Function at 0x14000ee4c
Capabilities:
Delete file
Get common file path
Get file attributes
Move file
Persist via lnk shortcut
Query or enumerate registry value
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xb530
call fcn.140015e00
sub rsp, rax
xor r15d, r15d
mov r12d, r8d
mov rax, rdx
mov r14, rcx
cmp rdx, r15
je 0x14000f331
lea rcx, [rsp + 0xb578]
mov dword [rsp + 0x28], 0x1000
lea r9, [rsp + 0xb588]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x1080]
lea rdx, [rsp + 0x4530]
mov rcx, rax
call fcn.14000e218
mov r13, rax
mov qword [rsp + 0xb578], rax
cmp rax, r15
je 0x14000f331
lea ebp, [r15 + 1]
lea rax, [rsp + 0x1080]
lea rbx, [rsp + 0x5530]
mov edi, 6
mov rdx, rbx
mov rcx, rax
call fcn.14000d038
add rbx, 0x1000
sub rdi, rbp
jne 0x14000eee0
or edi, 0xffffffff
mov ebx, r15d
lea rsi, str.Delete
mov rdx, qword [rsi]
lea rcx, [rsp + 0x4530]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, r15d
je 0x14000ef27
add ebx, ebp
add rsi, 8
cmp ebx, 0xd
jb 0x14000ef04
jmp 0x14000ef38
cmp ebx, 6
mov edi, ebx
jg 0x14000f5d9
je 0x14000f5bb
cmp edi, r15d
je 0x14000f34c
sub edi, ebp
je 0x14000f22c
sub edi, ebp
je 0x14000f20d
sub edi, ebp
je 0x14000efed
sub edi, ebp
je 0x14000efb2
cmp edi, ebp
jne 0x14000f2e8
movsx ecx, byte [rsp + 0x1080]
cmp ecx, r15d
je 0x14000ef9f
sub ecx, 0x30
je 0x14000ef8c
sub ecx, ebp
je 0x14000ef9f
cmp ecx, ebp
jne 0x14000f2e8
mov byte [0x14001f397], bpl
jmp 0x14000ef93
mov byte [0x14001f397], r15b
mov byte [0x14001f396], r15b
jmp 0x14000f2e8
mov byte [0x14001f397], r15b
mov byte [0x14001f396], bpl
jmp 0x14000f2e8
cmp dword [0x14001f454], ebp
je 0x14000f2e8
movsx ecx, byte [rsp + 0x1080]
call fcn.140011124
cmp al, r15b
je 0x14000efdd
movsx eax, byte [rsp + 0x1080]
sub eax, 0x30
jmp 0x14000efe2
mov eax, 2
mov dword [0x14001f454], eax
jmp 0x14000f2e8
cmp r12d, r15d
jne 0x14000f2e8
cmp byte [0x14001f45a], r15b
jne 0x14000f2e8
cmp byte [rsp + 0x1080], 0x22
lea rax, [rsp + 0x1080]
lea rdi, [rsp + 0x1081]
cmovne rdi, rax
mov byte [rsp + 0x80], r15b
mov rcx, rdi
call fcn.14000c808
cmp rax, 0x400
jae 0x14000f2e8
mov al, byte [rdi]
cmp al, 0x2e
jne 0x14000f050
cmp byte [rdi + 1], 0x5c
jne 0x14000f050
lea rdx, [rdi + 2]
jmp 0x14000f14f
cmp al, 0x5c
je 0x14000f14c
cmp al, r15b
je 0x14000f067
cmp byte [rdi + 1], 0x3a
je 0x14000f14c
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r15d
jne 0x14000f0da
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0xb578]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov dword [rsp + 0xb578], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + 0x80], r15b
je 0x14000f116
lea rcx, [rsp + 0x80]
call fcn.14000c808
lea rcx, [rsp + 0x80]
sub rcx, rbp
cmp byte [rax + rcx], 0x5c
je 0x14000f116
lea rdx, [0x1400168dc]
lea rcx, [rsp + 0x80]
call fcn.14000cbc0
mov rcx, rdi
call fcn.14000c808
lea rcx, [rsp + 0x80]
mov rbx, rax
call fcn.14000c808
add rbx, rax
cmp rbx, 0x3ff
jae 0x14000f15c
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.14000cbc0
jmp 0x14000f15c
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14000c978
lea rcx, [rsp + 0x80]
mov edx, 0x22
call fcn.14000c888
cmp rax, r15
je 0x14000f17c
cmp byte [rax + 1], r15b
jne 0x14000f17c
mov byte [rax], r15b
lea rsi, [0x14001e380]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14000c978
lea rcx, [rsp + 0x80]
call fcn.14000e640
mov edx, 0x65
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x80]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov r9, rsi
xor r8d, r8d
mov edx, 0x143
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14000ca30
cmp eax, r15d
je 0x14000f2e8
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x143
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000f2e8
cmp r12d, r15d
jne 0x14000f2e8
lea rdx, [rsp + 0x1080]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x14000f2e8
cmp r12d, r15d
jne 0x14000f2e8
mov rcx, qword [0x14001fce8]
cmp rcx, r15
sete dil
cmp dil, r15b
jne 0x14000f25b
lea rdx, str._br_
call fcn.14000cbc0
mov rcx, qword [0x14001fce8]
mov bpl, byte [rsp + 0xb588]
cmp bpl, r15b
je 0x14000f272
lea rbx, [rsp + 0x1080]
jmp 0x14000f291
lea rcx, [rsp + 0xb578]
call fcn.14000e3bc
mov r13, qword [rsp + 0xb578]
mov rcx, qword [0x14001fce8]
mov rbx, rax
cmp dil, r15b
je 0x14000f29b
mov rsi, r15
jmp 0x14000f2a3
call fcn.14000c808
mov rsi, rax
mov rcx, rbx
call fcn.14000c808
mov rcx, qword [0x14001fce8]
lea rdx, [rax + rsi + 5]
call fcn.14000c5c4
mov qword [0x14001fce8], rax
cmp dil, r15b
je 0x14000f2cb
mov byte [rax], r15b
mov rdx, rbx
mov rcx, rax
call fcn.14000cbc0
cmp bpl, r15b
jne 0x14000f2e3
mov rcx, rbx
call fcn.14000c598
mov ebp, 1
lea rax, [rsp + 0xb578]
lea r9, [rsp + 0xb588]
lea r8, [rsp + 0x1080]
lea rdx, [rsp + 0x4530]
mov rcx, r13
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rax
call fcn.14000e218
mov r13, rax
mov qword [rsp + 0xb578], rax
cmp rax, r15
jne 0x14000eecb
mov rbx, qword [rsp + 0xb570]
add rsp, 0xb530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 2
cmp r12d, eax
jne 0x14000f2e8
lea rdx, [rsp + 0x80]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x880]
call fcn.14000c978
lea rcx, [rsp + 0x880]
call fcn.140008d78
lea rdx, [rsp + 0x1080]
lea rcx, [rsp + 0x880]
call fcn.14000cbc0
lea rcx, [rsp + 0x3520]
call fcn.140006b68
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x3520]
call fcn.140006ba4
lea rcx, [rsp + 0x2c94]
call fcn.1400116fc
lea rcx, [rsp + 0x2cb8]
call fcn.1400116fc
lea rcx, [rsp + 0x2cdc]
call fcn.1400116fc
lea rdx, [rsp + 0x2080]
lea rcx, [rsp + 0x3520]
xor r8d, r8d
call fcn.140006f68
cmp al, r15b
je 0x14000f5a9
or edi, 0xffffffff
lea rcx, [rsp + 0x2080]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [rsp + 0x2c90], r15b
je 0x14000f4ea
call fcn.140008384
cmp eax, 4
je 0x14000f4ea
lea rdx, [rsp + 0xc80]
lea rcx, [rsp + 0x80]
call fcn.14000888c
lea rcx, [rsp + 0xc80]
call fcn.140008d78
lea rcx, [rsp + 0x80]
call fcn.14000c808
mov rbx, rax
cmp rax, 4
jb 0x14000f483
lea rcx, [rsp + 0xc80]
call fcn.14000c808
cmp rbx, rax
ja 0x14000f49b
lea rcx, [rsp + 0x1080]
xor edx, edx
call fcn.1400087f8
cmp al, r15b
jne 0x14000f5a9
lea rcx, [rsp + 0x2080]
call fcn.14000c808
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x38]
mov byte [rsp + rax + 0x2081], r15b
call fcn.14000c654
mov eax, 0x14
lea rcx, [rsp + 0x40]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x2080]
mov dword [rsp + 0x48], 3
mov qword [rsp + 0x50], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
lea rcx, [rsp + 0x2080]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
je 0x14000f588
lea rcx, [rsp + 0x2080]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, r15d
jne 0x14000f588
mov ebx, r15d
xor r9d, r9d
jmp 0x14000f520
add ebx, ebp
mov r9d, ebx
lea r8, [rsp + 0x2080]
lea rdx, str._s._d.tmp
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
jne 0x14000f51b
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x2080]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, r15d
je 0x14000f588
call fcn.140008384
cmp eax, r15d
je 0x14000f588
xor edx, edx
lea rcx, [rsp + 0x480]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rdx, [rsp + 0x2080]
lea rcx, [rsp + 0x3520]
xor r8d, r8d
call fcn.140006f68
cmp al, r15b
jne 0x14000f40d
lea rcx, [rsp + 0x3520]
call fcn.140006b88
jmp 0x14000f2e8
cmp r12d, 4
jne 0x14000f2e8
xor edx, edx
lea rcx, [rsp + 0x1080]
call fcn.14000eb74
jmp 0x14000f2e8
mov edi, 7
sub ebx, edi
je 0x14000f9ca
sub ebx, ebp
je 0x14000f981
sub ebx, ebp
je 0x14000f96f
sub ebx, ebp
je 0x14000f65d
sub ebx, ebp
je 0x14000f648
cmp ebx, ebp
jne 0x14000f2e8
movsx ecx, byte [rsp + 0x1080]
call fcn.14000c608
cmp eax, 0x46
je 0x14000f63c
cmp eax, 0x55
je 0x14000f630
mov byte [0x14001f395], r15b
mov byte [0x14001f394], r15b
jmp 0x14000f2e8
mov byte [0x14001f394], bpl
jmp 0x14000f2e8
mov byte [0x14001f395], bpl
jmp 0x14000f2e8
cmp r12d, edi
jne 0x14000f2e8
mov byte [0x14001f458], bpl
jmp 0x14000f2e8
cmp r12d, 6
jne 0x14000f2e8
movsx ecx, byte [rsp + 0x5530]
call fcn.14000c608
sub eax, 0x50
je 0x14000f694
sub eax, 3
je 0x14000f68d
cmp eax, ebp
je 0x14000f689
lea ebp, [r12 + 0xa]
jmp 0x14000f699
mov ebp, edi
jmp 0x14000f699
mov ebp, 0xb
jmp 0x14000f699
mov ebp, 2
lea rdx, [rsp + 0x6530]
lea rcx, [rsp + 0x80]
mov byte [rsp + 0xc80], r15b
mov byte [rsp + 0x480], r15b
call fcn.14000c978
cmp byte [rsp + 0x80], 0x22
lea rcx, [rsp + 0x80]
jne 0x14000f736
lea rdx, [rsp + 0x6531]
call fcn.14000c978
cmp byte [0x1400253e0], r15b
je 0x14000f702
lea rdx, [rsp + 0x81]
lea rcx, [0x1400252e0]
mov r8d, 0x22
call fcn.140011d18
jmp 0x14000f714
lea rcx, [rsp + 0x81]
mov edx, 0x22
call fcn.14000c848
cmp rax, r15
je 0x14000f7d0
lea rdx, [rax + 1]
lea rcx, [rsp + 0x480]
mov byte [rax], r15b
call fcn.14000c978
jmp 0x14000f7d0
xor edx, edx
call fcn.140006560
cmp al, r15b
jne 0x14000f7d0
mov rsi, r15
lea rbx, [rsp + 0x80]
cmp byte [rsp + 0x80], r15b
je 0x14000f7d0
mov dil, byte [rbx]
cmp dil, 0x20
je 0x14000f76a
cmp dil, 0x2f
jne 0x14000f7c0
lea rcx, [rsp + 0x80]
xor edx, edx
mov byte [rbx], r15b
call fcn.140006560
cmp al, r15b
je 0x14000f7bd
mov rsi, rbx
cmp dil, 0x2f
jne 0x14000f7a0
mov byte [rsp + 0x480], dil
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x481]
jmp 0x14000f7b3
inc rbx
cmp byte [rbx], 0x20
je 0x14000f7a0
mov rdx, rbx
lea rcx, [rsp + 0x480]
call fcn.14000c978
mov byte [rsi], dil
jmp 0x14000f7c0
mov byte [rbx], dil
inc rbx
cmp byte [rbx], r15b
jne 0x14000f75b
cmp rsi, r15
je 0x14000f7d0
mov byte [rsi], r15b
cmp byte [rsp + 0xa530], r15b
je 0x14000f7ef
lea rdx, [rsp + 0xc80]
lea rcx, [rsp + 0xa530]
call fcn.140006670
lea rdx, [rsp + 0x4130]
lea rcx, [rsp + 0x80]
call fcn.140006670
lea rcx, [rsp + 0x880]
mov edx, ebp
call fcn.14000d280
lea rcx, [rsp + 0x880]
call fcn.140008d78
cmp byte [rsp + 0x7530], r15b
je 0x14000f84c
lea rdx, [rsp + 0x7530]
lea rcx, [rsp + 0x880]
call fcn.14000cbc0
lea rcx, [rsp + 0x880]
call fcn.140008d78
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x3120]
call fcn.14000c978
cmp byte [rsp + 0x9530], r15b
lea rax, [rsp + 0x6530]
lea rcx, [rsp + 0x9530]
cmove rcx, rax
call fcn.140008968
lea rcx, [rsp + 0x880]
mov rdx, rax
call fcn.14000cbc0
lea rcx, [rsp + 0x880]
call fcn.140008d00
cmp rax, r15
je 0x14000f8b8
lea rdx, str..lnk
mov rcx, rax
call fcn.14000cb34
cmp eax, r15d
je 0x14000f8cc
lea rdx, str..lnk
lea rcx, [rsp + 0x880]
call fcn.14000cbc0
mov ebp, 1
lea rcx, [rsp + 0x880]
xor edx, edx
mov r8b, bpl
call fcn.1400067c4
mov r11b, byte [rsp + 0x480]
lea rax, [rsp + 0x480]
neg r11b
lea rdx, [rsp + 0x880]
sbb rcx, rcx
and rcx, rax
mov al, byte [rsp + 0xc80]
neg al
lea rax, [rsp + 0xc80]
mov qword [rsp + 0x20], rcx
sbb r9, r9
lea rcx, [rsp + 0x4130]
and r9, rax
mov al, byte [rsp + 0x8530]
neg al
lea rax, [rsp + 0x8530]
sbb r8, r8
and r8, rax
call fcn.14000d100
cmp byte [rsp + 0x3120], r15b
je 0x14000f2e8
lea r8, [rsp + 0x3120]
xor r9d, r9d
mov edx, ebp
mov ecx, 0x1000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x14000f2e8
cmp r12d, 5
jne 0x14000f2e8
mov dl, bpl
jmp 0x14000f5c7
cmp r12d, 3
jne 0x14000f9be
cmp byte [rsp + 0x1080], r15b
je 0x14000f9a2
lea rdx, [rsp + 0x1080]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowTextA]
lea rcx, [rsp + 0xb578]
call fcn.14000e3bc
mov r13, qword [rsp + 0xb578]
mov qword [0x14001fcf0], rax
mov byte [0x14001fcdf], bpl
jmp 0x14000f2e8
cmp r12d, ebp
jne 0x14000fb92
lea rdx, [rsp + 0xc80]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0xc80]
call fcn.140008d78
mov r9, qword [str.RarSFX]
lea r8, [rsp + 0xc80]
lea rdx, str._s_s_d
lea rcx, [rsp + 0x480]
mov ebx, r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or esi, 0xffffffff
jmp 0x14000fa6a
mov r9, qword [str.RarSFX]
lea r8, [rsp + 0xc80]
lea rdx, str._s_s_d
lea rcx, [rsp + 0x480]
add ebx, ebp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
jne 0x14000fa32
lea r8, [rsp + 0x480]
mov edx, 0x65
mov rcx, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp byte [rsp + 0x1080], r15b
je 0x14000f2e8
cmp byte [0x14001fcde], r15b
jne 0x14000f2e8
lea rcx, [rsp + 0x1080]
mov edx, 0x2c
mov byte [rsp + 0x80], r15b
call fcn.14000c848
cmp rax, r15
jne 0x14000fb08
mov eax, r15d
mov rbx, r15
cmp byte [rsp + 0x1080], r15b
je 0x14000fb08
cmp byte [rsp + rbx + 0x1080], 0x40
je 0x14000fae9
add rbx, rbp
add eax, ebp
cmp byte [rsp + rbx + 0x1080], r15b
jne 0x14000face
jmp 0x14000fb08
cdqe
lea rcx, [rsp + 0x80]
lea rdx, [rsp + rax + 0x1081]
call fcn.14000c978
mov byte [rsp + rbx + 0x1080], r15b
cmp byte [rsp + 0x80], r15b
jne 0x14000fb3c
lea rdx, [rsp + 0x5530]
lea rcx, [rsp + 0x1080]
call fcn.14000c978
lea rdx, [rsp + 0x6530]
lea rcx, [rsp + 0x80]
call fcn.14000c978
lea rcx, [rsp + 0x1080]
call fcn.14000d3a4
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x1080]
mov r9d, 0x24
mov rcx, r14
mov byte [rsp + 0x1880], r15b
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x14000f2e8
mov rdx, rbp
mov rcx, r14
mov byte [0x14001fcdd], bpl
mov dword [0x14001f430], ebp
call qword [sym.imp.USER32.dll_EndDialog]
cmp r12d, edi
jne 0x14000f2e8
mov eax, dword [0x14001f454]
mov ecx, 2
mov byte [0x14001f450], bpl
cmp eax, r15d
cmove eax, ecx
mov dword [0x14001f454], eax
jmp 0x14000f2e8