Function at 0x180012060
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov qword [rsp + 0x308], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbp, rcx
xor sil, sil
lea r9, str.dlpApps
lea r8, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x378]
call fcn.180034278
cmp qword [rax + 0x18], 5
seta r12b
mov byte [rsp + 0x30], r12b
cmp qword [rsp + 0x140], 8
jb 0x1800120ea
mov rcx, qword [rsp + 0x128]
call fcn.18006e998
lea r8, str.dlpApps
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rcx, [rsp + 0x158]
call fcn.1800031d0
nop
lea rcx, [0x1800bfc30]
cmp rcx, rax
je 0x180012128
mov rdx, rax
call fcn.180004090
nop
xor r13d, r13d
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x180012189
mov rdi, qword [rsp + 0x178]
cmp rcx, rdi
je 0x180012184
lea rbx, [rcx + 0x20]
nop dword [rax]
cmp qword [rbx], 8
jb 0x18001215f
mov rcx, qword [rbx - 0x18]
call fcn.18006e998
mov qword [rbx], 7
mov qword [rbx - 8], r13
mov word [rbx - 0x18], r13w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x180012150
mov rcx, qword [rsp + 0x170]
call fcn.18006e998
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], r13
mov rcx, qword [rsp + 0x158]
call fcn.18006e998
mov ecx, 8
call fcn.18006ea94
test rax, rax
je 0x1800121ca
lea rcx, [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x1800121cd
mov rax, r13
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.18001d360
mov qword [rsp + 0x110], rax
mov byte [rax + 0x79], 1
mov rax, qword [rsp + 0x110]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x110]
mov qword [rax], rax
mov rax, qword [rsp + 0x110]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x118], r13
mov ecx, 8
call fcn.18006ea94
test rax, rax
je 0x180012235
lea rcx, [rsp + 0x190]
mov qword [rax], rcx
jmp 0x180012238
mov rax, r13
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x190]
call fcn.180007350
mov qword [rsp + 0x1c0], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x1c0]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rax], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x1c8], r13
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call fcn.180011480
test eax, eax
jne 0x1800123e0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x190]
mov qword [rsp + 0x80], rcx
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xa0], xmm1
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x190]
call fcn.180007120
mov rcx, qword [rsp + 0x1c0]
call fcn.18006e998
mov qword [rsp + 0x1c0], r13
mov qword [rsp + 0x1c8], r13
mov rcx, qword [rsp + 0x190]
call fcn.18006e998
nop
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x80], rcx
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xa0], xmm1
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xe0]
call fcn.18001bd70
mov rcx, qword [rsp + 0x110]
call fcn.18006e998
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r13
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
jmp 0x180013901
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xb0]
call fcn.180003230
nop
mov rcx, qword [rsp + 0xd0]
sub rcx, qword [rsp + 0xc8]
movabs rax, 0x572620ae4c415c99
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x1800125d6
lea rcx, str.apps_query_from_das_empty_
call fcn.18002f34c
nop
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
je 0x180012474
mov rdi, qword [rsp + 0xd0]
cmp rbx, rdi
je 0x18001246c
nop
mov rcx, rbx
call fcn.180004bf0
add rbx, 0x178
cmp rbx, rdi
jne 0x180012450
mov rbx, qword [rsp + 0xc8]
mov rcx, rbx
call fcn.18006e998
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
mov rcx, qword [rsp + 0xb0]
call fcn.18006e998
nop
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x190]
mov qword [rsp + 0x80], rcx
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xa0], xmm1
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x190]
call fcn.180007120
mov rcx, qword [rsp + 0x1c0]
call fcn.18006e998
mov qword [rsp + 0x1c0], r13
mov qword [rsp + 0x1c8], r13
mov rcx, qword [rsp + 0x190]
call fcn.18006e998
nop
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x80], rcx
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xa0], xmm1
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xe0]
call fcn.18001bd70
mov rcx, qword [rsp + 0x110]
call fcn.18006e998
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r13
mov rcx, qword [rsp + 0xe0]
call fcn.18006e998
jmp 0x180013901
lea rcx, str.parse_app_rules_now
call fcn.18002f34c
lea r14, [0x1800bf228]
mov qword [rsp + 0x80], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x1800bfbf0]
mov rbx, qword [rax + 8]
mov rdi, rbx
cmp byte [rbx + 0x79], 0
jne 0x18001268f
xor r12d, r12d
nop word [rax + rax]
mov rdx, qword [rdi + 0x10]
lea rcx, [0x1800bfbc0]
call fcn.180019de0
mov rdi, qword [rdi]
cmp qword [rbx + 0x68], 8
jb 0x180012643
mov rcx, qword [rbx + 0x50]
call fcn.18006e998
mov qword [rbx + 0x68], 7
mov qword [rbx + 0x60], r12
mov word [rbx + 0x50], r12w
cmp qword [rbx + 0x38], 8
jb 0x180012664
mov rcx, qword [rbx + 0x20]
call fcn.18006e998
mov qword [rbx + 0x38], 7
mov qword [rbx + 0x30], r12
mov word [rbx + 0x20], r12w
mov rcx, rbx
call fcn.18006e998
mov rbx, rdi
cmp byte [rdi + 0x79], r12b
je 0x180012620
mov rax, qword [0x1800bfbf0]
jmp 0x180012692
xor r12d, r12d
mov qword [rax + 8], rax
mov qword [0x1800bfbf8], r12
mov rax, qword [0x1800bfbf0]
mov qword [rax], rax
mov rax, qword [0x1800bfbf0]
mov qword [rax + 0x10], rax
call fcn.180011100
mov dword [0x1800bf2fc], eax
mov eax, dword [rsp + 0x278]
and eax, 0xfffffe06
or eax, 6
mov dword [rsp + 0x278], eax
mov qword [rsp + 0x280], r12
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x290], r12
mov ecx, 0x40
call fcn.18006ea94
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x180012749
mov ecx, 8
call fcn.18006ea94
test rax, rax
je 0x180012716
mov qword [rax], rbx
jmp 0x180012719
mov rax, r12
mov qword [rbx], rax
mov rcx, rbx
call fcn.18005d338
mov qword [rbx + 0x30], rax
mov byte [rax + 0x51], 1
mov rax, qword [rbx + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rbx + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 0x30]
mov qword [rax + 0x10], rax
mov qword [rbx + 0x38], r12
jmp 0x18001274c
mov rbx, r12
mov qword [rsp + 0x270], rbx
mov ecx, 8
call fcn.18006ea94
test rax, rax
je 0x180012770
lea rcx, [rsp + 0x2a0]
mov qword [rax], rcx
jmp 0x180012773
mov rax, r12
mov qword [rsp + 0x2a0], rax
lea rcx, [rsp + 0x2a0]
call fcn.180007350
mov qword [rsp + 0x2d0], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x2d0]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rax], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x2d8], r12
mov rax, qword [rsp + 0xc8]
mov r15, rax
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0xd0]
cmp rax, rbx
jbe 0x1800127f1
call fcn.18006e940
mov rbx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rbp
or r13, 0xffffffffffffffff
cmp rax, rbx
jbe 0x18001280c
call fcn.18006e940
test rbp, rbp
je 0x18001281b
cmp rbp, qword [rsp + 0xb0]
je 0x180012820
call fcn.18006e940
cmp r15, rbx
je 0x1800135a7
test rbp, rbp
jne 0x180012838
call fcn.18006e940
mov r11, r12
jmp 0x18001283c
mov r11, qword [rbp]
cmp r15, qword [r11 + 0x20]
jb 0x180012847
call fcn.18006e940
mov rdx, r15
lea rcx, [rsp + 0xe0]
call fcn.18001c2c0
mov rbx, rax
mov qword [rsp + 0x150], rax
mov r11, qword [rsp + 0xe0]
mov qword [rsp + 0x148], r11
mov rsi, qword [rsp + 0x110]
mov rdi, rsi
test r11, r11
jne 0x180012897
call fcn.18006e940
mov rsi, qword [rsp + 0x110]
mov r11, qword [rsp + 0xe0]
cmp rbx, rdi
je 0x18001292e
mov r10, qword [rbx + 0x30]
cmp qword [rbx + 0x38], 8
jb 0x1800128b1
mov rdx, qword [rbx + 0x20]
jmp 0x1800128b5
lea rdx, [rbx + 0x20]
mov r9, qword [r15 + 0x18]
cmp r9, r9
cmovb r9, r9
cmp qword [r15 + 0x20], 8
jb 0x1800128cd
mov rcx, qword [r15 + 8]
jmp 0x1800128d1
lea rcx, [r15 + 8]
mov r8, r10
cmp r9, r10
cmovb r8, r9
test r8, r8
je 0x180012907
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1800128f8
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x1800128e0
jmp 0x180012907
mov r8d, 1
cmp word [rcx], ax
cmovb r8d, r13d
jmp 0x18001290a
mov r8d, r12d
movsxd rax, r8d
test r8d, r8d
jne 0x180012920
cmp r9, r10
jb 0x18001292e
mov eax, r12d
cmp r9, r10
setne al
test eax, eax
js 0x18001292e
lea rcx, [rsp + 0x148]
jmp 0x180012946
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], r11
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x90]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov r13, qword [rsp + 0x90]
test r13, r13
je 0x18001296e
cmp r13, r11
je 0x180012973
call fcn.18006e940
mov r14, qword [rsp + 0x98]
cmp r14, rsi
je 0x180013564
test rbp, rbp
jne 0x180012993
call fcn.18006e940
mov r11, r12
jmp 0x180012997
mov r11, qword [rbp]
cmp r15, qword [r11 + 0x20]
jb 0x1800129a2
call fcn.18006e940
cmp qword [r15 + 0x98], 8
jb 0x1800129b5
mov rdx, qword [r15 + 0x80]
jmp 0x1800129bc
lea rdx, [r15 + 0x80]
lea r8, [0x1800959f8]
lea rcx, [rsp + 0x158]
call fcn.180033970
nop
test rbp, rbp
jne 0x1800129e0
call fcn.18006e940
mov r11, r12
jmp 0x1800129e4
mov r11, qword [rbp]
cmp r15, qword [r11 + 0x20]
jb 0x1800129ef
call fcn.18006e940
cmp qword [r15 + 0x140], 8
jb 0x180012a02
mov rdx, qword [r15 + 0x128]
jmp 0x180012a09
lea rdx, [r15 + 0x128]
lea r9, [0x18009547c]
lea r8, [0x180095a00]
lea rcx, [rsp + 0x248]
call fcn.180033ff8
nop
mov r8, rax
lea rdx, [0x18009547c]
lea rcx, [rsp + 0x40]
call fcn.18001df70
nop
lea r8, [0x18009547c]
mov rdx, rax
lea rcx, [rsp + 0x398]
call fcn.18000aec0
nop
cmp qword [rsp + 0x60], 8
jb 0x180012a64
mov rcx, qword [rsp + 0x48]
call fcn.18006e998
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
cmp qword [rsp + 0x268], 8
jb 0x180012a90
mov rcx, qword [rsp + 0x250]
call fcn.18006e998
mov qword [rsp + 0x268], 7
mov qword [rsp + 0x260], r12
mov word [rsp + 0x250], r12w
mov rax, qword [rsp + 0x170]
mov rdi, rax
mov rbx, qword [rsp + 0x178]
cmp rax, rbx
jbe 0x180012ada
call fcn.18006e940
mov rbx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x158]
cmp rax, rbx
jbe 0x180012aec
call fcn.18006e940
test rsi, rsi
je 0x180012afb
cmp rsi, qword [rsp + 0x158]
je 0x180012b00
call fcn.18006e940
cmp rdi, rbx
je 0x180012ee7
mov r12, qword [0x1800bfbf0]
mov rbp, qword [0x1800bfbc0]
test rsi, rsi
jne 0x180012b26
call fcn.18006e940
xor r11d, r11d
jmp 0x180012b29
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012b34
call fcn.18006e940
mov r8, rdi
lea rdx, [rsp + 0x310]
lea rcx, [0x1800bfbc0]
call fcn.180018b30
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x180012b5b
cmp rcx, rbp
je 0x180012b60
call fcn.18006e940
cmp qword [rbx + 8], r12
je 0x180012cab
test rsi, rsi
jne 0x180012b7c
call fcn.18006e940
xor r12d, r12d
mov r11, r12
jmp 0x180012b82
mov r11, qword [rsi]
xor r12d, r12d
cmp rdi, qword [r11 + 0x20]
jb 0x180012b8d
call fcn.18006e940
mov rdx, rdi
lea rcx, [0x1800bfbc0]
call fcn.1800188f0
mov rbx, rax
mov ecx, dword [rax]
mov dword [rsp + 0x360], ecx
lea rdx, [rax + 8]
mov qword [rsp + 0x388], 7
mov qword [rsp + 0x380], r12
mov word [rsp + 0x370], r12w
or r15, 0xffffffffffffffff
mov r9, r15
xor r8d, r8d
lea rcx, [rsp + 0x368]
call fcn.180004f80
mov r11d, dword [rbx + 0x30]
mov dword [rsp + 0x390], r11d
lea r8, [rsp + 0x368]
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x120]
call fcn.180010d60
nop
mov r9, r15
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x398]
call fcn.180004f80
nop
cmp qword [rsp + 0x140], 8
jb 0x180012c39
mov rcx, qword [rsp + 0x128]
call fcn.18006e998
lea rbx, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 8
cmovae rbx, qword [rsp + 0x3a0]
test rsi, rsi
jne 0x180012c62
call fcn.18006e940
mov r11, r12
jmp 0x180012c65
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012c70
call fcn.18006e940
cmp qword [rdi + 0x20], 8
jb 0x180012c7d
mov rdx, qword [rdi + 8]
jmp 0x180012c81
lea rdx, [rdi + 8]
mov r8, rbx
lea rcx, str.combine_extensions_for__s:__s
call fcn.18002f1b4
nop
cmp qword [rsp + 0x388], 8
jb 0x180012cae
mov rcx, qword [rsp + 0x370]
call fcn.18006e998
jmp 0x180012cae
xor r12d, r12d
mov ebp, r12d
cmp dword [0x1800bf2fc], 0
je 0x180012da5
test rsi, rsi
jne 0x180012ccd
call fcn.18006e940
mov r11, r12
jmp 0x180012cd0
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012cdb
call fcn.18006e940
cmp qword [rdi + 0x20], 8
jb 0x180012ceb
lea rbx, [rdi + 8]
mov rax, qword [rbx]
jmp 0x180012cf2
lea rbx, [rdi + 8]
mov rax, rbx
test rax, rax
je 0x180012d34
test rsi, rsi
jne 0x180012d06
call fcn.18006e940
mov r11, r12
jmp 0x180012d09
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012d14
call fcn.18006e940
cmp qword [rdi + 0x20], 8
jb 0x180012d20
mov rcx, qword [rbx]
jmp 0x180012d23
mov rcx, rbx
lea rdx, str.chrome.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180012da0
test rsi, rsi
jne 0x180012d43
call fcn.18006e940
mov r11, r12
jmp 0x180012d46
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012d51
call fcn.18006e940
cmp qword [rdi + 0x20], 8
jb 0x180012d5d
mov rax, qword [rbx]
jmp 0x180012d60
mov rax, rbx
test rax, rax
je 0x180012da5
test rsi, rsi
jne 0x180012d74
call fcn.18006e940
mov r11, r12
jmp 0x180012d77
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012d82
call fcn.18006e940
cmp qword [rdi + 0x20], 8
jb 0x180012d8c
mov rbx, qword [rbx]
lea rdx, str.msedge.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180012da5
mov ebp, 1
test r13, r13
jne 0x180012db4
call fcn.18006e940
mov r11, r12
jmp 0x180012db8
mov r11, qword [r13]
cmp r14, qword [r11 + 0x30]
jne 0x180012dc3
call fcn.18006e940
mov eax, dword [r14 + 0x68]
cmp eax, 1
jne 0x180012dd1
lea ebx, [rax + 2]
jmp 0x180012df4
test eax, eax
jne 0x180012dda
lea ebx, [rax + 2]
jmp 0x180012df4
cmp eax, 2
jne 0x180012de4
lea ebx, [rax + 3]
jmp 0x180012df4
mov ebx, 1
cmp eax, 3
mov eax, 4
cmove ebx, eax
mov dword [rsp + 0x360], ebp
mov qword [rsp + 0x388], 7
mov qword [rsp + 0x380], r12
mov word [rsp + 0x370], r12w
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x368]
call fcn.180004f80
mov dword [rsp + 0x390], ebx
test rsi, rsi
jne 0x180012e4d
call fcn.18006e940
mov r11, r12
jmp 0x180012e50
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012e5b
call fcn.18006e940
mov rdx, rdi
lea rcx, [0x1800bfbc0]
call fcn.1800188f0
mov rbx, rax
mov ecx, dword [rsp + 0x360]
mov dword [rax], ecx
lea rcx, [rax + 8]
mov r9, rbp
xor r8d, r8d
lea rdx, [rsp + 0x368]
call fcn.180004f80
mov r11d, dword [rsp + 0x390]
mov dword [rbx + 0x30], r11d
cmp qword [rsp + 0x388], 8
jb 0x180012eb1
mov rcx, qword [rsp + 0x370]
call fcn.18006e998
test rsi, rsi
jne 0x180012ec0
call fcn.18006e940
mov r11, r12
jmp 0x180012ec3
mov r11, qword [rsi]
cmp rdi, qword [r11 + 0x20]
jb 0x180012ece
call fcn.18006e940
add rdi, 0x28
mov rbx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x170]
jmp 0x180012ae2
mov rbp, qword [rsp + 0x70]
test rbp, rbp
jne 0x180012efb
call fcn.18006e940
mov r11, r12
jmp 0x180012eff
mov r11, qword [rbp]
mov r15, qword [rsp + 0x38]
cmp r15, qword [r11 + 0x20]
jb 0x180012f0f
call fcn.18006e940
cmp qword [r15 + 0x168], 8
jb 0x180012f22
mov rdx, qword [r15 + 0x150]
jmp 0x180012f29
lea rdx, [r15 + 0x150]
lea r9, [0x18009547c]
lea r8, [0x180095a00]
lea rcx, [rsp + 0x120]
call fcn.180033ff8
nop
mov r8, rax
lea rdx, [0x18009547c]
lea rcx, [rsp + 0x220]
call fcn.18001df70
nop
lea r8, [0x18009547c]
mov rdx, rax
lea rcx, [rsp + 0x438]
call fcn.18000aec0
nop
cmp qword [rsp + 0x240], 8
jb 0x180012f8d
mov rcx, qword [rsp + 0x228]
call fcn.18006e998
mov qword [rsp + 0x240], 7
mov qword [rsp + 0x238], r12
mov word [rsp + 0x228], r12w
cmp qword [rsp + 0x140], 8
jb 0x180012fc2
mov rcx, qword [rsp + 0x128]
call fcn.18006e998
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], r12w
lea rax, [0x1800969c8]
mov qword [rsp + 0x248], rax
lea rax, [fcn.180001450]
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x260], rax
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x360]
call fcn.18001dca0
nop
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.18000f8e0
nop
lea rcx, [rsp + 0x360]
call fcn.1800051c0
mov rcx, qword [rsp + 0x360]
call fcn.18006e998
and dword [rsp + 0x1d8], 0xfffffe00
mov qword [rsp + 0x1e0], r12
mov qword [rsp + 0x1e8], r12
mov qword [rsp + 0x1f0], r12
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1f8]
call fcn.180055dd8
mov rbx, rax
lea r8, [0x180095a7d]
lea rdx, str.procs
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
mov rdx, rbx
call fcn.18005601c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x1f8]
call fcn.180001450
nop
mov byte [rsp + 0x48], 4
bts dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x18001310f
mov rcx, qword [rax + 8]
jmp 0x180013113
lea rcx, [rax + 8]
call fcn.1800555f0
mov qword [rsp + 0x40], rax
lea r8, [0x180095a84]
lea rdx, str.exts
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
nop
cmp qword [rsp + 0x218], 0x10
jb 0x18001315e
mov rcx, qword [rsp + 0x200]
call fcn.18006e998
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x1f8]
call fcn.180001450
nop
mov byte [rsp + 0x48], 4
bts dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800131a9
mov rcx, qword [rax + 8]
jmp 0x1800131ad
lea rcx, [rax + 8]
call fcn.1800555f0
mov qword [rsp + 0x40], rax
lea r8, [0x180095a90]
lea rdx, str.mainExts
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
nop
cmp qword [rsp + 0x218], 0x10
jb 0x1800131f8
mov rcx, qword [rsp + 0x200]
call fcn.18006e998
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
test r13, r13
jne 0x180013211
call fcn.18006e940
mov r11, r12
jmp 0x180013215
mov r11, qword [r13]
cmp r14, qword [r11 + 0x30]
jne 0x180013220
call fcn.18006e940
mov byte [rsp + 0x48], 1
btr dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movsxd rax, dword [r14 + 0x6c]
mov qword [rsp + 0x40], rax
lea r8, [0x180095969]
lea rdx, str.clipboard
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
test r13, r13
jne 0x180013284
call fcn.18006e940
mov r11, r12
jmp 0x180013288
mov r11, qword [r13]
cmp r14, qword [r11 + 0x30]
jne 0x180013293
call fcn.18006e940
mov byte [rsp + 0x48], 1
btr dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movsxd rax, dword [r14 + 0x70]
mov qword [rsp + 0x40], rax
lea r8, [0x180095970]
lea rdx, str.drag
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
test r13, r13
jne 0x1800132f7
call fcn.18006e940
mov r11, r12
jmp 0x1800132fb
mov r11, qword [r13]
cmp r14, qword [r11 + 0x30]
jne 0x180013306
call fcn.18006e940
mov byte [rsp + 0x48], 1
btr dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movsxd rax, dword [r14 + 0x68]
mov qword [rsp + 0x40], rax
lea r8, [0x180095aa1]
lea rdx, str.cryptMode
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
test r13, r13
jne 0x18001336a
call fcn.18006e940
mov r11, r12
jmp 0x18001336e
mov r11, qword [r13]
cmp r14, qword [r11 + 0x30]
jne 0x180013379
call fcn.18006e940
mov byte [rsp + 0x48], 1
btr dword [rsp + 0x48], 8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movsxd rax, dword [r14 + 0x74]
mov qword [rsp + 0x40], rax
lea r8, [0x180095982]
lea rdx, str.screenshot
lea rcx, [rsp + 0x1d0]
call fcn.180056f38
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18005601c
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x1f8]
call fcn.180055dd8
mov rbx, rax
lea rcx, [rsp + 0x270]
call fcn.180056ae0
mov edx, eax
lea rcx, [rsp + 0x270]
call fcn.180056b74
mov rcx, rax
mov rdx, rbx
call fcn.18005601c
test rbp, rbp
jne 0x18001341f
call fcn.18006e940
mov r11, r12
jmp 0x180013423
mov r11, qword [rbp]
cmp r15, qword [r11 + 0x20]
jb 0x18001342e
call fcn.18006e940
lea rdx, [r15 + 0x148]
lea rcx, [rsp + 0x1f8]
call fcn.18000a760
nop
cmp qword [rax + 0x20], 8
jb 0x180013450
mov rdx, qword [rax + 8]
jmp 0x180013454
lea rdx, [rax + 8]
lea r8, str.__.
lea rcx, [rsp + 0x40]
call fcn.180033970
nop
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.18000a620
nop
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.18000adb0
nop
lea rcx, [rsp + 0x320]
call fcn.1800042b0
nop
lea rcx, [rsp + 0x40]
call fcn.180005860
mov rcx, qword [rsp + 0x40]
call fcn.18006e998
nop
cmp qword [rsp + 0x218], 8
jb 0x1800134c4
mov rcx, qword [rsp + 0x200]
call fcn.18006e998
nop
lea rcx, [rsp + 0x1d0]
call fcn.180055f84
nop
lea rcx, [rsp + 0x2e0]
call fcn.180055f84
nop
cmp qword [rsp + 0x458], 8
jb 0x1800134f8
mov rcx, qword [rsp + 0x440]
call fcn.18006e998
mov qword [rsp + 0x458], 7
mov qword [rsp + 0x450], r12
mov word [rsp + 0x440], r12w
cmp qword [rsp + 0x3b8], 8
jb 0x18001352d
mov rcx, qword [rsp + 0x3a0]
call fcn.18006e998
mov qword [rsp + 0x3b8], 7
mov qword [rsp + 0x3b0], r12
mov word [rsp + 0x3a0], r12w
lea rcx, [rsp + 0x158]
call fcn.180005860
mov rcx, qword [rsp + 0x158]
call fcn.18006e998
test rbp, rbp
jne 0x180013573
call fcn.18006e940
mov r11, r12
jmp 0x180013577
mov r11, qword [rbp]
cmp r15, qword [r11 + 0x20]
jb 0x180013582
call fcn.18006e940
add r15, 0x178
mov qword [rsp + 0x38], r15
mov rbx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
or r13, 0xffffffffffffffff
jmp 0x180012802
cmp qword [0x1800bfbf8], 0
jne 0x1800135bd
lea rcx, str.kernel_app_rules_empty_
call fcn.18002f34c
lea r9, str.dlpApps
lea r8, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x410]
call fcn.180034278
nop
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x270]
call fcn.180057934
nop
mov rdx, rax
lea rcx, [rsp + 0x3c0]
call fcn.1800013c0
nop
cmp qword [rsp + 0x140], 0x10
jb 0x18001361f
mov rcx, qword [rsp + 0x128]
call fcn.18006e998
mov qword [rsp + 0x140], socket
mov qword [rsp + 0x138], r12
mov byte [rsp + 0x128], 0
lea r9, [rsp + 0x3c8]
cmp qword [rsp + 0x3e0], 8
cmovae r9, qword [rsp + 0x3c8]
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x428]
xor edx, edx
lea rcx, [rsp + 0x410]
call fcn.18000b4f0
test eax, eax
je 0x1800136c9
lea r9, [rsp + 0x3c8]
cmp qword [rsp + 0x3e0], 8
cmovae r9, qword [rsp + 0x3c8]
mov dword [rsp + 0x20], r12d
lea r8, str.dlpApps
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call fcn.180034178
mov byte [0x1800bf2f9], 1
lea rcx, str.dlp_apps_in_rule_changed
call fcn.18002f1b4
mov sil, 1
mov edx, 1
lea rcx, [rsp + 0x2e0]
call fcn.180032b00
cmp qword [rax + 0x20], 8
jb 0x1800136eb
mov r9, qword [rax + 8]
jmp 0x1800136ef
lea r9, [rax + 8]
mov dword [rsp + 0x20], r12d
lea r8, str.dlpAppsUptime
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call fcn.180034178
cmp qword [rsp + 0x300], 8
jb 0x180013726
mov rcx, qword [rsp + 0x2e8]
call fcn.18006e998
mov qword [rsp + 0x240], 7
mov qword [rsp + 0x238], r12
mov word [rsp + 0x228], r12w
mov r8d, 1
lea rdx, [0x18009547c]
lea rcx, [rsp + 0x220]
call fcn.180006960
lea r8, [rsp + 0x220]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x3e8]
call fcn.180001300
lea r9, [rsp + 0x3f0]
cmp qword [rsp + 0x408], 8
cmovae r9, qword [rsp + 0x3f0]
mov dword [rsp + 0x20], r12d
lea r8, str.dlpMainExts
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call fcn.180034178
cmp qword [rsp + 0x408], 8
jb 0x1800137cb
mov rcx, qword [rsp + 0x3f0]
call fcn.18006e998
mov qword [rsp + 0x408], 7
mov qword [rsp + 0x400], r12
mov word [rsp + 0x3f0], r12w
cmp qword [rsp + 0x3e0], 8
jb 0x180013800
mov rcx, qword [rsp + 0x3c8]
call fcn.18006e998
mov qword [rsp + 0x3e0], 7
mov qword [rsp + 0x3d8], r12
mov word [rsp + 0x3c8], r12w
cmp qword [rsp + 0x430], 8
jb 0x180013835
mov rcx, qword [rsp + 0x418]
call fcn.18006e998
mov qword [rsp + 0x430], 7
mov qword [rsp + 0x428], r12
mov word [rsp + 0x418], r12w
lea rcx, [rsp + 0x2a0]
call fcn.1800042b0
nop
lea rcx, [rsp + 0x270]
call fcn.180055f84
nop
lea rcx, [0x1800bf228]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
je 0x1800138ba
mov rdi, qword [rsp + 0xd0]
cmp rbx, rdi
je 0x1800138b2
mov rcx, rbx
call fcn.180004bf0
add rbx, 0x178
cmp rbx, rdi
jne 0x180013896
mov rbx, qword [rsp + 0xc8]
mov rcx, rbx
call fcn.18006e998
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r12
mov rcx, qword [rsp + 0xb0]
call fcn.18006e998
nop
lea rcx, [rsp + 0x190]
call fcn.180003ce0
nop
lea rcx, [rsp + 0xe0]
call fcn.180018e60
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
je 0x18001391e
test sil, sil
jne 0x18001391e
mov byte [0x1800bf2f9], 1
lea rcx, str.dlpApps_used_to_exist_but_dlpApps_not_setted_now
call fcn.18002f34c
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret