Function at 0x140030770
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
xor r8d, r8d
lea rdx, str.Tool_RemoveLauncher
lea rcx, [rbp - 0x18]
call fcn.140001190
nop
mov edi, 1
call fcn.140059f20
mov r12, qword [rax + 8]
call fcn.140056384
mov r11, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400307cf
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea r14, [0x1402209ac]
mov rbx, r14
shr rbx, 0x10
test rbx, rbx
jne 0x140030814
movzx esi, r14w
mov ecx, esi
call fcn.140056158
test rax, rax
je 0x140030824
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140005730
jmp 0x140030824
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.1400059f0
nop
mov r8, qword [r12 + 0x7f8]
lea rdx, str.PSW_sWindowClass
lea rcx, [rbp + 0x48]
call fcn.14000bfe0
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140030861
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.140056384
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140030881
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r9, str.LAK.EXE
mov r8, qword [r12 + 0x808]
lea rdx, [0x14021c280]
lea rcx, [rbp - 0x30]
call fcn.14000bfe0
mov rdx, qword [r12 + 0x1c0]
mov rcx, qword [rbp - 0x30]
call fcn.140030b30
or esi, 0xffffffff
test eax, eax
jne 0x140030abd
call fcn.140056384
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400308ed
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
test rbx, rbx
jne 0x140030924
movzx ebx, r14w
mov ecx, ebx
call fcn.140056158
test rax, rax
je 0x140030934
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140005730
jmp 0x140030934
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x40]
call fcn.1400059f0
nop
mov r8, qword [r12 + 0x808]
lea rdx, str._slaunch_notifyicon
lea rcx, [rbp + 0x40]
call fcn.14000bfe0
xor edx, edx
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140030971
xor r9d, r9d
xor r8d, r8d
mov edx, 0x403
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp + 0x50], r13
call fcn.140056384
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140030995
mov ecx, 0x80004005
call fcn.140004550
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r8, qword [r12 + 0x808]
lea rdx, str._s_Launcher
lea rcx, [rbp - 0x28]
call fcn.14000bfe0
lea r11, [rbp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rbp - 0x28]
test eax, eax
jne 0x140030a15
mov rdx, rbx
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140030a09
cmp eax, 2
je 0x140030a09
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140030a21
cmp eax, 2
je 0x140030a21
cmp eax, 3
cmovne edi, r13d
mov qword [rbp + 0x58], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140030a78
mov rdx, rbx
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140030a6c
cmp eax, 2
je 0x140030a6c
cmp eax, 3
cmovne edi, r13d
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140030a84
cmp eax, 2
je 0x140030a84
cmp eax, 3
cmovne edi, r13d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140030a9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140030abd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rbp - 0x18]
call fcn.140001370
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140030af5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140030b13
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp - 0x18]
call fcn.140001320
mov eax, edi
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret