Function at 0x1400d0104
Capabilities:
Delete file
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1050]
mov eax, 0x1150
call fcn.140108950
sub rsp, rax
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x11a8], rbx
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp + 0x1040], rax
mov qword [rbp + 0x10], r8
mov r12, rdx
mov r14, rcx
xor edi, edi
mov word [rbp + 0x5f0], di
mov ebx, 0x206
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x5f2]
call sub.msvcrt.dll_memset
mov word [rbp + 0xa10], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xa12]
call sub.msvcrt.dll_memset
mov word [rbp + 0xc20], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc22]
call sub.msvcrt.dll_memset
mov word [rbp + 0xe30], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xe32]
call sub.msvcrt.dll_memset
mov word [rbp + 0x800], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x802]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x74], edi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
mov dword [rsp + 0x70], edi
lea rcx, [rbp + 0xf0]
call fcn.1400db2f4
nop
lea rax, [0x140118d10]
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], edi
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
or dword [rbp + 0x68], 0xffffffff
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
lea rax, [0x140118d28]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov word [rbp + 4], di
mov dword [rbp + 8], edi
mov dword [rbp], edi
lea rcx, [rbp + 0x80]
call fcn.1400df834
nop
lea rcx, [rbp + 0x230]
call fcn.1400e190c
nop
lea rbx, [r14 + 0xd0]
cmp dword [rbx], edi
je 0x1400d0286
lea esi, [rdi + 1]
mov edi, esi
jmp 0x1400d0ca3
xor r9d, r9d
mov r8, rbx
mov edx, dword [r14 + 0x2f8]
mov rcx, r12
call fcn.1400d5380
test eax, eax
je 0x1400d02a1
mov dword [rbx], edi
mov eax, dword [rbx]
mov dword [rbp - 0x80], eax
mov qword [rsp + 0x20], r12
lea r9, str.SoftwareMicrosoftSQMClient
lea r8, str._s_s
mov r15d, 0x104
mov edx, r15d
lea rcx, [rbp + 0xe30]
call fcn.140069190
mov edi, eax
mov esi, 1
xor ebx, ebx
test eax, eax
jns 0x1400d0317
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c19
test byte [rcx + 0x1c], sil
je 0x1400d0c19
lea edx, [rsi + 0x39]
mov r9d, edi
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
jmp 0x1400d0c19
lea r9, [rsp + 0x74]
lea r8, str.DisableManifestDownload
lea rdx, [rbp + 0xe30]
mov rcx, 0xffffffff80000002
call fcn.1400ca758
test eax, eax
jne 0x1400d037d
cmp dword [rsp + 0x74], esi
jne 0x1400d037d
mov edi, esi
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0ca3
test byte [rcx + 0x1c], 4
je 0x1400d0ca3
mov edx, 0x3b
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
jmp 0x1400d0ca3
mov r9, r12
lea r8, str.SoftwareMicrosoftSQMClient_sAdaptiveSqmManifestInfo
mov rdx, r15
lea rcx, [rbp + 0x800]
call fcn.140069190
mov edi, eax
test eax, eax
jns 0x1400d03c7
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c19
test byte [rcx + 0x1c], sil
je 0x1400d0c19
mov edx, 0x3c
jmp 0x1400d02ff
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xf0]
call fcn.1400dcbc4
mov edi, eax
test eax, eax
js 0x1400d0c26
mov ecx, DispGetParam
call fcn.14010617c
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400d0411
lea rax, [0x140118a98]
mov qword [r15], rax
mov qword [r15 + 8], rbx
mov qword [r15 + 0x10], rbx
jmp 0x1400d0414
mov r15, rbx
test r15, r15
jne 0x1400d0423
mov edi, 0x8007000e
jmp 0x1400d0c26
mov rdx, r15
mov rbx, qword [rbp + 0x18]
mov rcx, rbx
call fcn.1400dd2ec
lea r13, [rbx + 0x10]
mov rax, qword [r13]
mov rbx, qword [rax + 0x40]
mov rcx, rbx
call qword [fcn.140009050]
mov r9, qword [rbp + 0x10]
mov r8, r12
lea rdx, [0x140127c18]
mov rcx, r13
call rbx
mov edi, eax
test eax, eax
js 0x1400d0c26
mov rax, qword [r13]
mov rbx, qword [rax + 0x48]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, str.default
mov rcx, r13
call rbx
lea rcx, [r15 + 8]
lea rdx, str.manifest
call fcn.1400d8f6c
mov edi, eax
test eax, eax
js 0x1400d0c26
mov rcx, r12
call fcn.1400cb32c
xor ecx, ecx
and al, 0x10
cmovne ecx, esi
mov dword [rbp + 0x140], ecx
mov edx, dword [r14 + 0x2e8]
mov ecx, dword [r14 + 0x2e4]
call fcn.1400cbc54
test eax, eax
jne 0x1400d04f4
mov edi, esi
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0ca3
test byte [rcx + 0x1c], 4
je 0x1400d0ca3
mov edx, 0x3d
jmp 0x1400d0368
lea rax, str.winsqm
lea rdx, str.sqmapi
cmp dword [r14 + 0x2f8], 0
cmovne rdx, rax
cmp dword [rbp + 0xe4], 0
je 0x1400d0523
lea rcx, [rbp + 0x80]
call fcn.1400dfb90
lea rax, str.asqm_query
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [r14 + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [r14 + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [r14 + 0x2ec]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x38]
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.1400e07e4
mov edi, eax
test eax, eax
js 0x1400d0c26
mov eax, dword [rbp + 0x50]
cmp dword [rbp + 0x108], eax
je 0x1400d0591
mov edi, 0x8007003a
jmp 0x1400d0c26
lea r8, [rbp - 0x68]
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.1400dd788
mov edi, eax
test eax, eax
js 0x1400d0c26
mov rcx, qword [rbp - 0x68]
cmp dword [rcx + 0xa8], esi
jne 0x1400d0587
lea r8, [rbp - 0x60]
call fcn.1400ddd3c
mov edi, eax
test eax, eax
js 0x1400d0c26
mov rdi, qword [rbp - 0x60]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov rcx, rax
lea rdx, str.rsrc
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400d0587
movzx eax, word [rdi + 8]
mov dword [rsp + 0x70], eax
mov r13, qword [rdi + 0x10]
cmp eax, dword [rbp - 0x80]
je 0x1400d027f
lea r9, [rbp + 0x5f0]
lea r8, [rsp + 0x70]
mov edx, dword [r14 + 0x2f8]
mov rcx, r12
call fcn.1400d5380
xor r12d, r12d
test eax, eax
je 0x1400d0679
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
lea edx, [r12 + 0x3e]
mov r9d, edi
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
jmp 0x1400d0c1c
lea r8, [rbp + 0x5f0]
mov ebx, 0x104
mov edx, ebx
lea rcx, [rbp + 0xa10]
call fcn.140036ea4
mov edi, eax
test eax, eax
jns 0x1400d06c1
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x3f
jmp 0x1400d0661
lea rcx, [rbp + 0xa10]
call fcn.1400cc0c8
test eax, eax
jne 0x1400d0718
mov edi, 0x80004005
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c29
test byte [rcx + 0x1c], sil
je 0x1400d0c29
mov edx, 0x40
lea r9, [rbp + 0xa10]
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003638
jmp 0x1400d0c29
mov edx, dword [r14 + 0x2e8]
mov ecx, dword [r14 + 0x2e4]
call fcn.1400cbc54
test eax, eax
jne 0x1400d076c
mov edi, esi
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0ca6
test byte [rcx + 0x1c], 4
je 0x1400d0ca6
mov edx, 0x41
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
jmp 0x1400d0ca6
lea rcx, [rbp + 0xa10]
call fcn.1400cc164
lea rcx, [rbp - 0x50]
call fcn.1400e1480
mov eax, dword [rbp + 8]
neg eax
sbb r15d, r15d
and r15d, 0x20
or r15d, 2
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0xc20]
lea r8, str.TestManifestUrl
lea rdx, [rbp + 0xe30]
mov rcx, 0xffffffff80000002
call fcn.1400ca3c0
test eax, eax
je 0x1400d09ca
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x1400d080b
cmp word [rdx], r12w
je 0x1400d080b
lea rcx, [rbp - 0x78]
call fcn.1400d8f6c
mov edi, eax
test eax, eax
jns 0x1400d086a
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x42
jmp 0x1400d0661
mov r9, qword [rbp - 0x38]
test r9, r9
je 0x1400d098a
cmp word [r9], r12w
je 0x1400d098a
lea r8, [0x140127c18]
lea rdx, str._s._s
lea rcx, [rbp - 0x78]
call fcn.1400d9360
mov edi, eax
test eax, eax
jns 0x1400d086a
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x44
jmp 0x1400d0661
mov rcx, qword [r14 + 0xa0]
mov ebx, dword [rbp - 8]
test rcx, rcx
je 0x1400d08d4
lea rax, str.https
lea r9, str.http
test ebx, ebx
cmovne r9, rax
mov qword [rsp + 0x38], r13
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rcx
lea r8, str._s__Partner_s:___s_s__s
mov edx, 0x104
lea rcx, [rbp + 0xc20]
call fcn.140069190
mov edi, eax
mov r15d, r12d
test ebx, ebx
setne r15b
jmp 0x1400d095b
movzx eax, word [rbp + 4]
test ax, ax
je 0x1400d08e2
movzx ecx, ax
jmp 0x1400d08f1
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0x16b
add ecx, 0x50
lea rax, str.https
lea r9, str.http
test ebx, ebx
cmovne r9, rax
mov qword [rsp + 0x38], r13
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r8, str._s:___s:_u_s__s
mov edx, 0x104
lea rcx, [rbp + 0xc20]
call fcn.140069190
mov edi, eax
test ebx, ebx
je 0x1400d095b
or r15d, esi
cmp dword [rbp - 4], r12d
jne 0x1400d0955
test byte [r14 + 0x2ec], sil
mov eax, 0x40
je 0x1400d0958
mov eax, r12d
or r15d, eax
test edi, edi
jns 0x1400d09ca
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x45
jmp 0x1400d0661
mov edi, 0x80070035
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c29
test byte [rcx + 0x1c], sil
je 0x1400d0c29
mov edx, 0x43
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
jmp 0x1400d0c29
mov rdx, qword [r14 + 0x70]
lea rcx, [rbp + 0x230]
call fcn.1400e1c58
mov edi, eax
test eax, eax
js 0x1400d0c29
mov r8d, r15d
lea rdx, [rbp + 0xc20]
lea rcx, [rbp + 0x230]
call fcn.1400e40c4
mov edi, eax
test eax, eax
js 0x1400d0c29
cmp dword [rbp + 0x590], 0xc8
je 0x1400d0a1a
mov edi, 0x8007003a
jmp 0x1400d0c29
mov eax, dword [rsp + 0x70]
lea r15, [r14 + 0xd0]
mov dword [r15], eax
mov rcx, qword [rbp + 0x598]
test rcx, rcx
je 0x1400d0be4
mov r9d, dword [rbp + 0x5a0]
cmp r9d, 0x10
jbe 0x1400d0be4
cmp dword [rcx], 0x434d5153
je 0x1400d0a89
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0a7f
test byte [rcx + 0x1c], sil
je 0x1400d0a7f
mov edx, 0x47
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov edi, 0x10000a0b
jmp 0x1400d0ca6
lea r11d, [r9 - 0x10]
mov edx, r12d
lea r10, [rcx + 0x10]
mov r8d, r11d
test r11d, r11d
je 0x1400d0aae
imul edx, edx, 0x65
movzx eax, byte [r10]
add edx, eax
add r10, rsi
add r8d, 0xffffffff
jne 0x1400d0a9c
cmp dword [rcx + 8], edx
je 0x1400d0ad3
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0a7f
test byte [rcx + 0x1c], sil
je 0x1400d0a7f
mov edx, 0x48
jmp 0x1400d0a6f
cmp dword [rcx + 4], r9d
je 0x1400d0afc
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0a7f
test byte [rcx + 0x1c], sil
je 0x1400d0a7f
mov edx, 0x49
jmp 0x1400d0a6f
mov rax, qword [r14 + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, r11d
lea r8, [rcx + 0x10]
lea rdx, [rbp + 0x5f0]
lea rcx, [rbp + 0x20]
call fcn.1400d2098
mov edi, eax
test eax, eax
js 0x1400d0c29
mov eax, dword [r14 + 0x2f8]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.Version
lea rdx, [rbp + 0x800]
call fcn.1400ca8e8
test eax, eax
je 0x1400d0b94
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x4a
jmp 0x1400d0661
lea rcx, [r14 + 0xd8]
lea r8, [rbp + 0x5f0]
mov edx, 0x104
call fcn.140036ea4
mov edi, eax
test eax, eax
jns 0x1400d0bd5
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c1c
test byte [rcx + 0x1c], sil
je 0x1400d0c1c
mov edx, 0x4b
jmp 0x1400d0661
mov eax, dword [rsp + 0x70]
mov dword [r15], eax
mov edi, r12d
jmp 0x1400d0ca6
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d0c12
test byte [rcx + 0x1c], sil
je 0x1400d0c12
mov edx, 0x46
lea r8, [0x140128308]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov edi, 0x10000a0b
jmp 0x1400d0c1c
xor r12d, r12d
test edi, edi
jns 0x1400d0ca6
jmp 0x1400d0c29
xor r12d, r12d
cmp word [rbp + 0x800], r12w
je 0x1400d0c94
mov eax, dword [r14 + 0x2f8]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
lea rdx, [rbp + 0x800]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d0c84
lea rdx, str.Version
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400d0c94
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400d0ca6
xor r12d, r12d
cmp dword [rbp + 0xe4], r12d
je 0x1400d0cbc
lea rcx, [rbp + 0x80]
call fcn.1400dfe98
nop
lea rcx, [rbp + 0x230]
call fcn.1400e1a94
nop
lea rcx, [rbp + 0x80]
call fcn.1400dfa78
nop
lea rcx, [rbp - 0x50]
call fcn.1400e1428
nop
mov edx, esi
lea rcx, [rbp - 0x78]
call fcn.1400d9748
nop
lea rcx, [rbp + 0x38]
call fcn.1400dd548
nop
lea rcx, [rbp + 0xf0]
call fcn.1400db428
nop
mov edx, esi
lea rcx, [rbp + 0x20]
call fcn.1400d9748
mov eax, edi
mov rcx, qword [rbp + 0x1040]
xor rcx, rsp
call fcn.140106ed0
mov rbx, qword [rsp + 0x11a8]
add rsp, 0x1150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret