Function at 0x140010780
Capabilities:
Delete registry key
Get common file path
Query environment variable

Disassembly:
push r12
push r14
sub rsp, 0x578
cmp dword [rcx + 0x1b8], 0
mov r14d, edx
mov r12, rcx
je 0x1400107ba
lea rdx, str.SoftwareNirSoftProduKey
mov rcx, 0xffffffff80000001
add rsp, 0x578
pop r14
pop r12
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov qword [rsp + 0x590], rbx
mov qword [rsp + 0x598], rbp
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x5a0], rsi
mov qword [rsp + 0x5a8], rdi
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x20]
mov edx, 0x2e
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x14001081b
mov byte [rax], 0
mov rbp, qword [r12 + 0x2e8]
xor eax, eax
or rcx, 0xffffffffffffffff
xor ebx, ebx
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov eax, dword [str..cfg]
mov rsi, rbx
mov dword [rdi - 1], eax
movzx eax, byte [0x140028438]
mov byte [rdi + 3], al
mov eax, dword [rbp + 0x48]
mov edi, ebx
test eax, eax
jle 0x140010a4c
mov qword [rsp + 0x570], r13
lea r13, [0x140027e59]
cmp edi, eax
jge 0x140010884
test rsi, rsi
js 0x14001087f
cmp edi, dword [rbp + 0x28]
jge 0x14001087f
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + rsi*4]
add rdx, qword [rbp + 0x18]
jmp 0x140010887
mov rdx, rbx
jmp 0x140010887
mov rdx, r13
lea rcx, str._cfg
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x1400108aa
mov eax, dword [rbp + 0x48]
add edi, 1
add rsi, 1
cmp edi, eax
jl 0x140010864
jmp 0x140010a44
test edi, edi
js 0x140010a44
mov rdx, qword [r12 + 0x2e8]
add edi, 1
cmp edi, dword [rdx + 0x48]
jge 0x1400108df
test edi, edi
js 0x1400108dc
cmp edi, dword [rdx + 0x28]
jge 0x1400108dc
mov rax, qword [rdx + 0x10]
movsxd rcx, edi
mov r13d, dword [rax + rcx*4]
add r13, qword [rdx + 0x18]
jmp 0x1400108df
mov r13, rbx
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call sub.msvcrt.dll__mbschr
test rax, rax
jne 0x140010a44
lea rcx, [rsp + 0x461]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x460], bl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x130], bl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x460]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x460]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x20]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, 0x104
jae 0x140010a22
mov rcx, rbx
nop
movzx eax, byte [rsp + rcx + 0x460]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x12f], al
jne 0x140010990
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400109ea
movsxd rax, ecx
cmp byte [rsp + rax + 0x12f], 0x5c
je 0x1400109ea
xor eax, eax
lea rdi, [rsp + 0x130]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140010a10
jmp 0x140010a29
mov byte [rsp + 0x130], bl
mov rcx, rbx
nop
movzx eax, byte [rsp + rcx + 0x130]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x1f], al
jne 0x140010a30
mov r13, qword [rsp + 0x570]
mov rsi, qword [rsp + 0x5a0]
mov rbp, qword [rsp + 0x598]
lea rax, [0x1400287a0]
mov qword [rsp + 0x240], rax
mov byte [rsp + 0x250], bl
mov byte [rsp + 0x355], bl
mov dword [rsp + 0x248], r14d
mov rcx, rbx
movzx eax, byte [rsp + rcx + 0x20]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x24f], al
jne 0x140010a84
lea rcx, str.General
nop
movzx eax, byte [rbx + rcx]
add rbx, 1
test al, al
mov byte [rsp + rbx + 0x354], al
jne 0x140010aa0
mov rcx, qword [r12 + 0x2d0]
lea rdx, [rsp + 0x240]
call fcn.1400033f0
mov edi, dword [rsp + 0x248]
mov rbx, qword [rsp + 0x590]
test edi, edi
je 0x140010afe
mov rcx, qword [r12 + 0x110]
test rcx, rcx
je 0x140010b11
lea rdx, [r12 + 0x17c]
mov dword [rdx], 0x2c
call qword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x140010b11
xor edx, edx
lea rcx, [r12 + 0x17c]
lea r8d, [rdx + 0x2c]
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x240]
lea r8, [r12 + 0x17c]
lea rdx, str.WinPos
lea rcx, [rsp + 0x240]
mov r9d, 0x2c
call qword [rax + 0x18]
test edi, edi
mov rdi, qword [rsp + 0x5a8]
jne 0x140010b4d
mov rcx, r12
call fcn.140022a70
mov rcx, qword [r12 + 0x2d8]
lea r9, str.Sort
lea r8, str.Columns
lea rdx, [rsp + 0x240]
call fcn.1400186f0
add rsp, 0x578
pop r14
pop r12
ret