Function at 0x18000fef0
Capabilities:
Delete file
Delete registry value
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1cd0
call fcn.18003e310
sub rsp, rax
mov rax, qword [0x18005a960]
xor rax, rsp
mov qword [rsp + 0x1cc0], rax
xor edi, edi
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x60], di
call fcn.180026a20
xor eax, eax
lea rcx, [rsp + 0x862]
xor edx, edx
mov r8d, 0xa28
mov dword [rsp + 0x48], 0x400
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x860], di
call fcn.180026a20
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 0x515
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1800100f7
mov ebx, edi
xor edx, edx
jmp 0x1800100b3
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x180010077
lea rcx, [rsp + 0x1292]
xor edx, edx
mov r8d, 0xa28
mov word [rsp + 0x1290], di
call fcn.180026a20
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x4c]
lea rax, [rsp + 0x1290]
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x18001006c
mov eax, dword [rsp + 0x4c]
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0x1290]
mov r8d, 0x515
mov word [rsp + rax*2 + 0x1290], di
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jbe 0x18001006c
lea rdx, str.Local_SettingsApplication_DataMicrosoftOutlookextend.dat
lea rcx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x800
mov dword [rsp + 0x48], 0x400
call fcn.180026a20
lea rcx, [rsp + 0x860]
xor edx, edx
mov r8d, 0xa2a
mov dword [rsp + 0x4c], 0x515
call fcn.180026a20
add ebx, 1
mov edx, ebx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov rcx, qword [rsp + 0x40]
jne 0x18000ffa7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftExchangeClientExtensions
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x18001014f
mov rcx, qword [rsp + 0x40]
lea rdx, str.Outlook_AddIns
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001015d
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1cc0]
xor rcx, rsp
call fcn.180026960
mov rbx, qword [rsp + 0x1ce0]
add rsp, 0x1cd0
pop rdi
ret