a15b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18001a155
sub rcx, rax
cmp rcx, 8
jb 0x18001a14f
cmp rcx, 0x27
ja 0x18001a149
mov rcx, rax
call fcn.18001c7b4
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
mov rax, qword [rbp - 0x38]
cmp rax, 8
jb 0x18001a13c
inc rax
mov rcx, qword [rbp - 0x50]
cmp rax, r14
ja 0x18001a17f
add rax, rax
cmp rax, 0x1000
jb 0x18001a137
test cl, 0x1f
jne 0x18001a179
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18001a173
sub rcx, rax
cmp rcx, 8
jb 0x18001a16d
cmp rcx, 0x27
ja 0x18001a167
mov rcx, rax
call fcn.18001c7b4
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jmp 0x180019f5f
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
nop
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
int3
call fcn.180020dd4
nop
mov rax, qword [rbp - 0x78]
cmp rax, 8
jb 0x18001a1ec
inc rax
mov rcx, qword [rsp + 0x70]
cmp rax, r14
jbe 0x18001a1a2
call fcn.180020dd4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18001a1e7
test byte [rsp + 0x70], 0x1f
je 0x18001a1ba
call fcn.180020dd4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001a1c9
call fcn.180020dd4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001a1d8
call fcn.180020dd4
int3
cmp rcx, 0x27
jbe 0x18001a1e4
call fcn.180020dd4
int3
mov rcx, rax
call fcn.18001c7b4
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
mov rax, qword [rbp - 0x58]
cmp rax, 8
jb 0x18001a262
inc rax
mov rcx, qword [rbp - 0x70]
cmp rax, r14
jbe 0x18001a219
call fcn.180020dd4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18001a25d
test byte [rbp - 0x70], 0x1f
je 0x18001a230
call fcn.180020dd4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001a23f
call fcn.180020dd4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001a24e
call fcn.180020dd4
int3
cmp rcx, 0x27
jbe 0x18001a25a
call fcn.180020dd4
int3
mov rcx, rax
call fcn.18001c7b4
mov eax, 1
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.18001c850
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret