Function at 0x14000b3a4
Capabilities:
Delete registry key
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1c0
xor r13d, r13d
xor eax, eax
mov rsi, rcx
mov dword [r11 - 0x168], r13d
mov dword [r11 - 0x164], r13d
mov byte [r11 - 0x160], r13b
mov byte [r11 - 0x15e], r13b
mov byte [r11 - 0x15d], r13b
lea r14d, [r13 + 1]
mov byte [r11 - 0x15f], r14b
mov dword [rsp + 0x8c], eax
mov qword [r11 - 0x158], rax
mov qword [r11 - 0x150], rax
mov dword [rsp + 0xa0], 8
mov dword [rsp + 0xa4], 0x9c59
mov byte [rsp + 0xa8], 4
mov byte [r11 - 0x13f], r13b
mov byte [r11 - 0x13e], r13b
mov byte [r11 - 0x13d], r13b
mov dword [rsp + 0xac], eax
mov qword [r11 - 0x138], rax
mov qword [r11 - 0x130], rax
mov dword [rsp + 0xc0], 5
mov dword [rsp + 0xc4], 0x9c52
mov byte [rsp + 0xc8], 4
mov byte [r11 - 0x11f], r13b
mov byte [r11 - 0x11e], r13b
mov byte [r11 - 0x11d], r13b
mov dword [rsp + 0xcc], eax
mov qword [r11 - 0x118], rax
mov qword [r11 - 0x110], rax
mov dword [rsp + 0xe0], 7
mov dword [rsp + 0xe4], 0x9c4e
mov byte [rsp + 0xe8], 4
mov byte [r11 - 0xff], r13b
mov byte [r11 - 0xfe], r13b
mov byte [r11 - 0xfd], r13b
mov dword [rsp + 0xec], eax
mov qword [r11 - 0xf8], rax
mov qword [r11 - 0xf0], rax
mov dword [r11 - 0xe8], r14d
mov dword [rsp + 0x104], 0x9c44
mov byte [rsp + 0x108], 4
mov byte [r11 - 0xdf], r13b
mov byte [r11 - 0xde], r13b
mov byte [r11 - 0xdd], r13b
mov dword [rsp + 0x10c], eax
mov qword [r11 - 0xd8], rax
mov qword [r11 - 0xd0], rax
mov dword [r11 - 0xc8], r13d
mov dword [rsp + 0x124], 0x9c41
mov byte [rsp + 0x128], 4
mov byte [r11 - 0xbf], r13b
mov byte [r11 - 0xbe], r13b
mov byte [r11 - 0xbd], r13b
mov dword [rsp + 0x12c], eax
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xb0], rax
mov dword [rsp + 0x140], 2
mov dword [rsp + 0x144], 0x9c48
mov byte [rsp + 0x148], 4
mov byte [r11 - 0x9f], r13b
mov byte [r11 - 0x9e], r13b
mov byte [r11 - 0x9d], r13b
mov dword [rsp + 0x14c], eax
mov qword [r11 - 0x98], rax
mov qword [r11 - 0x90], rax
mov dword [rsp + 0x160], 6
mov dword [rsp + 0x164], 0x9c51
mov byte [r11 - 0x80], 4
mov byte [r11 - 0x7f], r13b
mov byte [r11 - 0x7e], r13b
mov byte [r11 - 0x7d], r13b
mov dword [r11 - 0x7c], eax
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x70], rax
mov dword [r11 - 0x68], 3
mov dword [r11 - 0x64], 0x9c49
mov byte [r11 - 0x60], 4
mov byte [r11 - 0x5f], r13b
mov byte [r11 - 0x5e], r13b
or dword [r11 + 8], 0xffffffff
mov dword [rcx + 0x48], r14d
lea ecx, [rax + 0x66]
mov byte [r11 - 0x5d], r13b
mov dword [r11 - 0x5c], eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov dword [r11 - 0x48], 4
mov dword [r11 - 0x44], 0x9c42
mov byte [r11 - 0x40], 4
mov byte [r11 - 0x3f], r13b
mov byte [r11 - 0x3e], r13b
mov byte [r11 - 0x3d], r13b
mov dword [r11 - 0x3c], eax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
call fcn.14000794c
mov rcx, qword [rsi + 0x498]
mov rdx, rax
mov qword [rsi + 0x28], rax
call qword [sym.imp.USER32.dll_SetMenu]
mov r8, qword [rsi + 0x498]
lea rdx, [0x14001178f]
mov r9d, 0x101
mov ecx, 0x50000000
call qword [sym.imp.COMCTL32.dll_CreateStatusWindowA]
lea r9, [rsp + 0x1f0]
mov r8, r14
mov rcx, rax
mov edx, 0x404
mov qword [rsi + 8], rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsi + 0x498]
mov dword [rsp + 0x60], 0x20
lea r12d, [r13 + 0x10]
lea rax, [rsp + 0x80]
lea r9d, [r13 + 9]
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], 0x90
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 0xa
mov qword [rsp + 0x30], rax
mov rax, qword [0x1400152a0]
mov edx, 0x50000900
mov r8d, 0x102
mov qword [rsp + 0x28], 0x68
mov qword [rsp + 0x20], rax
call qword [sym.imp.COMCTL32.dll_CreateToolbarEx]
mov qword [rsp + 0x58], r13
mov qword [rsi + 0x10], rax
mov rax, qword [0x1400152a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsi + 0x498]
mov qword [rsp + 0x48], 0x103
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xc8
mov dword [rsp + 0x30], 0x190
lea rdx, [0x140011e88]
mov r9d, 0x50800809
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rsi
mov qword [rsi + 0x18], rax
call fcn.14000b2a0
mov rax, qword [rsi + 0x258]
movsxd rdi, dword [rax + 0x210]
mov rbx, qword [rax + 0x218]
mov rbp, qword [rax + 0x198]
cmp rdi, r13
jle 0x14000b7c0
add rbx, 0xc
mov rax, qword [rbx + 4]
mov r9d, dword [rbx - 4]
mov r8d, dword [rbx - 8]
mov edx, dword [rbx - 0xc]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx]
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.140003d48
add rbx, 0x18
sub rdi, r14
jne 0x14000b795
mov ebp, 0x19
mov r9d, r14d
mov edx, r12d
mov ecx, r12d
mov r8d, ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
lea edx, [rbp - 0x16]
mov rcx, rax
mov qword [rsi + 0x30], rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
mov rcx, qword [0x1400152a0]
mov ebx, 0x1000
lea edx, [rbp + 0x6c]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_LoadImageA]
mov rcx, qword [0x1400152a0]
lea edx, [rbp + 0x6d]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov rdi, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_LoadImageA]
mov rcx, qword [rsi + 0x30]
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_Replace]
mov rcx, qword [rsi + 0x30]
xor r9d, r9d
mov r8, rbx
mov edx, r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Replace]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x1400152a0]
lea edx, [rbp + 0x4d]
call qword [sym.imp.USER32.dll_LoadIconA]
mov rcx, qword [rsi + 0x30]
lea edx, [rbp - 0x17]
mov r8, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, rbx
xor r8d, r8d
mov rcx, rax
mov edx, 0x1208
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x18]
mov ebx, 0x1003
mov r8, r14
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9d, r14d
mov r8d, ebp
mov edx, r12d
mov ecx, r12d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
lea edx, [rbp - 0x17]
mov rcx, rax
mov qword [rsi + 0x38], rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
mov rcx, qword [0x1400152a0]
mov edx, 0xce
call qword [sym.imp.USER32.dll_LoadIconA]
xor edx, edx
mov r8, rax
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [0x1400152a0]
mov edx, 0xcf
call qword [sym.imp.USER32.dll_LoadIconA]
mov rcx, qword [rsi + 0x38]
mov edx, r14d
mov r8, rax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov r9, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x18]
lea r8d, [rbp - 0x17]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rsi
call fcn.14000b170
lea ecx, [rbp + 0x4f]
call fcn.14000794c
lea rdx, str._noloadsettings
lea rcx, [0x1400152b0]
mov qword [rsi + 0x20], rax
call sub.msvcrt.dll__strcmpi
cmp eax, r13d
jne 0x14000b98f
lea rdx, str.SoftwareNirSoftmzcv
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rax, qword [rsi + 0x250]
mov dword [rax + 0x38], r14d
mov rcx, qword [rsi + 0x250]
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rcx + 0x30]
call fcn.1400082d8
mov rcx, qword [rsi + 0x250]
xor edx, edx
call fcn.14000fde8
mov rbp, qword [rsi + 0x250]
mov r12, qword [rsi + 0x498]
movdqu xmm0, xmmword [rbp + 0x1c]
movdqu xmmword [rsp + 0x70], xmm0
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov edi, edx
sub edi, ebx
cmp edi, 0x14
jle 0x14000ba57
mov rcx, rbx
mov rax, rdx
shr rcx, 0x20
shr rax, 0x20
sub eax, ecx
cmp eax, 0x14
jle 0x14000ba57
cmp edx, 5
jle 0x14000ba57
cmp ecx, 0xfffffff6
jl 0x14000ba57
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rbx + 0x14]
cmp ecx, eax
jge 0x14000ba57
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, dword [rsp + 0x74]
lea edx, [r9 + 0x14]
cmp edx, eax
jge 0x14000ba57
cmp dword [rbp + 8], r13d
je 0x14000ba57
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x30], 0x204
mov r8d, ebx
sub eax, r9d
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rsi + 0x250]
mov rcx, qword [rcx + 0x30]
call fcn.140008330
mov r11, qword [rsi + 0x250]
mov rcx, qword [rsi + 0x258]
mov eax, dword [r11 + 0x2c]
mov dword [rcx + 0x1c8], eax
mov rcx, qword [rsi + 0x258]
mov rcx, qword [rcx + 0x198]
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rsi + 0x250]
mov r9d, 0x34
cmp dword [rax + 0x3c], r13d
lea ecx, [r9 + 1]
mov edx, 0x1036
cmovne r9d, ecx
mov rcx, qword [rsi + 0x18]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x1400164e0], r13b
mov r12d, 0x104
lea rbp, [0x1400164e0]
jne 0x14000baf6
mov rcx, rbp
call fcn.140006620
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test r14b, al
je 0x14000baf6
mov rdx, rbp
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rcx, str.report.html
mov rbx, rax
call sub.msvcrt.dll_strlen
lea r9, [rbx + rax + 1]
cmp r9, r12
jae 0x14000bb2f
lea r8, [rsi + 0x14b]
lea rdx, str.report.html
mov rcx, rbp
call fcn.140006700
jmp 0x14000bb36
mov byte [rsi + 0x14b], r13b
lea rcx, str.commdlg_FindReplace
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov rcx, rsi
mov dword [rsi + 0x260], eax
call fcn.14000c4ac
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x48], r13d
call fcn.14000a7d0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret