Function at 0x140009630
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x140249670]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
movdqa xmm0, xmmword [0x1401e6670]
lea rdx, str._Start_
xor r12d, r12d
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x50], r12
movdqu xmmword [rbp + 0x60], xmm0
lea r8d, [r12 + 0x2d]
call fcn.14000ca50
lea rcx, [rbp + 0x50]
call fcn.140005dc0
mov dil, 1
lea rcx, [rbp + 0x50]
mov byte [rsp + 0x40], dil
call fcn.140008ce0
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140008260
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov qword [rsp + 0x70], rbx
cmp r13, rbx
je 0x14000a08a
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.14000bb00
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x30]
call fcn.14000bb00
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.14000bb00
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14000bb00
mov r14, qword [rbp]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x16
jb 0x14000a233
cmp qword [rbp + 8], 0x10
lea r15, [rbp - 0x10]
lea rsi, [r14 + 0x16]
mov qword [rbp + 0x50], r12
cmovae r15, qword [rbp - 0x10]
lea rbx, [rbp + 0x50]
mov edi, select
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
cmp rsi, rdi
jbe 0x1400097c4
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140009768
mov rdi, rcx
movabs rax, 0x8000000000000027
jmp 0x14000978f
cmp rdi, 0x16
mov eax, socket
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400097ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a245
mov rcx, rax
call fcn.14015ae08
test rax, rax
je 0x14000a23f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400097c0
test rcx, rcx
je 0x1400097bd
call fcn.14015ae08
mov rbx, rax
jmp 0x1400097c0
mov rbx, r12
mov qword [rbp + 0x50], rbx
movups xmm0, xmmword [str.Attempting_to_upload:]
mov qword [rbp + 0x60], rsi
lea rcx, [rbx + 0x16]
mov qword [rbp + 0x68], rdi
mov r8, r14
movups xmmword [rbx], xmm0
mov eax, dword [0x1401e0d18]
mov rdx, r15
mov dword [rbx + 0x10], eax
movzx eax, word [0x1401e0d1c]
mov word [rbx + 0x14], ax
call fcn.14015e660
lea rcx, [rbp + 0x50]
mov byte [rbx + rsi], 0
call fcn.140005dc0
lea rcx, [rbp - 0x50]
call fcn.140022df0
cmp qword [rbp - 0x38], 8
lea rdx, [rbp - 0x50]
mov rax, qword [rbp - 0x40]
lea rbx, [rbp - 0x50]
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x70]
cmovae rbx, qword [rbp - 0x50]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
lea rsi, [rdx + rax*2]
mov qword [rbp - 0x58], setsockopt
mov rdx, rsi
sub rdx, rbx
sar rdx, 1
call fcn.14000b780
cmp rbx, rsi
je 0x1400098aa
nop word [rax + rax]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
movzx r9d, byte [rbx]
cmp rcx, rdx
jae 0x140009891
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
cmovae rax, qword [rbp - 0x70]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400098a1
xor r8d, r8d
lea rcx, [rbp - 0x70]
lea edx, [r8 + 1]
call fcn.14000e600
add rbx, 2
cmp rbx, rsi
jne 0x140009860
mov r14, qword [rbp - 0x60]
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, r14
cmp rax, 0x15
jb 0x14000a293
mov rcx, qword [rbp - 0x58]
lea r15, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
lea rsi, [r14 + 0x15]
cmp rcx, 0x10
mov qword [rsp + 0x50], rax
mov edi, select
mov qword [rsp + 0x48], rcx
cmovae r15, rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
lea rbx, [rbp + 0x50]
mov qword [rbp + 0x68], r12
cmp rsi, rdi
jbe 0x14000997b
mov rdi, rsi
or rdi, 0xf
cmp rdi, rdx
jbe 0x14000991f
mov rdi, rdx
movabs rax, 0x8000000000000027
jmp 0x140009946
cmp rdi, 0x16
mov eax, socket
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140009965
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a251
mov rcx, rax
call fcn.14015ae08
test rax, rax
je 0x14000a24b
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140009977
test rcx, rcx
je 0x140009974
call fcn.14015ae08
mov rbx, rax
jmp 0x140009977
mov rbx, r12
mov qword [rbp + 0x50], rbx
movups xmm0, xmmword [str.HTTP_Install_Bucket:]
mov qword [rbp + 0x60], rsi
lea rcx, [rbx + 0x15]
mov qword [rbp + 0x68], rdi
mov r8, r14
movups xmmword [rbx], xmm0
mov eax, dword [0x1401e0d30]
mov rdx, r15
mov dword [rbx + 0x10], eax
movzx eax, byte [0x1401e0d34]
mov byte [rbx + 0x14], al
call fcn.14015e660
lea rcx, [rbp + 0x50]
mov byte [rbx + rsi], 0
call fcn.140005dc0
cmp qword [rbp - 0x40], 0
je 0x140009ba8
mov r14, qword [rbp - 0x20]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x10
jb 0x14000a26f
cmp qword [rbp - 0x18], 0x10
lea r15, [rbp - 0x30]
lea rsi, [r14 + 0x10]
mov qword [rbp + 0x50], r12
cmovae r15, qword [rbp - 0x30]
lea rbx, [rbp + 0x50]
mov edi, select
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
cmp rsi, rdi
jbe 0x140009a88
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140009a2c
mov rdi, rcx
movabs rax, 0x8000000000000027
jmp 0x140009a53
cmp rdi, 0x16
mov eax, socket
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140009a72
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a25d
mov rcx, rax
call fcn.14015ae08
test rax, rax
je 0x14000a257
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140009a84
test rcx, rcx
je 0x140009a81
call fcn.14015ae08
mov rbx, rax
jmp 0x140009a84
mov rbx, r12
mov qword [rbp + 0x50], rbx
movups xmm0, xmmword [str.HTTP_file_path:]
mov qword [rbp + 0x60], rsi
lea rcx, [rbx + 0x10]
mov qword [rbp + 0x68], rdi
mov r8, r14
mov rdx, r15
movups xmmword [rbx], xmm0
call fcn.14015e660
lea rcx, [rbp + 0x50]
mov byte [rbx + rsi], 0
call fcn.140005dc0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x50]
call fcn.14000bb00
cmp qword [rbp - 0x38], 8
lea rsi, [rbp - 0x50]
mov rbx, qword [rbp - 0x40]
mov r14, rax
cmovae rsi, qword [rbp - 0x50]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
cmp rbx, 8
jae 0x140009afe
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x58], 7
movups xmmword [rbp - 0x70], xmm0
jmp 0x140009b92
movabs rax, 0x7ffffffffffffffe
mov rdi, rbx
or rdi, 7
movabs rdx, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x14000a269
add rcx, rcx
cmp rcx, 0x1000
jb 0x140009b68
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a269
mov rcx, rax
call fcn.14015ae08
mov rcx, rax
test rax, rax
je 0x14000a263
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140009b77
test rcx, rcx
je 0x140009b74
call fcn.14015ae08
jmp 0x140009b77
mov rax, r12
lea r8, [rbx*2 + 2]
mov qword [rbp - 0x70], rax
mov rdx, rsi
mov rcx, rax
call fcn.14015e660
mov qword [rbp - 0x58], rdi
mov rdx, r14
mov qword [rbp - 0x60], rbx
lea rcx, [rbp - 0x70]
call fcn.140025f40
movzx r12d, al
jmp 0x140009bd6
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x50]
call fcn.14000bb00
lea rdx, [rbp - 0x30]
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.14000bb00
mov rdx, rdi
mov rcx, rax
call fcn.140006440
test eax, eax
setne r12b
test r12b, r12b
je 0x140009ecb
mov r14, qword [rbp - 0x20]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 5
jb 0x14000a287
cmp qword [rbp - 0x18], 0x10
lea r15, [rbp - 0x30]
lea rsi, [r14 + 5]
mov edi, select
cmovae r15, qword [rbp - 0x30]
lea rbx, [rbp - 0x70]
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
cmp rsi, rdi
jbe 0x140009c9d
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140009c46
mov rdi, rcx
movabs rax, 0x8000000000000027
jmp 0x140009c6d
cmp rdi, 0x16
mov ecx, socket
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140009c8c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a275
mov rcx, rax
call fcn.14015ae08
test rax, rax
je 0x14000a27b
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140009c99
test rcx, rcx
je 0x140009c96
call fcn.14015ae08
mov rbx, rax
mov qword [rbp - 0x70], rbx
mov eax, dword [str.File]
lea rcx, [rbx + 5]
mov qword [rbp - 0x60], rsi
mov r8, r14
mov qword [rbp - 0x58], rdi
mov rdx, r15
mov dword [rbx], eax
movzx eax, byte [0x1401e0d6c]
mov byte [rbx + 4], al
call fcn.14015e660
mov r8d, reloc.WS2_32.dll_socket
mov byte [rbx + rsi], 0
lea rdx, str._uploaded_successfully.
lea rcx, [rbp - 0x70]
call fcn.14000cbb0
xor esi, esi
lea rcx, [rbp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], setsockopt
mov byte [rax], sil
call fcn.140005dc0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140009d44
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d3f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a27b
call fcn.14015ae00
cmp qword [rbp - 0x18], 0x10
lea rdi, [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
cmovae rdi, qword [rbp - 0x30]
call fcn.140131938
lea r8, [rbp - 0x80]
mov qword [rbp - 0x80], rdi
mov edx, eax
mov qword [rbp - 0x78], rbx
lea rcx, [rbp + 0x50]
call fcn.140004590
mov rdx, qword [rbp + 0x60]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 7
test rdx, rdx
jne 0x140009d96
mov qword [rbp - 0x60], rdx
mov word [rbp + rdx*2 - 0x70], si
jmp 0x140009dc5
cmp rdx, 7
ja 0x140009db4
mov qword [rbp - 0x60], rdx
lea rdi, [rbp - 0x70]
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 - 0x70], si
jmp 0x140009dc5
mov r9, rdx
mov word [rsp + 0x20], si
lea rcx, [rbp - 0x70]
call fcn.14000e450
mov rax, qword [rbp + 0x60]
lea r8, [rbp - 0x70]
mov r11, qword [rbp - 0x58]
lea rdx, [rbp + 0x50]
mov r10, qword [rbp - 0x70]
cmp r11, 8
cmovae r8, r10
cmp qword [rbp + 0x68], 8
cmovae rdx, qword [rbp + 0x50]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0x50]
cmovae rax, qword [rbp + 0x50]
cmp rax, r9
je 0x140009e29
sub r8, rax
mov esi, 0x2f
movzx ecx, word [rax]
cmp cx, 0x5c
jne 0x140009e11
movzx ecx, si
mov word [r8 + rax], cx
add rax, 2
cmp rax, r9
jne 0x140009e05
mov r11, qword [rbp - 0x58]
xor esi, esi
mov r10, qword [rbp - 0x70]
cmp r11, 8
lea rcx, [rbp - 0x70]
cmovae rcx, r10
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140009e7b
mov rcx, qword [rbp - 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a281
call fcn.14015ae00
mov rdx, qword [rbp + 0x68]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], si
cmp rdx, 8
jb 0x140009ecb
mov rcx, qword [rbp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ec6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a281
call fcn.14015ae00
cmp byte [rsp + 0x40], 0
je 0x140009edc
test r12b, r12b
je 0x140009edc
mov dil, 1
jmp 0x140009edf
xor dil, dil
mov rdx, qword [rsp + 0x48]
mov byte [rsp + 0x40], dil
cmp rdx, 0x10
jb 0x140009f21
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f1c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a28d
call fcn.14015ae00
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140009f61
mov rcx, qword [rbp - 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f5c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a28d
call fcn.14015ae00
mov rdx, qword [rbp + 8]
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
cmp rdx, 0x10
jb 0x140009fb0
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a28d
call fcn.14015ae00
mov rdx, qword [rbp - 0x18]
mov qword [rbp], r12
mov qword [rbp + 8], setsockopt
mov byte [rbp - 0x10], r12b
cmp rdx, 0x10
jb 0x140009ffb
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ff6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a28d
call fcn.14015ae00
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000a036
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a031
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a239
call fcn.14015ae00
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000a071
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a06c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a239
call fcn.14015ae00
add r13, 0x40
cmp r13, qword [rsp + 0x70]
jne 0x1400096d0
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
test r13, r13
je 0x14000a0e3
cmp r13, rbx
je 0x14000a0aa
mov rcx, r13
call fcn.140004330
add r13, 0x40
cmp r13, rbx
jne 0x14000a094
mov r13, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rax, r13
sub rdx, r13
and rdx, 0xffffffffffffffc0
cmp rdx, 0x1000
jb 0x14000a0db
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a239
mov rcx, r13
call fcn.14015ae00
test dil, dil
jne 0x14000a1ce
movups xmm0, xmmword [str.SOFTWAREAMDAMDAnalytics]
mov eax, dword [reloc.WS2_32.dll_WSAStartup]
lea rdx, [rbp + 0x50]
movups xmm1, xmmword [0x1401e0c78]
mov dword [rbp + 0x80], eax
lea rax, [rsp + 0x48]
movups xmmword [rbp + 0x50], xmm0
mov r9d, 0x20019
xor r8d, r8d
movups xmm0, xmmword [0x1401e0c88]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x48], r12
movups xmmword [rbp + 0x60], xmm1
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a1ce
xor edx, edx
mov dword [rsp + 0x50], 0x104
mov r8d, 0x208
lea rcx, [rbp + 0x90]
call fcn.14015ed10
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, str.AnalyticsAccepted
lea rax, [rbp + 0x90]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, [0x1401e0cc4]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x14000a1b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a1ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1401e0cc8]
lea rcx, [rbp + 0x90]
call fcn.140162a30
test eax, eax
je 0x14000a1d3
call fcn.140009070
movdqa xmm0, xmmword [0x1401e6670]
lea rdx, str._END_
mov r8d, 0x2b
mov qword [rbp + 0x50], r12
lea rcx, [rbp + 0x50]
movdqu xmmword [rbp + 0x60], xmm0
call fcn.14000ca50
lea rcx, [rbp + 0x50]
call fcn.140005dc0
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14015ade0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002e80
int3
call fcn.1401644c4
int3
call fcn.1401644c4
int3
call fcn.140002c70
int3
call fcn.1401644c4
int3
call fcn.140002c70
int3
call fcn.1401644c4
int3
call fcn.140002c70
int3
call fcn.1401644c4
int3
call fcn.140002c70
int3
call fcn.140002e80
int3
call fcn.140002c70
int3
call fcn.1401644c4
int3
call fcn.1401644c4
int3
call fcn.140002e80
int3
call fcn.1401644c4
int3
call fcn.140002e80
int3