Function at 0x18009d410
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x338]
sub rsp, 0x438
mov rax, qword [0x1800b88d0]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov eax, dword [rbp + 0x3a8]
mov r10, r9
mov r12, qword [rbp + 0x3a0]
mov qword [rbp - 0x78], r9
mov r9, r8
mov qword [rbp - 0x80], r8
mov r8, rdx
lea ebx, [rax + 0x11]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rcx
mov rdx, rcx
mov qword [rbp - 0x20], r12
mov dword [rsp + 0x60], ebx
cmp eax, ebx
jae case.0x18009dbe2.0
mov r13, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x70]
mov ecx, dword [rsp + 0x60]
xor r11d, r11d
lea r15, [0x180000000]
add eax, 0xffffff09
lea r14d, [r11 + 0x65]
cmp eax, 0x12
ja case.default.0x18009d4b6
mov ecx, dword [r15 + rax*4 + 0x9dfb0]
add rcx, r15
jmp rcx
mov eax, 0x4e
nop dword [rax]
cmp eax, 0x4e
je 0x18009df96
add eax, 0xbd
cmp eax, 0x10b
jb 0x18009d4c0
mov eax, 0x2e
mov dword [rbp + 0x38], 0x6c0065
mov word [rbp + 0x40], ax
mov dword [rbp + 0x3c], 0x320033
jmp case.0x18009d4b6.262
mov dword [rbp + 0x42], 0x6c0064
mov dword [rbp + 0x46], 0x6c
jmp case.0x18009d4b6.262
mov eax, 0x72
mov word [rbp + 0x21], ax
mov eax, 0x73
mov dword [rbp + 0x22], 0x65636f
mov word [rbp + 0x25], ax
jmp case.0x18009d4b6.262
lea rcx, [rbp + 0xe0]
mov word [rbp + 0xe0], r11w
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18009d535
mov eax, dword [0x1800af4ec]
movups xmm0, xmmword [str.rnel32.dl]
mov dword [rcx], eax
movzx eax, word [0x1800af4f0]
mov word [rcx + 4], ax
mov eax, dword [0x1800af508]
mov dword [rbp + 0xf4], eax
mov eax, 0x6c
mov dword [rbp + 0xf6], eax
movups xmmword [rbp + 0xe4], xmm0
jmp case.0x18009d4b6.262
mov r8d, 6
lea rdx, str.ocess3
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 0xa
lea rdx, [rbp + 0xd8]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov r8d, 6
lea rdx, str.First
lea rcx, [rbp + 0xd9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x78]
jmp case.0x18009d4b6.262
mov eax, 0x50
mov word [rbp + 0x20], ax
jmp case.0x18009d4b6.262
cmp byte [r12 + 0x284], 0
je 0x18009d7e7
mov r14d, 0x12
cmp r14d, 0x12
ja case.0x18009d61a.2
mov eax, r14d
mov ecx, dword [r15 + rax*4 + 0x9dffc]
add rcx, r15
jmp rcx
mov eax, 0x4c
mov word [rbp + 0xb8], ax
jmp case.0x18009d61a.2
mov rcx, qword [r12 + 0x260]
lea rdx, [r12 + 0x28]
call r13
test eax, eax
je 0x18009d7ff
xor r11d, r11d
jmp case.0x18009d61a.2
mov eax, dword [0x1800af51c]
mov dword [rbp + 0x70], eax
movzx eax, word [0x1800af520]
mov word [rbp + 0x74], ax
mov dword [rbp + 0xca], 0x6e006f
mov word [rbp + 0xce], r11w
jmp case.0x18009d61a.2
mov dword [rbp + 0xa2], 0x750043
jmp case.0x18009d61a.2
mov eax, 0x69
mov word [rbp + 0xc8], ax
jmp case.0x18009d61a.2
mov eax, 0x72
mov dword [rbp + 0x98], 0x610050
mov word [rbp + 0x9c], ax
jmp case.0x18009d61a.2
mov eax, 0x44
mov dword [rbp + 0xaa], 0x6d006f
mov word [rbp + 0xae], ax
jmp case.0x18009d61a.2
mov dword [rbp + 0x9e], 0x650073
jmp case.0x18009d61a.2
mov eax, dword [0x1800af534]
movsd xmm0, qword [str.o_eB]
mov dword [rbp + 0x8a], eax
mov eax, 0x65
mov dword [rbp + 0x8e], eax
mov dword [rbp + 0x90], 0x42
movsd qword [rbp + 0x82], xmm0
jmp case.0x18009d61a.2
mov dword [rbp + 0xb0], 0x620065
mov dword [rbp + 0xb4], 0x670075
jmp case.0x18009d61a.2
movabs rax, 0x4200650022
mov qword [rbp + 0x74], rax
mov dword [rbp + 0x7a], 0x6f
mov dword [rbp + 0x7c], 0x22
jmp case.0x18009d61a.2
mov dword [rbp + 0xc4], 0x740063
jmp case.0x18009d61a.2
mov rcx, qword [rbp + 8]
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x98]
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor r11d, r11d
jmp case.0x18009d61a.2
mov eax, dword [0x1800af53c]
mov dword [rbp + 0x7e], eax
movzx eax, word [0x1800af540]
mov word [rbp + 0x82], ax
jmp case.0x18009d61a.2
mov dword [rbp + 0xba], 0x6e0069
jmp case.0x18009d61a.2
mov dword [rbp + 0xa6], 0x740073
jmp case.0x18009d61a.2
mov eax, 0x65
mov dword [rbp + 0xbe], 0x530065
mov word [rbp + 0xc2], ax
jmp case.0x18009d61a.2
mov qword [rbp + 8], 0xffffffff80000001
mov byte [r12 + 0x284], 0
dec r14d
lea eax, [r14 + 0x12a]
cmp eax, 0x129
ja 0x18009d602
jmp 0x18009d5c8
mov rcx, qword [r12 + 0x260]
lea rdx, [r12 + 0x28]
call qword [rbp - 0x70]
test eax, eax
jne 0x18009d5c8
mov byte [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.1800a5da0
add rsp, 0x438
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r12d, 0x46
cmp r12d, 0x46
je 0x18009d912
cmp r12d, 0x110
je 0x18009d8fe
cmp r12d, 0x1022
je 0x18009d93e
cmp r12d, 0x3eb0
je 0x18009d87b
cmp r12d, 0x7c50
jne 0x18009d928
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009d925
mov r13, qword [rbp - 0x18]
mov r15d, 0xc4
mov r14, qword [r13 + 0x10]
mov qword [r13], r11
nop dword [rax]
mov eax, r15d
sub eax, 0xc4
je 0x18009d8d2
sub eax, 0x33
je 0x18009d8e8
sub eax, 0x88
je 0x18009d8b4
sub eax, 0x33
je 0x18009d8e8
cmp eax, 0xbb
je 0x18009d8f8
jmp 0x18009d8e8
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
mov qword [r14], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r11d, r11d
jmp 0x18009d8e8
test r14, r14
je 0x18009d8f8
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r11d, r11d
mov qword [r14 + 8], r11
add r15d, 0xbb
cmp r15d, 0x46b
jb 0x18009d890
mov qword [r13 + 0x10], r11
jmp 0x18009d928
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009d925
xor r8d, r8d
lea rcx, [rbp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x10], rax
xor r11d, r11d
add r12d, 0xfdc
cmp r12d, 0x4f4c
jbe 0x18009d832
jmp 0x18009d952
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov r13, rsi
mov r12d, 0x46
nop dword [rax + rax]
cmp r12d, 0x46
je 0x18009da4e
cmp r12d, 0x110
je 0x18009da34
cmp r12d, 0x1022
je 0x18009da7a
cmp r12d, 0x3eb0
je 0x18009d9a9
cmp r12d, 0x7c50
jne 0x18009da64
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009da64
mov rax, qword [rbp - 0x30]
mov r15d, 0xc4
mov r14, qword [rax + 0x10]
mov qword [rax], 0
nop
mov eax, r15d
sub eax, 0xc4
je 0x18009d9ff
sub eax, 0x33
je 0x18009da16
sub eax, 0x88
je 0x18009d9e4
sub eax, 0x33
je 0x18009da16
cmp eax, 0xbb
je 0x18009da26
jmp 0x18009da16
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
mov qword [r14], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009da16
test r14, r14
je 0x18009da26
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 8], 0
add r15d, 0xbb
cmp r15d, 0x46b
jb 0x18009d9c0
mov rax, qword [rbp - 0x30]
mov qword [rax + 0x10], 0
jmp 0x18009da64
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x30], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009da64
xor r8d, r8d
lea rcx, [rbp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 8], rax
add r12d, 0xfdc
cmp r12d, 0x4f4c
jbe 0x18009d960
jmp 0x18009da8e
mov rcx, qword [rbp - 8]
lea rdx, str.CreateToolhelp32Snapshot
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, qword [rsp + 0x70]
mov edx, 0x51
xor ecx, ecx
call fcn.1800a17a0
mov r12, qword [rbp - 0x20]
cmp qword [r12 + 0x260], 0xffffffffffffffff
jne 0x18009d5c8
mov r15d, 0x3d
nop dword [rax + rax]
cmp r15d, 0x169
ja 0x18009db66
je 0x18009db4a
mov eax, r15d
sub eax, 0x3d
je 0x18009db2a
sub eax, 0x4b
je 0x18009db21
sub eax, 0x4b
je 0x18009dafa
cmp eax, 0x4b
jne 0x18009dd1d
mov dword [rbp + 0x18], 0x4d736c6c
mov byte [rbp + 0x1c], 0
jmp 0x18009dd1d
mov r8d, 2
mov byte [rbp + 0x12], 0
lea rdx, [0x1800af5b4]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x14], 0x65437461
jmp 0x18009dd1d
mov byte [rbp + 0x11], 0x6f
jmp 0x18009dd1d
mov r8d, 1
mov byte [rbp + 0x10], 0
lea rdx, [0x1800af701]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18009dd1d
mov r8d, 1
lea rdx, [0x1800af56d]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18009dd1d
mov eax, r15d
sub eax, 0x1b4
je 0x18009dd10
sub eax, 0x4b
je 0x18009dccf
sub eax, 0x4b
je 0x18009dcc6
cmp eax, 0x4b
jne 0x18009dd1d
mov eax, dword [rbp - 0x64]
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x100]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_UrlCombineA]
cmp qword [r12 + 0x260], 0xffffffffffffffff
jne 0x18009dd1d
mov r14d, 7
cmp r14d, 7
ja case.default.0x18009dbe2
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0x9e048]
add rcx, rdx
jmp rcx
mov r8d, 3
lea rdx, [0x1800af5ea]
lea rcx, [rbp + 0x61]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x1800af626]
mov dword [rbp + 0x64], eax
movzx eax, byte [0x1800af62a]
mov byte [rbp + 0x68], al
mov byte [rbp + 0x69], 0
jmp case.default.0x18009dbe2
mov byte [rbp + 0x57], 0
jmp case.default.0x18009dbe2
mov byte [rsp + 0x68], 0
jmp case.default.0x18009dbe2
mov r8d, 3
lea rdx, [0x1800af64f]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x5a], 0x4d544942
jmp case.default.0x18009dbe2
xor r9d, r9d
mov dword [rbp - 0x68], 0x104
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_UrlCreateFromPathA]
jmp case.default.0x18009dbe2
mov r8d, 3
mov byte [rbp + 0x5e], 0
lea rdx, [0x1800af672]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x18009dbe2
mov r8d, 4
lea rdx, [0x1800af6a2]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1800af6b8]
mov word [rbp + 0x54], ax
movzx eax, byte [0x1800af6ba]
mov byte [rbp + 0x56], al
dec r14d
lea eax, [r14 + 0x24]
cmp eax, 0x23
ja 0x18009dbc4
jmp 0x18009dd1d
mov dword [rbp - 0x64], 0
jmp 0x18009dd1d
movups xmm0, xmmword [str.Location:_https:___s:_d_s]
xor edx, edx
movzx eax, word [0x1800af800]
movsd xmm1, qword [0x1800af7f8]
movups xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x88], ax
lea ecx, [rdx + 2]
movsd qword [rbp + 0x80], xmm1
call rbx
mov qword [r12 + 0x260], rax
mov dword [rbp - 0x60], 0x104
jmp 0x18009dd1d
mov eax, 0x756e
mov byte [rbp + 0x1f], 0
mov word [rbp + 0x1d], ax
add r15d, 0x4b
cmp r15d, 0x2e0
jb 0x18009dac0
jmp 0x18009d5c8
lea rax, [r12 + 0x54]
mov qword [rdx], rax
mov eax, dword [r12 + 0x30]
mov dword [rdx + 0x18], eax
jmp case.0x18009d4b6.262
mov eax, 0x7478
mov word [rbp + 0x2b], ax
jmp case.0x18009d4b6.262
mov eax, 0x57
mov dword [rbp + 0x32], 0x720065
mov word [rbp + 0xde], ax
mov eax, 0x6b
mov word [rbp + 0x30], ax
mov eax, 0x6e
mov word [rbp + 0x36], ax
jmp case.0x18009d4b6.262
mov r12d, 0x46
cmp r12d, 0x46
je 0x18009de6f
cmp r12d, 0x110
je 0x18009de52
cmp r12d, 0x1022
je 0x18009dea9
cmp r12d, 0x3eb0
je 0x18009ddcf
cmp r12d, 0x7c50
jne 0x18009de88
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009de85
mov rax, qword [rbp - 0x28]
mov r15d, 0xc4
mov r14, qword [rax + 0x10]
mov qword [rax], r11
mov eax, r15d
sub eax, 0xc4
je 0x18009de22
sub eax, 0x33
je 0x18009de38
sub eax, 0x88
je 0x18009de04
sub eax, 0x33
je 0x18009de38
cmp eax, 0xbb
je 0x18009de48
jmp 0x18009de38
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
mov qword [r14], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r11d, r11d
jmp 0x18009de38
test r14, r14
je 0x18009de48
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r11d, r11d
mov qword [r14 + 8], r11
add r15d, 0xbb
cmp r15d, 0x46b
jb 0x18009dde0
mov rax, qword [rbp - 0x28]
mov qword [rax + 0x10], r11
jmp 0x18009de88
lea rax, [0x1800af808]
movabs rcx, 0x6e00720065006b
mov qword [rbp - 0x28], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009de85
xor r8d, r8d
lea rcx, [0x1800af808]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp], rax
xor r11d, r11d
add r12d, 0xfdc
cmp r12d, 0x4f4c
jbe 0x18009dd86
mov r12, qword [rbp - 0x20]
mov qword [rbp - 0x70], rdi
jmp 0x18009d5c8
mov rcx, qword [rbp]
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, qword [rbp - 0x20]
mov rdi, rax
mov qword [rbp - 0x70], rax
jmp 0x18009d5c8
mov eax, 0x73
mov word [rbp + 0x26], ax
mov dword [rbp + 0x27], 0x4e3233
mov word [rbp + 0x2a], r14w
jmp case.0x18009d4b6.262
mov eax, dword [r9]
xor r9d, r9d
mov ecx, dword [r8]
lea r8, [rbp - 0x38]
mov dword [rbp - 0x40], eax
mov eax, dword [rdx]
lea rdx, [rsp + 0x68]
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x58], eax
mov eax, dword [r12]
mov dword [rsp + 0x68], eax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], r11
mov dword [rsp + 0x40], 0x8c
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x48], ecx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18006f230
mov qword [rsp + 0x68], rax
jmp 0x18009d5c8
mov eax, 0x57
mov word [rbp + 0x2d], ax
movzx eax, word [0x1800af824]
mov word [rbp + 0xd0], ax
movzx eax, byte [0x1800af826]
mov byte [rbp + 0xd2], al
mov ecx, dword [rsp + 0x60]
mov eax, dword [rbp + 0x3a8]
inc eax
mov dword [rbp + 0x3a8], eax
cmp eax, ecx
jae case.0x18009dbe2.0
jmp 0x18009d48f
mov eax, dword [r12 + 0x48]
mov dword [rdx + 0x1c], eax
mov eax, dword [r12 + 0x44]
mov dword [rdx + 0x20], eax
mov byte [rsp + 0x68], 1
jmp case.0x18009dbe2.0