Function at 0x1800071c4
Capabilities:
Copy file
Create thread
Delete file
Delete registry value
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
xor r15d, r15d
test edx, edx
je 0x180007355
cmp edx, 1
jne 0x18000768a
mov r8d, 0x104
mov qword [0x1800080b8], rcx
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [r15 + 0x2e]
lea rcx, [rbp + 0x60]
call fcn.180001db4
test rax, rax
je 0x18000768a
lea rdx, [0x1800015b0]
mov rcx, rax
call fcn.180007718
test eax, eax
jne 0x18000768a
lea r8, [rbp + 0x60]
lea rdx, [0x180001454]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ebx, 0xffffffff
cmp eax, ebx
je 0x18000732b
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9e8]
mov dword [rbp + 0x9e8], r15d
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], r15d
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], r15d
mov dword [rbp + 0x9f8], r15d
mov dword [rsp + 0x44], r15d
call fcn.1800052c0
test eax, eax
jne 0x1800072fb
lea rax, [rsp + 0x44]
xor edx, edx
lea r9, [rbp + 0x9f8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.1800052c0
test eax, eax
jne 0x1800072fb
mov ecx, dword [rbp + 0x9f8]
cmp dword [rbp + 0x9e8], ecx
ja 0x180007321
mov eax, dword [rsp + 0x40]
and eax, 1
test al, al
je 0x1800072fb
cmp dword [rbp + 0x9e8], ecx
jne 0x1800072fb
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x38], eax
ja 0x180007321
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x18000725b
lea rcx, [rsp + 0x50]
jmp 0x180007685
mov qword [rsp + 0x28], r15
lea r8, [0x1800058a4]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180008008], rax
jmp 0x18000768a
mov rcx, qword [0x180008008]
test rcx, rcx
je 0x180007367
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [section..data], r15b
je 0x18000768a
cmp byte [0x180008001], r15b
je 0x18000768a
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x50], r15b
call fcn.180001888
cmp byte [rsp + 0x50], r15b
je 0x18000768a
mov rcx, qword [0x1800080b8]
lea rdx, [rbp + 0x280]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rbp + 0x280]
lea rdx, [0x180001454]
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [0x180001438]
lea r8, [rsp + 0x50]
lea rdx, [0x180001388]
lea rcx, [rbp + 0x390]
call fcn.180001ef8
lea rax, [rsp + 0x30]
mov dword [rbp + 0x9f8], r15d
mov qword [rsp + 0x28], rax
lea r8, [0x180001448]
lea rax, [rbp + 0x9f8]
mov dword [rsp + 0x30], 4
lea rdx, [rbp + 0x390]
mov qword [rsp + 0x20], rax
call fcn.1800016b4
lea rcx, [rbp + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x180007681
cmp edi, 4
jne 0x180007681
cmp dword [rbp + 0x9f8], 1
jne 0x180007681
xor ecx, ecx
call fcn.180006484
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x50]
call fcn.1800066cc
cmp byte [rsp + 0x50], r15b
je 0x18000762d
lea rax, [rbp + 0x9e8]
mov dword [rbp + 0x9e8], 0x400
lea r9, [rbp + 0x5b0]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x170]
lea rdx, [0x180001518]
call fcn.180001940
cmp eax, 7
jne 0x1800075d6
lea rdx, [rbp + 0x5b0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r9d, dword [rbp + 0x9e8]
test eax, eax
jne 0x18000753c
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1800074d3
lea ecx, [r9 - 2]
cmp rcx, r8
jne 0x18000753c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], r15
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x180001518]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800075d6
lea rdx, [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800075d6
lea rdi, [rbp + 0x5b0]
mov esi, r15d
test r9d, r9d
je 0x1800075d6
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], r15b
jne 0x180007553
test ebx, ebx
je 0x1800075d6
inc ebx
lea rdx, [rsp + 0x50]
mov r14d, ebx
mov rcx, rdi
add r14, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180007589
add esi, ebx
mov rdi, r14
cmp esi, dword [rbp + 0x9e8]
jb 0x18000754f
jmp 0x1800075d6
mov eax, dword [rbp + 0x9e8]
mov rdx, r14
sub eax, ebx
mov rcx, rdi
mov dword [rbp + 0x9e8], eax
sub eax, esi
mov r8d, eax
call fcn.1800076c8
mov eax, dword [rbp + 0x9e8]
lea r8, [rbp + 0x170]
mov dword [rsp + 0x28], eax
lea rdx, [0x180001518]
lea rax, [rbp + 0x5b0]
mov r9d, 7
mov qword [rsp + 0x20], rax
call fcn.1800019fc
cmp byte [rsp + 0x50], r15b
je 0x18000762d
lea r8, [rsp + 0x50]
lea rdx, [0x1800014e0]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rbp + 0x9e8]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [0x1800013f8]
mov dword [rbp + 0x9e8], 1
lea rdx, [rbp + 0x5b0]
call fcn.1800019fc
lea rdx, [rbp + 0x4a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x4a0]
lea rdx, [0x180001628]
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x180007669
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x18000765e
lea rcx, [rbp + 0x60]
call fcn.1800061d8
mov rbx, qword [rsp + 0xae0]
mov eax, 1
add rsp, 0xab0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret