Function at 0x180004f30
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov r12d, ecx
xor r13d, r13d
mov dword [rbp + 0x6f], r13d
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x180005643
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000564e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x69], rax
mov dword [rbp + 0x77], r13d
xor r9d, r9d
lea r8, [rbp + 0x77]
xor edx, edx
xor ecx, ecx
call fcn.180002d20
call fcn.180002c40
mov rcx, rax
cmp dword [rbp + 0x77], r13d
je 0x180005019
test rax, rax
je 0x180005659
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rdx, str.CouponExtern64.dll
lea rdi, [r13 - 1]
cmp rdx, 0x10000
jae 0x180004ffb
movzx edx, dx
lea rcx, [rbp + 0x7f]
call fcn.180004270
jmp 0x180005017
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x180005000
mov r8d, eax
lea rcx, [rbp + 0x7f]
call fcn.1800056c0
nop
jmp 0x180005077
test rax, rax
je 0x180005664
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rdx, [0x180021a30]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x180005055
movzx edx, dx
lea rcx, [rbp + 0x7f]
call fcn.180004270
jmp 0x180005077
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x180005060
mov r8d, eax
lea rcx, [rbp + 0x7f]
call fcn.1800056c0
nop
mov dword [rbp + 0x6f], 1
lea rcx, [rbp + 0x17]
call fcn.1800028b0
nop
lea r8, [rbp + 0x7f]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.1800013d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1800050f0
cmp dword [rbx + 0x10], 0
jl 0x1800050e2
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1800050e2
call fcn.180001750
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1800050d8
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x61], rax
jmp 0x1800050f0
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x61]
call fcn.1800056c0
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000510e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000512c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180005149
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000566f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
lea rdx, str.CLSID_
cmp rdx, 0x10000
jae 0x180005186
movzx edx, dx
lea rcx, [rbp - 0x59]
call fcn.180004270
jmp 0x1800051a7
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x180005190
mov r8d, eax
lea rcx, [rbp - 0x59]
call fcn.1800056c0
nop
mov rsi, qword [section..data]
mov rbx, qword [rbp - 0x59]
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x1800051cc
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1800051dd
call fcn.180002c40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x18000567a
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov dword [rbp + 0x6f], 3
test rsi, rsi
jne 0x180005205
mov eax, r13d
jmp 0x18000521a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x180005210
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1800017e0
mov rdx, qword [rbp - 0x51]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x69]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x18000528f
cmp dword [rsi + 0x10], 0
jl 0x180005282
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x180005282
mov rcx, rbx
call fcn.180001750
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x180005278
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x69], rax
jmp 0x18000528f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x69]
call fcn.1800056c0
mov dword [rbp + 0x6f], 1
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1800052af
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1800052c8
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
test r12d, r12d
je 0x1800054f7
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], r13d
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov dword [rbp - 0x19], r13d
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov dword [rbp - 1], r13d
mov qword [rbp + 7], r13
mov r9d, 0xf013f
mov rbx, qword [rbp - 0x69]
mov r8, rbx
mov rdx, 0xffffffff80000000
lea rcx, [rbp - 0x39]
call fcn.180004bd0
test eax, eax
je 0x180005350
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffff80000000
lea rcx, [rbp - 0x39]
call fcn.1800018b0
test eax, eax
je 0x180005350
mov r14, qword [rbp - 0x39]
jmp 0x1800054b2
mov dword [rsp + 0x28], 0x1a
lea r15, [0x180021be8]
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov r14, qword [rbp - 0x39]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r9d, 0xf013f
lea r8, str.InprocServer32
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.180004bd0
test eax, eax
je 0x1800053d3
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.InprocServer32
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.1800018b0
test eax, eax
je 0x1800053d3
mov rsi, qword [rbp - 0x21]
jmp 0x1800054a4
mov rsi, qword [rbp - 0x21]
mov rax, qword [rbp - 0x61]
test rax, rax
je 0x180005412
mov rcx, rdi
lea rcx, [rcx + 1]
cmp word [rax + rcx*2], 0
jne 0x1800053e3
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 0x14
lea rax, str.Apartment
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r9d, 0xf013f
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.180004bd0
test eax, eax
je 0x1800054c3
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.1800018b0
test eax, eax
je 0x1800054c3
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1800054a4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x1800054b2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x1800055e8
mov rcx, r14
jmp 0x1800055e1
mov dword [rsp + 0x28], 0x1a
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, qword [section..data]
mov r15, qword [rbp - 9]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r15, r15
je 0x1800054a4
mov rcx, r15
jmp 0x18000549e
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x180005512
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x180005523
call fcn.180002c40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180005638
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
mov dword [rbp + 0x6f], 5
mov dword [rsp + 0x20], 0xe
lea r9, str.InprocServer32
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1800017e0
mov rbx, qword [rbp - 0x49]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000558e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x69]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800055e8
mov rdx, qword [section..data]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180005602
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18000561d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
int3
mov ecx, 0x80004005
call fcn.1800016f0
int3
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
int3