Function at 0x18000cea0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10d8]
mov eax, 0x11d8
call fcn.180013d40
sub rsp, rax
mov rax, qword [0x1800bd6d8]
xor rax, rsp
mov qword [rbp + 0x10c0], rax
mov dword [rsp + 0x70], r9d
mov qword [rsp + 0x68], r8
mov r15, rdx
mov r14, rcx
xor esi, esi
mov r12d, esi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov qword [rbp - 0x78], rsi
call fcn.180007b00
mov ebx, eax
test eax, eax
js 0x18000dd2d
cmp byte [r15], 0x7d
je 0x18000dd2d
mov r13d, 1
lea rdx, [0x180062cd0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
sete sil
lea rdx, [0x180062ca0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000cf45
test esi, esi
je 0x18000d16a
mov rbx, r15
nop dword [rax + rax]
mov rdi, qword [r14]
movsx ecx, byte [rdi]
mov edx, ecx
sub edx, 9
je 0x18000cf6c
sub edx, r13d
je 0x18000cf6c
sub edx, 3
je 0x18000cf6c
cmp edx, 0x13
jne 0x18000cf7a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000cf50
test cl, cl
je 0x18000dd28
cmp cl, 0x27
jne 0x18000d036
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov r8, rax
mov qword [r14], rax
movzx eax, byte [rax]
test al, al
je 0x18000d019
cmp al, 0x27
jne 0x18000cfb3
mov rcx, r8
call qword [sym.imp.USER32.dll_CharNextA]
cmp byte [rax], 0x27
jne 0x18000d019
mov rdi, qword [r14]
cmp byte [rdi], 0x27
jne 0x18000cfca
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
lea rcx, [rbx + 1]
add rcx, rdx
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test edx, edx
jle 0x18000d011
sub rdi, rbx
mov ecx, edx
nop
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, r13
jne 0x18000d000
mov r8, qword [r14]
movzx eax, byte [r8]
test al, al
jne 0x18000cfa1
mov rax, qword [r14]
cmp byte [rax], 0
je 0x18000dd28
mov byte [rbx], 0
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d0ae
movsx ecx, cl
sub ecx, 9
je 0x18000d0ab
sub ecx, r13d
je 0x18000d0ab
sub ecx, 3
je 0x18000d0ab
cmp ecx, 0x13
je 0x18000d0ab
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov r8, rax
sub r8, rdi
lea rcx, [rbx + 1]
add rcx, r8
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test r8d, r8d
jle 0x18000d0a1
sub rdi, rbx
mov ecx, r8d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, r13
jne 0x18000d090
mov rdx, qword [r14]
movzx ecx, byte [rdx]
mov rdi, rdx
test cl, cl
jne 0x18000d036
mov byte [rbx], 0
mov edi, dword [rsp + 0x70]
test edi, edi
je 0x18000d16a
xor eax, eax
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], rax
mov rcx, r15
movzx eax, byte [r15]
test al, al
je 0x18000d0f1
cmp al, 0x5c
je 0x18000d0e8
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
movzx eax, byte [rax]
test al, al
jne 0x18000d0d2
jmp 0x18000d0f1
test rcx, rcx
jne 0x18000dd28
lea rbx, str.AppID
nop dword [rax + rax]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000d135
add rbx, 8
lea rax, str.af_za
cmp rbx, rax
jl 0x18000d100
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x68], rax
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.18000c350
test esi, esi
je 0x18000d16a
mov rdx, r15
mov rcx, r14
call fcn.180007b00
mov ebx, eax
test eax, eax
js 0x18000dd2d
mov rdx, r15
mov rcx, r14
call fcn.18000e530
mov ebx, eax
test eax, eax
js 0x18000dd2d
xor esi, esi
jmp 0x18000d988
lea rdx, [0x180062cb8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor esi, esi
test eax, eax
jne 0x18000d2ef
mov r13d, esi
mov rbx, r15
nop word [rax + rax]
mov rdi, qword [r14]
movsx ecx, byte [rdi]
mov edx, ecx
sub edx, 9
je 0x18000d1ac
sub edx, 1
je 0x18000d1ac
sub edx, 3
je 0x18000d1ac
cmp edx, 0x13
jne 0x18000d1ba
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d190
test cl, cl
je 0x18000dd28
cmp cl, 0x27
jne 0x18000d277
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
movzx eax, byte [rax]
test al, al
je 0x18000d25a
cmp al, 0x27
jne 0x18000d1f3
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextA]
cmp byte [rax], 0x27
jne 0x18000d25a
mov rdi, qword [r14]
cmp byte [rdi], 0x27
jne 0x18000d20a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov r8, rax
sub r8, rdi
lea rcx, [rbx + 1]
add rcx, r8
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test r8d, r8d
jle 0x18000d253
sub rdi, rbx
mov ecx, r8d
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d241
mov rdx, qword [r14]
movzx eax, byte [rdx]
test al, al
jne 0x18000d1e1
mov rax, qword [r14]
cmp byte [rax], sil
je 0x18000dd28
mov byte [rbx], sil
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d2ef
movsx ecx, cl
sub ecx, 9
je 0x18000d2ec
sub ecx, 1
je 0x18000d2ec
sub ecx, 3
je 0x18000d2ec
cmp ecx, 0x13
je 0x18000d2ec
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov r8, rax
sub r8, rdi
lea rcx, [rbx + 1]
add rcx, r8
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test r8d, r8d
jle 0x18000d2e2
sub rdi, rbx
mov ecx, r8d
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d2d0
mov rdx, qword [r14]
movzx ecx, byte [rdx]
mov rdi, rdx
test cl, cl
jne 0x18000d277
mov byte [rbx], sil
lea rdx, [0x180062c90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18000d693
lea rbx, [rbp + 0xc0]
nop
mov rdi, qword [r14]
movsx ecx, byte [rdi]
mov edx, ecx
sub edx, 9
je 0x18000d32c
sub edx, 1
je 0x18000d32c
sub edx, 3
je 0x18000d32c
cmp edx, 0x13
jne 0x18000d33a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d310
test cl, cl
je 0x18000dd28
cmp cl, 0x27
jne 0x18000d3f0
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
movzx eax, byte [rax]
test al, al
je 0x18000d3d6
cmp al, 0x27
jne 0x18000d373
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextA]
cmp byte [rax], 0x27
jne 0x18000d3d6
mov rdi, qword [r14]
cmp byte [rdi], 0x27
jne 0x18000d38a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov rcx, rax
sub rcx, rdi
lea rax, [rbx + 1]
add rax, rcx
lea r8, [rbp + 0x10c0]
cmp rax, r8
jae 0x18000dd28
test ecx, ecx
jle 0x18000d3cf
sub rdi, rbx
mov ecx, ecx
nop
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d3c0
movzx eax, byte [rdx]
test al, al
jne 0x18000d361
mov rcx, qword [r14]
cmp byte [rcx], 0
je 0x18000dd28
mov byte [rbx], 0
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d45d
movsx ecx, cl
sub ecx, 9
je 0x18000d45a
sub ecx, 1
je 0x18000d45a
sub ecx, 3
je 0x18000d45a
cmp ecx, 0x13
je 0x18000d45a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov r8, rax
mov qword [r14], rax
mov rdx, rax
sub rdx, rdi
lea rcx, [rbx + 1]
add rcx, rdx
lea rax, [rbp + 0x10c0]
cmp rcx, rax
jae 0x18000dd28
test edx, edx
jle 0x18000d44f
sub rdi, rbx
mov ecx, edx
nop dword [rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d440
movzx ecx, byte [r8]
mov rdi, r8
test cl, cl
jne 0x18000d3f0
mov byte [rbx], 0
mov rbx, r15
mov rdi, qword [r14]
movsx ecx, byte [rdi]
mov edx, ecx
sub edx, 9
je 0x18000d47c
sub edx, 1
je 0x18000d47c
sub edx, 3
je 0x18000d47c
cmp edx, 0x13
jne 0x18000d48a
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d460
test cl, cl
je 0x18000dd28
cmp cl, 0x27
jne 0x18000d560
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
movzx eax, byte [rax]
test al, al
je 0x18000d53d
cmp al, 0x27
jne 0x18000d4c7
mov rcx, rdx
call qword [sym.imp.USER32.dll_CharNextA]
cmp byte [rax], 0x27
jne 0x18000d53d
mov rdi, qword [r14]
cmp byte [rdi], 0x27
jne 0x18000d4de
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
mov rdi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov r8, rax
sub r8, rdi
lea rcx, [rbx + 1]
add rcx, r8
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test r8d, r8d
jle 0x18000d532
sub rdi, rbx
mov ecx, r8d
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d520
mov rdx, qword [r14]
movzx eax, byte [rdx]
test al, al
jne 0x18000d4b5
mov rax, qword [r14]
cmp byte [rax], 0
je 0x18000dd28
mov byte [rbx], 0
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r14], rax
jmp 0x18000d5cf
movsx ecx, cl
sub ecx, 9
je 0x18000d5cc
sub ecx, 1
je 0x18000d5cc
sub ecx, 3
je 0x18000d5cc
cmp ecx, 0x13
je 0x18000d5cc
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
mov rdx, rax
mov qword [r14], rax
mov r8, rax
sub r8, rdi
lea rcx, [rbx + 1]
add rcx, r8
lea rax, [r15 + 0x1000]
cmp rcx, rax
jae 0x18000dd28
test r8d, r8d
jle 0x18000d5c2
sub rdi, rbx
mov ecx, r8d
nop
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000d5b0
mov rdx, qword [r14]
movzx ecx, byte [rdx]
mov rdi, rdx
test cl, cl
jne 0x18000d560
mov byte [rbx], 0
cmp byte [r15], 0x3d
jne 0x18000dd28
mov edi, dword [rsp + 0x70]
test edi, edi
je 0x18000d60e
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x58], rsi
mov r9, r15
lea r8, [rbp + 0xc0]
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.180002e00
mov ebx, eax
jmp 0x18000d980
cmp dword [rbp + 0x1140], 0
jne 0x18000d677
test r13d, r13d
je 0x18000d677
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000dd1d
mov rdi, qword [rsp + 0x60]
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, 0xfffffffd
jne 0x18000dcff
test rdi, rdi
je 0x18000d677
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r15
mov rcx, r14
call fcn.18000e530
mov ebx, eax
test eax, eax
js 0x18000dd2d
xor esi, esi
jmp 0x18000cf03
mov rcx, r15
movzx eax, byte [r15]
test al, al
je 0x18000d6bf
nop
cmp al, 0x5c
je 0x18000d6b6
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
movzx eax, byte [rax]
test al, al
jne 0x18000d6a0
jmp 0x18000d6bf
test rcx, rcx
jne 0x18000dd28
mov edi, dword [rsp + 0x70]
test edi, edi
je 0x18000d9e3
mov qword [rsp + 0x60], rsi
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x18000d747
cmp qword [rbx], 0
je 0x18000d73a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000d791
lea rdx, str.RegOpenKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000d740
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x18000d768
cmp dword [rbx + 8], 0
jne 0x18000d747
mov eax, 1
jmp 0x18000d768
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000d791
mov eax, esi
test r12, r12
je 0x18000d77c
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
test eax, eax
je 0x18000d94b
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x18000d809
cmp qword [rbx], 0
je 0x18000d7fc
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000d853
lea rdx, str.RegOpenKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000d802
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x18000d82a
cmp dword [rbx + 8], 0
jne 0x18000d809
mov eax, 1
jmp 0x18000d82a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000d853
mov eax, esi
test r12, r12
je 0x18000d83e
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
test eax, eax
je 0x18000d94b
mov qword [rsp + 0x60], rsi
test rbx, rbx
je 0x18000d8e6
cmp qword [rbx], 0
je 0x18000d8d9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000dd18
lea rdx, str.RegCreateKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000d8df
mov qword [rsp + 0x50], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x18000d91e
cmp dword [rbx + 8], 0
jne 0x18000d8e6
mov eax, 1
jmp 0x18000d91e
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000dd1d
mov eax, esi
test r12, r12
je 0x18000d936
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
test eax, eax
jne 0x18000dd1d
mov rdx, r15
mov rcx, r14
call fcn.180007b00
mov ebx, eax
test eax, eax
js 0x18000dd2d
cmp byte [r15], 0x3d
jne 0x18000d988
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.180002e00
mov ebx, eax
mov r12, qword [rsp + 0x78]
test eax, eax
js 0x18000dd2d
cmp byte [r15], 0x7b
jne 0x18000d68c
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x18000d9a0
cmp rax, 1
jne 0x18000d68c
mov dword [rsp + 0x20], esi
mov r9d, edi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.18000cea0
mov ebx, eax
test eax, eax
js 0x18000dd2d
mov rdx, r15
mov rcx, r14
call fcn.180007b00
jmp 0x18000d682
mov eax, dword [rbp + 0x1140]
test eax, eax
jne 0x18000dac5
mov qword [rsp + 0x60], rsi
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x18000da77
cmp qword [rbx], 0
je 0x18000da6a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000da25
lea edi, [rax + 1]
mov eax, dword [rbp + 0x1140]
jmp 0x18000daca
lea rdx, str.RegOpenKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000da70
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call r10
jmp 0x18000da98
cmp dword [rbx + 8], 0
jne 0x18000da77
mov edi, 1
jmp 0x18000da9a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x18000dabd
mov edi, esi
test r12, r12
je 0x18000dab0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [rbp - 0x80], esi
mov r12, qword [rsp + 0x60]
mov qword [rsp + 0x78], r12
mov eax, dword [rbp + 0x1140]
jmp 0x18000daca
mov edi, 2
mov esi, 1
test edi, edi
cmove esi, eax
mov r9, 0xffffffffffffffff
mov r8, r15
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.180026400
test eax, eax
je 0x18000db14
cmp eax, 0xc
je 0x18000dd60
cmp eax, 0x16
je 0x18000dd76
cmp eax, 0x22
je 0x18000dd76
cmp eax, 0x50
jne 0x18000dd6b
mov rdx, r15
mov rcx, r14
call fcn.180007b00
mov ebx, eax
test eax, eax
js 0x18000dd2d
mov rdx, r15
mov rcx, r14
call fcn.18000e530
mov ebx, eax
test eax, eax
js 0x18000dd2d
cmp byte [r15], 0x7b
jne 0x18000db98
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x18000db50
cmp rax, 1
jne 0x18000db98
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.18000cea0
mov ebx, eax
test eax, eax
jns 0x18000db83
test esi, esi
je 0x18000dd2d
mov rdx, r15
mov rcx, r14
call fcn.180007b00
mov ebx, eax
test eax, eax
js 0x18000dd2d
cmp edi, 2
je 0x18000d68c
test edi, edi
je 0x18000dbc0
cmp dword [rbp + 0x1140], 0
jne 0x18000d68c
mov ecx, edi
call fcn.1800037c0
mov ebx, eax
jmp 0x18000dd2d
xor esi, esi
cmp dword [rbp + 0x1140], esi
je 0x18000dc67
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18000dc67
cmp dword [rsp + 0x60], esi
jbe 0x18000dc67
lea rdi, str.AppID
mov rdx, qword [rdi]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18000cf03
add rdi, 8
lea rax, str.af_za
cmp rdi, rax
jl 0x18000dc21
test r13d, r13d
je 0x18000cf03
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x78]
call fcn.18000c350
mov r12, qword [rsp + 0x78]
jmp 0x18000cf03
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
test eax, eax
jne 0x18000dcb7
cmp dword [rsp + 0x60], eax
seta dil
mov eax, esi
test r12, r12
je 0x18000dccf
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, rsi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
test eax, eax
jne 0x18000dd1d
test r13d, r13d
je 0x18000cf03
test edi, edi
jne 0x18000cf03
lea rdx, [rbp - 0x50]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x18000dd1d
jmp 0x18000cf03
mov ecx, eax
call fcn.1800037c0
mov ebx, eax
test rdi, rdi
je 0x18000dd2d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18000dd2d
mov eax, 1
mov ecx, eax
call fcn.1800037c0
mov ebx, eax
jmp 0x18000dd2d
mov ebx, 0x80020009
test r12, r12
je 0x18000dd3b
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x10c0]
xor rcx, rsp
call fcn.180013da0
add rsp, 0x11d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180003880
int3
mov ecx, 0x80004005
call fcn.180003880
int3
mov ecx, 0x80070057
call fcn.180003880
int3