Function at 0x14000824c
Capabilities:
Delete file
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x580
mov edi, dword [rcx + 0x354]
xor ebp, ebp
mov rbx, rcx
cmp edi, 2
mov byte [rcx + 0x34], bpl
jne 0x140008278
call fcn.140007bf8
jmp 0x14000867e
lea rcx, [rsp + 0x372]
xor edx, edx
mov r8d, 0x208
mov rsi, rbp
mov word [rsp + 0x370], bp
call fcn.14001d490
cmp edi, 3
mov r12d, 0x104
jne 0x1400082d2
lea rax, [rsp + 0x370]
lea r8, [rbx + 0x776]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rsi, [rsp + 0x370]
lea rdi, [0x14003c080]
lea rdx, [0x140031aa0]
mov rcx, rdi
call fcn.14001dad0
lea rdx, [0x140031aa8]
mov rcx, rdi
call fcn.14001da90
lea rdx, [0x140031ab0]
mov rcx, rdi
call fcn.14001da90
lea rdx, [0x140031ab8]
mov rcx, rdi
call fcn.14001da90
lea r9, [rbx + 8]
lea rcx, [0x14003b0a0]
mov r8, rdi
mov rdx, rsi
mov dword [rsp + 0x20], 0x2c
call fcn.14000294c
cmp dword [rbx + 0x354], 3
jne 0x1400083eb
mov edi, 0x105
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8, rdi
mov byte [rsp + 0x40], bpl
call fcn.14001d490
lea rcx, [rsp + 0x151]
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x150], bpl
call fcn.14001d490
lea rdx, [rsp + 0x150]
lea rcx, [0x140038910]
call fcn.140009d4c
cmp byte [rbx + 0x776], 0x5c
mov r11b, byte [rbx + 0x87b]
mov byte [rsp + 0x151], r11b
je 0x1400083b0
lea rdx, [0x140031c04]
lea rcx, [rsp + 0x40]
call fcn.14001cde0
lea rdx, [rbx + 0x776]
lea rcx, [rsp + 0x40]
mov r8d, r12d
call fcn.1400099dc
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov r8d, r12d
call fcn.1400099dc
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008b64
jmp 0x14000867e
cmp dword [rbx + 0x564], 1
jne 0x14000845e
call fcn.140009490
cmp dword [rax + 4], 6
jb 0x14000845e
xor r9d, r9d
lea rax, [rbx + 0x148]
mov edi, 0x1008
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 4]
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x138], rax
je 0x140008456
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x140], rax
mov dword [rax], ebp
mov rcx, rbx
call fcn.140006ea0
lea rcx, [rsp + 0x151]
xor edx, edx
mov r8d, 0x107
mov byte [rsp + 0x150], bpl
call fcn.14001d490
mov r12d, 0xff
lea rcx, [rsp + 0x41]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x40], bpl
call fcn.14001d490
lea rdx, [rsp + 0x40]
lea rcx, [0x140038968]
call fcn.140009d4c
lea rcx, [rsp + 0x150]
call fcn.14000951c
mov r11b, byte [rsp + 0x150]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov byte [rsp + 0x40], r11b
call fcn.140008b64
cmp dword [rbx + 0x564], 1
jne 0x140008548
call fcn.140009490
cmp dword [rax + 4], 6
jb 0x140008548
mov rax, qword [rbx + 0x140]
cmp rax, rbp
je 0x140008507
mov dword [rax], 3
mov rcx, qword [rbx + 0x140]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x140], rbp
mov rcx, qword [rbx + 0x138]
cmp rcx, rbp
je 0x140008520
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x138], rbp
cmp byte [rbx + 0x24d], bpl
je 0x140008548
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbx + 0x24d]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [rbx + 0x24d], bpl
lea rcx, [rsp + 0x261]
xor edx, edx
mov r8d, 0x101
mov byte [rsp + 0x260], bpl
call fcn.14001d490
lea rdx, [rsp + 0x260]
lea rcx, [0x1400388e0]
call fcn.140009d4c
lea r11, [rsp + 0x5b8]
mov esi, 0x20019
lea rdx, [rsp + 0x260]
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x14000867e
mov rdx, qword [rsp + 0x5b8]
lea r8, [0x14003164b]
mov rcx, rbx
call fcn.1400079fc
lea rcx, [rsp + 0x41]
mov r8, r12
xor edx, edx
mov edi, ebp
mov byte [rsp + 0x40], bpl
call fcn.14001d490
xor edx, edx
jmp 0x140008629
lea rax, [rsp + 0x5c0]
lea rdx, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x140008624
mov rdx, qword [rsp + 0x5c0]
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1400079fc
mov rcx, qword [rsp + 0x5c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
mov edx, edi
mov rcx, qword [rsp + 0x5b8]
lea rax, [rsp + 0x5c8]
lea r9, [rsp + 0x5b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x5b0], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, qword [rsp + 0x5b8]
cmp eax, ebp
je 0x1400085df
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x580
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret