Function at 0x1800338d0
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x16a8]
mov eax, 0x17a8
call fcn.18006ce90
sub rsp, rax
lea eax, [rdx - 0xa]
mov rsi, rcx
cmp edx, eax
jbe 0x180033c63
mov qword [rsp + 0x17c0], rbx
lea ebx, [rdx - 0xf3]
mov qword [rsp + 0x17a0], rdi
lea rdx, [0x180000000]
mov qword [rsp + 0x1798], r12
mov edi, 0xa
mov r12, qword [rbp + 0x16d0]
mov qword [rsp + 0x1790], r13
mov r13d, dword [rbp + 0x16c8]
mov qword [rsp + 0x1788], r14
lea r9d, [rdi - 9]
mov qword [rsp + 0x1780], r15
lea r8d, [rdi - 8]
mov r15, qword [rbp + 0x16d0]
lea r10d, [rdi - 7]
xor r14d, r14d
nop dword [rax]
cmp ebx, 0x18
ja case.0x180033973.5
mov ecx, dword [rdx + rbx*4 + 0x33c70]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x16c8], r15d
jmp 0x180033bcd
xor edx, edx
mov qword [rsp + 0x58], r14
mov r8d, 0x800
lea rcx, [rbp + 0x680]
mov r12, r14
mov r15, r14
call fcn.18006e5e0
jmp 0x180033c0c
xor edx, edx
lea rcx, [rbp + 0xe80]
mov r8d, 0x800
call fcn.18006e5e0
mov eax, 1
lea r8, [rbp + 0x16c8]
mov word [rbp + 0x16c8], ax
lea rdx, [rsp + 0x50]
mov rax, qword [rsi]
mov ecx, 0x42
mov qword [rsp + 0x50], rax
call fcn.180018420
movsxd r12, eax
lea r8, [rbp + 0x16c8]
mov eax, 2
lea rdx, [rsp + 0x50]
mov word [rbp + 0x16c8], ax
lea rcx, [rbp + 0x680]
mov rax, qword [rsi]
mov r9d, 0x53
mov qword [rsp + 0x50], rax
call fcn.18002dab0
jmp 0x180033c0c
mov rax, qword [rsi]
lea r8, [rbp + 0x16c8]
mov r9d, 0x53
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov word [rbp + 0x16c8], r10w
lea rcx, [rbp + 0xe80]
call fcn.18002dab0
xor r9d, r9d
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x67]
call fcn.180051020
lea rcx, [rsp + 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x680]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180033c0c
mov rcx, qword [rsp + 0x58]
lea r9, [rbp + 0x16d0]
mov qword [rsp + 0x28], r14
lea rdx, [rbp + 0xe80]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180033c0c
mov eax, dword [rbp + 0x16d0]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x46
call fcn.180066820
mov r15, rax
jmp 0x180033c0c
mov word [0x1800ce8f8], r14w
jmp case.0x180033973.5
movups xmm0, xmmword [rsi]
mov eax, dword [rsi + 0x10]
lea rdx, [rbp + 0x90]
mov ecx, 0xfffffef8
mov dword [rbp + 0x4a0], eax
movaps xmmword [rbp + 0x490], xmm0
call qword [0x1800ce8f0]
jmp 0x180033c0c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180033c0c
mov rax, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x4000000
mov edx, 0x40000000
mov dword [rsp + 0x20], r8d
mov byte [rbp + rax - 0x80], 0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp r14, 0xffffffffffffffff
je 0x180033c0c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180033c0c
mov rax, qword [rsi]
lea r8, [rbp + 0x16d8]
mov word [rbp + 0x16d8], r9w
lea rdx, [rsp + 0x50]
mov r9d, 0x53
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x80]
call fcn.18002dab0
mov qword [rsp + 0x60], rax
jmp 0x180033c0c
mov dword [rbp + 0x16c8], r13d
mov rax, qword [rsi]
lea r9, [rbp + 0x16c8]
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov r10d, 3
lea rdx, [0x180000000]
lea r9d, [r10 - 2]
lea r8d, [r10 - 1]
dec ebx
mov r14d, 0
sub rdi, 1
jne 0x180033960
mov r15, qword [rsp + 0x1780]
mov r14, qword [rsp + 0x1788]
mov r13, qword [rsp + 0x1790]
mov r12, qword [rsp + 0x1798]
mov rdi, qword [rsp + 0x17a0]
mov rbx, qword [rsp + 0x17c0]
add rsp, 0x17a8
pop rsi
pop rbp
ret