Function at 0x1800377d0
Capabilities:
Delete registry key
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
imul eax, ecx, 0x5d8
mov rsi, r8
mov rdi, rdx
mov r13d, ecx
mov dword [rbp - 0x31], eax
cmp ecx, eax
ja 0x180038018
movzx r15d, byte [rbp + 0x67]
mov edx, 0x2c
mov r12d, dword [rbp + 0x67]
xor ebx, ebx
lea ecx, [rdx - 0xa]
lea r8d, [rdx + 0xe]
mov r14d, 0xffffffff
cmp r13d, 0x49b4
ja 0x180037c7a
je 0x180037c61
cmp r13d, 0x11f
ja 0x180037bc0
je 0x180037a54
mov eax, r13d
sub eax, 0x70
je 0x180037a0d
sub eax, 6
je 0x180037897
sub eax, 0x58
je 0x18003787f
cmp eax, 6
jne 0x180037e53
mov word [rbp - 0x61], dx
jmp 0x180037e53
mov eax, dword [rsi]
test eax, eax
je 0x180037cb5
imul ecx, eax, 0x1c
sub ecx, 0x1c
mov dword [rbp - 0x59], ecx
jmp 0x180037e4e
mov eax, dword [rdi]
xor edx, edx
mov qword [rsp + 0x40], rbx
xor r9d, r9d
xor r8d, r8d
cmp dword [rsi], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
lea ecx, [rdx + 0x5e]
mov qword [rsp + 0x30], rbx
jle 0x1800378d7
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call fcn.180012f90
test eax, eax
jne 0x180037e6d
mov r10, rdi
jmp 0x1800378f1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call fcn.180012f90
test eax, eax
jne 0x180037e6d
mov r10, rsi
movsxd r9, dword [r10]
mov rdx, rbx
test r9d, r9d
jle 0x1800379db
cmp r9d, 0x10
jb 0x1800379db
mov r8, qword [rbp - 0x19]
lea eax, [r9 - 1]
mov rdi, qword [r10 + 0x10]
lea r11, [r10 + 0x10]
movsxd rcx, eax
lea rax, [rdi + rcx*4]
lea r14, [r8 + rcx*4]
cmp r8, rax
ja 0x180037933
cmp r14, rdi
jae 0x1800379df
cmp r8, r11
ja 0x180037941
cmp r14, r11
jae 0x1800379df
mov ecx, r9d
and ecx, 0x8000000f
jge 0x180037953
dec ecx
or ecx, 0xfffffff0
inc ecx
mov r8, qword [rbp - 0x19]
mov eax, r9d
sub eax, ecx
movsxd r11, eax
lea rcx, [r8 + 0x20]
neg r8
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
lea rax, [r8 + rcx]
add rdx, 0x10
movdqu xmm1, xmmword [rax + rdi - 0x20]
lea rax, [r8 + rcx]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
movdqu xmm0, xmmword [rcx - 0x10]
movdqu xmm1, xmmword [rax + rdi - 0x10]
lea rax, [r8 + rcx]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rax + rdi]
lea rax, [r8 + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
movdqu xmm1, xmmword [rax + rdi + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp rdx, r11
jl 0x180037970
mov r8, qword [rbp - 0x19]
cmp rdx, r9
jge 0x180037e43
nop dword [rax + rax]
mov rax, qword [r10 + 0x10]
mov ecx, dword [rax + rdx*4]
xor dword [r8 + rdx*4], ecx
inc rdx
cmp rdx, r9
jge 0x180037e43
mov r8, qword [rbp - 0x19]
jmp 0x1800379f0
mov eax, dword [0x18008f960]
lea rcx, [rbp + 0xf]
mov dword [rbp + 0xf], eax
sub rcx, 2
movzx eax, word [0x18008f964]
mov word [rbp + 0x13], ax
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x180037a30
movups xmm0, xmmword [str.2_32.dll]
movzx eax, word [0x1800922e8]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
jmp 0x180037e4e
mov r14d, 0x6e
nop word [rax + rax]
cmp r14d, 0x6e
je 0x180037a7b
cmp r14d, 0x20a8
jne 0x180037ba7
mov rax, rbx
jmp 0x18003801c
cmp qword [rsi + 0x10], 8
jne 0x180037b03
mov edi, 0x2f
nop dword [rax + rax]
mov eax, edi
sub eax, 0x2e
je 0x180038018
cmp eax, 1
jne 0x180037af7
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x180037aad
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x69]
lea rax, [rbp - 0x35]
mov qword [rbp - 0x69], 8
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov ecx, 0xf5
call fcn.18002cec0
mov ecx, dword [rbp - 0x35]
xor edx, edx
mov eax, 0xffffffff
div rcx
xor edx, edx
mov rcx, rax
mov rax, 0xffffffffffffffff
div rcx
mov qword [rbp - 0x69], rax
mov eax, 0xffffffff
add edi, eax
cmp edi, 0x2d
ja 0x180037a90
cmp qword [rsi + 0x10], 0x10
jne 0x180037ba7
mov edi, 0xbd
mov eax, edi
sub eax, 0xbd
je 0x180037b86
sub eax, 9
je 0x180037b2f
cmp eax, 9
jne 0x180037b98
mov rax, qword [rbp + 7]
jmp 0x18003801c
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x180037b3c
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 9]
lea rax, [rbp + 7]
mov qword [rbp - 9], reloc.OLEAUT32.dll_SafeArrayGetDim
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov ecx, 0xf5
call fcn.18002cec0
test r12d, r12d
movzx eax, r15b
mov ecx, ebx
cmove ecx, eax
movzx r15d, cl
test cl, cl
je 0x180037b98
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x180037b98
lea rdx, [rbp - 1]
xor ecx, ecx
mov r15b, 1
call qword [sym.imp.ole32.dll_CreateObjrefMoniker]
mov r12d, eax
add edi, 9
cmp edi, 0xd8
jb 0x180037b13
add r14d, 0x203a
cmp r14d, 0x4074
jbe 0x180037a60
jmp 0x180037e43
cmp r13d, 0x26f0
je 0x180037c37
cmp r13d, 0x2906
je 0x180037bf2
cmp r13d, 0x479e
jne 0x180037e53
movsxd rcx, dword [rsi]
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + rcx*4 - 4]
mov dword [rbp - 0x39], edx
jmp 0x180037e49
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov r9d, 0x94
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180047a20
mov r8d, 0x10f
lea rdx, [rbp - 0x29]
xor ecx, ecx
call fcn.18001a490
jmp 0x180037e43
mov r9d, SafeArrayGetDim
lea rdx, [rbp + 0xf]
xor ecx, ecx
lea r8d, [r9 + 0x65]
call fcn.18001b7a0
mov rcx, rsi
call rax
mov dword [rdi], eax
cmp eax, r14d
jne 0x180037faa
jmp 0x180037e43
movzx eax, word [0x18009223c]
mov word [rbp - 0x5e], cx
mov word [rbp - 0x60], ax
mov word [rbp - 0x5d], r8w
jmp 0x180037e53
cmp r13d, 0x8e6e
ja 0x180037d14
je 0x180037cef
cmp r13d, 0x4d70
je 0x180037cd6
cmp r13d, 0x5196
je 0x180037cbd
cmp r13d, 0x73f0
je 0x180037e75
cmp r13d, 0x7a26
jne 0x180037e53
mov dword [rbp - 0x69], ebx
jmp 0x180038018
xor r9d, r9d
lea rcx, [rbp - 0x29]
xor edx, edx
mov r8d, 0x11f
call fcn.180045a00
jmp 0x180037e43
mov dword [rbp + 0x7f], 0x8080808
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 0xd], eax
mov dword [rbp - 0x11], 1
jmp 0x180037e53
mov edx, dword [rbp - 0x39]
mov ecx, dword [rbp - 0x59]
test edx, edx
je 0x180037d0c
nop dword [rax]
inc ecx
shr edx, 1
jne 0x180037d00
mov dword [rbp - 0x39], edx
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x69], ecx
jmp 0x180037e49
cmp r13d, 0x9294
je 0x180037d73
cmp r13d, 0xd53e
je 0x180038018
cmp r13d, 0xdb74
jne 0x180037e53
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180037d63
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180037d58
mov rax, qword [rdi]
mov word [rax + rcx], 0x22
jmp 0x180037e49
mov r9b, 0x22
mov rcx, rdi
call fcn.180052a30
jmp 0x180037e43
mov word [rbp - 0x5c], cx
lea rax, [rbp - 0x61]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], bl
jne 0x180037d82
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180037dcf
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180037db2
mov rax, qword [rdi]
lea rdi, [rax + rcx]
mov r8, r14
mov rcx, rdi
lea rdx, [rbp - 0x61]
call fcn.18005d880
mov byte [rdi + r14], bl
mov rdi, qword [rbp + 0x6f]
jmp 0x180037de3
lea r9, [rbp - 0x61]
mov qword [rsp + 0x20], r14
mov rdx, r14
mov rcx, rdi
call fcn.180052b90
cmp qword [rsi + 0x18], 0x10
mov r9, rsi
jb 0x180037df0
mov r9, qword [rsi]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
mov r14, qword [rsi + 0x10]
sub rax, rcx
cmp r14, rax
ja 0x180037e33
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180037e1b
mov rax, qword [rdi]
lea rdi, [rax + rcx]
mov r8, r14
mov rcx, rdi
mov rdx, r9
call fcn.18005d880
mov byte [rdi + r14], bl
jmp 0x180037e43
mov rdx, r14
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.180052b90
mov r8d, 0x3a
mov edx, 0x2c
mov ecx, 0x22
imul eax, dword [rbp + 0x67], 0x58
add r13d, eax
cmp r13d, dword [rbp - 0x31]
ja 0x180038018
mov rdi, qword [rbp + 0x6f]
jmp 0x18003782b
mov dword [rbp - 0x69], eax
jmp 0x180038018
mov r9, rsi
lea rcx, [rbp - 0x11]
mov r8, rdi
mov edx, 0xeb
call fcn.1800145f0
test al, al
je 0x180038003
mov r15d, dword [rbp + 0x67]
mov edi, reloc.OLEAUT32.dll_VarR4FromUI1
movzx r14d, byte [rbp + 0x67]
mov r12d, 0x4552
nop word [rax + rax]
cmp edi, 0x3d1
ja 0x180037f6d
je 0x180037f62
cmp edi, 0x43
je 0x180037f44
cmp edi, 0xf9
je 0x180037f26
cmp edi, 0x1af
je 0x180037f10
cmp edi, 0x265
je 0x180037f06
cmp edi, 0x31b
jne 0x180037fed
mov eax, dword [0x180092243]
mov dword [rbp - 0x47], eax
movzx eax, byte [0x180092247]
mov byte [rbp - 0x43], al
mov byte [rbp - 0x42], bl
jmp 0x180037fed
mov word [rbp - 0x49], r12w
jmp 0x180037fed
mov r8d, 5
lea rdx, [0x180092290]
lea rcx, [rbp - 0x4e]
jmp 0x180037fe8
mov r8d, 1
lea rdx, str.EventsLostException__
lea rcx, [rbp - 0x4f]
call fcn.1800650e0
mov byte [rbp - 0x4e], bl
jmp 0x180037fed
mov r8d, 2
lea rdx, [0x18009225d]
lea rcx, [rbp - 0x51]
call fcn.1800650e0
mov byte [rbp - 0x4f], bl
jmp 0x180037fed
mov word [rbp - 0x42], VarR4FromCy
jmp 0x180037fed
cmp edi, 0x487
je 0x180037fd7
cmp edi, 0x53d
je 0x180037fcf
cmp edi, 0x5f3
je 0x180037fb0
cmp edi, 0x6a9
jne 0x180037fed
test r15d, r15d
movzx eax, r14b
cmove ebx, eax
test bl, bl
je 0x180037faa
mov rcx, qword [rbp + 0x7f]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyA]
mov byte [rbp - 0x69], 1
jmp 0x180038018
lea r9, [rbp + 0x7f]
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp - 0x51]
mov edx, 0xf003f
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov r15d, eax
jmp 0x180037fed
mov byte [rbp - 0x40], bl
mov r14b, 1
jmp 0x180037fed
mov r8d, 1
lea rdx, [0x1800922bb]
lea rcx, [rbp - 0x41]
call fcn.1800650e0
add edi, 0xb6
cmp edi, 0x75f
jb 0x180037eb0
mov rdi, qword [rbp + 0x6f]
mov r9, rsi
mov r8, rdi
mov edx, 0xeb
xor ecx, ecx
call fcn.1800145f0
mov byte [rbp - 0x69], al
mov rax, qword [rbp - 0x69]
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret