Function at 0x180012de0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1804762b8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx ebx, byte [rbp - 0x68]
mov r14d, r9d
imul esi, r9d, 0x5ac
mov r13, rdx
mov dword [rbp - 0x5d], r9d
mov edi, r9d
mov dword [rbp - 0x65], 0
cmp r9d, esi
ja 0x180012fb0
mov ecx, 0x6c
lea r15d, [rcx - 0x20]
lea r12d, [rcx - 0x2b]
nop word [rax + rax]
cmp edi, 0xc680
ja 0x180012f1f
je 0x180012f13
cmp edi, 0x80
je 0x180012f09
cmp edi, 0x11f
je 0x180012ee8
cmp edi, 0x4280
je 0x180012ece
cmp edi, 0x8480
je 0x180012ec2
cmp edi, 0x951b
jne 0x180012f9f
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800e9340
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp + 0x1a], 0x4c586d
jmp 0x180012f9f
movzx eax, word [0x180469b10]
mov word [rbp + 0x18], ax
movzx eax, byte [0x180469b12]
mov byte [rbp + 0x1a], al
jmp 0x180012f9f
xor edx, edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov ebx, eax
mov ecx, 0x6c
jmp 0x180012f9f
mov word [rbp + 0x17], r15w
jmp 0x180012f9f
mov dword [rbp + 0x1d], 0x516a79
jmp 0x180012f9f
cmp edi, 0x10880
je 0x180012f9a
cmp edi, 0x14a80
je 0x180012f83
cmp edi, 0x18c80
je 0x180012f7a
cmp edi, 0x1ce80
je 0x180012f6b
cmp edi, 0x21080
jne 0x180012f9f
lea rax, [rbp + 0x17]
dec rax
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x180012f50
movzx ecx, word [0x180469b14]
mov word [rax], cx
mov ecx, 0x6c
jmp 0x180012f9f
mov eax, dword [str.vXU3]
mov dword [rbp + 0x26], eax
mov word [rbp + 0x2a], cx
jmp 0x180012f9f
mov dword [rbp + 0x23], 0x353441
jmp 0x180012f9f
movzx eax, word [0x180469b0c]
mov word [rbp + 0x21], ax
movzx eax, byte [0x180469b0e]
mov byte [rbp + 0x23], al
jmp 0x180012f9f
mov word [rbp + 0x20], r12w
imul eax, r14d, 0x84
add edi, eax
cmp edi, esi
jbe 0x180012e50
imul eax, r14d, 0x1d6
mov edi, r14d
mov dword [rbp - 0x61], r14d
mov dword [rbp - 0x51], eax
cmp r14d, eax
ja 0x180012e92
mov r8d, 0x65
movabs rcx, 0x7fffffffffffffff
lea edx, [r8 - 0x4f]
lea eax, [rdx + 0x5e]
cmp edi, 0x7600
ja 0x18001360e
je 0x1800135d6
cmp edi, 0x80
je 0x1800135aa
cmp edi, 0x1800
je 0x180013595
cmp edi, 0x2f80
je 0x180013576
cmp edi, 0x4700
je 0x180013051
cmp edi, 0x5e80
jne 0x1800136a3
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x59], 0
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov qword [rbp - 0x49], rax
imul eax, r14d, 0x2f
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
cmp qword [r13 + 0x10], 0x35
jb 0x1800136a3
mov r12d, 0xbc
cmp r12d, 0x15cd4
ja 0x1800132ac
je 0x180013176
cmp r12d, 0xaec8
ja 0x18001310f
je 0x1800130f5
cmp r12d, 0xbc
je 0x1800130d9
cmp r12d, 0x3ac0
je 0x1800130bf
cmp r12d, 0x74c4
jne 0x18001354a
mov r8d, 4
lea rdx, [0x180469b30]
lea rcx, [rbp + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180013531
movzx eax, word [0x180469b2c]
mov word [rbp], ax
movzx eax, byte [0x180469b2e]
mov byte [rbp + 2], al
jmp 0x180013545
mov r8d, 2
lea rdx, [0x180469b28]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180013531
movzx eax, word [0x180469b24]
mov word [rbp + 5], ax
movzx eax, byte [0x180469b26]
mov byte [rbp + 7], al
jmp 0x180013545
cmp r12d, 0xe8cc
je 0x180013158
cmp r12d, 0x122d0
jne 0x18001354a
movzx eax, word [0x180469b34]
lea rcx, [rbp - 1]
mov word [rbp + 0xa], ax
dec rcx
movzx eax, byte [0x180469b36]
mov byte [rbp + 0xc], al
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180013141
mov eax, dword [0x180469b38]
mov dword [rcx], eax
jmp 0x18001353b
mov word [rbp + 7], ax
movzx eax, word [0x180469b20]
mov word [rbp + 8], ax
movzx eax, byte [0x180469b22]
mov byte [rbp + 0xa], al
jmp 0x180013545
mov r14d, GetAcceptLanguagesW
mov word [rbp + 0xf], r8w
cmp qword [r13 + 0x10], r14
mov r15, r13
mov qword [rbp - 0x19], reloc.SHLWAPI.dll_GetAcceptLanguagesW
cmovb r14, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 0x10
mov byte [rbp - 0x31], 0
jb 0x1800131a4
mov r15, qword [r13]
cmp r14, 0xf
ja 0x1800131c8
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
lea rcx, [rbp - 0x31]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x31], 0
jmp 0x180013253
cmp r14, rcx
ja 0x1800136bb
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x1800131e2
mov rsi, rcx
jmp 0x1800131ea
cmp rsi, 0x16
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180013223
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800136c7
mov rcx, rax
call fcn.1800e8b50
test rax, rax
je 0x1800136b4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180013234
test rcx, rcx
je 0x180013232
call fcn.1800e8b50
mov rdi, rax
jmp 0x180013234
xor edi, edi
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
mov qword [rbp - 0x19], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x31], rdi
or dword [rbp - 0x65], 4
lea rcx, [0x180476228]
lea rdx, [rbp - 0x31]
call fcn.180008910
mov rax, qword [rbp - 0x19]
cmp rax, 0x10
jb 0x180013531
mov rcx, qword [rbp - 0x31]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800132a2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800136b4
call fcn.1800e8b8c
jmp 0x180013531
cmp r12d, 0x244e4
ja 0x18001350d
je 0x180013501
cmp r12d, 0x196d8
je 0x1800133fa
cmp r12d, 0x1d0dc
je 0x1800133ed
cmp r12d, 0x20ae0
jne 0x18001354a
mov rax, qword [r13 + 0x10]
mov qword [rbp - 0x19], reloc.SHLWAPI.dll_GetAcceptLanguagesW
mov byte [rbp - 0x31], 0
cmp rax, 0x11
jb 0x1800136c1
add rax, 0xffffffffffffffef
mov r14d, 0x24
cmp rax, r14
cmovb r14, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x18001331f
mov rax, qword [r13]
lea r15, [rax + 0x11]
cmp r14, 0xf
ja 0x180013352
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
lea rcx, [rbp - 0x31]
call sub.VCRUNTIME140.dll_memmove
or dword [rbp - 0x65], 2
lea rcx, [0x180476208]
mov byte [rbp + r14 - 0x31], 0
jmp 0x18001325e
cmp r14, rcx
ja 0x1800136bb
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x18001336c
mov rsi, rcx
jmp 0x180013374
cmp rsi, 0x16
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800133ad
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800136c7
mov rcx, rax
call fcn.1800e8b50
test rax, rax
je 0x1800136b4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800133be
test rcx, rcx
je 0x1800133bc
call fcn.1800e8b50
mov rdi, rax
jmp 0x1800133be
xor edi, edi
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
mov qword [rbp - 0x19], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
or dword [rbp - 0x65], 2
lea rcx, [0x180476208]
mov byte [rdi + r14], 0
mov qword [rbp - 0x31], rdi
jmp 0x18001325e
mov qword [rbp - 0x41], 0
jmp 0x18001354a
mov rax, qword [r13 + 0x10]
mov qword [rbp - 0x19], reloc.SHLWAPI.dll_GetAcceptLanguagesW
mov byte [rbp - 0x31], 0
cmp rax, 0xb
jb 0x1800136c1
add rax, 0xfffffffffffffff5
mov r14d, 6
cmp rax, r14
cmovb r14, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x180013433
mov rax, qword [r13]
lea r15, [rax + 0xb]
cmp r14, 0xf
ja 0x180013466
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
lea rcx, [rbp - 0x31]
call sub.VCRUNTIME140.dll_memmove
or dword [rbp - 0x65], 1
lea rcx, [0x180476248]
mov byte [rbp + r14 - 0x31], 0
jmp 0x18001325e
cmp r14, rcx
ja 0x1800136bb
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x180013480
mov rsi, rcx
jmp 0x180013488
cmp rsi, 0x16
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800134c1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800136c7
mov rcx, rax
call fcn.1800e8b50
test rax, rax
je 0x1800136b4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800134d2
test rcx, rcx
je 0x1800134d0
call fcn.1800e8b50
mov rdi, rax
jmp 0x1800134d2
xor edi, edi
mov r8, r14
mov qword [rbp - 0x21], r14
mov rdx, r15
mov qword [rbp - 0x19], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
or dword [rbp - 0x65], 1
lea rcx, [0x180476248]
mov byte [rdi + r14], 0
mov qword [rbp - 0x31], rdi
jmp 0x18001325e
lea rcx, [rbp - 1]
call qword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
jmp 0x180013531
cmp r12d, 0x27ee8
je 0x180013525
cmp r12d, 0x2b8ec
je 0x180012e92
jmp 0x18001354a
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.GDI32.dll_GetObjectType]
mov bl, 1
mov r8d, 0x65
lea edx, [r8 - 0x4f]
movabs rcx, 0x7fffffffffffffff
mov eax, 0x74
add r12d, 0x3a04
cmp r12d, 0x2f234
jbe 0x180013062
mov edi, dword [rbp - 0x61]
mov r14d, dword [rbp - 0x5d]
imul eax, r14d, 0x2f
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
imul eax, r14d, 0x2f
xorps xmm0, xmm0
mov dword [rbp - 0x55], 0xf003f
movups xmmword [rbp - 0x11], xmm0
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
imul eax, r14d, 0x2f
mov byte [rbp - 0x69], 1
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
mov r8d, 1
lea rdx, [0x180469b3c]
lea rcx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
imul eax, r14d, 0x2f
mov byte [rbp - 0x68], 1
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
mov eax, dword [rbp - 0x59]
lea r9, [rbp - 0x39]
mov edx, dword [rbp - 0x55]
lea rcx, [rbp + 0x17]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
test eax, eax
je 0x1800136a3
imul eax, r14d, 0x2f
mov byte [rbp - 0x68], 0
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
cmp edi, 0x8d80
je 0x180013677
cmp edi, 0xa500
je 0x180013656
cmp edi, 0xbc80
je 0x180013643
cmp edi, 0xd400
je 0x180012e92
imul eax, r14d, 0x2f
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
imul eax, r14d, 0x2f
xor bl, bl
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
cmp byte [rbp - 0x69], 0
je 0x1800136a3
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.GDI32.dll_DeleteObject]
imul eax, r14d, 0x2f
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
movzx eax, byte [rbp - 0x69]
xor ecx, ecx
cmp qword [rbp - 0x49], rcx
cmovne ecx, eax
cmp byte [rbp - 0x68], 0
movzx esi, cl
mov byte [rbp - 0x69], cl
je 0x1800136a3
mov rcx, qword [rbp - 0x39]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyA]
mov byte [rbp - 0x69], sil
imul eax, r14d, 0x2f
add edi, eax
cmp edi, dword [rbp - 0x51]
mov dword [rbp - 0x61], edi
jmp 0x180012fc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18001de50
int3
call fcn.18001de90
int3
call fcn.18001dd10
int3