Function at 0x140095a10
Capabilities:
Delete file
Delete registry key
Delete registry value
Set file attributes

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0xe8
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15, rcx
xor r13d, r13d
mov rcx, qword [rcx + 0xb90]
mov r12d, r13d
add rcx, 0x5a8
mov ebp, r13d
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140095e39
mov rcx, qword [r15 + 0xb90]
add rcx, 0x5a8
mov qword [rsp + 0xe0], r14
mov r14d, r13d
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140095e31
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rdi
nop dword [rax + rax]
mov rcx, qword [r15 + 0xb90]
mov edx, r14d
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140095b6a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
mov rcx, rax
lea rdx, [0x140335850]
call fcn.14027c4d8
test eax, eax
jne 0x140095b4a
add rbx, 0x5a8
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140095b4a
mov rax, qword [rbx]
mov rcx, rbx
mov esi, r13d
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140095b4a
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140095b4a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
mov rcx, rax
lea rdx, [0x140335838]
call fcn.14027c4d8
test eax, eax
jne 0x140095b3b
cmp byte [rdi + 0xae0], r12b
je 0x140095b3b
inc ebp
mov rax, qword [rbx]
mov rcx, rbx
inc esi
call qword [rax + Ordinal_26]
cmp esi, eax
jl 0x140095b02
mov rcx, qword [r15 + 0xb90]
inc r14d
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp r14d, eax
jl 0x140095aa0
test ebp, ebp
jle 0x140095e19
mov rcx, qword [r15 + 8]
xor r8d, r8d
movsxd r9, ebp
mov edx, 0x532
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [r15 + 0xb90]
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov ebp, eax
sub ebp, 1
js 0x140095e19
nop word [rax + rax]
cmp dword [0x14045e968], r13d
jne 0x140095e19
mov rcx, qword [r15 + 0xb90]
mov edx, ebp
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140095e19
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
mov rcx, rax
lea rdx, [0x140335810]
call fcn.14027c4d8
test eax, eax
jne 0x140095e10
mov rax, qword [rsi + 0x5a8]
lea rcx, [rsi + 0x5a8]
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140095e10
lea edi, [rax - 1]
test edi, edi
js 0x140095e10
cmp dword [0x14045e968], r13d
jne 0x140095e10
mov rax, qword [rsi + 0x5a8]
lea rcx, [rsi + 0x5a8]
mov edx, edi
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140095e10
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
mov rcx, rax
lea rdx, [0x140335928]
call fcn.14027c4d8
test eax, eax
jne 0x140095dc3
cmp byte [rbx + 0xae0], r13b
je 0x140095dc3
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x1f0]
test rax, rax
je 0x140095e10
movzx ecx, byte [rax + 0x24]
cmp cl, 1
jne 0x140095cb5
mov rcx, qword [rax + 0x25]
mov r8, qword [rcx + 0x14]
mov rdx, qword [rcx + 0xc]
mov rcx, qword [rcx + 4]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jmp 0x140095dc1
cmp cl, 2
jne 0x140095d3e
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x88
call fcn.14027b2c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1e0]
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], r13w
mov qword [rsp + 0x40], rcx
or r8d, 0xffffffff
lea rcx, [rsp + 0x40]
mov rdx, qword [rax]
call fcn.1400c76f0
mov rbx, qword [rsp + 0x40]
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x40]
test eax, eax
lea rax, [rsp + 0x48]
jne 0x140095dce
cmp rcx, rax
je 0x140095dc3
call fcn.1402804a8
jmp 0x140095dc3
cmp cl, 3
jne 0x140095d59
mov rcx, qword [rax + 0x25]
mov rcx, qword [rcx]
call fcn.1400aab20
test eax, eax
jne 0x140095dd8
jmp 0x140095dc3
cmp cl, 4
jne 0x140095d6d
mov rcx, qword [rax + 0x25]
call fcn.1400a7c40
test eax, eax
jne 0x140095dd8
jmp 0x140095dc3
cmp cl, 5
jne 0x140095dc3
mov rbx, qword [rax + 0x25]
mov r9d, 3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
lea rdx, [rbx + 8]
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140095dc3
mov rcx, qword [rsp + 0x30]
lea rdx, [rbx + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140095dd8
sub edi, 1
jns 0x140095c22
jmp 0x140095e10
cmp rcx, rax
je 0x140095dd8
call fcn.1402804a8
mov rcx, qword [r15 + 8]
inc r12d
movsxd r8, r12d
xor r9d, r9d
mov edx, 0x532
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [r15 + 8]
xor r9d, r9d
movsxd r8, ebp
mov edx, 0x533
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebp, 1
jns 0x140095bb0
mov rdi, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x118]
mov r14, qword [rsp + 0xe0]
mov rcx, qword [r15 + 8]
xor r9d, r9d
movsxd r8, r12d
mov edx, 0x531
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0xe8
pop r15
pop r13
pop r12
pop rbp
ret