Function at 0x140027e30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov r15, rdx
mov r14, rcx
mov edx, 1
lea rcx, str.SeBackupPrivilege
call fcn.140027d30
test eax, eax
jns 0x140027e95
mov r8d, 0x35
lea rdx, str.exportRegistryToFile_____Failed_to_modify_privilege._n
lea rcx, [0x140637438]
call fcn.140004100
xor al, al
jmp 0x1400283e4
mov rax, qword [r14 + 8]
cmp qword [r14], rax
jne 0x140027ebe
mov r8d, 0x3a
lea rdx, str.exportRegistryToFile_____error__registry_vector_is_empty__n
lea rcx, [0x140637438]
call fcn.140004100
xor al, al
jmp 0x1400283e4
call fcn.1402255b4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140027edd
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
call fcn.1402255b4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140027f0d
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x50], rbx
call fcn.1402255b4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140027f3d
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
mov rdi, qword [r14]
or esi, 0xffffffff
cmp rdi, qword [r14 + 8]
je 0x140028388
lea rax, [rbp - 0x38]
mov qword [rbp - 8], rax
nop word [rax + rax]
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.140003c60
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.140027aa0
mov r13, rax
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], 0
jge 0x140027f9d
mov eax, esi
jmp 0x140027fb8
lea rdx, [0x1405369f4]
call fcn.140360ee0
test rax, rax
jne 0x140027fb2
mov eax, esi
jmp 0x140027fb8
sub rax, qword [rdi]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.1400078d0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140028022
cmp dword [rbx + 0x10], 0
jl 0x140028014
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140028014
call fcn.140003c60
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140028009
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rbp - 0x50], rax
jmp 0x140028022
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140004100
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140028040
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x50]
cmp dword [rdx - 8], 1
jle 0x14002805a
mov edx, dword [rdx - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140003fa0
mov rdx, qword [rbp - 0x50]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028310
mov rdx, qword [rdi]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x48]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400280d8
cmp dword [rbx + 0x10], eax
jl 0x1400280cb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400280cb
call fcn.140003c60
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400280c0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rbp - 0x48], rax
jmp 0x1400280d8
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140004100
mov edx, 0x5c
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x48]
call fcn.140009690
call fcn.1402255b4
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140028305
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea r12, [0x140536ef0]
test r12, 0xffffffffffff0000
jne 0x140028141
movzx ebx, r12w
mov ecx, ebx
call fcn.1402253fc
test rax, rax
je 0x14002814e
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140003e00
jmp 0x14002814e
mov rdx, r12
lea rcx, [rbp - 0x40]
call fcn.140188680
nop
lea r8, [rbp - 0x40]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp - 0x18]
call fcn.1400044f0
nop
lea r8, [rbp - 0x48]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400044f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400281ce
cmp dword [rbx + 0x10], 0
jl 0x1400281c0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400281c0
call fcn.140003c60
mov r12, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400281b5
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r12 + 0x18]
mov qword [rbp + 0x58], rax
jmp 0x1400281ce
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x58]
call fcn.140004100
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400281ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002820c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002822a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x58]
call fcn.14000f490
test al, al
je 0x140028257
mov rcx, qword [rbp + 0x58]
cmp dword [rcx - 8], 1
jle 0x140028251
mov edx, dword [rcx - 0x10]
lea rcx, [rbp + 0x58]
call fcn.140003fa0
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0x58]
cmp dword [rdx - 8], 1
jle 0x140028271
mov edx, dword [rdx - 0x10]
lea rcx, [rbp + 0x58]
call fcn.140003fa0
mov rdx, qword [rbp + 0x58]
mov r9d, 2
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
test eax, eax
jne 0x1400282ab
lea rdx, [rbp + 0x58]
mov rcx, r15
call fcn.140001a70
add rdi, 8
cmp rdi, qword [r14 + 8]
je 0x140028388
mov rbx, qword [rbp - 0x50]
jmp 0x140027f70
mov r9d, eax
mov r8, qword [rdi]
lea rdx, str.exportRegistryToFile_____RegSaveKeyEx___failed_for_key__s_with_error_code__u_n
lea rcx, [0x140637438]
call fcn.140055e00
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400282e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140028303
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140028368
mov ecx, 0x80004005
call fcn.1400042e0
int3
mov r9d, eax
mov r8, qword [rdi]
lea rdx, str.exportRegistryToFile_____RegOpenKeyEx___failed_for_key__s_with_error_code__u_n
lea rcx, [0x140637438]
call fcn.140055e00
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140028349
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140028368
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140028384
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x1400283e4
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400283a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400283c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x48]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400283e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret