Function at 0x18002ed50
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x300
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov byte [rsp + 0x40], r9b
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x58], rcx
call fcn.18002de60
test rax, rax
je 0x18002f1fe
cmp qword [rbx + 0x18], 8
jb 0x18002edab
mov rdx, qword [rbx]
jmp 0x18002edae
mov rdx, rbx
mov edi, dword [rsp + 0x340]
mov r9d, edi
or r9d, 2
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
call rax
test eax, eax
jne 0x18002f1fe
call fcn.18002e130
mov qword [rsp + 0x70], rax
xor bl, bl
cmp byte [rsp + 0x40], bl
je 0x18002f202
test rax, rax
je 0x18002ee14
cmp qword [rsi + 0x18], 8
jb 0x18002ee02
mov rdx, qword [rsi]
jmp 0x18002ee05
mov rdx, rsi
xor r9d, r9d
mov r8d, edi
mov rcx, qword [rsp + 0x48]
call rax
jmp 0x18002ee2e
cmp qword [rsi + 0x18], 8
jb 0x18002ee20
mov rdx, qword [rsi]
jmp 0x18002ee23
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x18002ee39
mov al, 1
jmp 0x18002f234
cmp qword [rsi + 0x18], 8
jb 0x18002ee45
mov rdx, qword [rsi]
jmp 0x18002ee48
mov rdx, rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002ee75
cmp eax, 2
sete al
jmp 0x18002f234
xor edi, edi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0xa0]
call fcn.1800165a0
nop
lea r11d, [rdi + 1]
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x18002efb7
cmp r8, 0xffffffffffffffff
jbe 0x18002eedc
or rcx, 0xffffffffffffffff
jmp 0x18002eee0
lea rcx, [r8 - 1]
lea rax, [rsp + 0xa0]
mov r9, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
cmp r10, 8
cmovae rax, r9
lea rbx, [rax + rcx*2]
mov qword [rsp + 0x68], rbx
nop dword [rax]
test r11, r11
je 0x18002ef6b
mov rcx, r11
mov qword [rsp + 0x78], rcx
lea rdx, [0x180100a48]
mov qword [rsp + 0x90], rdx
nop dword [rax]
test rcx, rcx
je 0x18002ef6b
movzx eax, word [rbx]
cmp word [rdx], ax
je 0x18002ef53
add rdx, 2
mov qword [rsp + 0x90], rdx
dec rcx
mov qword [rsp + 0x78], rcx
jmp 0x18002ef30
lea rax, [rsp + 0xa0]
cmp r10, 8
cmovae rax, r9
sub rbx, rax
sar rbx, 1
jmp 0x18002efbb
lea rcx, [rsp + 0xa0]
call fcn.180013890
cmp rbx, rax
je 0x18002efa9
sub rbx, 2
mov qword [rsp + 0x68], rbx
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r11d, 1
jmp 0x18002ef10
mov r8, qword [rsp + 0xb0]
mov r11d, 1
or rbx, 0xffffffffffffffff
lea rax, [r8 - 1]
cmp rbx, rax
je 0x18002efdc
mov r8, r11
lea rdx, [0x180100a48]
lea rcx, [rsp + 0xa0]
call fcn.180016430
nop
mov dword [rsp + 0x50], 0x104
mov word [rsp + 0xe0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xe2]
call fcn.1800b6c70
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xe0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18002f13d
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xc0]
call fcn.180019600
nop
mov ebx, dword [rsp + 0x340]
mov dword [rsp + 0x20], ebx
movzx r9d, byte [rsp + 0x40]
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call fcn.18002ed50
test al, al
je 0x18002f107
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xe0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp qword [rsp + 0xd8], 8
jb 0x18002f0e4
mov rcx, qword [rsp + 0xc0]
call fcn.1800b5700
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], rdi
mov word [rsp + 0xc0], di
test ebx, ebx
jmp 0x18002f039
cmp qword [rsp + 0xd8], 8
jb 0x18002f11f
mov rcx, qword [rsp + 0xc0]
call fcn.1800b5700
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], rdi
mov word [rsp + 0xc0], di
jmp 0x18002f144
mov ebx, dword [rsp + 0x340]
cmp qword [rsp + 0xb8], 8
jb 0x18002f15c
mov rcx, qword [rsp + 0xa0]
call fcn.1800b5700
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
cmp byte [rsp + 0x40], 0
je 0x18002f21e
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18002f1a9
cmp qword [rsi + 0x18], 8
jb 0x18002f197
mov rsi, qword [rsi]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call rax
jmp 0x18002f1c1
cmp qword [rsi + 0x18], 8
jb 0x18002f1b3
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
jmp 0x18002f220
xor al, al
jmp 0x18002f234
cmp qword [rsi + 0x18], 8
jb 0x18002f20c
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x18002f220
xor bl, bl
call fcn.18002df80
test rax, rax
je 0x18002f1fe
mov rcx, qword [rsp + 0x48]
call rax
movzx eax, bl
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.1800b6c40
add rsp, 0x300
pop rdi
pop rsi
pop rbx
ret