Function at 0x18000c060
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3f8]
sub rsp, 0x4f0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x18003d080]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.1800113a0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1d0]
call fcn.1800113a0
lea r9, str.JiJianFormwork
lea r8, str._shellexContextMenuHandlers_
lea rdx, str._s_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.JiJianFormwork
lea r8, str._shellexDragDropHandlers_
lea rdx, str._s_s
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp - 0x68], 7
xor esi, esi
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
lea r8d, [rsi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x80]
call fcn.1800017a0
nop
lea r8d, [rsi + 0x26]
lea rdx, str.1BA2C45C_D06A_4E15_9603_876398D0A097
lea rcx, [rbp - 0x80]
call fcn.180004c30
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180001660
nop
lea r8d, [rsi + 0xf]
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x60]
call fcn.180004c30
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000c1fa
lea rdx, str.1BA2C45C_D06A_4E15_9603_876398D0A097
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.18000b600
mov rdi, rax
mov rbx, qword [rax]
movabs r14, 0x7fffffffffffffff
cmp rbx, qword [rax + 8]
je 0x18000c445
cmp qword [rbx + 0x18], 8
jb 0x18000c225
mov rdx, qword [rbx]
jmp 0x18000c228
mov rdx, rbx
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
cmp word [rdx], 0
jne 0x18000c243
mov r8, rsi
jmp 0x18000c25b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000c250
lea rcx, [rbp - 0x60]
call fcn.1800017a0
nop
cmp word [rbp - 0x40], 0
jne 0x18000c271
mov r8, rsi
jmp 0x18000c28b
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000c280
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.180004c30
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x18000c2bf
mov rdx, qword [rbx]
jmp 0x18000c2c2
mov rdx, rbx
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp word [rdx], 0
jne 0x18000c2e0
mov r8, rsi
jmp 0x18000c2ef
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000c2e4
lea rcx, [rsp + 0x40]
call fcn.1800017a0
nop
cmp word [rbp + 0x1d0], 0
jne 0x18000c309
mov r8, rsi
jmp 0x18000c31f
lea rax, [rbp + 0x1d0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000c314
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x40]
call fcn.180004c30
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x18000c3a3
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, r14
ja 0x18000c421
add rax, rax
cmp rax, 0x1000
jb 0x18000c39e
test cl, 0x1f
jne 0x18000c41b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000c415
sub rcx, rax
cmp rcx, 8
jb 0x18000c40f
cmp rcx, 0x27
ja 0x18000c409
mov rcx, rax
call fcn.18000f57c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x18000c3fc
inc rax
mov rcx, qword [rbp - 0x60]
cmp rax, r14
ja 0x18000c43f
add rax, rax
cmp rax, 0x1000
jb 0x18000c3f7
test cl, 0x1f
jne 0x18000c439
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000c433
sub rcx, rax
cmp rcx, 8
jb 0x18000c42d
cmp rcx, 0x27
ja 0x18000c427
mov rcx, rax
call fcn.18000f57c
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jmp 0x18000c213
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
nop
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
int3
call fcn.180013ba4
nop
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x18000c4ad
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, r14
jbe 0x18000c463
call fcn.180013ba4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000c4a8
test byte [rsp + 0x60], 0x1f
je 0x18000c47b
call fcn.180013ba4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000c48a
call fcn.180013ba4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000c499
call fcn.180013ba4
int3
cmp rcx, 0x27
jbe 0x18000c4a5
call fcn.180013ba4
int3
mov rcx, rax
call fcn.18000f57c
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x18000c525
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, r14
jbe 0x18000c4dc
call fcn.180013ba4
int3
add rax, rax
cmp rax, 0x1000
jb 0x18000c520
test byte [rbp - 0x80], 0x1f
je 0x18000c4f3
call fcn.180013ba4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000c502
call fcn.180013ba4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000c511
call fcn.180013ba4
int3
cmp rcx, 0x27
jbe 0x18000c51d
call fcn.180013ba4
int3
mov rcx, rax
call fcn.18000f57c
mov eax, 1
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.18000f690
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret