Function at 0x140029280
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r8d, r8d
lea rdx, str.Tool_RemoveLauncher
lea rcx, [rbp - 0x18]
call fcn.14000b870
nop
mov edi, 1
call fcn.140050920
mov r12, qword [rax + 8]
call fcn.14004cde4
mov r11, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400292df
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea r14, [0x1402145dc]
mov rbx, r14
shr rbx, 0x10
test rbx, rbx
jne 0x140029324
movzx esi, r14w
mov ecx, esi
call fcn.14004cbb8
test rax, rax
je 0x140029334
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1400012a0
jmp 0x140029334
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.1400014d0
nop
mov r8, qword [r12 + 0x800]
lea rdx, str.PSW_sWindowClass
lea rcx, [rbp + 0x48]
call fcn.140006620
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140029371
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14004cde4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140029391
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r9, str.LAK.EXE
mov r8, qword [r12 + 0x810]
lea rdx, [0x140212328]
lea rcx, [rbp - 0x30]
call fcn.140006620
mov rdx, qword [r12 + 0x1c0]
mov rcx, qword [rbp - 0x30]
call fcn.140029640
or esi, 0xffffffff
test eax, eax
jne 0x1400295cd
call fcn.14004cde4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400293fd
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
test rbx, rbx
jne 0x140029434
movzx ebx, r14w
mov ecx, ebx
call fcn.14004cbb8
test rax, rax
je 0x140029444
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400012a0
jmp 0x140029444
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.1400014d0
nop
mov r8, qword [r12 + 0x810]
lea rdx, str._slaunch_notifyicon
lea rcx, [rbp + 0x40]
call fcn.140006620
xor edx, edx
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140029481
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp + 0x50], r13
call fcn.14004cde4
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400294a5
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r8, qword [r12 + 0x810]
lea rdx, str._s_Launcher
lea rcx, [rbp - 0x28]
call fcn.140006620
lea r11, [rbp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rbp - 0x28]
test eax, eax
jne 0x140029525
mov rdx, rbx
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140029519
cmp eax, 2
je 0x140029519
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140029531
cmp eax, 2
je 0x140029531
cmp eax, 3
cmovne edi, r13d
mov qword [rbp + 0x58], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029588
mov rdx, rbx
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002957c
cmp eax, 2
je 0x14002957c
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140029594
cmp eax, 2
je 0x140029594
cmp eax, 3
cmovne edi, r13d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400295af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400295cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x18]
call fcn.14000ba50
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140029605
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140029623
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp - 0x18]
call fcn.14000ba00
mov eax, edi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret