Function at 0x14008a2d8
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rax + 0x10]
call fcn.140052130
lea rcx, [rsp + 0xa8]
mov edx, 5
call fcn.14005a1c4
lea rcx, [rsp + 0x48]
mov edx, 0x14
call fcn.14005a1c4
mov rax, qword [rsp + 0x98]
xor r15d, r15d
lea ecx, [r15 + 0x2d]
mov rdi, 0xffffffff80000002
mov bpl, r15b
mov sil, 0xff
mov r12b, r15b
mov r13b, r15b
cmp cx, word [rax]
jne 0x14008a4f2
mov ebx, ecx
lea rdx, [rsp + 0x98]
lea rcx, str._super_r
mov r8d, 8
call fcn.14005c928
cmp al, r15b
je 0x14008a372
mov sil, 1
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, str._super
mov r8d, 6
call fcn.14005c928
cmp al, r15b
je 0x14008a399
mov sil, r15b
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, str._quick
mov r8d, 6
call fcn.14005c928
cmp al, r15b
je 0x14008a3c0
mov sil, 0xff
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, [0x1400ff424]
mov r8d, 2
call fcn.14005c928
cmp al, r15b
je 0x14008a3eb
mov rdi, 0xffffffff80000003
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, [0x140104408]
mov r8d, 2
call fcn.14005c928
cmp al, r15b
je 0x14008a412
mov r12b, 1
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, [0x140104404]
mov r8d, 3
call fcn.14005c928
cmp al, r15b
je 0x14008a439
mov r13b, 1
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, str._wun
mov r8d, 4
call fcn.14005c928
cmp al, r15b
je 0x14008a460
mov r13b, 1
mov r12b, r13b
jmp 0x14008a4d9
lea rdx, [rsp + 0x98]
lea rcx, [0x14010367c]
mov r8d, 3
call fcn.14005c928
cmp al, r15b
je 0x14008a487
mov bpl, 1
mov r12b, bpl
jmp 0x14008a4d9
mov rcx, qword [rsp + 0x98]
movzx eax, word [rcx]
cmp ax, r15w
je 0x14008a4cc
mov ebx, 0x20
mov edx, 9
cmp dx, ax
ja 0x14008a4ad
cmp ax, 0xd
jbe 0x14008a4c7
cmp bx, ax
je 0x14008a4c7
add rcx, 2
mov qword [rsp + 0x98], rcx
mov ax, word [rcx]
cmp ax, r15w
jne 0x14008a49d
mov ebx, 0x2d
lea rcx, [rsp + 0x98]
call fcn.140052130
mov rax, qword [rsp + 0x98]
cmp bx, word [rax]
je 0x14008a34b
mov rbx, qword [rsp + 0x90]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14008a518
add rax, 2
lea rcx, [rsp + 0x98]
mov bpl, 1
mov qword [rsp + 0x98], rax
call fcn.140052130
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x98]
mov r9d, 0x2c
mov rcx, rbx
mov word [rsp + 0x20], r15w
call fcn.14004ba2c
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x98]
mov r9d, 0x2c
mov rcx, rbx
mov word [rsp + 0x20], r15w
call fcn.14004ba2c
mov rcx, qword [rsp + 0x48]
call fcn.140019d38
mov rbx, rax
cmp bpl, r15b
je 0x14008a629
cmp word [rax], r15w
jne 0x14008a59c
lea rcx, [rsp + 0x48]
call fcn.140052160
lea rcx, [rsp + 0xa8]
call fcn.140052160
mov rax, 0xffffffff80070057
jmp 0x14008a7db
mov rdx, qword [rsp + 0xa8]
mov esi, 0x20019
lea r8, [rsp + 0x40]
mov r13d, 4
mov r9d, esi
mov rcx, rdi
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], r13d
call fcn.140053348
cmp eax, r15d
je 0x14008a5fa
mov rdx, qword [rsp + 0xa8]
lea rax, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r15d
jne 0x14008a7c1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x40]
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov rcx, qword [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008a6f2
movzx eax, word [0x140118f8c]
mov ebp, 2
test bpl, al
jne 0x14008a678
or ax, 0x12
lea rcx, str.SeRestorePrivilege
xor r8d, r8d
mov edx, ebp
mov word [0x140118f8c], ax
call fcn.14001a1f0
lea rcx, str.SeSecurityPrivilege
xor r8d, r8d
mov edx, ebp
call fcn.14001a1f0
lea rcx, str.SeTakeOwnershipPrivilege
xor r8d, r8d
mov edx, ebp
call fcn.14001a1f0
lea rcx, str.SeBackupPrivilege
xor r8d, r8d
mov edx, ebp
call fcn.14001a1f0
lea rcx, str.SeBackupPrivilege
mov r8d, 1
mov edx, ebp
call fcn.14001a1f0
cmp word [rbx], r15w
je 0x14008a6dc
cmp r13b, r15b
jne 0x14008a6dc
mov rdx, qword [rsp + 0xa8]
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp sil, r15b
mov edi, eax
jl 0x14008a7c1
lea rcx, [rsp + 0xa8]
mov dl, sil
call fcn.14008a0d8
jmp 0x14008a7c1
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov bpl, 0x10
mov edi, eax
cmp bpl, r15b
je 0x14008a7c1
cmp edi, r15d
jne 0x14008a7c1
cmp r12b, r15b
je 0x14008a7c1
cmp word [rbx], r15w
je 0x14008a7c1
xor ecx, ecx
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x80000000
mov ebp, 3
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
call fcn.1400037e4
mov rcx, qword [rsp + 0x40]
cmp rcx, r15
jne 0x14008a7b5
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
call fcn.1400037e4
mov rcx, qword [rsp + 0x40]
cmp rcx, r15
jne 0x14008a7b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x20
cmp eax, ecx
je 0x14008a7a5
cmp eax, 0x21
jne 0x14008a7c1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008a72e
cmp rcx, 0xffffffffffffffff
je 0x14008a7c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call fcn.140052160
lea rcx, [rsp + 0xa8]
call fcn.140052160
movsxd rax, edi
add rsp, 0x50
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret