Function at 0x140013d50
Capabilities:
Delete registry key
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x650
xor r12d, r12d
lea rcx, str.comctl32.dll
mov rbp, r8
mov dword [rsp + 0x70], 8
mov dword [rsp + 0x74], 0xff
mov ebx, r12d
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x140013dec
lea rdx, str.InitCommonControlsEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013db9
lea rcx, [rsp + 0x70]
lea esi, [r12 + 1]
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x140013dec
test ebx, ebx
jne 0x140013df2
lea r9d, [rbx + 0x30]
lea r8, str.Error
lea rdx, str.Error:_Cannot_load_the_common_control_classes.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [rbx + 1]
jmp 0x1400143d1
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
mov qword [rsp + 0x670], r13
call qword [sym.imp.ole32.dll_CoInitialize]
cmp qword [0x14002feb8], r12
jne 0x140013e3b
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x14002feb8], rax
je 0x140013e3b
lea rdx, str.SHGetSpecialFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002feb0], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x4b0]
mov cx, 0x101
call sub.WS2_32.dll_WSAStartup
lea r13, [0x140028668]
mov ecx, 0x5a4
mov dword [rsp + 0x40], 0x400
mov dword [rsp + 0x44], 0x100
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x24], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x5c], 0x20
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x228], r12d
mov dword [rsp + 0x394], r12d
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x140013f11
mov dword [rax + 0x578], 1
mov byte [rax + 0xc], r12b
mov byte [rax + 0x111], r12b
mov byte [rax + 0x216], r12b
mov byte [rax + 0x31b], r12b
mov byte [rax + 0x420], r12b
mov dword [rax + 0x59c], r12d
mov qword [0x14002fec0], rax
mov qword [rsp + 0x380], rax
jmp 0x140013f19
mov qword [rsp + 0x380], r12
mov ecx, 0xda0
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x140013f3a
mov rcx, rax
call fcn.140004ef0
mov qword [rsp + 0x388], rax
jmp 0x140013f42
mov qword [rsp + 0x388], r12
xor ecx, ecx
mov dword [rsp + 0x390], r12d
mov dword [rsp + 0x264], r12d
mov dword [rsp + 0x260], r12d
mov qword [rsp + 0x258], r12
mov dword [rsp + 0x268], r12d
mov qword [rsp + 0x378], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, reloc.WS2_32.dll_WSAAsyncSelect
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov rdx, r12
lea rdi, [0x140027e50]
movzx ecx, byte [rdx + rdi]
add rdx, 1
test cl, cl
mov byte [rsp + rdx + 0xb7], cl
jne 0x140013f92
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x398], rax
call fcn.14001e7b0
mov rbx, qword [rsp + 0x398]
mov rsi, r12
cmp dword [rbx + 0x48], esi
mov edi, r12d
jle 0x140014024
nop
nop
cmp edi, dword [rbx + 0x48]
jge 0x140014001
test rsi, rsi
js 0x140013ffc
cmp edi, dword [rbx + 0x28]
jge 0x140013ffc
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + rsi*4]
add rdx, qword [rbx + 0x18]
jmp 0x140014008
mov rdx, r12
jmp 0x140014008
lea rdx, [0x140027e59]
lea rcx, str._savelangfile
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x14001406b
add edi, 1
add rsi, 1
cmp edi, dword [rbx + 0x48]
jl 0x140013fe0
call fcn.14001c230
mov rdi, qword [rsp + 0x398]
mov ebx, r12d
cmp dword [rdi + 0x48], ebx
mov rsi, r12
jle 0x1400141a1
cmp ebx, dword [rdi + 0x48]
jge 0x140014172
test rsi, rsi
js 0x14001416d
cmp ebx, dword [rdi + 0x28]
jge 0x14001416d
mov rax, qword [rdi + 0x10]
mov edx, dword [rax + rsi*4]
add rdx, qword [rdi + 0x18]
jmp 0x140014179
test edi, edi
js 0x140014024
lea rax, [0x14002f240]
lea rcx, [rsp + 0x3a1]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x3a0], r12b
mov qword [0x14002fe00], rax
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x3a0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x3a0]
mov edx, 0x2e
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x1400140ca
mov byte [rax], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3a0]
repne scasb al, byte [rdi]
mov rax, qword [str._lng.ini]
xor ecx, ecx
mov qword [rdi - 1], rax
movzx eax, byte [0x1400280a0]
mov byte [rdi + 7], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x3a0]
mov rcx, rax
call fcn.14001ccb0
mov rcx, qword [rsp + 0x380]
mov qword [rsp + 0xb0], r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x38]
lea r11, [0x140027e78]
mov qword [rsp + 0xb0], r11
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x50]
mov rcx, r12
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x24], r12d
mov qword [rsp + 0x30], r12
test rax, rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x28], r12d
jmp 0x14001439a
mov rdx, r12
jmp 0x140014179
lea rdx, [0x140027e59]
lea rcx, str._deleteregkey
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x1400141f4
add ebx, 1
add rsi, 1
cmp ebx, dword [rdi + 0x48]
jl 0x140014040
mov rdi, qword [rsp + 0x398]
cmp dword [rdi + 0x48], 1
jl 0x140014211
lea rcx, [rsp + 0xb0]
call fcn.140013140
test eax, eax
je 0x140014211
mov rcx, qword [rsp + 0x380]
mov edi, dword [rsp + 0x394]
mov qword [rsp + 0xb0], r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [0x140027e78]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xb0], r11
call fcn.14001e0c0
mov eax, edi
jmp 0x1400143c9
test ebx, ebx
js 0x140014199
lea rdx, str.SoftwareNirSoftProduKey
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140014107
lea rcx, [rsp + 0xb0]
call fcn.140012680
cmp dword [rsp + 0x234], 3
jne 0x14001423d
mov rcx, qword [rsp + 0x1c0]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140014250
mov rcx, qword [rsp + 0x1c0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 0x67
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov rcx, qword [rsp + 0x1c0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x419
mov qword [rsp + 0x1f0], rax
call qword [sym.imp.USER32.dll_PostMessageA]
lea rcx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x14001432e
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1c0]
lea r8, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x140014317
mov rcx, qword [0x14002fa78]
test rcx, rcx
je 0x1400142ea
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x140014317
mov rcx, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x140014317
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x1400142b0
call sub.WS2_32.dll_WSACleanup
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x380]
mov qword [rsp + 0xb0], r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x38]
lea r11, [0x140027e78]
mov qword [rsp + 0xb0], r11
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x50]
mov rcx, r12
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x24], r12d
mov qword [rsp + 0x30], r12
test rax, rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x28], r12d
je 0x1400143a9
mov rcx, rax
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
xor eax, eax
mov r13, qword [rsp + 0x670]
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret