Function at 0x14003b6bc
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov rax, qword [rbp + 0x660]
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov r13d, 1
xor ecx, ecx
mov dword [rsp + 0x4c], r9d
mov qword [rsp + 0x58], rdx
mov edi, r9d
mov qword [rsp + 0x68], rax
mov rbx, r8
mov dword [rsp + 0x44], ecx
mov r15d, r13d
mov dword [rsp + 0x54], ecx
mov r14d, ecx
mov dword [rsp + 0x50], ecx
mov r12d, ecx
cmp rdx, 0xffffffffffffffff
je 0x14003c49d
test r9d, r9d
je 0x14003b751
mov rcx, rsi
call fcn.14003b3f4
test eax, eax
jne 0x14003b9ed
mov dword [rsp + 0x54], r13d
test edi, edi
mov dword [rsp + 0x28], r15d
lea rax, str.DELFILES
lea r13, str.COPYFILES
cmove r13, rax
lea r8, [rbp - 0x78]
lea rax, str.DEFAULTINSTALL
mov qword [rsp + 0x78], r13
test rbx, rbx
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x58]
cmove rbx, rax
xor ecx, ecx
mov r9, rbx
call fcn.14003c7c0
xor ecx, ecx
test eax, eax
je 0x14003c49d
mov eax, edi
neg eax
sbb ecx, ecx
add ecx, 0x26dd
call fcn.140019024
lea rcx, [rbp - 0x78]
call fcn.14003ca58
xor ecx, ecx
mov qword [rbp - 0x80], rax
mov rbx, rax
test rax, rax
je 0x14003c49d
mov r8, qword [rsi + 0x18]
test r8, r8
je 0x14003c484
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], cx
jne 0x14003b7dc
add rax, rax
cmp rax, 0x208
jae 0x14003c484
mov edx, 0x104
lea rcx, [rbp + 0x3e0]
call fcn.140010dd0
lea r8, [rbp + 0x3e0]
mov ecx, 4
lea rdx, str._Source_location_is:_S._r_n
call fcn.140019b1c
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [0x14004ca38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstok]
nop dword [rax + rax]
xor ecx, ecx
mov r12, rax
test rax, rax
je 0x14003c481
xor ebx, ebx
mov r9, r12
lea rdx, str._Parsing__S_INFSection:_S_r_n
mov r8, r13
mov ecx, 4
call fcn.140019b1c
lea r9, str.DESTINATIONDIRS
mov dword [rsp + 0x28], ebx
lea r8, [rbp - 0x60]
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.14003c7c0
test eax, eax
jne 0x14003b8c4
lea rax, str.DEFAULTDESTDIR
mov dword [rsp + 0x28], ebx
lea r9, str.DESTINATIONDIRS
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x60]
xor ecx, ecx
lea rdx, [rsp + 0x58]
call fcn.14003c7c0
test eax, eax
je 0x14003c468
lea rcx, [rbp - 0x60]
call fcn.14003ca58
mov r13, rax
test rax, rax
je 0x14003c468
lea rax, [rbp - 0x40]
mov r8, r13
sub r8, rax
lea rcx, [rbp - 0x40]
mov edx, 0x104
mov edi, 1
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14003b913
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14003b913
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x14003b8f1
test rdx, rdx
lea rax, [rcx - 2]
lea rdx, [0x14004ca38]
cmovne rax, rcx
lea rcx, [rbp - 0x40]
mov word [rax], bx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
mov edi, dword [rsp + 0x4c]
xor r9d, r9d
mov rsi, rax
test rax, rax
je 0x14003b9a2
add rsi, 2
mov word [rax], r9w
mov r8, rsi
lea rax, [rbp + 0x1d0]
sub r8, rax
lea rcx, [rbp + 0x1d0]
mov edx, 0x104
lea r14d, [r9 + 1]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14003b98e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14003b98e
mov word [rcx], ax
add rcx, 2
sub rdx, r14
jne 0x14003b96c
mov r14d, dword [rsp + 0x44]
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r9w
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14003ba26
mov r8d, 2
mov dword [rsp + 0x40], r9d
lea rdx, [0x14004b31c]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
nop dword [rax + rax]
lea rcx, [rbp - 0x40]
test eax, eax
jne 0x14003ba01
lea r8, [rsp + 0x40]
lea rdx, [0x14004b324]
call fcn.1400025b4
mov eax, dword [rsp + 0x40]
jmp 0x14003ba0d
mov edx, 0x80004005
cmp eax, edx
jne 0x14003b751
mov eax, edx
jmp 0x14003c4b4
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
lea r8, [rbp - 0x40]
mov edx, eax
mov rcx, rbx
call fcn.140038550
xor r9d, r9d
test eax, eax
je 0x14003bf96
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], r9d
lea rdx, [0x14004b360]
mov ebx, r9d
lea rcx, [rbp - 0x40]
call fcn.1400025b4
xor ecx, ecx
test eax, eax
je 0x14003bd78
mov eax, dword [rsp + 0x48]
cmp eax, 0xffffffff
je 0x14003bd76
cmp eax, 0x19
ja 0x14003bd3f
je 0x14003bcfd
cmp eax, 0x11
ja 0x14003bbb8
je 0x14003bb68
mov ebx, ecx
test eax, eax
je 0x14003bd76
sub eax, 1
je 0x14003bb1a
sub eax, 9
je 0x14003bcfd
sub eax, 1
je 0x14003bb03
cmp eax, 1
jne 0x14003bd78
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14003bae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bad2
mov eax, 0x57
jmp 0x14003bad8
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.Drivers
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.140010d0c
xor r9d, r9d
jmp 0x14003bf96
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
jmp 0x14003bb2f
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
jne 0x14003bf96
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
jne 0x14003bb54
mov eax, 0x57
jmp 0x14003bb5a
jle 0x14003bd78
movzx edi, ax
or edi, 0x80070000
jmp 0x14003bf87
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x14003bbac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bb98
lea eax, [rbx + 0x57]
jmp 0x14003bb9e
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.INF
jmp 0x14003baed
mov ebx, ecx
sub eax, 0x12
je 0x14003bcad
sub eax, 2
je 0x14003bc5d
sub eax, 1
je 0x14003bd76
sub eax, 2
je 0x14003bd76
cmp eax, 1
jne 0x14003bd78
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14003bc04
mov edi, ebx
jmp 0x14003bc30
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bc1b
mov eax, 0x57
jmp 0x14003bc21
jle 0x14003bd78
movzx edi, ax
or edi, 0x80070000
jne 0x14003bd78
lea rdx, [0x14004b368]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
xor r9d, r9d
test rax, rax
je 0x14003bf87
mov word [rax + 4], r9w
jmp 0x14003bf87
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14003bca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bc8d
mov eax, 0x57
jmp 0x14003bc93
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.Fonts
jmp 0x14003baed
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14003bcf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bcdd
mov eax, 0x57
jmp 0x14003bce3
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.Help
jmp 0x14003baed
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
jne 0x14003bf96
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
je 0x14003bb4d
jg 0x14003bb5a
mov ebx, r9d
jmp 0x14003bd78
cmp eax, 0x4019
ja 0x14003bf13
cmp eax, 0x4016
jae 0x14003bd76
cmp eax, 0x1e
je 0x14003bd76
cmp eax, 0x32
je 0x14003bd76
cmp eax, 0x33
je 0x14003bec3
cmp eax, 0x34
je 0x14003be73
mov ebx, ecx
jbe 0x14003bd78
cmp eax, 0x37
ja 0x14003bd78
mov ebx, ecx
mov rcx, r13
call fcn.140001454
test ebx, ebx
je 0x14003c466
mov rcx, qword [rsp + 0x58]
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, r12
call fcn.14001f858
xor ebx, ebx
test eax, eax
je 0x14003c2e1
mov rcx, qword [rsp + 0x58]
lea esi, [rbx + 1]
mov rdx, r12
mov r13d, esi
call fcn.14001f904
mov ecx, eax
mov dword [rsp + 0x40], eax
mov ebx, eax
call fcn.140019314
cmp ebx, esi
jb 0x14003c2df
mov ecx, r13d
mov edi, r14d
add r13d, esi
call fcn.140019120
lea rcx, [rbp - 0x78]
call fcn.14003ca58
mov qword [rsp + 0x70], rax
mov r12, rax
test rax, rax
je 0x14003c2be
xor ebx, ebx
lea rdx, [0x14004ca38]
mov rcx, rax
cmp dword [rsp + 0x4c], ebx
je 0x14003c318
mov esi, ebx
mov dword [rsp + 0x48], 3
mov r14d, ebx
lea r15d, [rbx + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
lea edi, [rbx + 1]
test rax, rax
je 0x14003c153
xor r12d, r12d
mov ecx, edi
mov word [rax], r12w
lea rbx, [rax + 2]
sub ecx, 1
je 0x14003c0f3
sub ecx, 1
je 0x14003c0ee
cmp ecx, 1
je 0x14003c0e1
lea rdx, str.ERROR:_Too_many_commas_in_CopyFiles_section._r_n
mov ecx, 5
call fcn.140019ae0
jmp 0x14003c0f6
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x14003beb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bea3
lea eax, [rbx + 0x57]
jmp 0x14003bea9
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.SpoolDrivers
jmp 0x14003baed
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x14003bf07
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14003bef3
lea eax, [rbx + 0x57]
jmp 0x14003bef9
jle 0x14003bd78
movzx eax, ax
or eax, 0x80070000
jne 0x14003bd78
lea r8, str.Spool
jmp 0x14003baed
mov ebx, ecx
sub eax, 0x401f
je 0x14003bd76
sub eax, 4
je 0x14003bf74
sub eax, 3
je 0x14003bf64
sub eax, 5
je 0x14003bf54
cmp eax, 0x3825
jne 0x14003bd78
mov edx, 1
lea rcx, [rbp - 0x40]
call fcn.14001b20c
xor r9d, r9d
test eax, eax
jne 0x14003bf96
jmp 0x14003bd78
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.140037d88
jmp 0x14003bf82
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.140038074
jmp 0x14003bf82
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.140037a74
mov edi, eax
xor r9d, r9d
mov ebx, r9d
test edi, edi
jne 0x14003bd78
mov edi, dword [rsp + 0x4c]
mov ebx, 1
test rsi, rsi
je 0x14003bfe3
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
or rsi, 0xffffffffffffffff
lea rdx, [rbp - 0x40]
mov rax, rsi
xor ecx, ecx
inc rax
cmp word [rdx + rax*2], cx
jne 0x14003bfbd
mov edx, 0x104
lea r8, [rbp + 0x1d0]
sub rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140010d0c
xor r9d, r9d
jmp 0x14003bfe7
or rsi, 0xffffffffffffffff
test edi, edi
je 0x14003c0b4
lea r8, [rbp - 0x40]
mov edx, 0x104
lea rax, [rbp + 0x1d0]
mov r14d, 1
sub r8, rax
lea rcx, [rbp + 0x1d0]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14003c031
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14003c031
mov word [rcx], ax
add rcx, 2
sub rdx, r14
jne 0x14003c00f
mov r14d, dword [rsp + 0x44]
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r9w
je 0x14003c0ab
lea rcx, [rbp + 0x1d0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r9w
jne 0x14003c051
test rax, rax
je 0x14003c08f
cmp word [rbp + rax*2 + 0x1ce], 0x5c
jne 0x14003c08f
lea rcx, [rbp + 0x1d0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r9w
jne 0x14003c075
test rax, rax
je 0x14003c08f
mov word [rbp + rax*2 + 0x1ce], r9w
jmp 0x14003c047
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14003c0ab
test al, 0x10
jne 0x14003c0b4
lea rcx, [rbp - 0x40]
call fcn.14001a31c
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r9, r12
lea r8, [rbp - 0x40]
lea rdx, str._Assigned_destination:__S_to__S._r_n
mov ecx, 4
call fcn.140019b1c
jmp 0x14003bd78
mov rcx, rbx
call fcn.14001e4e8
mov r15d, eax
jmp 0x14003c0f6
mov r14, rbx
jmp 0x14003c0f6
mov rsi, rbx
lea rdx, [0x14004ca38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
inc edi
test rax, rax
jne 0x14003be38
mov r12, qword [rsp + 0x70]
xor ebx, ebx
test rsi, rsi
je 0x14003c138
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bx
jne 0x14003c127
cmp rax, 2
cmovb rsi, rbx
test r14, r14
je 0x14003c153
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], bx
jne 0x14003c141
cmp rax, 2
cmovb r14, rbx
mov rdi, qword [rsp + 0x60]
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14003c171
cmp dword [rax + 0x74], ebx
jne 0x14003c171
bt r15d, 0x18
jb 0x14003c171
and r15d, 0xffffffbf
lea rax, [rsp + 0x48]
mov r9, r12
mov qword [rsp + 0x38], rax
lea r8, [rbp - 0x40]
mov eax, dword [rsp + 0x54]
lea rcx, [rbp + 0x3e0]
mov dword [rsp + 0x30], eax
mov rdx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
call fcn.14001ecdc
mov r15d, eax
test eax, eax
jns 0x14003c1de
mov dword [rsp + 0x28], eax
lea r9, [rbp + 0x3e0]
mov r14d, eax
mov dword [rsp + 0x44], eax
lea rax, [rbp - 0x40]
mov r8, r12
lea rdx, str.ERROR:_Could_not_find_file__S_at_source__S_for_dest__S:_0x_x._r_n
mov qword [rsp + 0x20], rax
mov ecx, 2
call fcn.140019b1c
jmp 0x14003c2ad
mov r14d, 1
test r15d, r15d
jne 0x14003c209
cmp dword [rsp + 0x48], r14d
lea r9, [rbp - 0x40]
mov r8, r12
lea rdx, str._Copied_file__S_to__S._r_n
lea ecx, [r14 + 3]
cmove r15d, r14d
call fcn.140019b1c
cmp qword [rdi + 0x10], rbx
je 0x14003c29e
mov ecx, 0x208
call fcn.1400014a0
xor r9d, r9d
mov rbx, rax
test rax, rax
je 0x14003c29e
mov rdx, rax
mov esi, 0x104
lea rax, [rbp - 0x40]
mov r8d, esi
sub rax, rdx
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x14003c25b
movzx ecx, word [rdx + rax]
test cx, cx
je 0x14003c25b
mov word [rdx], cx
add rdx, 2
sub r8, r14
jne 0x14003c23a
test r8, r8
lea rax, [rdx - 2]
mov rcx, rbx
cmovne rax, rdx
mov word [rax], r9w
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.140010d0c
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
mov rdx, rbx
call fcn.140022f34
mov rcx, rbx
call fcn.140001454
cmp r15d, r14d
jne 0x14003c2a8
mov dword [rsp + 0x50], r14d
mov r14d, dword [rsp + 0x44]
mov rcx, r12
call fcn.140001454
mov ebx, dword [rsp + 0x40]
mov esi, 1
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x78]
call qword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
nop dword [rax + rax]
test eax, eax
je 0x14003c2df
cmp r13d, ebx
jbe 0x14003bdce
xor ebx, ebx
xor r8d, r8d
lea rdx, [0x14004ca38]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstok]
nop dword [rax + rax]
mov r13, qword [rsp + 0x78]
mov r12, rax
test rax, rax
jne 0x14003b85a
mov rbx, qword [rbp - 0x80]
mov r12d, dword [rsp + 0x50]
jmp 0x14003c484
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14003c32c
mov word [rax], bx
mov ecx, 0x208
call fcn.1400014a0
xor esi, esi
mov rbx, rax
test rax, rax
je 0x14003c2ad
mov rdx, rax
lea r15d, [rsi + 1]
lea rax, [rbp - 0x40]
mov r14d, 0x104
sub rax, rdx
mov r8d, r14d
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x14003c37c
movzx ecx, word [rdx + rax]
test cx, cx
je 0x14003c37c
mov word [rdx], cx
add rdx, 2
sub r8, r15
jne 0x14003c35b
test r8, r8
lea rax, [rdx - 2]
mov rcx, rbx
cmovne rax, rdx
mov word [rax], si
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r8, r12
mov rdx, r14
mov rcx, rbx
call fcn.140010d0c
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call fcn.14001d558
mov r15d, eax
mov r8, rbx
test eax, eax
jns 0x14003c3e5
mov r9d, eax
mov dword [rsp + 0x44], eax
lea rdx, str.ERROR:_Could_not_delete__S:_0x_x._r_n
mov ecx, 2
mov r14d, eax
call fcn.140019b1c
jmp 0x14003c40f
lea rdx, str._Deleted_file__S._r_n
mov ecx, 4
call fcn.140019b1c
mov eax, 1
mov dword [rsp + 0x44], edi
mov r14d, edi
cmp r15d, eax
jne 0x14003c40f
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x44], edi
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14003c459
xor edx, edx
call fcn.140026f28
mov rdi, rax
test rax, rax
je 0x14003c459
mov r8, rbx
mov rcx, rax
call fcn.14001bd70
mov rsi, rax
test rax, rax
je 0x14003c459
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, rsi
call fcn.140001454
mov rcx, rbx
call fcn.140001454
jmp 0x14003c2ad
xor ebx, ebx
mov r8, r12
lea rdx, str.ERROR:_Failed_to_assign_destination_for:__S._r_n
mov ecx, 2
call fcn.140019b1c
jmp 0x14003c2e1
mov r12d, ecx
mov rcx, rbx
call fcn.140001454
xor ecx, ecx
test r15d, r15d
jns 0x14003c498
mov r14d, r15d
jmp 0x14003c4b1
test r14d, r14d
jne 0x14003c4a0
mov r14d, r15d
mov eax, 1
cmp r14d, eax
jne 0x14003c4b1
test r12d, r12d
cmovne r14d, ecx
mov eax, r14d
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1400017f0
mov rbx, qword [rsp + 0x758]
add rsp, 0x700
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret