Function at 0x1800ee360
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov r11, qword [rbp + 0xc8]
mov r10, rdx
mov rsi, qword [rbp + 0xd0]
xor ebx, ebx
mov rdi, qword [rbp + 0xd8]
mov qword [rsp + 0x70], rdx
mov edx, dword [rbp + 0xc0]
mov r14d, edx
imul eax, edx, 0xf00
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], r11
mov dword [rbp - 0x70], eax
cmp edx, eax
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rdi
ja 0x1800eea58
mov r15, qword [rbp - 0x60]
mov r13, qword [rbp - 0x60]
mov r12, qword [rbp - 0x60]
cmp r14d, 0xcf8a
ja 0x1800ee7d9
je 0x1800ee7d1
cmp r14d, 0x572d
ja 0x1800ee598
je 0x1800ee54d
cmp r14d, 0xc0
ja 0x1800ee4cf
je 0x1800ee4af
mov eax, r14d
sub eax, 0x67
je 0x1800ee4a1
sub eax, 0x23
je 0x1800ee498
cmp eax, 0x23
jne 0x1800eea38
mov r9, r10
mov dword [rbp - 0x80], 0xf8
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], rbx
xor edx, edx
lea ecx, [rax - 8]
call fcn.1800bc830
mov r15, rax
test rax, rax
jne 0x1800eea23
mov edx, 0xb4
mov ecx, edx
sub ecx, 0xb4
je 0x1800ee485
cmp ecx, 1
je 0x1800eee56
jmp 0x1800ee489
mov qword [rbp - 0x68], rbx
inc edx
cmp edx, 0xb6
jb 0x1800ee470
jmp 0x1800eea23
mov qword [rbp - 0x40], r8
jmp 0x1800eea38
mov eax, 0x43
mov word [rbp + 0x18], ax
jmp 0x1800eea38
mov dword [rbp - 0x18], 0xce636261
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x28], eax
mov word [rbp - 0x14], 0xec
movzx eax, word [rbp - 0x14]
mov word [rbp + 0x2c], ax
jmp 0x1800eea38
cmp r14d, 0x33e7
je 0x1800ee541
cmp r14d, 0x458a
jne 0x1800eea38
mov rax, qword [rbp - 0x40]
mov rdx, r11
movsxd r8, dword [rdi]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [rax + 0x40]
mov qword [rbp - 0x38], rax
cmp rax, 1
jge 0x1800eea23
mov edx, 0xef
nop
mov ecx, edx
sub ecx, 0xef
je 0x1800ee525
cmp ecx, 0x3e
je 0x1800eee56
jmp 0x1800ee531
mov qword [rsp + 0x70], rbx
mov dword [rbp - 0x68], 0xfffffff6
add edx, 0x3e
cmp edx, 0x16b
jb 0x1800ee510
jmp 0x1800eea23
mov dword [rbp + 0x19], 0x6c6c61
jmp 0x1800eea38
mov r9, r15
mov dword [rsp + 0x58], 0xf8
xor r8d, r8d
lea rcx, [rsp + 0x58]
mov edx, 0xd5
call fcn.1800c77c0
mov eax, dword [rdi + 8]
lea r9, [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
mov edx, 0x11b
mov r8, qword [rdi]
add rcx, 0xa0
mov dword [rsp + 0x58], eax
call fcn.1800487a0
mov qword [rbp - 0x30], rax
jmp 0x1800eea23
cmp r14d, 0x9ae7
ja 0x1800ee611
je 0x1800ee5fc
cmp r14d, 0x60c0
je 0x1800ee5e1
cmp r14d, 0x6767
je 0x1800ee5d3
cmp r14d, 0x8a8a
jne 0x1800eea38
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
add qword [rcx + 8], rax
jmp 0x1800eea33
mov eax, 0x61
mov word [rbp + 0x1c], ax
jmp 0x1800eea38
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xc5
call fcn.1800bb7d0
mov qword [rbp - 0x50], rax
jmp 0x1800eea23
mov eax, 0x62
mov word [rbp + 0x1d], ax
mov dword [rbp + 0x1e], 0x6857656c
jmp 0x1800eea38
cmp r14d, 0xadad
je 0x1800ee635
cmp r14d, 0xce67
jne 0x1800eea38
mov eax, 0x6e65
mov word [rbp + 0x22], ax
jmp 0x1800eea38
mov r8, qword [rbp - 0x30]
test r8, r8
jne 0x1800ee77c
mov esi, 0xee
nop word [rax + rax]
mov eax, esi
sub eax, 0xee
je 0x1800ee76a
sub eax, 1
je 0x1800ee6f2
sub eax, 1
je 0x1800ee6ca
sub eax, 1
je 0x1800ee67b
cmp eax, 1
jne 0x1800ee6b7
mov qword [r12], r13
jmp 0x1800ee6b7
mov edx, dword [rbp - 0x58]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea r9, [r11 + 0x48]
mov qword [rsp + 0x28], 0xa
lea r8, str.O_knN_dev_null
mov rcx, r13
mov qword [rsp + 0x20], rdi
call fcn.18007ff70
mov dword [r12 + 8], eax
mov r11, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
inc esi
cmp esi, 0xf3
jb 0x1800ee650
mov rsi, qword [rbp - 0x20]
jmp 0x1800eea23
mov r9, r10
mov dword [rsp + 0x40], 0xa
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x48]
lea r12, [r15 + 0xd8]
call fcn.180037590
jmp 0x1800ee6ad
mov eax, dword [rbp - 0x58]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x40], eax
mov r8d, 0x97
mov rcx, r10
call fcn.18002e320
mov r13, rax
test rax, rax
jne 0x1800ee6ad
mov edi, 0xb5
nop dword [rax]
cmp edi, 0xb5
je 0x1800ee738
cmp edi, 0x171
jne 0x1800ee753
mov rax, rbx
jmp 0x1800eee5a
mov rdx, qword [rsp + 0x70]
mov r9d, 0xd5
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, r15
call fcn.180023820
add edi, 0xbc
cmp edi, 0x22d
jb 0x1800ee720
mov rdi, qword [rbp - 0x28]
jmp 0x1800ee6ad
mov eax, dword [rdi + 8]
add eax, 0x11
add eax, dword [r11 + 0x50]
mov dword [rbp - 0x58], eax
jmp 0x1800ee6b7
mov rbx, qword [rbp - 0x48]
mov ecx, 0x26
mov eax, ecx
sub eax, 0x24
je 0x1800ee7b0
sub eax, 1
je 0x1800ee79c
cmp eax, 1
jne 0x1800ee7bf
mov rbx, qword [r8 + 0x10]
jmp 0x1800ee7bf
mov rax, qword [rbx + 0xd8]
lea r12, [r15 + 0xd8]
mov qword [r12], rax
jmp 0x1800ee7bf
mov eax, dword [rbx + 0xe0]
mov r13, qword [r12]
mov dword [r12 + 8], eax
dec ecx
cmp ecx, 0x23
ja 0x1800ee785
mov qword [rbp - 0x48], rbx
xor ebx, ebx
jmp 0x1800eea2e
mov dword [rbp - 0x68], ebx
jmp 0x1800eea38
cmp r14d, 0x168e7
ja 0x1800ee95a
je 0x1800ee951
cmp r14d, 0x120c0
ja 0x1800ee924
je 0x1800ee90a
cmp r14d, 0x101e7
je 0x1800ee8ee
cmp r14d, 0x1042d
je 0x1800ee827
cmp r14d, 0x1148a
je 0x1800eee56
jmp 0x1800eea38
cmp dword [rsi], 1
je 0x1800eea38
cmp dword [rdi + 8], 0xb
jne 0x1800ee868
mov rax, qword [rdi]
lea r8, str.DontFlatten
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov ecx, 0xa0
mov dword [rsp + 0x40], GetAcceptLanguagesA
call fcn.1800a9fa0
test eax, eax
je 0x1800ee8e3
cmp dword [rdi + 8], 0xa
jne 0x1800ee8a0
mov rax, qword [rdi]
lea r8, str.RSCmdEmpty
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov ecx, 0xa0
mov dword [rsp + 0x40], 0xa
call fcn.1800a9fa0
test eax, eax
je 0x1800ee8e3
mov r8, qword [rsp + 0x78]
mov eax, dword [rdi + 8]
mov ecx, dword [r8 + 0x50]
cmp eax, ecx
jne 0x1800ee8d9
mov rax, qword [rdi]
lea rdx, [rsp + 0x40]
mov r8, qword [r8 + 0x48]
xor r9d, r9d
mov dword [rsp + 0x40], ecx
mov ecx, 0xa0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.1800a9fa0
jmp 0x1800ee8db
sub eax, ecx
test eax, eax
jne 0x1800eea23
mov dword [rsi], 1
jmp 0x1800eea23
mov eax, dword [str.setsockopt_IP_DROP_MEMBERSHIP_]
mov dword [rbp - 0x10], eax
movzx eax, byte [0x180115194]
mov byte [rbp - 0xc], al
mov byte [rbp + 0x24], 0
jmp 0x1800eea38
mov r9d, 0xd9
lea rcx, [rbp + 0x28]
xor r8d, r8d
mov rdx, rax
call fcn.180018330
jmp 0x1800eea23
cmp r14d, 0x13567
je 0x1800ee948
cmp r14d, 0x15aad
jne 0x1800eea38
mov eax, dword [rsi]
mov dword [r15 + 0xe8], eax
jmp 0x1800eea38
mov byte [rbp - 0xb], 0
jmp 0x1800eea38
mov byte [rbp - 0xb], 0x63
jmp 0x1800eea38
cmp r14d, 0x20367
ja 0x1800ee9c6
je 0x1800ee9c0
cmp r14d, 0x19c67
je 0x1800ee9ba
cmp r14d, 0x1b12d
je 0x1800ee9a2
cmp r14d, 0x1cfe7
jne 0x1800eea38
movzx eax, word [0x1801151df]
mov word [rbp - 0xa], ax
movzx eax, byte [0x1801151e1]
mov byte [rbp - 8], al
mov byte [rbp - 7], 0
jmp 0x1800eea38
mov eax, dword [rcx]
mov dword [r15 + 0xec], eax
mov eax, dword [r8]
mov dword [r15 + 0xf4], eax
jmp 0x1800eea38
mov byte [rbp - 0xa], 0
jmp 0x1800eea38
mov byte [rbp - 7], 0x74
jmp 0x1800eea38
cmp r14d, 0x207ad
je 0x1800ee9de
cmp r14d, 0x236e7
jne 0x1800eea38
mov byte [rbp - 6], 0
jmp 0x1800eea38
mov eax, dword [r9]
lea rdx, [rbp - 0x78]
mov r8d, dword [r11 + 0x50]
or eax, 8
mov dword [rsp + 0x40], eax
add r8, 4
mov eax, dword [rdi + 8]
add r8, r13
mov dword [rbp - 0x78], eax
mov r9, r15
lea rax, [rsp + 0x40]
mov rcx, r10
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0xff
call fcn.1800524a0
mov qword [rbp - 0x68], r15
mov r9, qword [rsp + 0x68]
mov edx, dword [rbp + 0xc0]
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r10, qword [rsp + 0x70]
mov eax, edx
mov r11, qword [rsp + 0x78]
shl eax, 7
add r14d, eax
mov rax, qword [rbp - 0x50]
cmp r14d, dword [rbp - 0x70]
jbe 0x1800ee3f3
lea edi, [rdx + 0x11e6]
mov dword [rsp + 0x58], edi
cmp edx, edi
jae 0x1800eee56
mov r12, qword [rbp - 0x60]
mov ecx, 0x41
movzx r14d, byte [rsp + 0x48]
mov r9d, 0x414d
movzx r15d, byte [rsp + 0x48]
mov r13, qword [rbp - 0x60]
mov esi, dword [rbp - 0x54]
lea r8d, [rcx + 0x15]
cmp edx, 0x7cf
ja 0x1800eec1b
je 0x1800eec0d
cmp edx, 0x37d
ja 0x1800eeb6b
je 0x1800eeb61
cmp edx, 0x15e
ja 0x1800eeb10
je 0x1800eeaff
mov eax, edx
sub eax, 0x67
je 0x1800eeae3
sub eax, 0x46
je 0x1800eee56
cmp eax, 0x58
jne 0x1800eee25
mov dword [rbp + 0x38], 0x320033
jmp 0x1800eee25
mov r8d, 4
lea rdx, [0x180115272]
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x1800eee1f
mov r9, rax
xor edx, edx
xor ecx, ecx
call fcn.180062960
jmp 0x1800eee1f
cmp edx, 0x1a3
je 0x1800eeb58
cmp edx, 0x241
je 0x1800eeb38
cmp edx, 0x2df
jne 0x1800eee25
mov dword [rbp + 0x42], 0x6c
jmp 0x1800eee25
mov r8d, 3
lea rdx, [0x180115260]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + 0x42], bx
jmp 0x1800eee1f
mov word [rbp + 0x3c], bx
jmp 0x1800eee25
mov word [rbp], r9w
jmp 0x1800eee25
cmp edx, 0x5f5
ja 0x1800eebcf
je 0x1800eebc6
cmp edx, 0x41b
je 0x1800eebb4
cmp edx, 0x4b9
je 0x1800eeb9f
cmp edx, 0x557
jne 0x1800eee25
mov eax, 0x5f33
mov word [rbp + 9], ax
jmp 0x1800eee25
mov eax, 0x5f
mov word [rbp + 4], ax
mov dword [rbp + 5], 0x444e4142
jmp 0x1800eee25
mov eax, 0x50
mov word [rbp + 2], cx
mov word [rbp + 3], ax
jmp 0x1800eee25
mov word [rbp + 0xb], cx
jmp 0x1800eee25
cmp edx, 0x693
je 0x1800eebf6
cmp edx, 0x731
jne 0x1800eee25
mov eax, 0x49
mov word [rbp + 0xe], ax
mov word [rbp + 0xf], r8w
jmp 0x1800eee25
mov eax, 0x43
mov word [rbp + 0xc], ax
mov eax, 0x54
mov word [rbp + 0xd], ax
jmp 0x1800eee25
mov eax, 0x45
mov word [rbp + 0x10], ax
jmp 0x1800eee25
cmp edx, 0xc21
ja 0x1800eed2c
je 0x1800eed08
cmp edx, 0xa47
ja 0x1800eec9a
je 0x1800eec74
cmp edx, 0x86d
je 0x1800eec68
cmp edx, 0x90b
je 0x1800eec60
cmp edx, 0x9a9
jne 0x1800eee25
mov dword [rsp + 0x40], 0xf003f
jmp 0x1800eee25
mov r13, rbx
jmp 0x1800eee25
mov r15b, 1
movzx r14d, r15b
jmp 0x1800eee25
mov r9d, 0x94
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x30]
xor ecx, ecx
lea rdx, [rbp - 0x10]
call fcn.1800e4330
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x70], ebx
jmp 0x1800eee1f
cmp edx, 0xae5
je 0x1800eecbf
cmp edx, 0xb83
jne 0x1800eee25
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov r12, rax
jmp 0x1800eee1f
xor r9d, r9d
mov dword [rbp - 0x78], ebx
xor edx, edx
mov rcx, r10
lea r8d, [r9 + 0x69]
call fcn.18007a760
test al, al
jne 0x1800eee1f
mov ecx, 0xf0
mov eax, ecx
sub eax, 0xf0
je 0x1800eecf4
cmp eax, 0x5e
je 0x1800eee56
jmp 0x1800eecf8
mov byte [rbp - 0x68], 0
add ecx, 0x5e
cmp ecx, 0x1ac
jb 0x1800eece0
jmp 0x1800eee1f
mov eax, dword [rbp - 0x78]
lea r9, [rbp - 0x60]
mov edx, dword [rsp + 0x40]
lea rcx, [rbp + 0x18]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov dword [rbp - 0x80], eax
jmp 0x1800eee1f
cmp edx, 0xe99
ja 0x1800eedec
je 0x1800eeddd
cmp edx, 0xcbf
je 0x1800eedcf
cmp edx, 0xd5d
je 0x1800eedac
cmp edx, 0xdfb
jne 0x1800eee25
test r15b, r15b
je 0x1800eed98
mov edi, 0x38
mov eax, edi
sub eax, 0x38
je 0x1800eed85
cmp eax, 1
jne 0x1800eed87
mov rcx, qword [rbp - 0x60]
mov r8d, esi
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyA]
jmp 0x1800eed87
mov esi, ebx
inc edi
cmp edi, 0x3a
jb 0x1800eed68
mov edi, dword [rsp + 0x58]
mov edx, dword [rbp + 0xc0]
test r14b, r14b
je 0x1800eee25
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1800eee1f
movzx eax, r14b
test r12, r12
mov ecx, ebx
cmovne ecx, eax
cmp dword [rbp - 0x80], 0
movzx r14d, cl
movzx eax, r15b
mov ecx, ebx
cmove ecx, eax
movzx r15d, cl
jmp 0x1800eee25
cmp byte [r11], 0
mov eax, ebx
setne al
mov dword [rbp - 0x54], eax
jmp 0x1800eee25
lea rdx, [rbp]
mov rcx, r13
call qword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1800eee1f
cmp edx, 0xf37
je 0x1800eedfe
cmp edx, 0xfd5
je 0x1800eee56
jmp 0x1800eee25
mov rcx, qword [r10]
lea r9, [rbp - 0x54]
mov edx, 6
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [rbp - 0x48]
test eax, eax
sete byte [rbp - 0x68]
mov edx, dword [rbp + 0xc0]
mov r10, qword [rsp + 0x70]
add edx, 0x9e
mov r11, qword [rsp + 0x78]
mov ecx, 0x41
mov rax, qword [rbp - 0x50]
mov r9d, 0x414d
mov dword [rbp + 0xc0], edx
lea r8d, [rcx + 0x15]
cmp edx, edi
jb 0x1800eea90
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.180106610
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret