Function at 0x140027b00
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r8d, r8d
lea rdx, str.Tool_RemoveLauncher
lea rcx, [rbp - 0x18]
call fcn.140017fc0
nop
mov edi, 1
call fcn.140054cb8
mov r12, qword [rax + 8]
call fcn.140051e58
mov r11, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027b5f
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea r14, [0x1401c6ea8]
mov rbx, r14
shr rbx, 0x10
test rbx, rbx
jne 0x140027ba4
movzx esi, r14w
mov ecx, esi
call fcn.140051c2c
test rax, rax
je 0x140027bb4
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140001b00
jmp 0x140027bb4
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.140001c20
nop
mov r8, qword [r12 + 0x800]
lea rdx, str.PSW_sWindowClass
lea rcx, [rbp + 0x48]
call fcn.140007540
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140027bf1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.140051e58
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027c11
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r9, str.LAK.EXE
mov r8, qword [r12 + 0x810]
lea rdx, [0x1401c9460]
lea rcx, [rbp - 0x30]
call fcn.140007540
mov rdx, qword [r12 + 0x1c0]
mov rcx, qword [rbp - 0x30]
call fcn.1400248d0
or esi, 0xffffffff
test eax, eax
jne 0x140027e4d
call fcn.140051e58
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027c7d
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
test rbx, rbx
jne 0x140027cb4
movzx ebx, r14w
mov ecx, ebx
call fcn.140051c2c
test rax, rax
je 0x140027cc4
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140001b00
jmp 0x140027cc4
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.140001c20
nop
mov r8, qword [r12 + 0x810]
lea rdx, str._slaunch_notifyicon
lea rcx, [rbp + 0x40]
call fcn.140007540
xor edx, edx
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140027d01
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp + 0x50], r13
call fcn.140051e58
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140027d25
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r8, qword [r12 + 0x810]
lea rdx, str._s_Launcher
lea rcx, [rbp - 0x28]
call fcn.140007540
lea r11, [rbp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rbp - 0x28]
test eax, eax
jne 0x140027da5
mov rdx, rbx
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140027d99
cmp eax, 2
je 0x140027d99
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140027db1
cmp eax, 2
je 0x140027db1
cmp eax, 3
cmovne edi, r13d
mov qword [rbp + 0x58], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027e08
mov rdx, rbx
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140027dfc
cmp eax, 2
je 0x140027dfc
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140027e14
cmp eax, 2
je 0x140027e14
cmp eax, 3
cmovne edi, r13d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140027e2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140027e4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x18]
call fcn.140017c80
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140027e85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140027ea3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp - 0x18]
call fcn.140018150
mov eax, edi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret