Function at 0x180046310
Capabilities:
Delete registry value
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov qword [rbp - 0x41], r8
lea ecx, [rdx - 0xf]
mov r15, r9
mov dword [rsp + 0x34], ecx
cmp edx, ecx
jbe 0x1800466f1
mov r14d, dword [rbp - 0x7d]
lea r13d, [rdx - 0x127]
mov r12d, dword [rbp - 0x7d]
mov ebx, 3
movzx esi, byte [rsp + 0x39]
mov eax, ecx
lea rdx, [0x180000000]
mov r9d, 0x4479
cmp r13d, 0xf
ja case.default.0x180046390
mov ecx, dword [rdx + r13*4 + 0x4671c]
add rcx, rdx
jmp rcx
mov r8d, 4
lea rdx, [0x18009c06a]
lea rcx, [rbp - 0x39]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x18009c08d]
mov dword [rbp - 0x35], eax
movzx eax, byte [0x18009c091]
mov byte [rbp - 0x31], al
movzx eax, word [0x18009c0b2]
mov word [rbp - 0x30], ax
movzx eax, byte [0x18009c0b4]
mov byte [rbp - 0x2e], al
mov byte [rbp - 0x2d], 0
jmp case.0x180046390.1
mov byte [rsp + 0x30], 1
mov qword [rbp - 0x49], 0
jmp case.0x180046390.1
cmp byte [rsp + 0x39], 0
je 0x1800463fd
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
cmp byte [rsp + 0x38], 0
je 0x18004640e
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ILFree]
lea rcx, [rdi + 0xa]
cmp rcx, r15
je case.0x180046390.1
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x180046428
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.180047840
jmp case.0x180046390.1
mov byte [rbp - 0x39], 0
jmp case.0x180046390.1
mov eax, dword [rbp - 0x79]
lea r9, [rbp - 0x61]
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, r14d
lea rcx, [rbp - 0x39]
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov dword [rbp - 0x7d], eax
jmp case.0x180046390.1
movzx eax, byte [rsp + 0x38]
xor ecx, ecx
cmp qword [rbp - 0x69], rcx
cmovne ecx, eax
mov byte [rsp + 0x38], cl
jmp case.0x180046390.1
mov word [rbp - 0x2d], r9w
mov byte [rbp - 0x2b], 0
jmp case.0x180046390.1
mov dword [rbp - 0x71], 0
jmp case.0x180046390.1
mov byte [rsp + 0x39], 1
mov byte [rsp + 0x38], 1
jmp case.0x180046390.1
cmp byte [rsp + 0x30], 0
je case.0x180046390.1
mov ebx, 0x4c
mov eax, ebx
sub eax, 0x4c
je 0x1800464f3
sub eax, 1
je 0x1800464cf
cmp eax, 1
jne 0x180046538
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
jmp 0x180046538
xor ecx, ecx
movzx eax, sil
test r12d, r12d
cmove ecx, eax
movzx esi, cl
test cl, cl
je 0x180046538
mov rcx, qword [rbp - 0x59]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteUSValueW]
jmp 0x180046538
movups xmm0, xmmword [str._Z14convert_uchar8Dv8_s]
lea r9, [rbp - 0x59]
xor r8d, r8d
movups xmm1, xmmword [0x18009c0e8]
mov edx, 0xf003f
lea rcx, [rbp - 0x19]
movups xmmword [rbp - 0x19], xmm0
mov sil, 1
mov dword [rsp + 0x20], 0
movups xmm0, xmmword [0x18009c0f8]
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyW]
mov r12d, eax
inc ebx
cmp ebx, 0x4f
jb 0x1800464b2
jmp 0x18004664e
movzx ecx, word [r8]
mov ebx, 0x52
mov word [rsp + 0x40], cx
mov eax, ebx
sub eax, 0x52
je 0x180046591
sub eax, 0x5c
je 0x180046569
cmp eax, 0x34
je 0x1800465a0
jmp 0x180046595
mov edx, 0x50
mov rcx, rdi
call fcn.180069880
mov r8, rax
lea rdx, [0x1800a0c58]
lea rcx, [rsp + 0x40]
call fcn.180088fc0
movzx ecx, word [rsp + 0x40]
jmp 0x180046595
mov word [rdi + 8], cx
add ebx, 0x34
cmp ebx, 0xee
jb 0x180046556
xor eax, eax
mov r14d, 0xf003f
mov word [rsp + 0x48], ax
mov byte [rbp - 0x7f], al
jmp 0x18004664e
lea rcx, [rbp - 0x51]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rbp - 0x75], eax
lea rax, [0x180046760]
mov qword [rdi], rax
mov word [rsp + 0x48], bx
mov dword [rbp - 0x79], 0
jmp case.0x180046390.1
mov eax, dword [0x18009c11f]
lea rdx, [0x18009c15f]
mov dword [rbp - 0x2b], eax
lea rcx, [rbp - 0x39]
movzx eax, byte [0x18009c123]
mov r8, rbx
mov byte [rbp - 0x27], al
mov byte [rbp - 0x26], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x5772
mov byte [rbp - 0x21], 0
mov word [rbp - 0x23], ax
jmp case.0x180046390.1
movzx eax, byte [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov r8d, dword [rbp - 0x71]
xor ecx, ecx
cmp dword [rbp - 0x75], ecx
cmove ecx, eax
movzx ebx, cl
mov byte [rsp + 0x30], cl
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.SHELL32.dll_ILAppendID]
cmp dword [rbp - 0x7d], 0
mov qword [rbp - 0x69], rax
je 0x18004664e
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x30], bl
mov ebx, 3
mov eax, dword [rsp + 0x34]
dec r13d
lea ecx, [r13 + 0x127]
cmp ecx, eax
jbe 0x1800466f1
mov r8, qword [rbp - 0x41]
jmp 0x18004636e
mov ecx, dword [rdi]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
mov dword [rdi], edx
mov eax, dword [r15]
test eax, eax
je 0x1800466cd
nop word [rax + rax]
dec dword [r15]
mov ecx, dword [rdi]
lea eax, [rcx*4]
xor eax, ecx
add eax, eax
xor eax, ecx
shl eax, 2
xor eax, ecx
shr ecx, 1
and eax, 0xffe00000
shl eax, 0xa
or eax, ecx
mov dword [rdi], eax
cmp dword [r15], 0
jne 0x1800466a0
xor eax, eax
dec eax
mov dword [r15], eax
mov edx, dword [rdi]
mov eax, edx
shr eax, 8
mov ecx, edx
shl ecx, 8
xor eax, ecx
shl edx, 8
and eax, 0xff00ff
xor eax, edx
rol eax, 0x10
mov dword [rdi], eax
jmp 0x1800466f4
mov eax, dword [rbp - 0x7d]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180089600
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret