Function at 0x180048840
Capabilities:
Delete file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul eax, r8d, 0x5fa
mov r12d, r8d
mov r15, rdx
mov rsi, rcx
mov ebp, r8d
mov dword [rsp + 0x90], eax
cmp r8d, eax
ja 0x180048bc3
mov r13, qword [rsp + 0x98]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x98]
nop
cmp ebp, 0x9be6
ja 0x180048a7e
je 0x180048a50
mov eax, ebp
sub eax, 0x27
je 0x180048a10
sub eax, 0x5b
je 0x180048a08
sub eax, 0x57
je 0x1800489a1
sub eax, 0x4d5b
je 0x18004894a
cmp eax, 0x3456
jne 0x180048bad
mov edi, dword [rsp + 0x90]
nop dword [rax]
mov ebx, 0x49
cmp ebx, 0x49
je 0x180048c03
cmp ebx, 0x2bea
je 0x180048be3
cmp ebx, 0x578b
jne 0x180048c1d
mov r9, qword [r15 + 0x18]
lea r8, str.Fun::TailBbl
mov edx, 0x8e
xor ecx, ecx
call fcn.180045d20
lea r9, [rsp + 0x90]
mov dword [rsp + 0x90], edi
mov r8d, SHSetFolderPathA
lea rdx, str.N7VN7V7V7V
lea rcx, str.Per_element_
call fcn.180008340
jmp 0x180048c1d
mov rcx, qword [r15 + 0x10]
test rcx, rcx
je 0x18004896f
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180048960
inc r13
add r13, rax
cmp dword [r15 + 0x18], 0
je 0x180048bad
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x180048bad
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180048990
add r13, rax
jmp 0x180048bad
cmp dword [rsi], 4
jge 0x1800489f2
mov ebx, 0x14
nop dword [rax + rax]
cmp ebx, 0x14
je 0x1800489c9
cmp ebx, 0xdac
jne 0x1800489e4
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [r15]
lea rcx, str.VVC:__ERROR__creating_counter_set_instance_for__s_failed
call fcn.1800a0e30
lea rcx, str.exception_specification_of__0_uses_itself
call fcn.1800a0e30
add ebx, 0xd98
cmp ebx, 0x1b30
jbe 0x1800489b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x180048bad
xor r13d, r13d
jmp 0x180048bad
mov ebx, 0x1e8480
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov r9, rsi
mov dword [rsp + 0x28], 0x36
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180041390
sub rbx, 1
jne 0x180048a20
jmp 0x180048bad
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x180048a6c
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180048a60
add r13, rax
lea rcx, [r13 + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
jmp 0x180048bad
cmp ebp, 0xe998
je 0x180048ba0
cmp ebp, 0x1043b
je 0x180048bc3
cmp ebp, 0x1374a
je 0x180048ab2
cmp ebp, 0x184fc
jne 0x180048bad
mov rax, r14
jmp 0x180048bcb
mov r8, qword [r15 + 0x10]
test r8, r8
je 0x180048af8
lea rcx, [r14 - 1]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180048ac0
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180048ad0
lea rcx, [r14 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180048ae4
movzx eax, word [reloc.SHELL32.dll_PathMakeUniqueName]
mov word [rcx], ax
cmp dword [r15 + 0x18], 0
je 0x180048b3f
cmp qword [rsi + 0x10], 0
je 0x180048b3f
mov rdi, qword [rsi + 0x10]
cmp byte [rdi], 0x2f
jne 0x180048b18
nop
inc rdi
cmp byte [rdi], 0x2f
je 0x180048b10
lea rcx, [r14 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180048b20
xor edx, edx
nop dword [rax]
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180048b30
cmp qword [rsi + 0x18], 0
je 0x180048bad
mov r8d, 0x79
nop dword [rax]
mov eax, r8d
sub eax, 0x79
je 0x180048b91
cmp eax, 1
jne 0x180048b95
cmp byte [rdi], 0x2f
jne 0x180048b6a
inc rdi
cmp byte [rdi], 0x2f
je 0x180048b62
lea rcx, [r14 - 1]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180048b70
xor edx, edx
nop dword [rax]
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180048b80
jmp 0x180048b95
mov rdi, qword [rsi + 0x18]
inc r8d
cmp r8d, 0x7b
jb 0x180048b50
jmp 0x180048bad
test r14, r14
je 0x1800489bd
mov byte [r14], 0
imul eax, r12d, 0x99
add ebp, eax
cmp ebp, dword [rsp + 0x90]
jbe 0x180048890
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15 + 8]
lea r9, str.B_vB_vz_vz_v
lea r8, str.setKeepAlive
mov edx, 0x7c
call fcn.18003e410
mov edi, eax
jmp 0x180048c1d
lea rcx, str.MaxLogSizeKB
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.s_getpc_b64
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add ebx, 0x2ba1
cmp ebx, 0x82e3
jbe 0x1800488e5
jmp 0x1800488e0