Function at 0x14006c2b0
Capabilities:
Delete directory
Delete registry value
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.140134690
sub rsp, rax
xor r14d, r14d
mov ecx, dword [0x14070a508]
test ecx, ecx
jne 0x14006c2f7
call fcn.14002e1d0
mov ecx, r14d
test al, al
setne cl
inc ecx
mov dword [0x14070a508], ecx
cmp ecx, 1
lea rcx, [rbp - 0x30]
mov edx, 0x15e
je 0x14006c30a
mov edx, 0x15d
call fcn.1400177a0
nop
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x14006ca3f
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x1058], rax
mov rdx, rbx
lea rcx, [rbp + 0x1058]
call fcn.140007020
mov r12, 0xffffffffffffffff
test al, al
jne 0x14006c38d
test rbx, rbx
jne 0x14006c364
mov eax, r14d
jmp 0x14006c37a
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14006c370
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x1058]
call fcn.140008250
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14006c3cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c3c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca4a
call fcn.140133e68
lea rax, [rbp + 0x1050]
mov qword [rsp + 0x20], rax
mov r9d, 0x2021b
xor r8d, r8d
mov rbx, qword [rbp + 0x1058]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006c405
xor sil, sil
jmp 0x14006c9fa
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1050]
call fcn.140070ed0
cmp qword [rsp + 0x40], 0
jne 0x14006c44c
mov rcx, qword [rbp + 0x1050]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor sil, sil
jmp 0x14006c9a8
mov esi, 1
mov edi, esi
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.14017e2dc
test eax, eax
je 0x14006c84b
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jl 0x14006c453
lea rdx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x48]
cmp r10, 8
cmovae rdx, r9
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x14006c4d7
lea rcx, [r8 - 1]
mov rax, r12
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14006c4cf
nop dword [rax]
cmp rcx, rdx
je 0x14006c4d7
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14006c4c0
sub rcx, rdx
sar rcx, 1
jmp 0x14006c4da
mov rcx, r12
inc rcx
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp r8, rcx
jb 0x14006ca50
sub r8, rcx
mov r14, r12
cmp r8, r12
cmovb r14, r8
lea rax, [rsp + 0x30]
cmp r10, 8
cmovae rax, r9
lea rax, [rax + rcx*2]
mov qword [rbp + 0x1060], rax
movabs rcx, 0x7ffffffffffffffe
cmp r14, 7
ja 0x14006c560
mov qword [rbp - 0x80], r14
lea rdi, [r14 + r14]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1401378a0
xor ecx, ecx
mov word [rsp + rdi + 0x70], cx
mov r15, qword [rbp - 0x78]
mov r14, qword [rbp - 0x80]
mov r13, qword [rsp + 0x70]
jmp 0x14006c5c1
cmp r14, rcx
ja 0x14006ca56
mov r15, r14
or r15, 7
cmp r15, rcx
jbe 0x14006c57a
mov r15, rcx
jmp 0x14006c586
mov eax, 0xa
cmp r15, rax
cmovb r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x70]
call fcn.14000c790
mov r13, rax
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r15
lea rdi, [r14 + r14]
mov r8, rdi
mov rdx, qword [rbp + 0x1060]
mov rcx, rax
call fcn.1401378a0
xor ecx, ecx
mov word [rdi + r13], cx
mov qword [rsp + 0x70], r13
test r14, r14
je 0x14006c801
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rcx
lea rax, [rsp + 0x70]
cmp r15, 8
cmovae rax, r13
mov qword [rbp + 0x1060], rax
cmp r14, 8
jae 0x14006c5fe
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
mov edi, 7
jmp 0x14006c63e
mov rdi, r14
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x70]
call fcn.14000c790
mov qword [rbp - 0x70], rax
lea r8, [r14*2 + 2]
mov rdx, qword [rbp + 0x1060]
mov rcx, rax
call fcn.1401378a0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rdi
lea rcx, [rbp - 0x70]
call fcn.140069ca0
test eax, eax
je 0x14006c75a
mov edx, 0xea60
mov r8d, 0x3e8
mov ecx, eax
call fcn.140069fc0
test al, al
je 0x14006c801
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.14017e2dc
test eax, eax
je 0x14006c752
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x14006c671
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x14006c6d0
lea rcx, [rsp + 0x50]
call fcn.14003a5e0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14006c807
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca5c
call fcn.140133e68
jmp 0x14006c807
mov sil, 1
jmp 0x14006c804
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov r8, r12
inc r8
cmp word [rdx + r8*2], r14w
jne 0x14006c784
lea rcx, [rsp + 0x50]
call fcn.14003a5e0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14006c807
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca39
jmp 0x14006c748
xor sil, sil
xor r14d, r14d
cmp r15, 8
jb 0x14006c842
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14006c83a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca62
mov rcx, r13
call fcn.140133e68
test sil, sil
je 0x14006c99a
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea rdi, [rax + rax]
add r8, rdi
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
sub r8, rdx
lea rcx, [rbp + 0x10]
call fcn.1401378a0
mov word [rbp + rdi + 0x10], r14w
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14006c932
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
lea rax, [rbp + 0x10]
mov r8, r12
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14006c8c0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14003a5e0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14006c932
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c92d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca68
call fcn.140133e68
mov edx, 5
lea rcx, [rbp - 0x10]
call fcn.1400177a0
cmp qword [rax + 0x18], 8
jb 0x14006c94a
mov rax, qword [rax]
mov rdx, rax
mov rcx, qword [rbp + 0x1050]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14006c99a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c995
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca6e
call fcn.140133e68
mov rcx, qword [rbp + 0x1050]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14006c9e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c9e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ca33
call fcn.140133e68
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x14006ca14
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x1168]
add rsp, 0x1110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401462a8
nop
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
nop
call fcn.140074b90
int3
call fcn.1400157c0
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3