Function at 0x1800929f0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1800b88d0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r13d, r8d
mov dword [rsp + 0x70], r8d
mov r8, qword [rbp + 0x3f8]
mov r15, rcx
mov rcx, qword [rbp + 0x3f0]
mov qword [rsp + 0x50], r9
lea ebx, [r13 + 0x97e]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x40], ebx
cmp r13d, ebx
jae 0x180092f87
mov rsi, qword [rbp - 0x48]
xor r10d, r10d
mov rbx, qword [rbp - 0x50]
mov r11d, 0x7261
mov r12, qword [rbp - 0x58]
mov eax, dword [rsp + 0x40]
lea r14d, [r10 + 0x73]
nop
cmp r13d, 0x1d9
ja 0x180092c98
je 0x180092c6d
cmp r13d, 0xcb
ja 0x180092b7b
je 0x180092b43
mov eax, r13d
sub eax, 0x2c
je 0x180092b2c
sub eax, 0x18
je 0x180092b06
sub eax, 0x2a
je 0x180092aef
cmp eax, 0x45
jne 0x180093337
mov rdi, qword [rbp - 0x40]
cmp dword [rdi + 0x2dc], 0x2a
jne 0x180092b39
mov eax, dword [rcx]
lea r8, [rsp + 0x70]
mov ecx, 0xc6
mov dword [rsp + 0x70], eax
mov rdx, rdi
call fcn.18007b6f0
mov dword [rsp + 0x48], eax
jmp 0x18009331a
mov eax, dword [rdx]
mov dword [rbp - 0x80], eax
mov eax, dword [r9]
mov dword [rbp - 0x7c], eax
mov eax, dword [r15 + 0x78]
mov dword [rbp - 0x78], eax
jmp 0x180093337
mov eax, dword [0x1800b0db1]
mov dword [rbp + 0x1a0], eax
movzx eax, byte [0x1800b0db5]
mov byte [rbp + 0x1a4], al
mov word [rbp + 0x1a5], r11w
jmp 0x180093337
mov qword [rbp - 0x40], r15
test r15, r15
jne 0x180093337
mov eax, 0xffffffff
jmp 0x180092f8b
mov r8d, 3
mov byte [rbp + 0x1a7], 0
lea rdx, [0x1800b0f3a]
lea rcx, [rbp + 0x1a7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r10d, r10d
mov byte [rbp + 0x1aa], 0
mov word [rbp + 0x1e8], r10w
jmp 0x18009331d
mov eax, r13d
sub eax, 0xf5
je 0x180092c55
sub eax, 0x45
je 0x180092f87
sub eax, 0x18
je 0x180092c36
cmp eax, 0x2a
jne 0x180093337
cmp dword [r15 + 0x14], 0
mov edi, r10d
jbe 0x180093337
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
mov r13d, dword [rbp - 0x80]
mov r12d, dword [rbp - 0x7c]
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov r9, rsi
mov dword [rbx], r13d
mov rdx, r15
mov dword [rsi], r12d
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x30], 0x52
lea r8, [r8 + rax*2]
test rcx, rcx
je 0x180092bf7
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.180070c10
mov rcx, qword [rsp + 0x58]
inc edi
mov r8, qword [rsp + 0x60]
cmp edi, dword [r15 + 0x14]
jb 0x180092bd0
mov rbx, qword [rbp - 0x50]
xor r10d, r10d
mov rsi, qword [rbp - 0x48]
mov r12, qword [rbp - 0x58]
mov r13d, dword [rsp + 0x70]
jmp 0x180093327
mov r8d, 5
lea rdx, [0x1800b0dc2]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18009331a
mov eax, dword [r15 + 0x7c]
mov dword [rbp - 0x74], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x7c], eax
mov dword [r15 + 0x78], eax
jmp 0x180093337
movsd xmm0, qword [0x1800b0d68]
movzx eax, word [0x1800b0d70]
movsd qword [rbp + 0x1f2], xmm0
mov word [rbp + 0x1fa], ax
mov word [rbp + 0x1fc], r10w
jmp 0x180093337
cmp r13d, 0x3f5
ja 0x1800932b4
je 0x180093205
mov eax, r13d
sub eax, 0x203
je 0x1800931af
sub eax, 0x5d
je 0x180093175
sub eax, 0x87
je 0x180093027
cmp eax, 0x87
jne 0x180093337
mov ecx, 0x202
mov dword [rbp - 0x60], 0x104
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x70], r10d
mov dword [rbp - 0x64], 0x84d0
call rsi
test eax, eax
je 0x18009331a
mov edi, 0xda
cmp edi, 0x44fa
ja 0x180092eb3
je 0x180092e94
cmp edi, 0x22ea
ja 0x180092e06
je 0x180092dd8
cmp edi, 0xda
je 0x180092dbd
cmp edi, 0x95e
je 0x180092da7
cmp edi, 0x11e2
je 0x180092d7f
cmp edi, 0x1a66
jne 0x180093010
movzx eax, word [0x1800b0e44]
mov word [rbp + 0x18c], ax
movzx eax, byte [0x1800b0e46]
mov byte [rbp + 0x18e], al
mov dword [rbp + 0x18f], 0x77656956
mov byte [rbp + 0x193], 0
jmp 0x180093010
mov r8d, 1
lea rdx, [0x1800b0de8]
lea rcx, [rbp + 0x18a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov word [rbp + 0x18b], 0x75
jmp 0x180093010
mov dword [rbp + 0x186], 0x73655272
mov byte [rbp + 0x18a], 0
jmp 0x180093010
mov eax, 0x5370
mov dword [rbp + 0x182], 0x65646168
mov word [rbp + 0x180], ax
jmp 0x180093010
movzx eax, word [0x1800b0eac]
mov word [rbp + 0x194], ax
movzx eax, byte [0x1800b0eae]
mov byte [rbp + 0x196], al
mov byte [rbp + 0x193], 0x73
mov byte [rbp + 0x197], 0
jmp 0x180093010
cmp edi, 0x2b6e
je 0x180092e53
cmp edi, 0x33f2
je 0x180092e31
cmp edi, 0x3c76
jne 0x180093010
mov dword [rbp + 0x1da], 0x6e
jmp 0x180093010
mov eax, 0x68
mov word [rbp + 0x1d2], ax
movabs rax, 0x670061004d
mov qword [rbp + 0x1d4], rax
jmp 0x180093010
mov r8d, 2
lea rdx, [0x1800b0edf]
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x1800b0ef0]
mov dword [rbp + 0x1c8], eax
mov eax, dword [0x1800b0ef8]
mov dword [rbp + 0x1cc], eax
mov dword [rbp + 0x1d0], 0x63
jmp 0x180093010
mov eax, dword [0x1800b0e6c]
mov dword [rbp + 0x1dc], eax
movzx eax, word [0x1800b0e70]
mov word [rbp + 0x1e0], ax
jmp 0x180093010
cmp edi, 0x670a
ja 0x180092f6b
je 0x180092f53
cmp edi, 0x4d7e
je 0x180092f31
cmp edi, 0x5602
je 0x180092f12
cmp edi, 0x5e86
jne 0x180093010
mov eax, 0x5f
mov dword [rbp + 0x1bd], 0x696c5f6c
mov word [rbp + 0x1b6], ax
mov eax, 0x6f72
mov word [rbp + 0x1bb], ax
mov dword [rbp + 0x1b7], 0x746e6f63
jmp 0x180093010
mov dword [rbp + 0x1b1], 0x656363
mov word [rbp + 0x1b4], r14w
mov word [rbp + reloc.SHLWAPI.dll_IsOS], r14w
jmp 0x180093010
movabs rax, 0x7200650069
mov qword [rbp + 0x1e0], rax
mov eax, 0x61
mov word [rbp + 0x1b0], ax
jmp 0x180093010
mov eax, 0x7473
mov byte [rbp + 0x1c3], 0
mov word [rbp + 0x1c1], ax
jmp 0x180093010
cmp edi, 0x6f8e
je 0x180092fe4
cmp edi, 0x7812
je 0x180092fb5
cmp edi, 0x8096
jne 0x180093010
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1800a5da0
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x218]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov byte [rsp + 0x48], 0
jmp 0x180093010
movups xmm0, xmmword [str.HgfsPackRenameReply]
movups xmm1, xmmword [0x1800b0e88]
movups xmmword [rbp + 0x218], xmm0
movsd xmm0, qword [0x1800b0e98]
movsd qword [rbp + 0x238], xmm0
movups xmmword [rbp + 0x228], xmm1
add edi, 0x884
cmp edi, 0x8840
jbe 0x180092d02
jmp 0x18009331a
mov r14d, 0x46
nop dword [rax]
cmp r14d, 0x46
je 0x18009310c
cmp r14d, 0x110
je 0x1800930f2
cmp r14d, 0x1022
je 0x18009314b
cmp r14d, 0x3eb0
je 0x180093078
cmp r14d, 0x7c50
jne 0x180093125
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180093122
mov rdi, qword [r12 + 0x10]
mov esi, 0xc4
mov qword [r12], r10
mov eax, esi
sub eax, 0xc4
je 0x1800930c7
sub eax, 0x33
je 0x1800930dd
sub eax, 0x88
je 0x1800930a9
sub eax, 0x33
je 0x1800930dd
cmp eax, 0xbb
je 0x1800930eb
jmp 0x1800930dd
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
mov qword [rdi], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r10d, r10d
jmp 0x1800930dd
test rdi, rdi
je 0x1800930eb
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r10d, r10d
mov qword [rdi + 8], r10
add esi, 0xbb
cmp esi, 0x46b
jb 0x180093086
mov qword [r12 + 0x10], r10
jmp 0x180093125
mov rcx, qword [rbp + 0x1e8]
lea r12, [rbp + 0x1e8]
mov qword [rbp - 0x58], r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180093122
xor r8d, r8d
lea rcx, [rbp + 0x1e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x38], rax
xor r10d, r10d
add r14d, 0xfdc
cmp r14d, 0x4f4c
jbe 0x180093030
mov rsi, rbx
mov qword [rbp - 0x48], rbx
mov r14d, 0x73
jmp 0x18009331a
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rbp - 0x50], rax
mov rsi, rax
mov qword [rbp - 0x48], rax
mov r14d, 0x73
jmp 0x18009331a
movzx eax, word [0x1800b0da0]
movups xmm0, xmmword [str.PolicyCheckerState]
mov word [rbp + 0x210], ax
movzx eax, byte [0x1800b0da2]
mov byte [rbp + 0x212], al
mov byte [rsp + 0x44], 1
movups xmmword [rbp + 0x200], xmm0
mov dword [rbp - 0x6c], 0xf003f
jmp 0x180093337
mov eax, SHUnicodeToAnsi
cmp eax, 0xd6
je 0x1800931c8
cmp eax, 0x19ea
je 0x180092f87
jmp 0x1800931db
mov ecx, dword [rbp - 0x78]
mov dword [r15 + 0x78], ecx
mov ecx, dword [rbp - 0x74]
mov dword [r15 + 0x7c], ecx
mov dword [rsp + 0x48], r10d
add eax, 0x1914
cmp eax, 0x3228
jbe 0x1800931b4
xor edx, edx
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x41]
call fcn.1800633c0
mov byte [rsp + 0x48], al
jmp 0x18009331a
mov eax, dword [rbp - 0x70]
lea r9, [rbp - 0x30]
mov edx, dword [rbp - 0x6c]
lea rcx, [rbp + 0x200]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov rdx, r15
mov ecx, 0x7e
mov dword [rbp - 0x68], eax
call fcn.18005a8e0
test al, al
jne 0x18009331a
mov edi, 0xec
mov ecx, edi
sub ecx, 0xec
je 0x180093261
sub ecx, 0x6c
je 0x18009325a
cmp ecx, 0x6c
je 0x180092f87
jmp 0x1800932a7
mov byte [rsp + 0x48], 0
jmp 0x1800932a7
movups xmm0, xmmword [str.FM:ULv4i16_indexed]
lea rcx, [rbp + 0x240]
movups xmm1, xmmword [0x1800b0f10]
movups xmmword [rbp + 0x240], xmm0
movsd xmm0, qword [0x1800b0f20]
movsd qword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x250], xmm1
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHRegDuplicateHKey]
add edi, 0x6c
cmp edi, 0x230
jb 0x180093240
jmp 0x18009331a
cmp r13d, 0x47c
je 0x1800932d9
cmp r13d, 0x503
je 0x1800931e7
cmp r13d, 0x58a
je 0x180092f87
jmp 0x18009333b
cmp dword [rbp - 0x68], 0
mov ecx, r10d
movzx eax, byte [rsp + 0x44]
cmove ecx, eax
mov byte [rsp + 0x44], cl
cmp cl, 0
je 0x180093300
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteUSValueA]
mov r8d, dword [rbp - 0x64]
lea rcx, [rbp + 0x270]
mov edx, dword [rbp - 0x60]
mov r9d, 3
call qword [sym.imp.SHLWAPI.dll_StrFromTimeIntervalA]
xor r10d, r10d
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov r11d, 0x7261
mov rdx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x40]
add r13d, 0x87
mov dword [rsp + 0x70], r13d
cmp r13d, eax
jb 0x180092a80
jmp 0x180092f87