Function at 0x100035e58
Capabilities:
Delete directory
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb30
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0xb20], rax
xor ebp, ebp
lea rax, [rsp + 0x50]
mov edi, ecx
lea esi, [rbp + 1]
lea rdx, [0x10001d310]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov r14, rbp
mov r12, rbp
mov r15d, ebp
mov ebx, ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x100035f3a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
lea rdx, [0x10001d380]
xor r8d, r8d
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100035f23
cmp dword [rsp + 0x40], 4
je 0x100035f1c
cmp dword [rsp + 0x40], 3
jne 0x100035f23
cmp dword [rsp + 0x44], esi
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, ebp
je 0x100035f3a
mov dword [rsp + 0x44], ebp
cmp edi, ebp
je 0x100035f3e
mov dword [rsp + 0x44], esi
call fcn.10004048c
cmp eax, 6
jne 0x100035f53
call fcn.100037138
cmp eax, ebp
cmovne r15d, esi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.100037238
mov edi, 0x208
lea rcx, [rsp + 0xe0]
mov rdx, rdi
cmp eax, 0x20
jne 0x1000362bb
lea r8, [0x10001d270]
call fcn.10002e35c
cmp eax, ebp
jl 0x10003647d
lea r8, [0x10001faa0]
lea rcx, [rsp + 0x2f0]
mov rdx, rdi
call fcn.10002e35c
cmp eax, ebp
jl 0x10003647d
lea r8, [0x10001fb00]
lea rcx, [rsp + 0x500]
mov r9d, 0x9b
mov edx, 0x200
call fcn.10002e5e0
cmp eax, ebp
jl 0x10003647d
lea r8, [0x10001c120]
lea rcx, [rsp + 0x60]
mov edx, 0x80
call fcn.10002e35c
cmp eax, ebp
jl 0x10003647d
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r13, rax
cmp rax, rbp
je 0x100036021
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], edi
call fcn.1000367c4
cmp eax, ebp
jne 0x100036021
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov r13, rbp
cmp r15d, ebp
jne 0x10003608a
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r14, rax
cmp rax, rbp
je 0x100036058
lea r8, [rsp + 0x40]
mov rdx, rax
xor ecx, ecx
mov dword [rsp + 0x40], edi
call fcn.1000366c0
cmp eax, ebp
jne 0x100036058
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov r14, rbp
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r12, rax
cmp rax, rbp
je 0x10003608a
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, esi
mov dword [rsp + 0x40], edi
call fcn.1000366c0
cmp eax, ebp
jne 0x10003608a
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov r12, rbp
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov ebx, 0x104
mov rsi, rax
cmp rax, rbp
je 0x1000360cd
lea r8, [rsp + 0x40]
mov rdx, rax
xor ecx, ecx
mov dword [rsp + 0x40], ebx
call fcn.100036b48
cmp eax, ebp
je 0x1000360c2
mov rcx, rsi
call fcn.10003fff0
cmp eax, ebp
jne 0x1000360cd
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rsi, rbp
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbp, rax
test rax, rax
je 0x10003610d
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, 1
mov dword [rsp + 0x40], ebx
call fcn.100036b48
test eax, eax
je 0x100036103
mov rcx, rbp
call fcn.10003fff0
test eax, eax
jne 0x10003610d
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor ebp, ebp
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rbx, rax
test rax, rax
je 0x10003614f
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x40], 0x104
call fcn.100036d90
test eax, eax
je 0x100036145
mov rcx, rbx
call fcn.10003fff0
test eax, eax
jne 0x10003614f
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor ebx, ebx
xor edx, edx
mov rcx, rbx
call fcn.100034ae8
test r15d, r15d
jne 0x100036183
xor edx, edx
mov rcx, r14
call fcn.100034ae8
cmp dword [rsp + 0x44], r15d
je 0x100036179
call fcn.100037238
cmp eax, 0x20
je 0x100036183
xor edx, edx
mov rcx, r12
call fcn.100034ae8
xor edx, edx
mov rcx, rbp
call fcn.100034ae8
call fcn.100035434
test rbp, rbp
je 0x10003619f
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
test r14, r14
je 0x1000361ac
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
test r15d, r15d
jne 0x1000361bf
test r12, r12
je 0x1000361bf
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test rbx, rbx
je 0x1000361cd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test rsi, rsi
je 0x1000361db
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test r15d, r15d
jne 0x1000361eb
cmp dword [rsp + 0x44], r15d
je 0x100036440
lea r8, [0x10001fc10]
lea rcx, [rsp + 0x700]
mov rdx, rdi
call fcn.10002e35c
lea rcx, [rsp + 0xe0]
call fcn.100035848
lea r8, [0x10001d668]
lea rcx, [rsp + 0x910]
mov rdx, rdi
call fcn.10002e35c
mov edi, 5
mov ebp, 0x1000
test rsi, rsi
je 0x100036319
lea rcx, [0x10001d7c8]
xor edx, edx
call fcn.10004100c
test eax, eax
je 0x1000362fa
call fcn.100035cb4
lea r11, [rsp + 0x2f0]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x500]
lea r9, [rsp + 0x700]
lea r8, [rsp + 0x910]
lea rcx, [rsp + 0xe0]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.100035984
test eax, eax
js 0x100036319
xor r9d, r9d
mov r8, rsi
mov edx, edi
mov ecx, ebp
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x100036319
lea r8, [0x10001d1e0]
call fcn.10002e35c
cmp eax, ebp
jl 0x10003647d
lea r8, [0x10001fb60]
lea rcx, [rsp + 0x2f0]
mov rdx, rdi
call fcn.10002e35c
cmp eax, ebp
jl 0x10003647d
lea r8, [0x10001fbb0]
jmp 0x100035fb3
lea rcx, [0x10001d7c8]
mov edx, 1
call fcn.10004100c
test eax, eax
jne 0x100036319
xor edx, edx
mov rcx, rsi
call fcn.100034ae8
test r13, r13
je 0x10003633a
lea rcx, [0x10001d7e8]
xor edx, edx
call fcn.10004100c
test eax, eax
jne 0x10003633a
xor edx, edx
mov rcx, r13
call fcn.100034ae8
test r12, r12
je 0x100036440
lea rcx, [0x10001fc60]
mov edx, 1
call fcn.10004100c
test eax, eax
je 0x1000363d3
test r15d, r15d
jne 0x100036440
lea rax, [rsp + 0x2f0]
lea r9, [rsp + 0x700]
lea r8, [rsp + 0x910]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov rdx, r12
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
call fcn.100035984
test eax, eax
js 0x1000363bd
mov r8, r12
mov ecx, ebp
jmp 0x100036435
lea rdx, [0x10001fc90]
mov r8d, eax
mov ecx, 2
call fcn.10004575c
jmp 0x100036440
test rbx, rbx
je 0x100036440
lea rax, [rsp + 0x2f0]
lea r9, [rsp + 0x700]
lea r8, [rsp + 0x910]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
call fcn.100035984
test eax, eax
js 0x100036440
mov r8, rbx
mov ecx, 0x10
xor r9d, r9d
mov edx, edi
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
test rsi, rsi
je 0x10003644d
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
test rbx, rbx
je 0x100036463
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
test r13, r13
je 0x100036470
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
test r12, r12
je 0x10003647d
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0xb20]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0xb30]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret