Function at 0x1800082b0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x22e8
call fcn.180020cd0
sub rsp, rax
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov rax, qword [0x18002fa78]
xor rax, rsp
mov qword [rsp + 0x22d0], rax
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x78], r8
mov rsi, rdx
mov rax, rcx
mov qword [rsp + 0x58], rcx
xor ebp, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], ebp
mov ecx, dword [rsp + 0x2330]
mov dword [rsp + 0x90], ecx
mov rcx, rax
call fcn.180006390
mov ebx, eax
test eax, eax
jns 0x180008321
jmp 0x180008bae
cmp word [rsi], 0x7d
je 0x180008b9e
nop dword [rax + rax]
mov dword [rsp + 0x50], 1
lea rdx, str.Delete
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
test eax, eax
sete dil
lea rdx, str.ForceRemove
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000836c
test edi, edi
je 0x18000848d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
cmp dword [rsp + 0x60], 0
je 0x18000848d
xor eax, eax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], eax
mov rcx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x1800083d2
nop word [rax + rax]
cmp ax, 0x5c
je 0x1800083c9
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x1800083b0
jmp 0x1800083d2
test rcx, rcx
jne 0x180008a9f
lea rbx, str.AppID
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000843f
add rbx, 8
lea rax, [0x180024ce0]
cmp rbx, rax
jl 0x1800083e0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.180006710
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
test edi, edi
je 0x180008482
mov rdx, rsi
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
mov rdx, rsi
mov rcx, rdi
call fcn.1800065c0
mov ebx, eax
test eax, eax
js 0x180008b9e
mov dword [rsp + 0x88], 0
jmp 0x180008791
mov dword [rsp + 0x88], 0
lea rdx, str.NoRemove
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800084c0
xor edi, edi
mov dword [rsp + 0x50], edi
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
jmp 0x1800084c4
mov edi, dword [rsp + 0x50]
lea rdx, [0x180024c20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18000860b
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
cmp word [rsi], 0x3d
jne 0x180008afa
cmp dword [rsp + 0x60], 0
je 0x18000857f
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0
mov r9, rsi
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0xa0]
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.180007e20
mov ebx, eax
xor eax, eax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], eax
test ebx, ebx
js 0x180008ab7
mov dword [rsp + 0xa8], eax
jmp 0x180008791
cmp dword [rsp + 0x2330], 0
jne 0x1800085ef
test edi, edi
je 0x1800085ef
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180008aec
mov rdi, qword [rsp + 0x50]
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1800085e1
cmp eax, 2
jne 0x180008acc
test rdi, rdi
je 0x1800085ef
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.1800065c0
mov ebx, eax
test eax, eax
js 0x180008b9e
jmp 0x180008a90
mov rcx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x180008638
cmp ax, 0x5c
je 0x18000862f
call qword [sym.imp.USER32.dll_CharNextW]
mov rcx, rax
mov ax, word [rax]
test ax, ax
jne 0x180008616
jmp 0x180008638
test rcx, rcx
jne 0x180008b12
cmp dword [rsp + 0x60], 0
je 0x1800087ec
xor edi, edi
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rsi
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180008698
mov eax, edi
test rbp, rbp
je 0x180008682
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x50]
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], edi
test eax, eax
je 0x18000874f
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800086e2
mov eax, edi
test rbp, rbp
je 0x1800086d0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x50]
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], edi
test eax, eax
je 0x18000874f
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180008b31
mov eax, edi
test rbp, rbp
je 0x180008739
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x50]
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], edi
test eax, eax
jne 0x180008b31
mov rdx, rsi
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
cmp word [rsi], 0x3d
jne 0x180008791
mov r9, rsi
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180007e20
mov ebx, eax
test eax, eax
js 0x180008b2a
mov rbp, qword [rsp + 0x68]
cmp word [rsi], 0x7b
jne 0x180008a90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x180008a90
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x60]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.1800082b0
mov ebx, eax
test eax, eax
js 0x180008b9e
mov rdx, rsi
mov rcx, rdi
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
jmp 0x180008a90
cmp dword [rsp + 0x2330], 0
jne 0x180008853
xor ebx, ebx
mov qword [rsp + 0x98], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x18000884d
mov edi, ebx
test rbp, rbp
je 0x18000883c
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], ebx
test edi, edi
je 0x180008863
jmp 0x180008858
mov edi, 2
mov dword [rsp + 0x2330], 1
or r9, 0xffffffffffffffff
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.180013ab0
test eax, eax
je 0x1800088a4
cmp eax, 0xc
je 0x180008b62
cmp eax, 0x16
je 0x180008b57
cmp eax, 0x22
je 0x180008b57
cmp eax, 0x50
jne 0x180008b4c
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.1800065c0
mov ebx, eax
test eax, eax
js 0x180008b9e
cmp word [rsi], 0x7b
jne 0x18000892f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x18000892f
mov eax, dword [rsp + 0x2330]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbp
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.1800082b0
mov ebx, eax
test eax, eax
jns 0x180008918
cmp dword [rsp + 0x2330], 0
je 0x180008b9e
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.180006390
mov ebx, eax
test eax, eax
js 0x180008b9e
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x2330], eax
cmp edi, 2
je 0x180008a90
test edi, edi
je 0x180008957
test eax, eax
je 0x180008b6d
jmp 0x180008a90
test eax, eax
je 0x1800089c4
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call fcn.180006550
test eax, eax
je 0x1800089c4
lea rdi, str.AppID
mov rdx, qword [rdi]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180008a90
add rdi, 8
lea rax, [0x180024ce0]
cmp rdi, rax
jl 0x180008973
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180008a90
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.180006710
mov rbp, qword [rsp + 0x68]
jmp 0x180008a90
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call fcn.180006550
mov edi, eax
xor eax, eax
test rbp, rbp
je 0x1800089ea
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], 0
test eax, eax
jne 0x180008b83
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180008a90
test edi, edi
jne 0x180008a90
cmp byte [0x180031070], dil
jne 0x180008a52
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008a42
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180031068], rax
jmp 0x180008a49
mov rax, qword [0x180031068]
mov byte [0x180031070], 1
jmp 0x180008a59
mov rax, qword [0x180031068]
test rax, rax
je 0x180008a75
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
call rax
jmp 0x180008a88
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x180008b78
cmp word [rsi], 0x7d
je 0x180008b9e
jmp 0x180008330
test rbp, rbp
je 0x180008aad
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x180008bae
test rbp, rbp
je 0x180008ac5
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180008bae
mov ecx, eax
call fcn.180005ec0
mov ebx, eax
test rdi, rdi
je 0x180008b9e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180008b9e
mov ecx, eax
call fcn.180005ec0
mov ebx, eax
jmp 0x180008b9e
test rbp, rbp
je 0x180008b08
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x180008bae
test rbp, rbp
je 0x180008b20
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80020009
jmp 0x180008bae
mov rbp, qword [rsp + 0x68]
jmp 0x180008b9e
mov ecx, eax
call fcn.180005ec0
mov ebx, eax
test rbp, rbp
je 0x180008b48
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180008bae
mov ecx, 0x80004005
call fcn.180001000
int3
mov ecx, 0x80070057
call fcn.180001000
int3
mov ecx, 0x8007000e
call fcn.180001000
int3
mov ecx, edi
call fcn.180005ec0
mov ebx, eax
jmp 0x180008b9e
mov ecx, eax
call fcn.180005ec0
mov ebx, eax
jmp 0x180008b9e
mov ecx, eax
call fcn.180005ec0
mov ebx, eax
test rbp, rbp
je 0x180008b9a
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180008bae
test rbp, rbp
je 0x180008bac
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x22d0]
xor rcx, rsp
call fcn.1800134f0
add rsp, 0x22e8
pop rdi
pop rsi
pop rbp
pop rbx
ret