Function at 0x418760
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x368
mov qword [rsp + 0x360], rbx
mov qword [rsp + 0x358], rbp
mov qword [rsp + 0x350], rsi
mov qword [rsp + 0x348], rdi
mov qword [rsp + 0x340], r12
mov rbx, rcx
mov qword [rsp + 0x338], r13
call fcn.004545a0
test eax, eax
je 0x418811
lea rdx, str.CUninstall_::_DeleteInstalledRegisteyEntries_n
lea rcx, [rsp + 0x130]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x130]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4187e3
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.004548a0
lea r12, [rbx + 0x13c0]
cmp qword [r12], 0
jne 0x418823
xor ebx, ebx
jmp 0x418828
lea rbx, [r12 + 8]
test rbx, rbx
je 0x418a22
mov r13, 0xffffffff80000005
sub rbx, r12
sub rbx, 7
mov rcx, rbx
lea rax, [rbx - 1]
cmp rax, 0x1f3
ja 0x418879
mov rax, qword [r12]
cmp rbx, rax
jae 0x41885e
lea rbx, [rbx + r12 + 8]
jmp 0x418860
xor ebx, ebx
lea rdi, [rcx - 1]
cmp rdi, rax
jae 0x41887b
cmp rdi, 0xffffffffffffffff
je 0x41887b
mov rdi, qword [r12 + rdi*8 + 0x200]
jmp 0x41887d
xor ebx, ebx
xor edi, edi
mov rsi, qword [rdi]
mov rbp, qword [rdi + 0x18]
lea rdx, str.HKCR
mov rcx, rsi
call fcn.00488120
test eax, eax
jne 0x4188a0
mov r8, 0xffffffff80000000
jmp 0x4188f4
lea rdx, str.HKCU
mov rcx, rsi
call fcn.00488120
test eax, eax
jne 0x4188bc
mov r8, 0xffffffff80000001
jmp 0x4188f4
lea rdx, [0x004abcc0]
mov rcx, rsi
call fcn.00488120
test eax, eax
jne 0x4188d8
mov r8, 0xffffffff80000003
jmp 0x4188f4
lea rdx, str.HKCC
mov rcx, rsi
call fcn.00488120
mov r8, 0xffffffff80000002
test eax, eax
cmove r8, r13
lea rcx, [rsp + 0x130]
mov rdx, rbp
call fcn.00465d20
mov r8, qword [rdi + 0x30]
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x130]
call fcn.00465350
test eax, eax
jne 0x418955
call fcn.004545a0
test eax, eax
je 0x418955
mov r9, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
lea rdx, str.FAILED_Registry_DeleteValue_:_RegKey___s__RegValue___s_n
lea rcx, [rsp + 0x30]
call fcn.00486850
call fcn.004546e0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.004548a0
mov rcx, qword [rdi + 0x18]
call fcn.0048acd0
mov rcx, rax
call fcn.00487800
mov r11, rax
mov rdx, rax
mov rax, qword [rdi + 0x18]
movzx ecx, byte [rdx]
inc rax
inc rdx
test cl, cl
mov byte [rax - 1], cl
jne 0x418970
mov rcx, r11
call fcn.00487200
mov rcx, qword [rdi + 0x18]
lea rdx, str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUNONCE
call fcn.00486ac0
test rax, rax
je 0x4189a5
sub eax, dword [rdi + 0x18]
cmp eax, 0xffffffff
jne 0x418a01
mov rcx, qword [rdi + 0x18]
lea rdx, str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN
call fcn.00486ac0
test rax, rax
je 0x4189c2
sub eax, dword [rdi + 0x18]
cmp eax, 0xffffffff
jne 0x418a01
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x130]
call fcn.00464960
test eax, eax
je 0x418a01
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x130]
xor r9d, r9d
mov r8d, 1
mov dword [rsp + 0x20], 1
call fcn.00464cc0
test rbx, rbx
jne 0x418838
mov r13, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x350]
mov rbp, qword [rsp + 0x358]
call fcn.004545a0
mov r12, qword [rsp + 0x340]
mov rbx, qword [rsp + 0x360]
test eax, eax
je 0x418aae
lea rdx, str.CUninstall_::_DeleteInstalledRegisteyEntries_n
lea rcx, [rsp + 0x130]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x20203a54495845
xor eax, eax
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x130]
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x418a80
call fcn.004546e0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x348]
add rsp, 0x368
ret