Function at 0x140005e70
Capabilities:
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Get installed programs
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x658]
sub rsp, 0x730
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rbp + 0x620], rax
xor r14d, r14d
mov dword [rsp + 0x30], r14d
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068c0
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068cb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068d6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068e1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068ec
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.140001180
mov rcx, rax
test rax, rax
je 0x1400068f7
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r13, [r14 - 1]
test eax, eax
jne 0x14000601e
mov dword [rsp + 0x60], 0x400
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x220]
mov rax, r13
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ff0
mov r8d, eax
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x78]
call fcn.140003380
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
lea rsi, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rsi, rdi
je 0x14000607a
cmp dword [rdi + 0x10], 0
jl 0x140006069
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x140006069
mov rcx, rsi
call fcn.140003260
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000605e
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14000607a
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140003380
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140006099
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
mov rdi, qword [rsp + 0x58]
lea rax, [rdi - 0x18]
mov qword [rbp - 0x40], rax
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x1400060bd
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400060ce
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140006902
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 2
lea rax, str.ElanFP
mov r14, r13
nop word [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140006100
movsxd r12, dword [rdi - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x14000690d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000613e
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.140003520
mov rbx, qword [rbp - 0x80]
mov r9d, r12d
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.1400032f0
movsxd rdx, r14d
lea rcx, [rbx + r12*2]
mov r9d, r14d
lea r8, str.ElanFP
call fcn.1400032f0
cmp r15d, dword [rbx - 0xc]
jg 0x1400068b5
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor r15d, r15d
mov word [rbx + rax*2], r15w
lea rdi, [rbx - 0x18]
mov rsi, qword [rsp + 0x38]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x1400061df
cmp dword [rsi + 0x10], r15d
jl 0x1400061ce
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x1400061ce
mov rcx, rdi
call fcn.140003260
mov rbx, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1400061c3
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400061df
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003380
mov dword [rsp + 0x30], r15d
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x1400061fe
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
nop
mov r14, qword [rsp + 0x38]
lea rax, [r14 - 0x18]
mov qword [rbp - 0x48], rax
mov rcx, qword [r14 - 0x18]
test rcx, rcx
je 0x140006222
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140006233
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140006918
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
mov dword [rsp + 0x30], 4
lea rax, str..
mov rsi, r13
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140006260
movsxd r12, dword [r14 - 0x10]
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x140006923
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000629d
mov edx, r15d
lea rcx, [rbp - 0x78]
call fcn.140003520
mov rbx, qword [rbp - 0x78]
mov r9d, r12d
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.1400032f0
movsxd rdx, esi
lea rcx, [rbx + r12*2]
mov r9d, esi
lea r8, str..
call fcn.1400032f0
cmp r15d, dword [rbx - 0xc]
jg 0x1400068aa
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor r15d, r15d
mov word [rbx + rax*2], r15w
lea rdi, [rbx - 0x18]
mov rsi, qword [rsp + 0x50]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14000633f
cmp dword [rsi + 0x10], r15d
jl 0x14000632d
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14000632d
mov rcx, rdi
call fcn.140003260
mov rbx, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140006322
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14000633f
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003380
nop
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140006358
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
mov r8, qword [rsp + 0x58]
lea rdx, str.ProgramFilesDir___s_r_n
xor ecx, ecx
call fcn.1400013f0
mov r8, qword [rsp + 0x38]
lea rdx, str.ProgramFilesELANDir___s_r_n
xor ecx, ecx
call fcn.1400013f0
mov r8, qword [rsp + 0x50]
lea rdx, str.ProgramFilesELANAllFileDir___s_r_n
xor ecx, ecx
call fcn.1400013f0
lea rdx, [rbp - 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400067cf
mov r12d, r15d
mov dword [rsp + 0x30], r15d
nop word [rax + rax]
lea rcx, [rbp - 4]
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400063d0
mov r8d, eax
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x48]
call fcn.140003380
mov rbx, qword [rsp + 0x48]
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140006407
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140006415
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r8, rax
lea rdx, [0x140027b84]
lea rcx, [rbp - 0x60]
call fcn.140006a50
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x14000697b
mov rdx, rax
sub rdx, rbx
nop dword [rax + rax]
movzx edi, word [rbx]
movzx ecx, word [rbx + rdx]
sub edi, ecx
jne 0x140006453
add rbx, 2
test ecx, ecx
jne 0x140006440
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000646d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test edi, edi
je 0x14000676a
mov rcx, qword [rsi]
test rcx, rcx
je 0x140006488
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140006496
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r8, rax
lea rdx, [0x140027b88]
lea rcx, [rbp - 0x58]
call fcn.140006a50
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x140006970
mov rcx, qword [rsp + 0x48]
mov r8, rax
sub r8, rcx
movzx ebx, word [rcx]
movzx edx, word [rcx + r8]
sub ebx, edx
jne 0x1400064d5
add rcx, 2
test edx, edx
jne 0x1400064c1
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400064ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebx, ebx
je 0x14000676a
mov rcx, qword [r14 - 0x18]
test rcx, rcx
je 0x14000650b
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140006522
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x140006965
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
or dword [rsp + 0x30], 8
movsxd r15, dword [r14 - 0x10]
lea esi, [r15 + 1]
test esi, esi
js 0x14000695a
mov r13d, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14000656c
mov edx, esi
lea rcx, [rbp - 0x70]
call fcn.140003520
mov rbx, qword [rbp - 0x70]
mov r9d, r15d
mov r8, qword [rsp + 0x38]
mov rdx, r15
mov rcx, rbx
call fcn.1400032f0
lea rcx, [rbx + r15*2]
mov r9d, r13d
lea r8, [0x1400248bc]
mov rdx, r13
call fcn.1400032f0
cmp esi, dword [rbx - 0xc]
jg 0x14000694f
mov dword [rbx - 0x10], esi
mov rax, r15
xor r15d, r15d
mov word [rbx + rax*2 + 2], r15w
lea r13, [rbx - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x1400065c5
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400065dc
call fcn.140001180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x140006944
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x68], rdi
or r12d, 0x18
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x30], r12d
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsi - 0x10]
mov dword [rsp + 0x68], eax
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x64], edx
lea r12d, [rdx + rax]
test r12d, r12d
js 0x140006939
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x140006641
mov edx, r12d
lea rcx, [rbp - 0x68]
call fcn.140003520
mov rdi, qword [rbp - 0x68]
mov edx, dword [rsp + 0x64]
movsxd r15, edx
mov r9d, edx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1400032f0
movsxd r9, dword [rsp + 0x68]
mov rdx, r9
lea rcx, [rdi + r15*2]
mov r8, rsi
call fcn.1400032f0
cmp r12d, dword [rdi - 0xc]
jg 0x14000692e
mov dword [rdi - 0x10], r12d
movsxd rax, r12d
xor r15d, r15d
mov word [rdi + rax*2], r15w
lea rsi, [rdi - 0x18]
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x1400066e5
cmp dword [rbx + 0x10], r15d
jl 0x1400066d4
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x1400066d4
mov rcx, rsi
call fcn.140003260
mov rdi, rax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400066c9
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x1400066e5
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140003380
mov ebx, dword [rsp + 0x6c]
and ebx, 0xffffffef
mov dword [rsp + 0x30], ebx
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000670b
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
and ebx, 0xfffffff7
mov dword [rsp + 0x30], ebx
mov eax, 0xffffffff
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x14000672f
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + 8]
mov r8, qword [rsp + 0x48]
lea rdx, str.SubFileName___s_r_n
xor ecx, ecx
call fcn.1400013f0
mov rbx, qword [rsp + 0x40]
mov r8, rbx
lea rdx, str.SubFileNamePath___s_r_n
xor ecx, ecx
call fcn.1400013f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r13, 0xffffffffffffffff
jmp 0x14000676f
mov rbx, qword [rsp + 0x40]
lea rdx, [rbp - 0x30]
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000678e
mov r12d, dword [rsp + 0x30]
jmp 0x1400063c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallElanFP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
jne 0x1400067c8
lea rdx, str.Delete_App_and_Feature_registry_done_r_n
xor ecx, ecx
call fcn.1400013f0
mov edi, 1
jmp 0x1400067e5
lea rdx, str.There_is_no_file_in_ElanFP_folder__no_legacy_files_r_n
xor ecx, ecx
call fcn.1400013f0
mov edi, r15d
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006800
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006820
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006840
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, r13d
mov rdx, qword [rbp - 0x48]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000685b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rbp - 0x40]
lock xadd dword [rax + 0x10], r13d
sub r13d, 1
jg 0x140006878
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140007310
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001980
nop
mov ecx, 0x80070057
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
int3
mov ecx, 0x80070057
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
int3
mov ecx, 0x80070057
call fcn.140001980
nop
mov ecx, 0x80070057
call fcn.140001980
int3
mov ecx, 0x80070057
call fcn.140001980
int3
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80070057
call fcn.140001980
int3
mov ecx, 0x80070057
call fcn.140001980
int3
mov ecx, 0x80004005
call fcn.140001980
nop
mov ecx, 0x80004005
call fcn.140001980
int3
mov ecx, 0x80004005
call fcn.140001980
int3