Function at 0x18000f664
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x100
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800764c0]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov bpl, cl
mov r12b, cl
or r12b, 0x20
lea rcx, [rsp + 0x68]
call fcn.180034e5c
mov r11, qword [rsp + 0x90]
mov rax, qword [r11]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor edi, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r13, qword [rsp + 0x90]
cmp rbx, rdi
je 0x18000f6f6
cmp rbx, qword [rsp + 0x68]
je 0x18000f6fb
call fcn.18003c608
cmp rsi, r13
je 0x18000f7bb
cmp rbx, rdi
jne 0x18000f713
call fcn.18003c608
mov r11, rdi
jmp 0x18000f716
mov r11, qword [rbx]
cmp rsi, qword [r11 + 0x28]
jne 0x18000f721
call fcn.18003c608
mov al, byte [rsi + 0x38]
or al, 0x20
cmp al, r12b
je 0x18000f74d
cmp rbx, rdi
jne 0x18000f73a
call fcn.18003c608
mov r11, rdi
jmp 0x18000f73d
mov r11, qword [rbx]
cmp rsi, qword [r11 + 0x28]
jne 0x18000f748
call fcn.18003c608
mov rsi, qword [rsi]
jmp 0x18000f6e2
cmp rbx, rdi
jne 0x18000f75c
call fcn.18003c608
mov r11, rdi
jmp 0x18000f75f
mov r11, qword [rbx]
cmp rsi, qword [r11 + 0x28]
jne 0x18000f76a
call fcn.18003c608
cmp byte [rsi + 0x3a], dil
je 0x18000f7a5
cmp rbx, rdi
jne 0x18000f77c
call fcn.18003c608
jmp 0x18000f77f
mov rdi, qword [rbx]
cmp rsi, qword [rdi + 0x28]
jne 0x18000f78a
call fcn.18003c608
lea rcx, [rsp + 0x68]
call fcn.180035cb8
mov rcx, qword [rsp + 0x68]
call fcn.18003c660
xor eax, eax
jmp 0x18000fa17
lea rcx, [rsp + 0x68]
call fcn.180035cb8
mov rcx, qword [rsp + 0x68]
call fcn.18003c660
jmp 0x18000f7cf
lea rcx, [rsp + 0x68]
call fcn.180035cb8
mov rcx, qword [rsp + 0x68]
call fcn.18003c660
mov byte [rsp + 0x20], dil
mov byte [rsp + 0x21], dil
lea r8, [rsp + 0x21]
lea rdx, [rsp + 0x20]
mov cl, bpl
call fcn.18003539c
cmp al, dil
jne 0x18000f7f7
xor eax, eax
jmp 0x18000fa17
cmp byte [rsp + 0x20], dil
je 0x18000f805
xor eax, eax
jmp 0x18000fa17
mov dl, bpl
lea rcx, [rsp + 0xd0]
call fcn.18000f000
nop
cmp qword [rsp + 0xe8], rdi
jne 0x18000f84c
lea rcx, [0x1800601e8]
call fcn.180019070
nop
cmp qword [rsp + 0xf0], 0x10
jb 0x18000f845
mov rcx, qword [rsp + 0xd8]
call fcn.18003c660
xor eax, eax
jmp 0x18000fa17
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x48], 1
btr dword [rsp + 0x48], 8
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movsx rax, bpl
mov qword [rsp + 0x40], rax
lea rdx, str.letter
lea rcx, [rsp + 0x68]
call fcn.180026aa8
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.1800257e4
lea r11, [rsp + 0x40]
mov qword [rsp + 0x30], r11
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.180025558
mov rbx, rax
lea rdx, [0x180060084]
lea rcx, [rsp + 0x68]
call fcn.180026aa8
mov rcx, rax
mov rdx, rbx
call fcn.1800257e4
lea r8, str.mounted
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpusbmgr_
mov rsi, 0xffffffff80000002
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ebx, 7
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
lea r8d, [rbx - 2]
lea rdx, str.mount
lea rcx, [rsp + 0x40]
call fcn.180002638
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.18000ecbc
nop
cmp qword [rsp + 0x60], 8
jb 0x18000f959
mov rcx, qword [rsp + 0x48]
call fcn.18003c660
lea r9, str.mounted
lea r8, str.SoftwareWOW6432Nodeprojonepodlpusbmgr_
mov rdx, rsi
lea rcx, [rsp + 0xa8]
call fcn.18001c1d4
nop
cmp qword [rsp + 0xc0], rdi
jbe 0x18000f9c2
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae rcx, qword [rsp + 0xb0]
lea rdx, [0x180060218]
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
cmp eax, edi
jne 0x18000f9c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetVolumeLabelW_failed:_d
call fcn.180018ed8
nop
cmp qword [rsp + 0xc8], 8
jb 0x18000f9da
mov rcx, qword [rsp + 0xb0]
call fcn.18003c660
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], rdi
mov word [rsp + 0xb0], di
lea rcx, [rsp + 0x68]
call fcn.18002574c
nop
cmp qword [rsp + 0xf0], 0x10
jb 0x18000fa15
mov rcx, qword [rsp + 0xd8]
call fcn.18003c660
xor eax, eax
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.18003c1a0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret