Function at 0x180006e40
Capabilities:
Delete registry value
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x550], rax
xor edi, edi
mov qword [rbp - 0x78], r8
lea r15d, [rcx + 0xc3]
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], edi
mov r12, rdx
lea r13, [0x180000000]
mov esi, ecx
lea edx, [rdi + 0x75]
mov r14d, ecx
cmp ecx, r15d
jae 0x1800070f1
add esi, 0xffffffed
lea r8d, [rdi + 0x6f]
lea r9d, [rdi + 0x65]
lea r10d, [rdi + 0x5c]
lea rbx, str.table.marker
lea rdx, [0x180082190]
lea r11d, [rdi + 0x6e]
cmp esi, 0xa8
ja case.0x180006ee1.15
movzx eax, byte [rsi + r13 + 0x7b2c]
mov ecx, dword [r13 + rax*4 + 0x7aec]
add rcx, r13
jmp rcx
mov eax, 0x72
mov word [rbp + 0x23a], ax
jmp case.0x180006ee1.15
mov word [rbp - 0x1b], r8w
jmp case.0x180006ee1.15
mov dword [rbp + 0x230], 0x680073
mov dword [rbp + 0x234], 0x3a0061
jmp case.0x180006ee1.15
mov word [rbp + 0x23c], r9w
jmp case.0x180006ee1.15
mov eax, 0x75
mov word [rbp + 0x24], ax
jmp case.0x180006ee1.15
mov word [rbp + 0x238], r10w
jmp case.0x180006ee1.15
mov eax, 0x82
cmp eax, 0x82
je 0x180007144
add eax, 0x3f
cmp eax, 0xc1
jb 0x180006f44
mov dword [rbp + 0x252], 0x730064
jmp case.0x180006ee1.15
mov eax, 0x72
mov dword [rbp + 0x24e], 0x610065
mov word [rbp + 0x24c], ax
jmp case.0x180006ee1.15
mov dword [rbp + 0x23e], 0x5f0064
mov dword [rbp + 0x242], 0x6f006e
jmp case.0x180006ee1.15
test r12, r12
jne 0x180006fee
mov qword [rsp + 0x58], rdi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rdi
lea rdx, [0x180077149]
mov qword [rsp + 0x48], rdi
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor ecx, ecx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x80], edi
call fcn.18002b8a0
lea rdx, [0x180082190]
mov rbx, rdx
mov ecx, edi
mov r8d, 0x80
shl rcx, 7
add rcx, rdx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180007038
mov ecx, 0x10a
mov eax, ecx
sub eax, 0x10a
je 0x180007025
cmp eax, 1
je case.0x180007142.0
jmp 0x18000702e
xor eax, eax
mov qword [rbx], rax
mov dword [rsp + 0x74], eax
inc ecx
cmp ecx, 0x10c
jb 0x180007011
inc edi
lea rdx, [0x180082190]
sub rbx, 0xffffffffffffff80
cmp edi, 0x20
jl 0x180006ff1
mov r8d, 0x6f
lea rdx, [0x180082190]
lea rbx, str.table.marker
xor edi, edi
lea r9d, [r8 - 0xa]
lea r10d, [r8 - 0x13]
lea r11d, [r8 - 1]
jmp case.0x180006ee1.15
mov word [rbp + 0x246], r11w
mov dword [rbp + 0x248], 0x680074
jmp case.0x180006ee1.15
mov r8d, 3
lea rdx, [0x18007ac70]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 0x6f
lea rdx, [0x180082190]
lea r9d, [r8 - 0xa]
lea r10d, [r8 - 0x13]
lea r11d, [r8 - 1]
jmp case.0x180006ee1.15
mov word [rbp + 0x26], di
lea rdx, [0x1800775c8]
mov r8d, 2
lea rcx, [rbp + 0x26]
jmp 0x180007093
mov eax, dword [str.www.]
mov dword [rbp - 0x20], eax
mov byte [rbp - 0x1c], 0x79
add r14d, 0xd
add esi, 0xd
cmp r14d, r15d
jb 0x180006ec1
mov esi, dword [rsp + 0x78]
mov edx, 0x75
lea edi, [rsi - 0xf]
cmp esi, edi
jbe 0x1800072a5
movzx eax, byte [rsp + 0x60]
lea ebx, [rsi - 0x39]
mov rcx, qword [rbp - 0x78]
movabs r15, 0x72002e004d
mov byte [rsp + 0x60], al
movabs r14, 0x2f006c0031
mov qword [rsp + 0x68], rcx
cmp ebx, 0x75
ja case.0x180007142.15
movzx eax, byte [rbx + r13 + 0x7c18]
mov ecx, dword [r13 + rax*4 + 0x7bd8]
add rcx, r13
jmp rcx
mov eax, 1
jmp 0x18000789b
movzx eax, word [0x18007ac80]
mov word [rbp - 0x16], ax
movzx eax, byte [0x18007ac82]
mov byte [rbp - 0x14], al
jmp case.0x180007142.15
lea rcx, [rbp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180007170
mov eax, dword [0x1800798e4]
mov dword [rcx], eax
jmp case.0x180007142.15
mov word [rbp - 0x1a], dx
jmp case.0x180007142.15
mov dword [rbp + 0x50], 0x73
jmp case.0x180007142.15
movzx eax, byte [0x180080b18]
mov byte [rsp + 0x74], al
jmp case.0x180007142.15
xor eax, eax
mov dword [rbp + 0x25a], 0x6d0069
mov word [rbp + 0x25e], ax
jmp case.0x180007142.15
mov eax, dword [0x18007ac84]
mov dword [rbp + 0x28], eax
movzx eax, word [0x18007ac88]
mov word [rbp + 0x2c], ax
jmp case.0x180007142.15
mov dword [rbp - 0x19], 0x627574
jmp case.0x180007142.15
mov eax, dword [0x18007ac8c]
lea rdx, [0x1800798e4]
mov dword [rbp + 0x3c], eax
lea rcx, [rbp + 0x40]
movzx eax, word [0x18007ac90]
mov r8d, 2
mov word [rbp + 0x40], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x180007142.15
mov dword [rbp + 0x256], 0x64005f
jmp case.0x180007142.15
xor eax, eax
mov cl, 1
mov byte [rsp + 0x60], cl
mov r9d, eax
mov qword [rsp + 0x68], rax
jmp 0x180007291
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
jmp case.0x180007142.15
lea rax, [rbp + 0x20]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180007250
movsd xmm0, qword [0x18007ac98]
movsd qword [rax], xmm0
mov qword [rbp + 0x48], r15
jmp case.0x180007142.15
movsd xmm0, qword [str.zo:_n]
mov eax, dword [0x18007aca8]
mov qword [rbp + 0x2c], r14
movsd qword [rbp + 0x32], xmm0
mov dword [rbp + 0x3a], eax
movzx ecx, byte [rsp + 0x60]
mov r9, qword [rsp + 0x68]
dec ebx
mov edx, 0x75
lea eax, [rbx + 0x39]
cmp eax, edi
ja 0x180007125
jmp 0x1800072b7
movzx ecx, byte [rsp + 0x60]
mov r9, qword [rbp - 0x78]
mov byte [rsp + 0x60], cl
mov qword [rsp + 0x68], r9
lea edi, [rsi + 0xb40]
mov dword [rbp - 0x70], edi
cmp esi, edi
jae case.0x180007142.0
mov r13, qword [rbp - 0x68]
mov eax, 0x77
mov ebx, dword [rbp - 0x70]
lea r15d, [rax - 0x48]
mov r10d, 0x16
movabs r8, 0x7fffffffffffffff
mov r11d, 0x4d5f
lea r14d, [r10 + 0x49]
lea edx, [r10 + 0x2f]
cmp esi, 0x2ee
ja 0x1800079c8
je 0x1800079b1
cmp esi, 0x16e
ja 0x18000794e
je 0x180007945
mov eax, esi
sub eax, 0x6f
je 0x180007358
sub eax, 0x3f
je 0x180007347
cmp eax, 0x81
lea eax, [rdx + 0x32]
jne 0x180007ab5
test ebx, ebx
je 0x180007ab5
xor cl, cl
mov byte [rsp + 0x60], cl
jmp 0x180007ab5
mov dword [rbp - 0x14], 0x6d6f63
mov word [rbp - 0x30], r15w
jmp 0x180007ab0
cmp qword [r12 + 0x10], 0x35
jb 0x180007934
mov r15d, reloc.SHELL32.dll_SHSetFolderPathA
nop word [rax + rax]
cmp r15d, 0x70e
ja 0x180007596
je 0x180007456
cmp r15d, 0x3a3
ja 0x1800073f2
je 0x1800073e1
cmp r15d, 0xe7
je 0x1800073d5
cmp r15d, 0x196
je 0x1800073cc
cmp r15d, 0x245
je 0x1800073c2
cmp r15d, 0x2f4
jne 0x180007913
mov dword [rbp - 9], 0x454b41
jmp 0x180007913
mov word [rbp - 0xb], r11w
jmp 0x180007913
mov word [rbp - 0xc], dx
jmp 0x180007913
mov dword [rbp - 0x10], 0x4b414d43
jmp 0x180007913
mov word [rbp - 6], r14w
mov dword [rbp - 5], 0x4d5953
jmp 0x180007913
cmp r15d, 0x452
je 0x180007443
cmp r15d, 0x501
je 0x180007435
cmp r15d, 0x5b0
je 0x180007425
cmp r15d, 0x65f
jne 0x180007913
xor eax, eax
mov qword [rbp - 0x58], rax
jmp 0x180007913
mov word [rbp + 7], dx
mov r13, 0xffffffff80000001
jmp 0x180007913
mov eax, 0x4c55
mov word [rbp + 5], ax
jmp 0x180007913
mov dword [rbp - 2], 0x4c4f42
mov dword [rbp + 1], 0x525f4349
jmp 0x180007913
mov esi, 0xb
mov qword [rbp - 0x38], ILFindLastID
cmp qword [r12 + 0x10], rsi
mov r14, r12
mov byte [rbp - 0x50], 0
cmovb rsi, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0x10
jb 0x180007481
mov r14, qword [r12]
cmp rsi, 0xf
ja 0x1800074a4
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x50], 0
jmp 0x18000752e
cmp rsi, r8
ja 0x180007ad8
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x1800074be
mov rdi, r8
jmp 0x1800074c6
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800074ff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180007ae4
mov rcx, rax
call fcn.180071f5c
test rax, rax
je 0x180007ad1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180007510
test rcx, rcx
je 0x18000750b
call fcn.180071f5c
jmp 0x18000750d
xor eax, eax
mov rbx, rax
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
mov qword [rbp - 0x38], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x50], rbx
or dword [rsp + 0x70], 2
mov rax, qword [0x1800807b0]
cmp rax, 0x10
jb 0x180007575
mov rcx, qword [0x180080798]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180007570
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007ad1
mov rcx, r8
call fcn.180071f98
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [0x180080798], xmm0
movups xmmword [0x1800807a8], xmm1
mov r14d, 0x5f
jmp 0x1800078f9
cmp r15d, 0xb28
ja 0x180007873
je 0x180007766
cmp r15d, 0x7bd
je 0x18000775a
cmp r15d, 0x86c
je 0x180007733
cmp r15d, 0x91b
je 0x180007728
cmp r15d, 0x9ca
jne 0x180007913
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x38], ILFindLastID
mov byte [rbp - 0x50], 0
cmp rax, 0xb
jb 0x180007ade
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x180007617
mov rax, qword [r12]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18000763e
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x50], 0
jmp 0x1800076c8
cmp rsi, r8
ja 0x180007ad8
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x180007658
mov rdi, r8
jmp 0x180007660
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180007699
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180007ae4
mov rcx, rax
call fcn.180071f5c
test rax, rax
je 0x180007ad1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800076aa
test rcx, rcx
je 0x1800076a5
call fcn.180071f5c
jmp 0x1800076a7
xor eax, eax
mov rbx, rax
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
mov qword [rbp - 0x38], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x50], rbx
or dword [rsp + 0x70], 4
lea rcx, [0x1800807b8]
lea rdx, [rbp - 0x50]
call fcn.180004330
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x18000758b
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007718
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007ad1
call fcn.180071f98
mov r14d, 0x5f
jmp 0x1800078f9
xor eax, eax
mov qword [rbp - 0x60], rax
jmp 0x180007913
movzx eax, word [0x18007acb8]
movsd xmm0, qword [str.5_:_J_FK]
mov word [rbp + 0x18], ax
movzx eax, byte [0x18007acba]
mov byte [rbp + 0x1a], al
movsd qword [rbp + 0x10], xmm0
jmp 0x180007913
mov dword [rbp - 0x6c], 0x36
jmp 0x180007913
mov rax, qword [r12 + 0x10]
xor edx, edx
mov dword [rbp - 0x80], edx
mov qword [rbp - 0x38], ILFindLastID
mov byte [rbp - 0x50], dl
cmp rax, 0x11
jb 0x180007ade
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x1800077a4
mov rax, qword [r12]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x1800077d7
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memmove
or dword [rsp + 0x70], 1
lea rcx, [0x180080778]
mov byte [rbp + rsi - 0x50], 0
jmp 0x1800076d4
cmp rsi, r8
ja 0x180007ad8
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x1800077f1
mov rdi, r8
jmp 0x1800077f9
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180007832
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180007ae4
mov rcx, rax
call fcn.180071f5c
test rax, rax
je 0x180007ad1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180007844
test rcx, rcx
je 0x180007841
call fcn.180071f5c
mov rbx, rax
jmp 0x180007844
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x40], rsi
mov rdx, r14
mov qword [rbp - 0x38], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
or dword [rsp + 0x70], 1
lea rcx, [0x180080778]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x50], rbx
jmp 0x1800076d4
cmp r15d, 0xbd7
je 0x1800078e8
cmp r15d, 0xc86
je 0x1800078c5
cmp r15d, 0xd35
jne 0x180007913
mov byte [rsp + 0x74], 1
mov eax, dword [rsp + 0x74]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.180072740
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x660
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, dword [rbp - 0x80]
lea rax, [rbp + 0x440]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x6c]
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x1800078f9
lea r8, [rbp - 0x10]
mov rcx, r13
lea rdx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov r10d, 0x16
mov r11d, 0x4d5f
movabs r8, 0x7fffffffffffffff
lea edx, [r10 + 0x2f]
add r15d, 0xaf
cmp r15d, 0xde4
jb 0x180007370
mov edi, dword [rbp - 0x70]
mov r15d, 0x2f
mov esi, dword [rsp + 0x78]
lea rcx, [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov ebx, eax
jmp 0x180007aab
mov word [rbp - 0x2f], ax
jmp 0x180007ab5
mov eax, esi
sub eax, 0x1ef
je 0x180007999
sub eax, 0x3f
je 0x180007984
cmp eax, 0x81
jne 0x180007ab0
test cl, cl
je 0x18000797a
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
movzx ecx, byte [rsp + 0x60]
mov byte [rsp + 0x74], 0
jmp 0x180007ab0
mov eax, 0x68
mov dword [rbp - 0x2e], 0x637461
mov word [rbp - 0x2b], ax
jmp 0x180007ab0
mov r8d, 0x7d
lea rdx, [rbp + 0x20]
mov rcx, r9
call qword [sym.imp.SHLWAPI.dll_PathCompactPathW]
jmp 0x180007aab
mov edx, 0x3f
mov word [rbp - 0x2a], dx
mov edx, 0x3d76
mov word [rbp - 0x29], dx
jmp 0x180007ab5
cmp esi, 0x52e
ja 0x180007a49
je 0x1800079f7
mov eax, esi
sub eax, 0x36f
je case.0x180007142.0
sub eax, 0x3f
je 0x1800079ee
cmp eax, 0xc0
jmp 0x180007ab0
mov byte [rbp - 0x27], 0
jmp 0x180007ab0
lea rax, [rbp - 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180007a02
mov r14, qword [rbp - 0x78]
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.18002a970
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180007a30
lea rcx, [r14 + 0x20]
lea rdx, [rbp - 0x30]
call fcn.18002a970
jmp 0x180007aab
cmp esi, 0x5ee
je 0x180007a8a
cmp esi, 0x6ae
je 0x180007a7b
cmp esi, 0x76e
jne 0x180007ab5
mov rdx, qword [rbp - 0x78]
mov r9d, 0x72
add rdx, 0x40
xor r8d, r8d
xor ecx, ecx
call fcn.18005e500
jmp 0x180007aab
mov rax, qword [rbp - 0x78]
mov edx, 0x1bb
mov word [rax + 0x60], dx
jmp 0x180007ab0
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x180007a99
mov rdx, qword [r12]
mov rcx, qword [rbp - 0x78]
mov r8, qword [r12 + 0x10]
add rcx, 0x20
call fcn.18002a5e0
movzx ecx, byte [rsp + 0x60]
mov eax, 0x77
add esi, 0xc0
mov dword [rsp + 0x78], esi
cmp esi, edi
jae case.0x180007142.0
mov r9, qword [rsp + 0x68]
jmp 0x1800072d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800254c0
int3
call fcn.180025500
int3
call fcn.180025380
int3