Function at 0x180004b50
Capabilities:
Delete registry value
Query or enumerate registry value
Read file via mapping

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rdx, qword [0x180023be0]
xor r15d, r15d
lea r8, [rax - 0x58]
mov rcx, 0xffffffff80000001
mov r13d, r15d
mov dword [rax + 8], r15d
mov dword [rax + 0x18], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
cmp eax, r15d
jne 0x180004e38
mov rcx, qword [0x180023a50]
lea r8d, [r15 + 0x13]
xor edx, edx
lea ebx, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, r15
je 0x180004e2d
mov rcx, qword [0x180023a50]
xor edx, edx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r15
je 0x180004e1b
mov sil, byte [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov r8, rbp
mov edx, r13d
mov dword [rsp + 0xb0], 0x13
mov dword [rsp + 0xa0], 0x105
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
cmp eax, 0xea
je 0x180004dc6
cmp eax, r15d
jne 0x180004dba
mov r8d, dword [0x180023ab4]
mov edx, dword [rsp + 0xa0]
xor r9d, r9d
mov rcx, rdi
call fcn.18001800c
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180006634
cmp eax, r15d
jne 0x180004c84
inc r13d
jmp 0x180004d9f
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea edx, [r9 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
cmp rax, r15
je 0x180004d9f
mov ecx, dword [rsp + 0xb0]
lea r12, [rsp + 0xa8]
lea rbx, [rcx + rbp - 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r11d, eax
cmp eax, r15d
je 0x180004d1e
mov cl, byte [rbx]
sub cl, 0x30
cmp cl, 9
jbe 0x180004cfc
mov al, byte [rbx]
sub al, 0x41
cmp al, 5
ja 0x180004cef
mov cl, byte [rbx]
sub cl, 0x37
jmp 0x180004cfc
mov al, byte [rbx]
sub al, 0x61
cmp al, 5
ja 0x180004d1e
mov cl, byte [rbx]
sub cl, 0x57
test r11b, 1
je 0x180004d0e
add sil, cl
mov byte [r12], sil
inc r12
jmp 0x180004d15
mov sil, cl
shl sil, 4
inc rbx
add r11d, 0xffffffff
jne 0x180004cd6
mov eax, dword [rsp + 0xa8]
mov ecx, 2
cmp eax, r15d
cmove eax, ecx
mov rcx, rdi
mov dword [rsp + 0xa8], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rdi
inc eax
mov rcx, rdi
movsxd r8, eax
call qword [sym.imp.ntdll.dll_wcstombs]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8d, dword [rsp + 0xa8]
mov edx, dword [rsp + 0xb8]
mov r9, rax
mov rcx, r14
mov dword [rsp + 0x20], 1
call fcn.180004504
mov ebx, eax
cmp eax, r15d
jne 0x180004d91
mov rcx, qword [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp ebx, r15d
jne 0x180004dba
mov rcx, qword [0x180023c48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180004e09
jmp 0x180004be0
cmp ebx, 0x103
cmove ebx, r15d
jmp 0x180004e09
cmp dword [rsp + 0xb0], 0x13
ja 0x180004e09
cmp dword [rsp + 0xa0], 0x105
jbe 0x180004e09
mov rcx, qword [0x180023a50]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rsp + 0xa0]
mov rcx, qword [0x180023a50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, qword [0x180023a50]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180023a50]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x120
call fcn.18000c050
test byte [0x1800233e4], 4
je 0x180004e8e
xor r9d, r9d
lea rax, [0x180025488]
mov r8d, 0x10000
lea edx, [r9 + 0xb]
mov ecx, 0x112
mov qword [rsp + 0x20], rax
call fcn.180003804
add rsp, 0x38
jmp 0x180004b50