Function at 0x180005940
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x18002c718]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor edi, edi
mov qword [rsp + 0x48], rdx
lea r9d, [r8 + 0xb]
mov ebx, r8d
mov dword [rsp + 0x40], ebx
mov r10, rcx
lea rcx, [0x180000000]
mov r11, rdx
lea r13d, [rdi + 0x74]
cmp r8d, r9d
jae 0x180005ace
lea edx, [r8 - 0xb1]
mov r8d, 0x7472
lea esi, [rdi + 0x57]
lea r14d, [rdi + 0x41]
lea r15d, [rdi + 0x75]
lea r12d, [rdi + 0x77]
cmp edx, 0x1a
ja case.default.0x1800059da
mov ecx, dword [rcx + rdx*4 + 0x6074]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 0x332], di
jmp case.0x1800059da.3
mov dword [rsp + 0x34], 0x40007400
mov ecx, dword [rsp + 0x34]
add ecx, 0x14
add ecx, dword [r11]
mov dword [rsp + 0x34], ecx
jmp case.0x1800059da.3
mov word [rbp + 0x326], r8w
jmp case.0x1800059da.3
mov eax, 0x53
mov word [rbp + 0x323], ax
mov eax, 0x61
mov word [rbp + 0x324], r13w
mov word [rbp + 0x325], ax
jmp case.0x1800059da.3
mov dword [rsp + 0x30], edi
mov eax, dword [rsp + 0x30]
jmp case.0x1800059da.3
mov eax, dword [rsp + 0x34]
movzx ecx, word [r10]
mov dword [rax], ecx
jmp case.0x1800059da.3
mov eax, 0x53
mov word [rbp + 0x320], si
mov word [rbp + 0x321], ax
mov word [rbp + 0x322], r14w
jmp case.0x1800059da.3
mov eax, 0x70
mov word [rbp + 0x328], r15w
mov word [rbp + 0x329], ax
mov word [rbp + 0x330], r12w
jmp case.0x1800059da.3
movzx eax, word [r11]
mov dword [rsp + 0x30], 0x40006c00
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
movzx ecx, word [rax]
mov word [rsp + 0x3c], cx
jmp case.0x1800059da.3
mov dword [rsp + 0x34], edi
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x34], eax
lea rcx, [0x180000000]
inc edx
lea eax, [rdx + 0xb1]
cmp eax, r9d
jb 0x1800059c0
lea edx, [rbx - 0xc]
mov dword [rsp + 0x30], edx
cmp ebx, edx
jbe case.0x180005b3c.0
mov r13, qword [rsp + 0x50]
lea esi, [rbx - 0xb2]
movzx r12d, byte [rsp + 0x3a]
mov r8d, 0x6c
mov r15, qword [rsp + 0x50]
movabs r9, 0x33005f00320073
movzx r14d, byte [rsp + 0x3a]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], esi
mov edx, dword [rsp + 0x34]
mov rsi, qword [rsp + 0x50]
nop word [rax + rax]
cmp edx, 0xb
ja case.default.0x180005b3c
mov eax, edx
mov ecx, dword [rcx + rax*4 + 0x60e0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 0x344], di
jmp case.0x180005b3c.3
mov word [rbp + 0x342], r8w
jmp case.0x180005b3c.3
mov ecx, 0x131
call fcn.180012730
mov byte [rsp + 0x3c], al
jmp 0x180005fe0
mov eax, dword [0x180025eea]
mov dword [rbp + 0x33a], eax
movzx eax, word [0x180025eee]
mov word [rbp + 0x33e], ax
mov qword [rbp + 0x332], r9
mov word [rbp + 0x340], di
jmp case.0x180005b3c.3
xor edx, edx
mov rcx, r11
lea r8d, [rdx + 0x64]
call fcn.18001d320
test al, al
jne 0x180005ca2
mov ebx, 7
cmp ebx, 7
ja case.default.0x180005bce
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x6110]
add rcx, rdx
jmp rcx
mov r9, qword [rbp - 0x80]
xorps xmm0, xmm0
mov edx, dword [rsp + 0x58]
xor eax, eax
xor r8d, r8d
mov qword [rbp - 0x40], rax
xor ecx, ecx
mov dword [rbp - 0x38], eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.GDI32.dll_AddFontMemResourceEx]
mov r13, rax
jmp case.default.0x180005bce
mov rax, qword [rbp - 0x78]
lea r9, [rbp - 0x68]
mov r8d, dword [rsp + 0x5c]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_CreateDIBSection]
movzx ecx, r12b
test r13, r13
mov edx, edi
mov r15, rax
cmovne edx, ecx
movzx r12d, dl
jmp case.default.0x180005bce
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x78], rdi
jmp case.default.0x180005bce
mov dword [rsp + 0x5c], edi
jmp case.default.0x180005bce
mov qword [rbp - 0x80], rdi
jmp case.default.0x180005bce
test r12b, r12b
je 0x180005c5e
mov rcx, r13
call qword [sym.imp.GDI32.dll_RemoveFontMemResourceEx]
movzx eax, byte [rsp + 0x38]
test r15, r15
mov ecx, edi
cmovne ecx, eax
mov byte [rsp + 0x38], cl
cmp cl, 0
je case.default.0x180005bce
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp case.default.0x180005bce
mov byte [rsp + 0x38], 1
mov r12b, 1
mov qword [rbp - 0x78], rdi
dec ebx
lea eax, [rbx + 0x124]
cmp eax, 0x123
ja 0x180005bb2
mov ebx, dword [rsp + 0x40]
movzx eax, byte [rsp + 0x39]
mov ecx, edi
cmp qword [rsp + 0x70], rcx
cmovne ecx, eax
mov byte [rsp + 0x39], cl
jmp 0x180005fe0
cmp byte [rsp + 0x39], dil
je case.0x180005b3c.3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x180005fe0
mov r8d, 1
lea rdx, [0x180025f06]
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180005fe0
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x1a4
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x30]
call qword [sym.imp.GDI32.dll_CreateFontIndirectExW]
mov ecx, 0x202
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x70], rax
call qword [rbp - 0x70]
test eax, eax
je 0x180005fe0
mov ebx, 0x11a
cmp ebx, 0x24c
ja 0x180005ec3
je 0x180005e95
cmp ebx, 0x1a2
ja 0x180005e07
je 0x180005dea
mov eax, ebx
sub eax, 0x11a
je 0x180005dc5
sub eax, 0x22
je 0x180005dac
sub eax, 0x22
je 0x180005d87
mov r8d, 0x6c
cmp eax, 0x22
jne 0x180005faa
mov eax, 0x72
mov word [rbp + 0x364], ax
jmp 0x180005faa
mov eax, 0x74
mov dword [rbp + 0x35a], 0x200074
mov word [rbp + 0x362], ax
mov dword [rbp + 0x35e], 0x6e0065
jmp case.0x180005eef.623
mov dword [rbp + 0x352], 0x6d0065
mov dword [rbp + 0x356], 0x6e0065
jmp case.0x180005eef.623
mov eax, 0x70
mov dword [rbp + 0x348], 0x680063
mov word [rbp + 0x350], ax
mov dword [rbp + 0x34c], 0x700061
jmp case.0x180005eef.623
mov r8d, 0x6c
mov dword [rbp + 0x366], 0x200065
mov word [rbp + 0x36a], r8w
jmp 0x180005faa
mov eax, ebx
sub eax, 0x1c4
je 0x180005e7c
sub eax, 0x22
je 0x180005e57
sub eax, 0x22
je 0x180005e4b
mov r8d, 0x6c
cmp eax, 0x22
jne 0x180005faa
mov eax, dword [0x180026076]
mov dword [rbp - 0x60], eax
movzx eax, word [0x18002607a]
mov word [rbp - 0x5c], ax
mov eax, 0x44
mov word [rbp - 0x5a], ax
jmp 0x180005faa
mov word [rbp + 0x37e], di
jmp case.0x180005eef.623
mov eax, 0x61
mov dword [rbp + 0x376], 0x610072
mov word [rbp + 0x374], ax
mov dword [rbp + 0x37a], 0x740063
jmp case.0x180005eef.623
mov dword [rbp + 0x36c], 0x730065
mov dword [rbp + 0x370], 0x630020
jmp case.0x180005eef.623
movsd xmm0, qword [0x180025f8c]
lea rdx, [0x180025fbe]
movzx eax, word [0x180025f94]
mov r8d, 3
movsd qword [rbp - 0x58], xmm0
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], di
jmp 0x180005f9a
lea eax, [rbx - 0x26e]
cmp eax, 0xee
ja case.0x180005eef.623
lea r9, [0x180000000]
movzx eax, byte [r9 + rax + 0x6154]
mov ecx, dword [r9 + rax*4 + 0x6130]
add rcx, r9
jmp rcx
mov r8d, 2
lea rdx, [0x180025f6c]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp - 0x3c], 0x53
jmp case.0x180005eef.623
mov eax, dword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov edx, dword [rsp + 0x64]
lea rcx, [rbp + 0x348]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyW]
mov dword [rsp + 0x68], eax
test r14b, r14b
je case.0x180005eef.623
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x180005eef.623
mov byte [rsp + 0x3a], 1
mov r14b, 1
jmp case.0x180005eef.623
mov dword [rsp + 0x60], edi
jmp case.0x180005eef.623
movzx eax, r14b
test rsi, rsi
mov ecx, edi
cmovne ecx, eax
movzx r14d, cl
jmp case.0x180005eef.623
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x64], 0xf003f
call qword [sym.imp.SHLWAPI.dll_StrDupW]
mov rsi, rax
jmp case.0x180005eef.623
mov dword [rbp - 0x48], 0x490052
lea rdx, [0x180026024]
mov word [rbp - 0x44], di
mov r8d, 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 0x6c
add ebx, 0x22
cmp ebx, 0x37e
jb 0x180005d30
mov ebx, dword [rsp + 0x40]
jmp 0x180005fe6
lea r8, [rbp + 0x330]
mov byte [rsp + 0x39], 1
lea rdx, [rbp + 0x320]
mov ecx, 0xb1
call fcn.1800081e0
mov qword [rbp - 0x70], rax
mov r8d, 0x6c
mov edx, dword [rsp + 0x34]
movabs r9, 0x33005f00320073
mov r11, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
dec ebx
dec edx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x34], edx
cmp ebx, eax
jbe case.0x180005b3c.0
lea rcx, [0x180000000]
jmp 0x180005b20
cmp dword [rsp + 0x68], edi
movzx eax, byte [rsp + 0x3a]
cmove edi, eax
test dil, dil
je case.0x180005bce.0
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyW]
mov byte [rsp + 0x3c], 0
movzx eax, word [rsp + 0x3c]
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.180022a70
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret