Function at 0x1401999d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x15e0]
mov eax, 0x16e0
call fcn.140247340
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor esi, esi
mov edi, esi
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x80]
call fcn.140249b10
mov r8d, 0x104
lea rdx, [rbp + 0x80]
lea rcx, str.SUPERSetup
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r14d, 1
mov ecx, r14d
call fcn.140190750
cmp byte [rbp + 0x80], sil
jne 0x140199ab6
cmp qword [0x14037ae18], rsi
jne 0x140199a76
lea ecx, [rsi + 0x50]
call fcn.14018ef40
mov qword [rbp + 0x1610], rax
test rax, rax
je 0x140199a6c
mov rdx, qword [0x14037adb0]
mov rcx, rax
call fcn.14018d530
jmp 0x140199a6f
mov rax, rsi
mov qword [0x14037ae18], rax
call fcn.1400f9a40
mov edx, 0xa2
xor ecx, ecx
mov r9d, 0x1024
lea r8d, [rdx + 1]
call fcn.1400e9d70
cmp eax, 6
cmove edi, r14d
xor ecx, ecx
call fcn.1401994d0
xor r9d, r9d
xor edx, edx
mov r8d, 0x400
lea rcx, [0x140296e88]
call fcn.1400ea960
xor edx, edx
lea rcx, str.SUPERANTISPYWARE
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
je 0x140199b43
mov r9d, r14d
mov r8d, r14d
lea rdx, str.SASUninstall___WM_CLOSE
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x2710
xor edx, edx
lea rcx, str.SUPERANTISPYWARE
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140199b38
test ebx, ebx
je 0x140199b38
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0xffffff9c
xor edx, edx
lea rcx, str.SUPERANTISPYWARE
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140199b12
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, r14d
xor ecx, ecx
call fcn.1400fcba0
test edi, edi
je 0x140199f26
mov rdx, qword [0x140337ea8]
test rdx, rdx
je 0x140199b6e
mov rcx, qword [0x140337ed0]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov qword [rbp + 0x1620], rsi
lea r8, [rbp + 0x1620]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rbp + 0x1620]
test rcx, rcx
je 0x140199d0a
mov ebx, esi
mov r9d, 0x410
lea r8, [rbp + 0x5a0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x140199cfd
nop dword [rax]
nop word [rax + rax]
inc ebx
mov qword [rbp + 0x1628], rsi
lea r8, [rbp + 0x1628]
lea rdx, [rbp + 0x5a0]
mov rcx, qword [rbp + 0x1620]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rbp + 0x1628]
test rcx, rcx
je 0x140199cd6
mov dword [rbp + 0x1610], 0x410
mov byte [rbp + 0x5a0], 0
lea rax, [rbp + 0x1610]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1618]
xor r8d, r8d
lea rdx, str.ProfileImagePath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbp + 0x1610]
test eax, eax
je 0x140199cc9
cmp byte [rbp + 0x5a0], 0
je 0x140199cc9
mov byte [rbp + rax + 0x5a0], 0
lea rdx, [0x140296ea0]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [0x140296e88]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov r8d, 0x410
lea rdx, [rbp + 0x11d0]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edx, r14d
lea rcx, [rbp + 0x11d0]
call fcn.140198240
lea rcx, [rbp + 0x11d0]
call fcn.1400fca30
lea rcx, [rbp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, qword [rbp + 0x1628]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x410
lea r8, [rbp + 0x5a0]
mov edx, ebx
mov rcx, qword [rbp + 0x1620]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x140199bd0
mov rcx, qword [rbp + 0x1620]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x410
lea r8, [rbp + 0x9b0]
lea rdx, [0x140296e88]
lea rcx, [0x140296ea0]
call fcn.1400eaaa0
mov edx, r14d
lea rcx, [rbp + 0x9b0]
call fcn.140198240
lea rcx, [rbp + 0x9b0]
call fcn.1400fca30
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [rsp + 0x20], 0x410
lea r9, [rbp + 0x9b0]
lea r8, [0x140296e88]
lea rdx, [0x140296ea0]
mov ecx, 0x23
call fcn.1400eab60
mov edx, r14d
lea rcx, [rbp + 0x9b0]
call fcn.140198240
lea rcx, [rbp + 0x9b0]
call fcn.1400fca30
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor r8d, r8d
mov edx, r14d
mov ecx, r14d
call fcn.140223ce0
mov r8d, 0x410
lea rdx, [rbp + 0xdc0]
lea rcx, str._WinDir_Tasks_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, [rbp + 0xdc0]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.140253604
lea r8, str.SUPERAntiSpyware_Scheduled_Task_.job
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.1402504d8
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
test rax, rax
je 0x140199e69
lea r8, [rbp + 0xdc0]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.140253604
lea r8, [rsp + 0x6c]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.1402504d8
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140199e13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, 0x410
lea rdx, [rbp + 0xdc0]
lea rcx, str._WinDir_System32Tasks_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, [rbp + 0xdc0]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.140253604
lea r8, str.SUPERAntiSpyware_Scheduled_Task_.
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.1402504d8
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
test rax, rax
je 0x140199f26
nop dword [rax]
lea r8, [rbp + 0xdc0]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.140253604
lea r8, [rsp + 0x6c]
mov edx, 0x410
lea rcx, [rbp + 0x190]
call fcn.1402504d8
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140199ed0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x16e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret