Function at 0x1400452b0
Capabilities:
Check os version
Delete registry key
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r15, r8
mov r12, rdx
mov rdi, rcx
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x7f], rbx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 6
ja 0x14004531c
jne 0x1400454a0
cmp edx, 1
jbe 0x1400454a0
cmp qword [0x1401afd58], 0xffffffff80000002
je 0x1400454a0
mov r8b, 1
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140044e20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or esi, 0xffffffff
cmp rcx, rbx
je 0x140045391
cmp dword [rbx + 0x10], 0
jl 0x140045383
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140045383
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], esi
jg 0x140045379
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x7f], rax
jmp 0x140045391
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x7f]
call fcn.1400023d0
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400453a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [0x1401afd58]
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp + 0x7f]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004540d
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140045417
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [0x1401afd58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140045445
xor dil, dil
jmp 0x1400456a1
mov rax, qword [r15]
mov rdx, qword [r12]
mov rcx, qword [rbp - 0x19]
cmp dword [rax - 0x10], 0
jne 0x140045460
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x140045497
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140045497
mov rdx, qword [r15]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x19]
jmp 0x140045695
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1f]
call fcn.140044e20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or esi, 0xffffffff
cmp rcx, rbx
je 0x140045504
cmp dword [rbx + 0x10], 0
jl 0x1400454f6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400454f6
call fcn.140002520
mov rdi, rax
lock add dword [rbx + 0x10], esi
jg 0x1400454ec
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x7f], rax
jmp 0x140045504
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x7f]
call fcn.1400023d0
nop
mov rdx, qword [rbp + 0x1f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004551c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401b4d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
xor edi, edi
cmp ecx, 0x11
jne 0x1400455ae
mov ecx, edi
mov eax, 0x5254e78f
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xc7
mov eax, r8d
sub eax, edx
cmp eax, 7
je 0x1400455a8
nop
mov eax, r8d
or eax, 0xffffffc8
add r8d, eax
inc ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x1400455a8
mov eax, 0x5254e78f
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xc7
mov eax, r8d
sub eax, edx
cmp eax, 7
jne 0x140045570
mov dword [0x1401b4d80], ecx
mov r14, qword [0x1401afd58]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rbp + 0x7f]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140045610
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004561a
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [0x1401afd58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400456a1
mov rax, qword [r15]
mov rdx, qword [r12]
mov rcx, qword [rbp - 1]
cmp dword [rax - 0x10], edi
jne 0x14004565a
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x140045691
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140045691
mov rdx, qword [r15]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
jg 0x1400456b8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret