Function at 0x180029af0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor esi, esi
mov r14d, r8d
mov qword [rbp - 0x80], rsi
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x180029fb6
mov eax, dword [0x1800bcf60]
cmp dword [rcx], eax
jne 0x180029b65
mov eax, dword [0x1800bcf64]
cmp dword [rcx + 4], eax
jne 0x180029b65
mov eax, dword [0x1800bcf68]
cmp dword [rcx + 8], eax
jne 0x180029b65
mov eax, dword [0x1800bcf6c]
cmp dword [rcx + 0xc], eax
je 0x180029fb6
xor edx, edx
lea rax, [rbp - 0x80]
lea r9, [0x1800ba5f8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800bcf80]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180029fb6
mov ecx, dword [rbx]
test ecx, ecx
je 0x180029bfa
nop word [rax + rax]
mov rax, qword [rbx + 8]
lea r9, [rbp - 0x78]
mov r8d, 1
mov rdx, rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
test r14d, r14d
je 0x180029bdb
cmp ecx, r8d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
jne 0x180029bce
call qword [rax + 0x28]
jmp 0x180029bd1
call qword [rax + 0x38]
test eax, eax
js 0x180029fb8
jmp 0x180029bef
cmp ecx, 1
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
jne 0x180029bec
call qword [rax + 0x30]
jmp 0x180029bef
call qword [rax + 0x40]
mov ecx, dword [rbx + 0x10]
add rbx, 0x10
test ecx, ecx
jne 0x180029ba0
test r14d, r14d
jne 0x180029fba
lea r8d, [r14 + 0x40]
mov rcx, rdi
lea rdx, [rbp + 0xa0]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x180029c24
lea eax, [r14 + 0xd]
jmp 0x180029fb8
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.18008b1e8
test eax, eax
je 0x180029c61
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
lea r8, [rbp + 0xa0]
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.180094ddc
test eax, eax
je 0x180029c9e
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.180094ddc
test eax, eax
je 0x180029cdb
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
mov r9d, 0x20019
mov qword [rsp + 0x68], rsi
lea r8, [rbp - 0x60]
mov qword [rsp + 0x60], rsi
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x78], esi
call fcn.18002a020
test eax, eax
jne 0x180029deb
mov rbx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x180029d6a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
test rdi, rdi
jne 0x180029deb
cmp dword [rsp + 0x78], esi
jne 0x180029deb
cmp byte [0x1800f3f00], sil
jne 0x180029dc4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180029db4
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f3ef8], rax
mov byte [0x1800f3f00], 1
jmp 0x180029dcb
mov rax, qword [0x1800f3ef8]
mov byte [0x1800f3f00], 1
jmp 0x180029dcb
mov rax, qword [0x1800f3ef8]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x180029de5
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180029deb
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.18008b1e8
test eax, eax
je 0x180029e28
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
lea r8, [rbp + 0xa0]
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.180094ddc
test eax, eax
je 0x180029e65
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.180094ddc
test eax, eax
je 0x180029ea2
cmp eax, 0xc
je 0x180029ff2
cmp eax, 0x16
je 0x18002a008
cmp eax, 0x22
je 0x18002a008
cmp eax, 0x50
jne 0x180029ffd
mov r9d, 0x20019
lea r8, [rbp - 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x60]
call fcn.18002a020
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x180029f99
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x38], rsi
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsxd rdi, eax
test rbx, rbx
je 0x180029f1c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
test rdi, rdi
jne 0x180029f99
cmp dword [rsp + 0x78], esi
jne 0x180029f99
cmp byte [0x1800f3f00], sil
jne 0x180029f72
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180029f62
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f3ef8], rax
mov byte [0x1800f3f00], 1
jmp 0x180029f79
mov rax, qword [0x1800f3ef8]
mov byte [0x1800f3f00], 1
jmp 0x180029f79
mov rax, qword [0x1800f3ef8]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000000
test rax, rax
je 0x180029f93
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x180029f99
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x180029fa7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180029fba
mov eax, esi
mov esi, eax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180029fc9
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180067630
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180005ca0
int3
mov ecx, 0x80004005
call fcn.180005ca0
int3
mov ecx, 0x80070057
call fcn.180005ca0
int3