Function at 0x18000f960
Capabilities:
Delete registry key
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x18002c718]
xor rax, rsp
mov qword [rbp + 0xb8], rax
lea ebx, [rcx - 0xe]
mov qword [rsp + 0x60], r8
xor r10d, r10d
mov dword [rsp + 0x40], ebx
cmp ecx, ebx
mov dword [rsp + 0x58], ecx
movzx ebx, byte [rsp + 0x44]
mov r15, rdx
mov edi, ecx
mov dword [rsp + 0x68], r10d
jbe case.0x18000fa0d.0
mov edx, dword [rsp + 0x50]
lea esi, [rcx - 0x2d]
mov r9d, dword [rsp + 0x50]
lea r11, [0x180000000]
mov r13, qword [rbp - 0x68]
lea r14d, [r10 + 0x65]
mov r12d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], r9d
nop dword [rax + rax]
cmp esi, 0x22
ja case.default.0x18000fa0d
movzx eax, byte [r11 + rsi + 0x10054]
mov ecx, dword [r11 + rax*4 + 0x1001c]
add rcx, r11
jmp rcx
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x18000fa1c
mov rcx, qword [r8]
mov qword [rsp + 0x30], r10
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r10d, r10d
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x60], r10
cmp rax, 0xffffffffffffffff
jne 0x18000fc30
mov edi, r10d
nop dword [rax]
cmp edi, 0xf
ja case.default.0x18000fa7c
lea rdx, [0x180000000]
mov ecx, edi
mov eax, dword [rdx + rcx*4 + 0x10078]
add rax, rdx
jmp rax
mov eax, dword [0x180025e84]
lea rdx, [0x180025e90]
mov dword [rbp + 0xa8], eax
lea rcx, [rbp + 0x98]
movzx eax, word [0x180025e88]
mov r8d, 3
mov word [rbp + 0xac], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r10d, r10d
mov r13, 0xffffffff80000001
jmp case.default.0x18000fa7c
mov dword [rbp + 0x82], 0x570065
mov dword [rbp + 0x86], 0x740069
mov dword [rbp + 0x8a], 0x440068
mov word [rbp + 0x8e], r14w
jmp case.default.0x18000fa7c
mov dword [rbp + 0x64], 0x6f0063
mov dword [rbp + 0x68], 0x640072
jmp case.default.0x18000fa7c
mov dword [rbp + 0x78], 0x530074
jmp case.default.0x18000fa7c
mov eax, 0x52
mov word [rbp + 0x60], ax
jmp case.default.0x18000fa7c
mov dword [rbp + 0x7c], 0x610074
jmp case.default.0x18000fa7c
mov eax, 0x43
mov dword [rbp + 0x6e], 0x720075
mov word [rbp + 0x6c], ax
mov eax, 0x72
mov word [rbp + 0x72], ax
jmp case.default.0x18000fa7c
lea rax, [rbp + 0x98]
mov word [rbp + 0x98], r10w
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x18000fb60
movzx ecx, word [0x180025ea0]
lea rdx, [rbp + 0xa4]
movsd xmm0, qword [str.428]
mov r8d, 0xa
movsd qword [rax], xmm0
mov word [rax + 8], cx
mov eax, dword [0x180025ea4]
mov dword [rbp + 0xa0], eax
lea ecx, [r8 + 0x20]
movzx eax, word [0x180025ea8]
mov word [rbp + 0xa4], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
xor r10d, r10d
jmp case.default.0x18000fa7c
mov word [rbp + 0x62], r14w
jmp case.default.0x18000fa7c
mov dword [rbp + 0x90], 0x61006c
jmp case.default.0x18000fa7c
lea r8, [rbp - 0x48]
mov edx, r12d
lea rcx, [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrToInt64ExW]
lea rdx, [rbp + 0x98]
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
xor bl, bl
xor r10d, r10d
jmp case.default.0x18000fa7c
mov dword [rbp + 0x74], 0x6e0065
jmp case.default.0x18000fa7c
mov eax, 0x74
mov word [rbp + 0x80], ax
jmp case.default.0x18000fa7c
mov dword [rbp + 0x94], 0x79
jmp case.default.0x18000fa7c
mov r12d, r10d
inc edi
lea eax, [rdi + 0x126]
cmp eax, 0x136
jb 0x18000fa60
mov edi, dword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea r11, [0x180000000]
mov edx, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x4c]
mov dword [rsp + 0x6c], r10d
jmp case.0x18000fa0d.13
movzx eax, word [r8 + 0x1c]
mov ecx, 0xfff3
and ax, cx
mov word [r8 + 0x1c], ax
jmp case.0x18000fa0d.13
mov r9d, dword [rbp - 0x78]
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rbp - 0x80]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.SHLWAPI.dll_ColorAdjustLuma]
mov bl, 1
mov r8, qword [rsp + 0x60]
lea r11, [0x180000000]
mov edx, dword [rsp + 0x48]
xor r10d, r10d
mov r9d, dword [rsp + 0x4c]
jmp case.0x18000fa0d.13
cmp qword [r8 + 0x18], 0x10
mov rax, r8
jb 0x18000fcb9
mov rax, qword [r8]
mov edx, dword [rax + 4]
mov dword [rsp + 0x48], edx
cmp rdx, qword [rbp - 0x70]
jae 0x18000fcfd
mov dword [r15 + 0x20], r9d
jmp case.0x18000fa0d.13
mov eax, dword [rsp + 0x54]
cmp eax, dword [rsp + 0x6c]
je case.0x18000fa0d.13
mov ecx, 0x3f
mov eax, ecx
sub eax, 0x3f
je 0x18000fd38
sub eax, 0x51
je 0x18000fd24
sub eax, 0x51
je 0x18000fd04
sub eax, 0x51
je 0x18000fd38
cmp eax, 0x51
jne 0x18000fd38
xor al, al
jmp 0x18000ffd6
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
jmp 0x18000fd38
mov qword [r15 + 0x10], r10
mov rax, r15
cmp qword [r15 + 0x18], 0x10
jb 0x18000fd35
mov rax, qword [r15]
mov byte [rax], 0
add ecx, 0x51
cmp ecx, 0x1d4
jb 0x18000fce2
jmp case.0x18000fa0d.13
mov rcx, qword [rbp - 0x68]
mov dword [r15 + 0x24], edx
mov rax, qword [r8 + 0x10]
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
cmp rax, rcx
jb 0x18001000d
sub rax, rcx
mov qword [rbp - 0x40], 0xffffffffffffffff
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x38], rax
cmp rax, rsi
cmovb rsi, rax
cmp qword [r8 + 0x18], 0x10
mov rax, r8
jb 0x18000fd93
mov rax, qword [r8]
lea r14, [rax + rcx]
cmp rsi, 0xf
ja 0x18000fdba
mov r8, rsi
mov qword [rbp + 0x50], rsi
mov rdx, r14
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x40], 0
jmp 0x18000fe5f
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x180010007
mov rdi, rsi
or rdi, 0xf
mov qword [rbp - 0x30], rdi
cmp rdi, rax
jbe 0x18000fde2
mov rdi, rax
jmp 0x18000fdf2
mov eax, 0x16
cmp rdi, rax
mov qword [rbp - 0x28], rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18000fe2b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180010013
mov rcx, rax
call fcn.180022524
test rax, rax
je 0x180010000
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000fe3d
test rcx, rcx
je 0x18000fe3a
call fcn.180022524
mov rbx, rax
jmp 0x18000fe3d
mov rbx, r10
mov r8, rsi
mov qword [rbp + 0x50], rsi
mov rdx, r14
mov qword [rbp + 0x58], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x58]
mov byte [rbx + rsi], 0
mov qword [rbp + 0x40], rbx
or dword [rsp + 0x68], 1
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.1800039a0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x18000feab
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fea6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010000
call fcn.180022560
mov r8, qword [rsp + 0x60]
lea r11, [0x180000000]
mov esi, dword [rsp + 0x70]
xor r10d, r10d
mov edx, dword [rsp + 0x48]
mov bl, 1
mov r9d, dword [rsp + 0x4c]
mov qword [rbp + 0x50], r10
lea r14d, [r10 + 0x65]
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], r10b
jmp case.0x18000fa0d.13
cmp qword [r8 + 0x18], 0x10
mov rax, r8
jb 0x18000feef
mov rax, qword [r8]
mov r9d, dword [rax]
mov dword [rsp + 0x4c], r9d
cmp r9, qword [rbp - 0x70]
jae 0x18000fcfd
jmp case.0x18000fa0d.13
movzx eax, word [r8 + 0x1c]
movzx ecx, word [r15]
or cx, ax
mov word [r8 + 0x1c], cx
jmp case.0x18000fa0d.13
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
mov qword [rbp - 0x58], r10
mov dword [rbp - 0x80], 0x32
jb 0x18000ff34
mov rdx, qword [r15]
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x6c]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18000fc8f
mov rcx, qword [rsp + 0x78]
xor edx, edx
mov qword [rbp - 0x50], r10
mov dword [rbp - 0x7c], r10d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, r15
mov dword [rsp + 0x54], eax
call fcn.180022300
jmp 0x18000fc8f
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x78], 5
mov dword [rsp + 0x50], 1
jmp 0x18000fc8f
mov rax, qword [r8 + 0x10]
mov qword [rbp - 0x68], 8
cmp rax, 8
jb 0x18000fcfd
add rax, 0xfffffffffffffff8
mov qword [rbp - 0x70], rax
mov eax, dword [rsp + 0x40]
dec edi
dec esi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x70], esi
cmp edi, eax
ja 0x18000f9f0
movzx eax, bl
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.180022a70
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180020a60
int3
call fcn.180020aa0
int3
call fcn.180020920
int3