Function at 0x1839e
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
push 0x1e06a
lea eax, [ebp - 0x20]
push eax
call esi
push 0x1fa88
lea eax, [ebp - 0x10]
push eax
call esi
mov eax, 0x464b5147
mov ebx, 0x22500
cmp dword [0x224fc], eax
je 0x183e1
mov dword [0x224fc], eax
jmp 0x18481
xor eax, eax
cmp ax, word [0x22500]
je 0x18481
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
xor eax, eax
mov esi, 0x400
mov word [ebp - 8], ax
mov eax, esi
push esi
mov word [ebp - 6], ax
call fcn.000153de
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x18481
push esi
push edi
push eax
call sub.ntoskrnl.exe_memset
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18479
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18479
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18479
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
push dword [ebp - 4]
call fcn.000153f8
mov edi, dword [ebp + 8]
test edi, edi
je 0x187fd
mov eax, dword [edi + 0x18]
test eax, eax
je 0x187fd
cmp dword [eax + 0x10], 0
je 0x187fd
push 0x40
push 0
push ebx
call sub.ntoskrnl.exe_memset
mov eax, dword [edi + 0x18]
movzx ecx, word [eax + 0xc]
push ecx
push dword [eax + 0x10]
push ebx
call sub.ntoskrnl.exe_memcpy
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 0x10]
movzx eax, word [eax]
add esp, 0x18
push 0x74
pop ebx
mov ecx, ebx
cmp cx, ax
je 0x186cb
push 0x6e
pop ecx
cmp cx, ax
jne 0x185d0
lea esi, [ebx + 0xc]
push esi
push 0
push 0x200e8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
push 0x61
pop ebx
mov word [0x200e8], ax
mov eax, ebx
push 0x6e
mov word [0x200ea], ax
pop eax
mov word [0x200ec], ax
call fcn.00011b60
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, edi
add edx, ebx
mov word [0x200ee], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x200f0], dx
call fcn.00011b60
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x20168
mov word [0x200f2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x20168], ax
mov eax, ebx
push 0x6e
mov word [0x2016a], ax
pop eax
mov word [0x2016c], ax
call fcn.00011b60
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, edi
and eax, 7
add eax, 0x6f
mov word [0x20170], ax
add edx, ebx
mov word [0x2016e], dx
call fcn.00011b60
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
push 0x201e8
add edx, 0x68
mov word [0x20172], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x201e8], ax
mov eax, ebx
push 0x6e
jmp 0x187b7
push 0x77
pop ecx
cmp cx, ax
jne 0x186cb
lea esi, [ecx + 9]
push esi
push 0
push 0x200e8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x63
pop eax
push 0x70
mov word [0x200ea], ax
pop eax
mov word [0x200e8], bx
mov word [0x200ec], ax
call fcn.00011b60
push 0x1a
xor edx, edx
pop ecx
div ecx
push 0x61
pop ebx
push 0xb
pop ecx
mov eax, edi
add edx, ebx
mov word [0x200ee], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x200f0], dx
call fcn.00011b60
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x20168
mov word [0x200f2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
push 0x63
mov word [0x20168], ax
pop eax
push 0x70
mov word [0x2016a], ax
pop eax
mov word [0x2016c], ax
call fcn.00011b60
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, edi
and eax, 7
add eax, 0x6f
mov word [0x20170], ax
add edx, ebx
mov word [0x2016e], dx
call fcn.00011b60
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
push 0x201e8
add edx, 0x68
mov word [0x20172], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
push 0x63
mov word [0x201e8], ax
pop eax
push 0x70
jmp 0x187b7
mov esi, 0x80
push esi
push 0
push 0x200e8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
push reloc.ntoskrnl.exe_MmIsAddressValid
mov word [0x200e8], ax
pop eax
mov word [0x200ea], ax
mov word [0x200ec], bx
call fcn.00011b60
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop ebx
push 0xb
pop ecx
mov eax, edi
add edx, ebx
mov word [0x200ee], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x200f0], dx
call fcn.00011b60
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x20168
mov word [0x200f2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
push reloc.ntoskrnl.exe_MmIsAddressValid
mov word [0x20168], ax
pop eax
push 0x74
mov word [0x2016a], ax
pop eax
mov word [0x2016c], ax
call fcn.00011b60
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, edi
and eax, 7
add eax, 0x6f
mov word [0x20170], ax
add edx, ebx
mov word [0x2016e], dx
call fcn.00011b60
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
push 0x201e8
add edx, 0x68
mov word [0x20172], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
push reloc.ntoskrnl.exe_MmIsAddressValid
mov word [0x201e8], ax
pop eax
push 0x74
mov word [0x201ea], ax
pop eax
mov word [0x201ec], ax
call fcn.00011b60
and eax, 0xf
add eax, 0x66
mov word [0x201ee], ax
push 0xd
xor edx, edx
pop ecx
mov eax, edi
div ecx
add edx, 0x65
mov word [0x201f0], dx
call fcn.00011b60
push 9
xor edx, edx
pop ecx
div ecx
add edx, ebx
mov word [0x201f2], dx
pop edi
pop esi
pop ebx
leave
ret 4