Function at 0x18000c090
Capabilities:
Delete file
Encode data using xor
Get common file path
Get installed programs
Query or enumerate registry key
Query or enumerate registry value
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b10]
mov eax, 0x2c10
call fcn.18001a3b0
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x2c48], rbx
mov qword [rsp + 0x2c50], rsi
mov qword [rsp + 0x2c58], rdi
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x2b00], rax
mov r14, rcx
xor edi, edi
mov byte [rbp + 0x2530], dil
mov ebx, 0xc7
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x2531]
call fcn.180019880
mov dword [rsp + 0x40], 0x104
lea r13d, [rdi + 1]
mov dword [rsp + 0x50], r13d
lea rcx, [rbp - 0x80]
call fcn.18000cef8
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x2530]
call fcn.180019fe0
lea r11, [rsp + 0x68]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x2530]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000c178
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x80]
call fcn.18000203c
xor al, al
jmp 0x18000cb70
mov esi, 0x3e8
mov dword [rsp + 0x40], esi
mov byte [rbp + 0x1f60], dil
xor edx, edx
lea r8d, [rsi - 1]
lea rcx, [rbp + 0x1f61]
call fcn.180019880
mov byte [rbp + 0x2460], dil
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x2461]
call fcn.180019880
mov qword [rsp + 0x48], rdi
lea rcx, [r14 + 8]
lea rdx, [0x18003d964]
call fcn.18001b560
mov r12, rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x68]
test rax, rax
jne 0x18000c1e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x18000cb64
mov dword [rsp + 0x40], 0xc8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x2460]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov r15d, r13d
test eax, eax
jne 0x18000c851
movabs rbx, 0x6666666666666667
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1f60]
call fcn.180019880
lea r9, [rbp + 0x2460]
lea r8, [rbp + 0x2530]
lea rdx, str._s_s
lea rcx, [rbp + 0x1f60]
call fcn.18001e530
lea r11, [rsp + 0x58]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1f60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000c800
mov dword [rsp + 0x40], esi
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1f60]
call fcn.180019880
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ParentDisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rbp + 0x1f60], dil
je 0x18000c2eb
test eax, eax
je 0x18000c800
mov dword [rsp + 0x40], esi
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1f60]
call fcn.180019880
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18000c800
cmp byte [rbp + 0x1f60], dil
je 0x18000c800
lea rdx, [0x18003f6d0]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x1f60]
lea rcx, [0x180050ff0]
call fcn.1800079fc
test al, al
je 0x18000c3a6
mov rcx, qword [rsp + 0x48]
call fcn.180006c98
mov r8, qword [rsp + 0x48]
lea rdx, [0x18003d804]
mov rcx, r12
call fcn.18001a1e0
mov rcx, qword [rsp + 0x48]
call fcn.18001a1d8
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], esi
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1f60]
call fcn.180019880
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rbp + 0x1f60], dil
jne 0x18000c40c
lea rdx, str.NULL
lea rcx, [rbp + 0x1f60]
call fcn.180019fe0
lea rdx, [0x18003f6d0]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x1f60]
lea rcx, [0x180050ff0]
call fcn.1800079fc
test al, al
je 0x18000c468
mov rcx, qword [rsp + 0x48]
call fcn.180006c98
mov r8, qword [rsp + 0x48]
lea rdx, [0x18003d804]
mov rcx, r12
call fcn.18001a1e0
mov rcx, qword [rsp + 0x48]
call fcn.18001a1d8
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], esi
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x1f60]
call fcn.180019880
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rbp + 0x1f60], dil
je 0x18000c4bf
test eax, eax
je 0x18000c52d
mov dword [rsp + 0x40], esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rbp + 0x1f60], dil
je 0x18000c51a
test eax, eax
jne 0x18000c51a
lea edx, [rax + 0x5c]
lea rcx, [rbp + 0x1f60]
call fcn.18001c6b0
test rax, rax
je 0x18000c51a
mov byte [rax + r13], dil
jmp 0x18000c52d
lea rdx, str.NULL
lea rcx, [rbp + 0x1f60]
call fcn.180019fe0
mov byte [rbp + 0x2710], dil
xor edx, edx
mov r8d, 0x3e7
lea rcx, [rbp + 0x2711]
call fcn.180019880
lea rdx, [rbp + 0x1f60]
lea rcx, [rbp + 0x2710]
call fcn.180019fe0
lea rcx, [rbp + 0x2710]
call fcn.1800191f0
lea rcx, [rbp + 0x1f60]
call fcn.18001b8d0
lea esi, [rax + 0xf]
lea rdx, [0x18003f690]
lea rcx, [rbp + 0x2710]
call fcn.18001c168
test rax, rax
je 0x18000c76a
lea rdx, str.Users_
lea rcx, [rbp + 0x2710]
call fcn.180019f40
lea rdx, [rbp + 0x2710]
mov rcx, r14
call fcn.18000bee0
test eax, eax
jg 0x18000c608
mov ecx, dword [0x1800531d8]
cmp ecx, 2
je 0x18000c5c8
cmp ecx, 3
jne 0x18000c600
xor r9d, r9d
lea r8d, [r9 + 5]
lea rdx, [rbp + 0x2710]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rdx, str.Tencent_Files_
lea rcx, [rbp + 0x2710]
call fcn.180019f40
lea rdx, [rbp + 0x2710]
mov rcx, r14
call fcn.18000bee0
test eax, eax
jle 0x18000c76a
mov rcx, qword [r14 + 0x118]
sub rcx, qword [r14 + 0x110]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea eax, [rdx + rdx*4]
lea esi, [rsi + rax*4]
mov ecx, esi
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x18000c76a
lea rdx, [rbp + 0x1f60]
mov rcx, rax
call fcn.180019fe0
lea rdx, [0x18003e0d4]
mov rcx, rbx
call fcn.180019f40
mov r13d, edi
mov r8, qword [r14 + 0x110]
mov rcx, qword [r14 + 0x118]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18000c6fd
mov rsi, rdi
movabs r12, 0x6666666666666667
lea rdx, [rsi + r8]
cmp qword [rdx + 0x18], 0x10
jb 0x18000c6ad
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.180019f40
lea rdx, [0x18003df6c]
mov rcx, rbx
call fcn.180019f40
inc r13d
add rsi, 0x28
mov r8, qword [r14 + 0x110]
mov rcx, qword [r14 + 0x118]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, r13d
cmp rax, rdx
jb 0x18000c69f
mov r12, qword [rsp + 0x60]
mov r8, qword [r14 + 0x110]
mov rcx, qword [r14 + 0x118]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*4]
lea rdx, [r8 + rax*8 - 0x28]
cmp qword [rdx + 0x18], 0x10
jb 0x18000c73c
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.180019f40
lea rdx, [0x18003e0d0]
mov rcx, rbx
call fcn.180019f40
lea rdx, [0x18003e5fc]
mov rcx, rbx
call fcn.180019f40
mov r13d, 1
jmp 0x18000c797
mov ecx, esi
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x18000c7e4
lea rdx, [rbp + 0x1f60]
mov rcx, rax
call fcn.180019fe0
lea rdx, [0x18003e5fc]
mov rcx, rbx
call fcn.180019f40
lea r8, [rsp + 0x48]
mov rdx, rbx
lea rcx, [0x180050ff0]
call fcn.1800079fc
test al, al
je 0x18000c7e4
mov rcx, qword [rsp + 0x48]
call fcn.180006c98
mov r8, qword [rsp + 0x48]
lea rdx, [0x18003d804]
mov rcx, r12
call fcn.18001a1e0
mov rcx, qword [rsp + 0x48]
call fcn.18001a1d8
mov qword [rsp + 0x48], rdi
mov rcx, rbx
call fcn.18001a1d8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x3e8
movabs rbx, 0x6666666666666667
jmp 0x18000c80b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], 0xc8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x2460]
mov edx, r15d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add r15d, r13d
test eax, eax
je 0x18000c22f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x80]
call fcn.18000d0b0
mov esi, edi
cmp dword [rbp + 0x1f54], edi
jle 0x18000c95a
xor edx, edx
mov r8d, 0x3e8
lea rcx, [rbp + 0x1f60]
call fcn.180019880
lea rdx, [0x18003f670]
lea rcx, [rbp + 0x1f60]
call fcn.180019fe0
lea rdx, [0x18003f6d0]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
movsxd r11, esi
lea rbx, [r11 + r11*8]
lea rdx, [rbp + rbx*4 + 0x1e00]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, [0x18003f6d0]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, [rbp + rbx*4 + 0x1dec]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, str.NULL_r_n
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x1f60]
lea rcx, [0x180050ff0]
call fcn.1800079fc
test al, al
je 0x18000c94b
mov rcx, qword [rsp + 0x48]
call fcn.180006c98
mov r8, qword [rsp + 0x48]
lea rdx, [0x18003d804]
mov rcx, r12
call fcn.18001a1e0
mov rcx, qword [rsp + 0x48]
call fcn.18001a1d8
mov qword [rsp + 0x48], rdi
add esi, r13d
cmp esi, dword [rbp + 0x1f54]
jl 0x18000c873
mov byte [rbp + 0x2600], dil
mov ebx, 0x103
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x2601]
call fcn.180019880
mov byte [rbp + 0x2350], dil
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x2351]
call fcn.180019880
xor edx, edx
mov r8d, 0x3e8
lea rcx, [rbp + 0x1f60]
call fcn.180019880
xor edx, edx
lea rcx, [rbp + 0x2600]
call fcn.18000b7b4
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
lea rcx, [rbp + 0x2600]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000caf1
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov esi, 4
mov r8d, esi
lea rdx, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, r13d
xor r8d, r8d
mov edx, dword [rsp + 0x54]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, esi
lea rdx, [rsp + 0x54]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp + 0x2350]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x54]
mov byte [rbp + r11 + 0x2350], dil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x54], edi
jbe 0x18000ca92
lea rax, [rbp + 0x2350]
mov ecx, dword [rsp + 0x54]
xor byte [rax], 0x87
add rax, r13
sub rcx, r13
jne 0x18000ca87
lea rdx, str.MM_ZR_EXE
lea rcx, [rbp + 0x1f60]
call fcn.180019fe0
lea rdx, [0x18003f6d0]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, [rbp + 0x2350]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, [0x18003f650]
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rdx, str.NULL_r_n
lea rcx, [rbp + 0x1f60]
call fcn.180019f40
lea rcx, [rbp + 0x2350]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x1f60]
call fcn.18001b8d0
test rax, rax
je 0x18000cb58
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x1f60]
lea rcx, [0x180050ff0]
call fcn.1800079fc
test al, al
je 0x18000cb58
mov rcx, qword [rsp + 0x48]
call fcn.180006c98
mov r8, qword [rsp + 0x48]
lea rdx, [0x18003d804]
mov rcx, r12
call fcn.18001a1e0
mov rcx, qword [rsp + 0x48]
call fcn.18001a1d8
mov qword [rsp + 0x48], rdi
mov rcx, r12
call fcn.18001a170
nop
mov dil, r13b
lea rcx, [rbp - 0x80]
call fcn.18000203c
mov al, dil
mov rcx, qword [rbp + 0x2b00]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x2c10]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret