Function at 0x1000071c8
Capabilities:
Delete file
Get file size
Read file on windows
Set registry value
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
xor r15d, r15d
lea rax, [0x1000070f4]
mov qword [0x100023fe0], rcx
mov qword [r11 - 0x50], rax
lea rax, [0x100003c48]
lea rbx, [0x100003c50]
mov qword [r11 - 0xd8], rax
mov rax, qword [0x100022848]
lea rcx, [r11 - 0xb0]
mov r14, r8
mov qword [r11 - 0x58], rbx
mov qword [r11 - 0x48], r15
mov qword [r11 - 0xb0], rax
mov qword [r11 - 0xa8], rax
mov qword [r11 - 0xa0], rax
mov qword [r11 - 0x98], rax
mov qword [r11 - 0x40], r15
mov dword [r11 - 0xd0], r15d
mov dword [r11 - 0xcc], r15d
mov dword [r11 - 0xc8], r15d
mov dword [r11 - 0xc4], r15d
mov dword [r11 - 0xc0], r15d
mov dword [r11 - 0xbc], r15d
mov dword [r11 - 0xb8], r15d
call fcn.100008f48
lea rcx, [rsp + 0xb0]
call fcn.100008f48
lea rcx, [rsp + 0xb8]
call fcn.100008f48
lea rcx, [rsp + 0xc0]
call fcn.100008f48
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.100006a50
lea r13d, [r15 + 1]
cmp eax, r15d
je 0x1000073c4
mov rbx, qword [rsp + 0xc0]
mov r12d, r15d
cmp qword [rbx - 0x10], r15
je 0x1000073bd
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1000073bd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x100007395
lea rcx, [rsi + 2]
call fcn.10000ca78
mov rdi, rax
cmp rax, r15
je 0x10000738f
lea r8, [rsi + 2]
xor edx, edx
mov rcx, rax
call fcn.100014da0
lea r9, [rsp + 0x160]
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x160], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r15d
je 0x100007387
cmp dword [rsp + 0x160], esi
jne 0x100007387
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.100006a50
mov rbx, qword [rsp + 0xc0]
mov r12d, eax
mov rcx, rdi
call fcn.10000ca6c
mov r13d, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xc0]
call fcn.100008f48
cmp r12d, r15d
jne 0x1000072be
lea rbx, [0x100003c50]
mov rdi, qword [rsp + 0xa8]
mov eax, r15d
mov r12d, 2
cmp qword [rdi - 0x10], r15
je 0x1000073e3
mov rdx, rdi
mov ecx, r13d
jmp 0x100007409
mov rdx, qword [rsp + 0xb0]
cmp qword [rdx - 0x10], r15
je 0x1000073f6
mov ecx, r12d
jmp 0x100007409
mov rdx, qword [rsp + 0xb8]
cmp qword [rdx - 0x10], r15
je 0x10000740e
mov ecx, 3
call fcn.100009b7c
mov ebp, r15d
cmp eax, r13d
jne 0x100007827
mov rax, qword [0x100022848]
lea rdx, [0x100003cc0]
lea rcx, [rsp + 0x48]
mov r8, rbx
mov qword [rsp + 0x48], rax
call fcn.100009a08
mov r8, qword [rsp + 0x48]
lea rax, [0x100004788]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x78], r15d
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x20], 0xf003f
call fcn.100009e10
cmp dword [rsp + 0x78], r15d
je 0x1000077e1
mov rax, qword [0x100022848]
mov esi, r15d
mov qword [rsp + 0x40], rax
lea rdx, [0x100003b30]
lea rcx, [rsp + 0x160]
call fcn.100009150
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x68]
mov r8d, esi
call fcn.10000a17c
mov rcx, qword [rax]
cmp qword [rsp + 0x40], rcx
je 0x1000074d0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.100009238
mov r8, rax
jmp 0x1000074d5
lea r8, [rsp + 0x40]
mov rax, qword [rsp + 0x160]
mov r8, qword [r8]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1000074f6
add rax, r12
test ecx, ecx
jne 0x1000074e3
cmp edx, r15d
lea rcx, [rsp + 0xd0]
mov ebx, r15d
setne bl
call fcn.100008fcc
lea rcx, [rsp + 0x160]
call fcn.100008fcc
cmp ebx, r15d
je 0x1000075dd
xor eax, eax
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x170], r15
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xd8], r15d
call fcn.100008958
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0xe0], r15
call fcn.100009438
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x170]
lea rcx, [rsp + 0xd8]
mov rdx, rax
call fcn.1000086d4
cmp eax, r13d
je 0x1000075a4
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.10000a4a8
cmp eax, r15d
jne 0x1000075bc
jmp 0x1000075b9
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0xd8]
call fcn.1000088b0
add esi, r13d
lea rax, [0x100004728]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xe8], rax
call fcn.100008fcc
jmp 0x10000748b
cmp qword [rdi - 0x10], r15
je 0x100007695
cmp dword [rsp + 0x88], r15d
je 0x10000767e
mov dword [rsp + 0x160], r13d
cmp dword [0x10002400c], r15d
je 0x100007644
cmp dword [rsp + 0x78], r15d
je 0x100007695
mov rax, qword [0x100022930]
cmp rax, r15
je 0x100007695
lea rcx, [rsp + 0x160]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
call rax
jmp 0x100007695
mov dword [rsp + 0x170], r13d
cmp dword [rsp + 0x78], r15d
je 0x100007695
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x170]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100007695
cmp dword [rsp + 0x98], r15d
je 0x100007695
lea rcx, [rsp + 0x68]
mov rdx, rdi
call fcn.10000a4a8
lea rdx, [0x100003b30]
lea rcx, [rsp + 0x160]
call fcn.100009150
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call fcn.10000a17c
mov rcx, qword [rax]
cmp qword [rsp + 0x40], rcx
je 0x1000076da
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.100009238
mov rdx, rax
jmp 0x1000076df
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x160]
mov rdx, qword [rdx]
sub rdx, rax
movzx r8d, word [rax]
movzx ecx, word [rax + rdx]
sub r8d, ecx
jne 0x100007701
add rax, r12
test ecx, ecx
jne 0x1000076ed
cmp r8d, r15d
lea rcx, [rsp + 0x170]
mov ebx, r15d
sete bl
call fcn.100008fcc
lea rcx, [rsp + 0x160]
call fcn.100008fcc
lea rcx, [rsp + 0x68]
cmp ebx, r15d
cmovne ebp, r13d
call fcn.100009f00
lea rcx, [rsp + 0x40]
call fcn.100008fcc
cmp ebp, r15d
je 0x1000077e1
lea rdx, [0x100003cf0]
lea rcx, [rsp + 0x48]
call fcn.1000092a8
mov rdx, qword [rsp + 0x48]
lea r11, [0x100004788]
lea rax, [rsp + 0x58]
mov ebx, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, ebx
cmp dword [0x10002400c], r15d
je 0x1000077a0
call fcn.10000a9c4
jmp 0x1000077a6
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, r15d
cmp eax, r15d
mov dword [rsp + 0x64], ebx
sete cl
mov dword [rsp + 0x60], ecx
cmp ecx, r15d
je 0x1000077d7
lea rdx, [0x100003c50]
lea rcx, [rsp + 0x50]
call fcn.10000a2f0
lea rcx, [rsp + 0x50]
call fcn.100009f00
lea rcx, [rsp + 0x50]
call fcn.100009f4c
cmp dword [0x10002400c], r15d
je 0x100007813
mov rax, qword [0x100022868]
lea rcx, [0x100022868]
call qword [rax + 8]
mov rax, qword [0x1000228e0]
lea rcx, [0x1000228e0]
call qword [rax + 8]
mov dword [0x10002400c], r15d
lea rcx, [rsp + 0x68]
call fcn.100009f4c
lea rcx, [rsp + 0x48]
call fcn.100008fcc
cmp word [r14], 0x2d
je 0x100007839
cmp word [r14], 0x2f
jne 0x100007942
cmp ebp, r15d
jne 0x100007900
lea rdx, [r14 + 2]
lea rcx, [0x100003d18]
mov r8, r12
call fcn.10000cf30
cmp eax, r15d
jne 0x10000786a
call fcn.100007b3c
cmp eax, r15d
je 0x100007a42
jmp 0x1000078bc
lea rdx, [r14 + 2]
lea rcx, [0x100003d20]
mov r8, r12
call fcn.10000cf30
cmp eax, r15d
je 0x100007900
lea rdx, [r14 + 2]
lea rcx, [0x100003d28]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
jne 0x1000078a4
call fcn.100007b3c
jmp 0x100007a42
lea rdx, [r14 + 2]
lea rcx, [0x100003d2c]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
jne 0x1000078c6
call fcn.100007dfc
jmp 0x100007a42
lea rdx, [r14 + 2]
lea rcx, [0x100003d30]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
jne 0x1000078e8
call fcn.100007efc
jmp 0x100007a42
lea rdx, [r14 + 2]
lea rcx, [0x100003d34]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
jne 0x10000790a
call fcn.100008048
jmp 0x100007a42
lea rdx, [r14 + 2]
lea rcx, [0x100003d38]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
je 0x100007a13
lea rdx, [r14 + 2]
lea rcx, [0x100003d3c]
mov r8, r13
call fcn.10000cf30
cmp eax, r15d
jne 0x100007a13
lea rbx, [0x100003d40]
lea rcx, [0x100003d60]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003db0]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003e00]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003e60]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003eb0]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003f10]
mov rdx, rbx
call fcn.10000cfdc
lea rcx, [0x100003f80]
call fcn.10000cfdc
lea rcx, [0x100003fe0]
call fcn.10000cfdc
lea rcx, [rsp + 0x100]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, r15d
jne 0x1000079e9
lea rcx, [0x100004040]
call fcn.100007a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x80]
call fcn.100006a0c
mov rbx, qword [rsp + 0x168]
xor eax, eax
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x1000040a8]
lea rcx, [0x100004300]
mov dword [0x100024004], r13d
call fcn.10000cfdc
lea rcx, [0x1000081d0]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.100006e2c
xor ecx, ecx
call fcn.10000d3fc
int3