Function at 0x18005baa0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov r12, qword [rbp + 0x7f]
lea r15d, [r9 + 0xd]
xor ebx, ebx
lea r8, [0x180000000]
mov r14d, r9d
mov esi, r9d
cmp r9d, r15d
jae 0x18005bce9
lea edi, [r9 - 0xdf]
nop dword [rax + rax]
cmp edi, 0x3a
ja case.0x18005bb0d.12
movzx eax, byte [r8 + rdi + 0x5c0cc]
mov ecx, dword [r8 + rax*4 + 0x5c098]
add rcx, r8
jmp rcx
mov byte [rsp + 0x5b], 0x59
jmp case.0x18005bb0d.12
mov eax, dword [0x1800bb644]
lea rcx, [rbp - 0x79]
mov r8, qword [rsp + 0x40]
inc eax
mov dword [0x1800bb644], eax
cmp r8, rcx
je 0x18005bd78
inc eax
mov qword [rsp + 0x28], rbx
lea r9, str.123456789
mov dword [0x1800bb644], eax
xor edx, edx
mov dword [rsp + 0x20], 0xc1
xor ecx, ecx
call fcn.1800516d0
test eax, eax
je 0x18005bd78
mov rcx, qword [rsp + 0x40]
call fcn.18006e620
lea r8, [0x180000000]
jmp case.0x18005bb0d.12
inc dword [0x1800bb644]
lea r8, [0x180098e58]
mov r9d, 0x75bcd15
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.180024c00
cmp eax, 9
jne 0x18005bd36
lea r8, [0x180000000]
jmp case.0x18005bb0d.12
mov eax, dword [0x18009affc]
mov dword [rbp - 0x39], eax
movzx eax, word [0x18009b000]
mov word [rbp - 0x35], ax
jmp case.0x18005bb0d.12
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
cmp rax, rcx
je 0x18005bbf2
mov edx, dword [r12]
cmp dword [rax + 8], edx
je 0x18005c07c
add rax, 0x10
cmp rax, rcx
jne 0x18005bbe0
mov qword [rbp - 0x69], rbx
jmp case.0x18005bb0d.12
inc dword [0x1800bb644]
lea rax, [rbp - 0x79]
mov r9d, 0x7b
mov qword [rsp + 0x40], rax
lea r8, [0x180098e58]
lea rcx, [rsp + 0x40]
lea edx, [r9 - 0x76]
call fcn.180024c00
cmp eax, 3
jne 0x18005bd84
mov eax, dword [0x1800bb644]
lea rcx, [rbp - 0x79]
mov r8, qword [rsp + 0x40]
inc eax
mov dword [0x1800bb644], eax
cmp r8, rcx
jne 0x18005bd78
inc eax
mov qword [rsp + 0x28], rbx
lea r9, [0x18009b004]
mov dword [0x1800bb644], eax
xor edx, edx
mov dword [rsp + 0x20], 0xc1
xor ecx, ecx
call fcn.1800516d0
test eax, eax
je 0x18005bd78
lea r8, [0x180000000]
jmp case.0x18005bb0d.12
mov r8d, 3
lea rdx, [0x18009b033]
lea rcx, [rsp + 0x58]
call fcn.18006e170
lea r8, [0x180000000]
mov byte [rsp + 0x5b], bl
jmp case.0x18005bb0d.12
mov dword [rsp + 0x5c], 0x5255435f
mov byte [rsp + 0x60], bl
jmp case.0x18005bb0d.12
mov r8d, 3
lea rdx, [0x18009b040]
lea rcx, [rbp - 0x39]
call fcn.18006db94
lea r8, [0x180000000]
jmp case.0x18005bb0d.12
mov dword [rbp - 0x69], ebx
inc esi
inc edi
cmp esi, r15d
jb 0x18005baf0
mov rdx, qword [rbp + 0x4f]
lea edi, [r14 - 0xe]
cmp r14d, edi
jbe case.0x18005bd34.224
mov r15, qword [rbp - 0x61]
movzx r13d, byte [rbp + 0x5f]
mov rsi, qword [rbp - 0x61]
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 - 0xd9]
cmp eax, 0x3e
ja case.0x18005bd34.231
movzx eax, byte [r8 + rax + 0x5c144]
mov ecx, dword [r8 + rax*4 + 0x5c108]
add rcx, r8
jmp rcx
mov r9d, 0x75bcd15
lea r8, [0x180098e58]
mov edx, 5
lea rcx, [rsp + 0x40]
call fcn.180024c00
movsd xmm2, qword [0x1800a17e8]
movd xmm1, eax
lea rcx, str._f____f_n
cvtdq2pd xmm1, xmm1
movq r8, xmm2
movq rdx, xmm1
call fcn.180064fc0
lea rax, str.false
jmp 0x18005c07c
mov r9d, 0x7b
lea r8, [0x180098e58]
lea rcx, [rsp + 0x40]
lea edx, [r9 - 0x76]
call fcn.180024c00
movsd xmm2, qword [0x1800a17b8]
jmp 0x18005bd5a
mov qword [rsp + 0x30], rbx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x5b
xor edx, edx
call fcn.18000df30
mov r14d, 0xda
jmp case.0x18005bd34.231
mov dword [r15 + 0x1c], 1
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
nop dword [rax + rax]
inc rax
cmp byte [r12 + rax], bl
jne 0x18005bdf0
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x11a
lea rcx, [rbp - 0x51]
mov r9, r15
mov qword [rsp + 0x20], rax
mov r8, r12
call fcn.18002b760
cmp eax, 0xffffffff
jne 0x18005be39
mov r14d, 0xda
jmp case.0x18005bd34.231
mov rax, qword [rbp + 0x6f]
test byte [rax + 0xc0], 2
jne 0x18005be7e
movzx ecx, word [rbp - 0x49]
call qword [rbp - 0x61]
lea r9, [rbp + 0x5f]
mov qword [rsp + 0x50], 2
lea r8, [rsp + 0x48]
mov word [rbp + 0x5f], ax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], rbx
lea rcx, [rbp - 0x51]
mov dword [rsp + 0x20], 0x10b
call fcn.180047860
mov eax, dword [rbp - 0x49]
lea r9, [rsp + 0x50]
mov r8, qword [rbp - 0x51]
mov ecx, 0xc0
mov rdx, qword [rbp + 0x6f]
mov dword [rsp + 0x50], eax
call fcn.180034720
jmp case.0x18005bd34.231
test r13b, r13b
je 0x18005beb5
mov rcx, qword [rbp - 0x21]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteUSValueA]
mov rcx, qword [rbp - 0x59]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x69], rax
jmp case.0x18005bd34.231
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x71], 0xf003f
jmp case.0x18005bd34.231
mov r8d, 3
mov word [rsp + 0x60], 0x52
lea rdx, [0x18009b051]
lea rcx, [rsp + 0x61]
call fcn.18006e170
mov byte [rsp + 0x64], bl
jmp case.0x18005bd34.231
mov eax, dword [rbp - 0x6d]
lea r9, [rbp - 0x21]
mov edx, dword [rbp - 0x71]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
test eax, eax
je case.0x18005bd34.231
xor r13b, r13b
jmp case.0x18005bd34.231
mov eax, dword [0x18009b06c]
mov r13b, 1
mov dword [rsp + 0x64], eax
movzx eax, byte [0x18009b070]
mov byte [rsp + 0x68], al
mov byte [rbp - 0x80], bl
jmp case.0x18005bd34.231
lea rax, [rsp + 0x48]
mov dword [rsi + 0x14], 1
mov r9d, 0x5d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov rdx, rsi
lea rcx, [rbp - 0x51]
call fcn.180016340
jmp case.0x18005bd34.231
mov rcx, rsi
call fcn.18006e620
jmp case.0x18005bd34.231
lea r9, [rsp + 0x48]
mov qword [rsp + 0x48], 0x800
mov r8d, 0xb8
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
lea r15, [rsi + 0x20]
call fcn.180047510
mov eax, dword [0x1800ba648]
inc eax
mov dword [0x1800ba648], eax
mov word [rsi + 0x12], ax
mov eax, 0x100
mov word [rsi + 0x10], ax
jmp case.0x18005bd34.231
mov eax, dword [rdx]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x14], 1
jmp case.0x18005bd34.231
mov dword [rbp - 0x6d], ebx
cmp qword [rbp - 0x59], rbx
jne case.0x18005bd34.231
mov rax, rbx
jmp 0x18005c07c
mov r8d, 0xa
lea rdx, [rbp - 0x2f]
lea ecx, [r8 - 8]
call fcn.18006e81c
mov r8d, 4
lea rdx, str..dll
lea rcx, [rbp - 0x39]
call fcn.18006db94
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rcx, [rbp - 0x39]
xor edx, edx
mov dword [rsp + 0x20], 0xe9
lea r8d, [r9 + 9]
call fcn.18000df30
mov edx, 0xc20
mov qword [rbp - 0x61], rax
mov ecx, 1
call fcn.18006d048
mov rsi, rax
dec r14d
cmp r14d, edi
jbe case.0x18005bd34.224
mov rdx, qword [rbp + 0x4f]
lea r8, [0x180000000]
jmp 0x18005bd10
mov rax, qword [rbp - 0x69]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret