Function at 0x140004c80
Capabilities:
Delete file
Query or enumerate registry value
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140154060]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor edi, edi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePCUI
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov qword [rbp - 0x10], rdi
mov qword [rbp], rdi
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], dil
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], dil
lea r8d, [rdi + 3]
lea rdx, [0x1400d859c]
lea rcx, [rbp - 0x70]
call fcn.140008c40
nop
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], dil
lea r8d, [rdi + 0xb]
lea rdx, str.InstallPath
lea rcx, [rsp + 0x68]
call fcn.140008c40
nop
mov rbx, qword [rsp + 0x60]
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
lea rcx, [rbp - 0x10]
call fcn.140008c40
mov dword [rbp - 0x78], 0x200
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140004ddb
lea rax, [rbp + 0xd0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140004dc0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x10]
call fcn.140008c40
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140004e1a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140004e6a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
add r8, qword [rbp]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov qword [rsp + 0x68], rdi
mov rcx, rdi
mov qword [rsp + 0x78], rcx
mov r10d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], r10
mov byte [rsp + 0x68], cl
cmp rdx, r8
je 0x140004ec0
sub r8, rdx
lea rcx, [rsp + 0x68]
call fcn.140008c40
mov r10, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 0x2f
jb 0x14000554a
lea r9, [rsp + 0x68]
cmp r10, 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], Ordinal_50
lea rax, str.AndroidEmulator_resConfigAndroidEmulator.xml
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xb0]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0x2f
jb 0x140005550
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], Ordinal_50
lea rax, str.AndroidEmulator_reswindowbackground_nhucc.jpg
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x90]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0xb
jb 0x140005556
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], recv
lea rax, str.Config.ini
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x70]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0x24
jb 0x14000555c
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], Ordinal_41
lea rax, str.AndroidEmulator_resimgloading.png
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x50]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0x21
jb 0x140005562
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_33
lea rax, str.AndroidEmulator_resimglogo.png
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0x16
jb 0x140005568
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_22
lea rax, str.AndroidEmulatorEx.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.140009fc0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 0xb
jb 0x14000556e
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], recv
lea rax, str.dsound.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.140009fc0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, rbx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 9
jb 0x140005574
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], 9
lea rax, [0x1400d86f8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.140009fc0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call fcn.140007c80
mov edx, 0x40c
mov rcx, rax
call fcn.140004ad0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x40]
call fcn.140007c80
mov edx, 0x437
mov rcx, rax
call fcn.140004ad0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov edx, 0x2006
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
mov edx, 0x2006
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140007c80
mov edx, 0x40a
mov rcx, rax
call fcn.140004ad0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140007c80
mov edx, 0x406
mov rcx, rax
call fcn.140004ad0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140007c80
mov edx, 0x407
mov rcx, rax
call fcn.140004ad0
call fcn.1400042a0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
test al, al
je 0x140005214
call fcn.140007c80
mov edx, 0x40b
mov rcx, rax
jmp 0x140005276
call fcn.140007c80
mov edx, reloc.WS2_32.dll_WSAGetLastError
mov rcx, rax
call fcn.140004ad0
mov rax, qword [rsp + 0x78]
sub rbx, rax
cmp rbx, 0xc
jb 0x140005544
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], recv
lea rcx, str.AEngine.dll
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.140009fc0
mov edx, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rsp + 0x40]
call fcn.140004ad0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400052ba
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140005308
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005303
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005303
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140005357
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005351
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005351
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140005396
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005390
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005390
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x1400053d5
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140005417
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005411
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005411
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14000545c
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005456
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005456
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1400054a1
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000549b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000549b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400054e1
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400054db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140005520
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000551a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000551a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
nop
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1400c4450
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
nop
call fcn.1400021f0
int3