Function at 0x18000ac30
Capabilities:
Delete registry value
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x180081de0]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r11d, 0x6e
mov qword [rsp + 0x60], rdx
lea edi, [rcx - 0xd]
mov rsi, r8
lea r10, [0x180000000]
mov r13d, ecx
lea r12d, [r11 - 0xb]
lea r9d, [r11 + 2]
lea r8d, [r11 - 9]
lea r15d, [r11 + 1]
cmp ecx, edi
jbe 0x18000ae6d
lea ebx, [rcx - 0x9f]
lea r14d, [r11 - 0x1e]
nop dword [rax]
cmp ebx, 0x23
ja case.0x18000acbd.13
movzx eax, byte [r10 + rbx + 0xb630]
mov ecx, dword [r10 + rax*4 + 0xb5f8]
add rcx, r10
jmp rcx
mov word [rbp - 0x10], r11w
mov word [rbp - 0xf], r12w
jmp case.0x18000acbd.13
mov byte [rbp - 0x7c], r14b
jmp case.0x18000acbd.13
mov r8d, 2
lea rdx, [0x180075908]
lea rcx, [rbp - 0xe]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
lea rdx, [0x18007939b]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 1
mov byte [rbp - 0x7d], 0
lea rdx, [0x1800793be]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov rdx, qword [rsp + 0x60]
lea r10, [0x180000000]
mov r11d, 0x6e
lea r8d, [r11 - 9]
lea r9d, [r11 + 2]
jmp case.0x18000acbd.13
mov word [rbp - 0x25], r9w
mov word [rbp - 0x24], r8w
jmp case.0x18000acbd.13
mov eax, dword [rdx + 0x18]
cmp dword [rdx], eax
jge 0x18000aec2
mov rax, qword [rdx + 0x10]
mov ecx, 7
sub cl, byte [rdx + 4]
movzx edx, byte [rax]
shr edx, cl
and edx, 1
mov dword [rsp + 0x4c], edx
mov rdx, qword [rsp + 0x60]
jmp case.0x18000acbd.13
lea rax, [rbp - 0x28]
mov word [rbp - 0x28], r14w
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x18000ad90
movzx ecx, word [0x1800765d8]
mov word [rax], cx
mov word [rbp - 0x26], r8w
jmp case.0x18000acbd.13
mov r8d, 1
lea rdx, [0x1800793e4]
lea rcx, [rbp - 0x77]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000ad20
movzx eax, word [0x180079414]
mov word [rbp - 0x7a], ax
movzx eax, byte [0x180079416]
mov byte [rbp - 0x78], al
mov byte [rbp - 0x7b], 0x41
mov byte [rbp - 0x77], 0
jmp case.0x18000acbd.13
movzx eax, word [0x180079420]
mov word [rbp - 0x13], ax
mov word [rbp - 0x11], r8w
jmp case.0x18000acbd.13
mov r8d, 2
lea rdx, [0x180075c00]
lea rcx, [rbp - 0x23]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
lea rdx, [0x180079424]
lea rcx, [rbp - 0x22]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.kenM]
mov word [rbp - 0x20], r15w
mov dword [rbp - 0x1f], eax
movzx eax, byte [0x18007942c]
mov byte [rbp - 0x1b], al
jmp 0x18000ad20
movsd xmm0, qword [str.emoryRef]
movzx eax, byte [0x180079438]
movsd qword [rbp - 0x1b], xmm0
mov byte [rbp - 0x13], al
dec ebx
lea eax, [rbx + 0x9f]
cmp eax, edi
ja 0x18000aca0
lea r8d, [r13 + 0xd]
mov dword [rsp + 0x40], r8d
cmp r13d, r8d
jae case.0x18000aec0.12
mov r15d, dword [rsp + 0x50]
lea r8d, [r13 - 0xa8]
mov edi, dword [rsp + 0x50]
xor r9d, r9d
mov r14d, dword [rsp + 0x50]
movzx r12d, word [rsp + 0x44]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], r8d
mov ebx, 0x44
cmp r8d, 0xc
ja case.default.0x18000aec0
mov ecx, dword [r10 + r8*4 + 0xb654]
add rcx, r10
jmp rcx
mov eax, 0xffffffff
jmp 0x18000b5cb
mov rcx, qword [rdx + 8]
mov eax, dword [rcx + 8]
add eax, dword [rcx + 4]
jmp 0x18000b5cb
mov byte [rsp + 0x4c], 1
jmp case.0x18000aec0.5
mov dword [rsp + 0x68], 0xf003f
jmp case.0x18000aec0.5
mov rbx, qword [rsp + 0x70]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x54], eax
call fcn.18004b2a0
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18000af20
mov rdx, qword [rsi]
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x48]
xor r9d, r9d
jmp case.0x18000aec0.5
cmp byte [rsp + 0x44], 0
je case.0x18000aec0.5
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteUSValueA]
mov r8d, dword [rsp + 0x48]
xor r9d, r9d
jmp case.0x18000aec0.5
mov eax, dword [str.OR_PA]
mov dword [rbp + 0x3c], eax
movzx eax, word [0x180079440]
mov word [rbp + 0x40], ax
jmp case.0x18000aec0.5
mov word [rbp + 0x41], bx
jmp case.0x18000aec0.5
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x18000afa0
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, dword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x44], 1
jmp case.0x18000aec0.5
movsd xmm0, qword [str.GST_CORE]
lea rdx, [0x180078454]
mov eax, 0x5f
mov byte [rbp - 0x76], 0
lea rcx, [rbp + 0x30]
movsd qword [rbp + 0x30], xmm0
mov word [rbp + 0x38], ax
lea r8d, [rax - 0x5e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x180079454]
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
mov word [rbp + 0x3a], ax
movzx eax, byte [0x180079456]
mov byte [rbp + 0x3c], al
jmp case.0x18000aec0.5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x68]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], 0
lea rcx, [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp eax, dword [rsp + 0x58]
je 0x18000af3c
mov ebx, 0xfe
nop
cmp ebx, 0x324aa
ja 0x18000b232
je 0x18000b1f6
cmp ebx, 0x1662e
ja 0x18000b148
je 0x18000b118
cmp ebx, 0xfe
je 0x18000b104
cmp ebx, 0x5a4a
je 0x18000b0e7
cmp ebx, 0xb396
je 0x18000b0c9
xor r9d, r9d
cmp ebx, 0x10ce2
jne 0x18000b186
mov eax, 0x6b
mov word [rbp - 0x65], ax
jmp 0x18000b186
mov eax, 0x6c
mov word [rbp - 0x6b], ax
mov eax, 0x5c
mov word [rbp - 0x66], ax
mov dword [rbp - 0x6a], 0x3a636162
jmp 0x18000b183
mov eax, 0x52
mov word [rbp - 0x6e], ax
mov eax, 0x6f
mov word [rbp - 0x6d], ax
mov eax, 0x6c
mov word [rbp - 0x6c], ax
jmp 0x18000b183
mov eax, 0x44
mov word [rbp - 0x70], ax
mov eax, 0x69
mov word [rbp - 0x6f], ax
jmp 0x18000b183
mov r8d, 5
lea rdx, [0x180079694]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x77
mov word [rbp + 2], ax
movabs rax, 0x3400360077002d
mov qword [rbp + 4], rax
jmp 0x18000b183
cmp ebx, 0x1bf7a
je 0x18000b1ec
cmp ebx, 0x218c6
je 0x18000b1c4
cmp ebx, 0x27212
je 0x18000b1a2
cmp ebx, 0x2cb5e
jne 0x18000b183
mov r8d, 2
lea rdx, [0x1800796f2]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r9d, r9d
add ebx, 0x594c
cmp ebx, 0x6a0a4
jbe 0x18000b070
mov r8d, dword [rsp + 0x48]
jmp case.0x18000aec0.5
movsd xmm0, qword [0x180079594]
xor r9d, r9d
movzx eax, word [0x18007959c]
movsd qword [rbp + 0x16], xmm0
mov word [rbp + 0x1e], ax
mov word [rbp + 0x20], r9w
jmp 0x18000b186
mov r8d, 3
lea rdx, [0x180079600]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r9d, r9d
mov dword [rbp + 0x12], 0x74006e
mov word [rbp + 0x16], r9w
jmp 0x18000b186
xor r9d, r9d
mov word [rbp + 0xc], r9w
jmp 0x18000b186
xor eax, eax
lea rdx, [0x18007946e]
lea rcx, [rbp - 8]
mov word [rbp + 0x24], ax
lea r8d, [rax + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor eax, eax
mov dword [rbp + 0x26], 0x720075
mov word [rbp + 0x2a], ax
lea rdx, [0x180079516]
lea rcx, [rbp + 0x2a]
lea r8d, [rax + 2]
jmp 0x18000b17d
cmp ebx, 0x4e326
ja 0x18000b338
je 0x18000b315
cmp ebx, 0x37df6
je 0x18000b2d2
cmp ebx, 0x3d742
je 0x18000b2c4
cmp ebx, 0x4308e
je 0x18000b294
cmp ebx, 0x489da
jne 0x18000b183
xor eax, eax
lea rdx, [0x180079656]
lea rcx, [rbp - 0x42]
mov word [rbp - 0x42], ax
lea r8d, [rax + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r9d, r9d
mov word [rbp - 0x3c], r9w
jmp 0x18000b186
xor eax, eax
lea rdx, [0x1800797c6]
lea rcx, [rbp - 0x60]
mov word [rbp - 0x50], ax
lea r8d, [rax + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x62
mov dword [rbp - 0x48], 0x610054
mov word [rbp - 0x44], ax
jmp 0x18000b183
mov eax, 0x5f
mov word [rbp - 0x52], ax
jmp 0x18000b183
xor eax, eax
lea rdx, str.pkix_VerifyNode_Hashcode
lea rcx, [rbp - 0x60]
mov word [rbp + 0x2e], ax
lea r8d, [rax + 5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
lea rdx, [0x180079774]
lea rcx, [rbp - 0x56]
mov word [rbp - 0x56], ax
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r9d, r9d
mov word [rbp - 0x52], r9w
jmp 0x18000b186
mov r8d, 5
lea rdx, [0x1800796ca]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp - 0x32], 0x6f
jmp 0x18000b183
cmp ebx, 0x53c72
je 0x18000b3bf
cmp ebx, 0x595be
je 0x18000b37f
cmp ebx, 0x5ef0a
je 0x18000b361
cmp ebx, 0x64856
je case.0x18000aec0.12
jmp 0x18000b183
mov r9d, edi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 8]
mov ecx, r15d
call qword [sym.imp.SHLWAPI.dll_StrIsIntlEqualW]
mov byte [rsp + 0x4c], 0
jmp 0x18000b183
xor eax, eax
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18000b392
mov rax, qword [rsi]
lea rcx, [rbp - 0x70]
mov byte [rax], 0
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea rax, [rbp - 8]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000b3b0
jmp 0x18000b183
xor r9d, r9d
mov dword [rbp - 0x30], 0x79
mov r15d, r9d
jmp 0x18000b186
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_StrCmpCA]
movzx eax, byte [rsp + 0x44]
xor r9d, r9d
cmp dword [rsp + 0x50], r9d
mov ecx, r9d
mov r8d, dword [rsp + 0x48]
cmove ecx, eax
mov byte [rsp + 0x44], cl
jmp case.0x18000aec0.5
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x18000b588
mov ebx, reloc.SHLWAPI.dll_GetAcceptLanguagesA
cmp ebx, 0xe
ja case.default.0x18000b427
mov eax, ebx
mov ecx, dword [r10 + rax*4 + 0xb688]
add rcx, r10
jmp rcx
mov eax, dword [0x1800799f0]
mov dword [rbp + 0x14], eax
movzx eax, word [0x1800799f4]
mov word [rbp + 0x18], ax
mov word [rbp + 0x1a], r9w
jmp case.default.0x18000b427
mov word [rbp + 0xc], r9w
jmp case.default.0x18000b427
mov r8d, 2
lea rdx, [0x180079a6a]
lea rcx, [rbp + 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r9d, r9d
lea r10, [0x180000000]
jmp case.default.0x18000b427
mov eax, 0x45
mov dword [rbp - 0x36], 0x74
mov word [rbp - 4], ax
mov dword [rbp - 8], 0x540053
jmp case.default.0x18000b427
mov dword [rbp - 2], 0x5f0050
mov word [rbp + 2], r9w
jmp case.default.0x18000b427
mov eax, 0x44
mov dword [rbp - 0x5e], 0x4d004f
mov word [rbp - 0x60], ax
mov eax, 0x41
mov word [rbp - 0x5a], ax
jmp case.default.0x18000b427
mov r14d, 0x104
mov r12d, 0x47
jmp case.default.0x18000b427
mov eax, 0x70
mov word [rbp - 0x58], ax
jmp case.default.0x18000b427
mov r8d, r14d
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsi]
xor r9d, r9d
lea r10, [0x180000000]
jmp case.default.0x18000b427
mov dword [rbp + 2], 0x540041
lea rdx, [0x180079ad4]
mov word [rbp + 6], r9w
lea rcx, [rbp + 6]
mov r8d, 3
jmp 0x18000b462
mov eax, 0x2e
mov dword [rbp - 0x42], 0x6f0063
mov word [rbp - 0x44], ax
jmp case.default.0x18000b427
mov dword [rbp + 0x10], 0x55004f
mov word [rbp + 0x14], r9w
jmp case.default.0x18000b427
mov dword [rbp - 0x3e], 0x6e006e
mov dword [rbp - 0x3a], 0x630065
jmp case.default.0x18000b427
mov eax, 0x61
mov dword [rbp - 0x56], 0x6c0070
mov word [rbp - 0x4e], ax
mov dword [rbp - 0x52], 0x630069
mov dword [rbp - 0x4c], 0x690074
mov dword [rbp - 0x48], 0x6e006f
dec ebx
lea eax, [rbx + 0x77]
cmp eax, 0x76
ja 0x18000b411
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x58], r9d
mov eax, dword [rsp + 0x40]
inc r8d
inc r13d
mov dword [rsp + 0x48], r8d
cmp r13d, eax
jae case.0x18000aec0.12
mov rdx, qword [rsp + 0x60]
lea r10, [0x180000000]
jmp 0x18000aea6
movzx r8d, r12w
lea rcx, [rbp - 8]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrIW]
mov byte [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.18005fed0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret