Function at 0x180019620
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x180081de0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov ebx, dword [rbp - 0x69]
lea r10d, [r8 + 0x918]
mov r11, rdx
mov qword [rbp - 0x59], rdx
mov rdx, rcx
mov qword [rbp - 0x51], rcx
xor ecx, ecx
mov rsi, r9
mov r9d, r8d
cmp r8d, r10d
jae 0x1800198ad
mov r12d, dword [rbp - 0x69]
lea edi, [rcx + 0x65]
mov r14, qword [rbp - 0x51]
lea eax, [rcx + 0x54]
mov r15, qword [rbp - 0x51]
lea r13d, [rcx + 0x6e]
mov dword [rbp - 0x69], ebx
nop dword [rax]
cmp r9d, 0x236
ja 0x180019755
je 0x180019749
cmp r9d, 0x108
ja 0x180019716
je 0x1800196f1
mov eax, r9d
sub eax, 0x11
je 0x1800196de
sub eax, 0xa1
je 0x1800196d0
cmp eax, 0x21
je 0x180019a9c
mov eax, 0x54
jmp 0x1800197e9
mov word [rbp - 0x11], di
mov eax, 0x54
jmp 0x1800197e9
mov rax, qword [r11 + 8]
mov ebx, dword [rax]
mov eax, 0x54
mov dword [rbp - 0x69], ebx
jmp 0x1800197e9
mov r15, qword [r11 + 0x78]
mov r12d, 7
add r15, 0x90
mov r14, qword [r15 + 0x28]
test r14, r14
jne 0x1800197e9
mov eax, ecx
jmp 0x180019a9e
mov eax, r9d
sub eax, 0x174
je 0x180019733
cmp eax, 0x56
je 0x1800197fe
mov eax, 0x54
jmp 0x1800197e9
mov dword [rbp - 0xf], 0x610073
mov eax, 0x54
mov word [rbp - 0xb], r13w
jmp 0x1800197e9
mov dword [rbp - 9], 0x6d002e
jmp 0x1800197e9
cmp r9d, 0x2f8
je 0x1800197e2
cmp r9d, 0x3ba
je 0x1800197cc
cmp r9d, 0x47c
je 0x1800197aa
cmp r9d, 0x53e
je 0x18001978c
cmp r9d, 0x600
jne 0x1800197e9
mov word [rbp - 0x16], ax
jmp 0x1800197e9
mov edi, 0x53
mov dword [rbp - 0x1a], 0x434e5550
mov word [rbp - 0x1f], di
mov edi, 0x65
mov dword [rbp - 0x1e], 0x42555320
jmp 0x1800197e9
mov edi, 0x4550
mov dword [rbp + 7], 0x740064
mov word [rbp - 0x21], di
mov edi, 0x65
mov dword [rbp + 0xb], 0x72006f
mov word [rbp + 0xf], cx
jmp 0x1800197e9
mov dword [rbp - 1], 0x6c0075
mov r13d, 0x6e
mov dword [rbp + 3], 0x5f0065
jmp 0x1800197e9
mov dword [rbp - 5], 0x64006f
add r9d, 0xc2
cmp r9d, r10d
jb 0x180019690
jmp 0x1800198b0
test rsi, rsi
je 0x18001989f
mov edi, 0x110
nop dword [rax]
mov eax, edi
sub eax, 0x110
je 0x180019841
sub eax, 1
je 0x180019835
cmp eax, 1
jne 0x180019891
mov rax, qword [r14 + 0x40]
mov qword [rsi + 0x18], rax
mov rax, qword [r14 + 0x48]
mov qword [rsi + 0x20], rax
jmp 0x180019891
mov dword [rsi + 0xc], ecx
mov eax, dword [r14 + 0x3c]
mov dword [rsi + 0x10], eax
jmp 0x180019891
mov rbx, qword [r14 + 0x88]
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 0x43]
call fcn.180006b30
test eax, eax
je 0x18001985f
mov r12d, dword [r15 + 0x30]
movsxd rax, r12d
xor r9d, r9d
mov r8, qword [rbx + rax*8 + 0x10]
lea rbx, [rbx + rax*8]
xor ecx, ecx
lea edx, [r9 + 0x3c]
call fcn.180052fd0
mov qword [rsi], rax
mov edx, 0x31
mov r8, qword [rbx + 0x10]
xor ecx, ecx
call fcn.18002b7f0
mov dword [rsi + 8], eax
xor ecx, ecx
inc edi
cmp edi, 0x113
jb 0x180019810
mov qword [r15 + 0x28], rcx
mov eax, 1
jmp 0x180019a9e
mov dword [rbp - 0x69], ebx
lea eax, [r8 - 0xc]
cmp r8d, eax
jbe 0x180019a9c
movzx r15d, byte [rbp - 0x61]
lea edi, [r8 - 0xa7]
mov r12d, dword [rbp - 0x69]
lea r8, [0x180000000]
mov r13d, dword [rbp - 0x69]
mov r14d, GetAcceptLanguagesA
mov ebx, dword [rbp - 0x69]
cmp edi, 0xb
ja case.default.0x1800198f5
mov ecx, dword [r8 + rdi*4 + 0x19ac8]
add rcx, r8
jmp rcx
mov byte [rbp - 0x37], 0
jmp case.default.0x1800198f5
xor ecx, ecx
movzx eax, r15b
test ebx, ebx
cmove ecx, eax
movzx r15d, cl
test cl, cl
je case.default.0x1800198f5
mov rcx, qword [rbp - 0x49]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegDeleteEmptyUSKeyW]
mov r11, qword [rbp - 0x59]
jmp case.default.0x1800198f5
movzx eax, word [rdx]
mov r8d, 0xad
lea rdx, [rbp - 0x61]
mov word [rbp - 0x61], ax
mov rcx, r11
call fcn.1800425a0
mov r11, qword [rbp - 0x59]
jmp case.default.0x1800198f5
mov r8d, 1
mov dword [rbp - 0x15], 0x245349
lea rdx, [0x18007a3e9]
lea rcx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r11, qword [rbp - 0x59]
jmp case.default.0x1800198f5
mov byte [rbp - 0x40], 0
jmp case.default.0x1800198f5
lea rax, [0x180019b00]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x49]
mov qword [r11], rax
xor r8d, r8d
lea rcx, [rbp - 0x11]
mov edx, r13d
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyW]
mov r11, qword [rbp - 0x59]
mov ebx, eax
jmp case.default.0x1800198f5
mov dword [rbp - 0x37], 0x53455551
mov byte [rbp - 0x33], 0
jmp case.default.0x1800198f5
mov r8d, 5
lea rdx, [0x18007a3fe]
lea rcx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18007a41a]
mov r11, qword [rbp - 0x59]
mov word [rbp - 0x2e], ax
movzx eax, byte [0x18007a41c]
mov byte [rbp - 0x2c], al
mov byte [rbp - 0x2b], 0
jmp case.default.0x1800198f5
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r11, qword [rbp - 0x59]
lea rcx, [r11 + 0xa]
cmp rcx, rsi
je case.default.0x1800198f5
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x180019a20
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
call fcn.180027020
mov r11, qword [rbp - 0x59]
jmp case.default.0x1800198f5
mov r13d, 0xf003f
xor r12d, r12d
jmp case.default.0x1800198f5
mov r8d, 4
lea rdx, [0x18007a421]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
mov byte [rbp - 0x3c], 0
lea rdx, [0x18007a444]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r11, qword [rbp - 0x59]
jmp case.default.0x1800198f5
mov dword [rbp - 0x2b], 0x48435f42
mov r15b, 1
mov word [rbp - 0x27], 0x31
mov rdx, qword [rbp - 0x51]
lea r8, [0x180000000]
dec edi
sub r14, 1
jne 0x1800198e1
mov ebx, dword [rbp - 0x69]
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18005fed0
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret