Function at 0x10001c5cc
Capabilities:
Delete file
Get file size
Read file on windows
Set registry value
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor r15d, r15d
lea rax, [0x10001c4f8]
mov qword [0x100035f60], rcx
mov qword [r11 - 0x58], rax
lea rax, [0x100019700]
lea rbx, [0x100019708]
mov qword [r11 - 0xb8], rax
mov rax, qword [0x1000345a8]
lea rcx, [r11 - 0x90]
mov r14, r8
mov qword [r11 - 0x60], rbx
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x90], rax
mov qword [r11 - 0x88], rax
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x48], r15
mov dword [r11 - 0xb0], r15d
mov dword [r11 - 0xac], r15d
mov dword [r11 - 0xa8], r15d
mov dword [r11 - 0xa4], r15d
mov dword [r11 - 0xa0], r15d
mov dword [r11 - 0x9c], r15d
mov dword [r11 - 0x98], r15d
call fcn.10001da14
lea rcx, [rsp + 0xb0]
call fcn.10001da14
lea rcx, [rsp + 0xb8]
call fcn.10001da14
lea rcx, [rsp + 0xc0]
call fcn.10001da14
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.10001be64
lea r13d, [r15 + 1]
cmp eax, r15d
je 0x10001c7c2
mov rbx, qword [rsp + 0xc0]
mov r12d, r15d
cmp qword [rbx - 0x10], r15
je 0x10001c7bb
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x10001c7bb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
je 0x10001c793
lea rcx, [rdi + 2]
call fcn.10002157c
cmp rax, r15
mov rsi, rax
je 0x10001c78d
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
call fcn.100028c50
lea r9, [rsp + 0x140]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x140], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r15d
je 0x10001c785
cmp dword [rsp + 0x140], edi
jne 0x10001c785
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.10001be64
mov rbx, qword [rsp + 0xc0]
mov r12d, eax
mov rcx, rsi
call fcn.100021570
mov r13d, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xc0]
call fcn.10001da14
cmp r12d, r15d
jne 0x10001c6bc
lea rbx, [0x100019708]
mov rsi, qword [rsp + 0xa8]
mov eax, r15d
mov r12d, 2
cmp qword [rsi - 0x10], r15
je 0x10001c7e1
mov rdx, rsi
mov ecx, r13d
jmp 0x10001c807
mov rdx, qword [rsp + 0xb0]
cmp qword [rdx - 0x10], r15
je 0x10001c7f4
mov ecx, r12d
jmp 0x10001c807
mov rdx, qword [rsp + 0xb8]
cmp qword [rdx - 0x10], r15
je 0x10001c80c
mov ecx, 3
call fcn.10001e6cc
cmp eax, r13d
mov ebp, r15d
jne 0x10001cbdc
mov rax, qword [0x1000345a8]
lea rdx, [0x100019778]
lea rcx, [rsp + 0x48]
mov r8, rbx
mov qword [rsp + 0x48], rax
call fcn.10001e400
mov r8, qword [rsp + 0x48]
lea rax, [0x100019ea8]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x78], r15d
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x20], 0xf003f
call fcn.10001e980
cmp dword [rsp + 0x78], r15d
je 0x10001cb96
mov rax, qword [0x1000345a8]
mov edi, r15d
mov qword [rsp + 0x40], rax
lea rdx, [0x100019620]
lea rcx, [rsp + 0x140]
call fcn.10001dc10
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x68]
mov r8d, edi
call fcn.10001ed5c
mov rcx, qword [rax]
cmp qword [rsp + 0x40], rcx
je 0x10001c8ce
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.10001dcf8
mov r11, rax
jmp 0x10001c8d3
lea r11, [rsp + 0x40]
mov rax, qword [rsp + 0x140]
mov r8, qword [r11]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x10001c8f4
add rax, r12
test ecx, ecx
jne 0x10001c8e1
cmp edx, r15d
lea rcx, [rsp + 0xd0]
mov ebx, r15d
setne bl
call fcn.10001da98
lea rcx, [rsp + 0x140]
call fcn.10001da98
cmp ebx, r15d
je 0x10001c992
xor eax, eax
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call fcn.10001de9c
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x150]
mov rcx, rax
call sub.WINSPOOL.DRV_OpenPrinterW
cmp eax, r15d
jne 0x10001c97d
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.10001f150
cmp eax, r15d
jne 0x10001c889
jmp 0x10001c98a
mov rcx, qword [rsp + 0x150]
call sub.WINSPOOL.DRV_ClosePrinter
add edi, r13d
jmp 0x10001c889
cmp qword [rsi - 0x10], r15
je 0x10001ca4a
cmp dword [rsp + 0x88], r15d
je 0x10001ca33
cmp dword [0x100035f8c], r15d
mov dword [rsp + 0x140], r13d
je 0x10001c9f9
cmp dword [rsp + 0x78], r15d
je 0x10001ca4a
mov rax, qword [0x1000348c0]
cmp rax, r15
je 0x10001ca4a
lea rcx, [rsp + 0x140]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
call rax
jmp 0x10001ca4a
cmp dword [rsp + 0x78], r15d
mov dword [rsp + 0x150], r13d
je 0x10001ca4a
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x150]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10001ca4a
cmp dword [rsp + 0x98], r15d
je 0x10001ca4a
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.10001f150
lea rdx, [0x100019620]
lea rcx, [rsp + 0x140]
call fcn.10001dc10
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call fcn.10001ed5c
mov rcx, qword [rax]
cmp qword [rsp + 0x40], rcx
je 0x10001ca8f
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.10001dcf8
mov rdx, rax
jmp 0x10001ca94
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x140]
mov rdx, qword [rdx]
sub rdx, rax
movzx r8d, word [rax]
movzx ecx, word [rax + rdx]
sub r8d, ecx
jne 0x10001cab6
add rax, r12
test ecx, ecx
jne 0x10001caa2
cmp r8d, r15d
lea rcx, [rsp + 0x150]
mov ebx, r15d
sete bl
call fcn.10001da98
lea rcx, [rsp + 0x140]
call fcn.10001da98
lea rcx, [rsp + 0x68]
cmp ebx, r15d
cmovne ebp, r13d
call fcn.10001ea70
lea rcx, [rsp + 0x40]
call fcn.10001da98
cmp ebp, r15d
je 0x10001cb96
lea rdx, [0x1000197a8]
lea rcx, [rsp + 0x48]
call fcn.10001dd68
mov rdx, qword [rsp + 0x48]
lea r11, [0x100019ea8]
lea rax, [rsp + 0x58]
mov ebx, 0xf003f
xor r8d, r8d
cmp dword [0x100035f8c], r15d
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], r15
mov rcx, 0xffffffff80000002
mov r9d, ebx
je 0x10001cb55
call fcn.10001f6b8
jmp 0x10001cb5b
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, r15d
cmp eax, r15d
mov dword [rsp + 0x64], ebx
sete cl
cmp ecx, r15d
mov dword [rsp + 0x60], ecx
je 0x10001cb8c
lea rdx, [0x100019708]
lea rcx, [rsp + 0x50]
call fcn.10001ef1c
lea rcx, [rsp + 0x50]
call fcn.10001ea70
lea rcx, [rsp + 0x50]
call fcn.10001eabc
cmp dword [0x100035f8c], r15d
je 0x10001cbc8
mov rax, qword [0x1000347f8]
lea rcx, [0x1000347f8]
call qword [rax + 8]
mov rax, qword [0x100034870]
lea rcx, [0x100034870]
call qword [rax + 8]
mov dword [0x100035f8c], r15d
lea rcx, [rsp + 0x68]
call fcn.10001eabc
lea rcx, [rsp + 0x48]
call fcn.10001da98
cmp word [r14], 0x2d
je 0x10001cbee
cmp word [r14], 0x2f
jne 0x10001ccf7
cmp ebp, r15d
jne 0x10001ccb5
lea rdx, [r14 + 2]
lea rcx, [0x1000197d0]
mov r8, r12
call fcn.100021a0c
cmp eax, r15d
jne 0x10001cc1f
call fcn.10001cef4
cmp eax, r15d
je 0x10001cdf7
jmp 0x10001cc71
lea rdx, [r14 + 2]
lea rcx, [0x1000197d8]
mov r8, r12
call fcn.100021a0c
cmp eax, r15d
je 0x10001ccb5
lea rdx, [r14 + 2]
lea rcx, [0x1000197e0]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
jne 0x10001cc59
call fcn.10001cef4
jmp 0x10001cdf7
lea rdx, [r14 + 2]
lea rcx, [0x1000197e4]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
jne 0x10001cc7b
call fcn.10001d0e8
jmp 0x10001cdf7
lea rdx, [r14 + 2]
lea rcx, [0x1000197e8]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
jne 0x10001cc9d
call fcn.10001d1e8
jmp 0x10001cdf7
lea rdx, [r14 + 2]
lea rcx, [0x1000197ec]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
jne 0x10001ccbf
call fcn.10001d334
jmp 0x10001cdf7
lea rdx, [r14 + 2]
lea rcx, [0x1000197f0]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
je 0x10001cdc8
lea rdx, [r14 + 2]
lea rcx, [0x1000197f4]
mov r8, r13
call fcn.100021a0c
cmp eax, r15d
jne 0x10001cdc8
lea rbx, [0x1000197f8]
lea rcx, [0x100019820]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x100019870]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x1000198c0]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x100019920]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x100019970]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x1000199d0]
mov rdx, rbx
call fcn.100021ab8
lea rcx, [0x100019a40]
call fcn.100021ab8
lea rcx, [0x100019aa0]
call fcn.100021ab8
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, r15d
jne 0x10001cd9e
lea rcx, [0x100019b00]
call fcn.10001ce08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x80]
call fcn.10001be20
mov rbx, qword [rsp + 0x148]
xor eax, eax
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x100019b68]
lea rcx, [0x100019dc0]
mov dword [0x100035f84], r13d
call fcn.100021ab8
lea rcx, [0x10001d4bc]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.10001c230
xor ecx, ecx
call fcn.100021f28
int3