Function at 0x1800035cc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rsi, qword [rsp + 0x158]
xor r14d, r14d
add edx, 0xfffffefe
or ebx, 0xffffffff
mov rdi, r9
mov r10d, r8d
lea r13d, [r14 + 1]
mov rbp, rcx
mov r12d, r14d
mov r8d, r14d
mov r9d, r14d
lea r15, [0x18003bc21]
cmp edx, 0x2c
ja case.0x180003638.275
mov eax, edx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x3ca0]
add rcx, rdx
jmp rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180002c1c
jmp 0x180003adb
cmp rdi, r14
je case.0x180003638.275
cmp dword [rsp + 0x150], r14d
je case.0x180003638.275
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x8c
mov qword [rsp + 0x60], r14
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180008e50
mov ebx, eax
cmp eax, r14d
jne 0x180003c58
lea r8, [rsp + 0x60]
mov r9d, 0x94
mov edx, 0x10
mov rcx, rbp
call fcn.18000eff0
cmp eax, r14d
je 0x1800036bd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f080
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003c58
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180003340
jmp 0x180003b38
mov r9d, r13d
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001950
jmp 0x180003b38
mov eax, r13d
lock xadd dword [0x180037af4], eax
add eax, r13d
cmp eax, r13d
jg 0x180003723
mov edx, 0x117
mov rcx, rdi
call fcn.1800025c0
mov ebx, eax
cmp eax, r14d
je 0x180003c58
lock add dword [0x180037af4], 0xffffffff
jmp 0x180003c58
mov r8d, r13d
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001e5c
jmp 0x180003b38
call fcn.1800017f0
jmp 0x180003b38
call fcn.180001838
jmp 0x180003b38
lea rcx, [0x180001248]
jmp 0x180003ad1
lea rcx, [0x1800023d8]
jmp 0x180003ad1
lea rcx, [fcn.1800023fc]
jmp 0x180003ad1
lea rcx, [fcn.180006074]
jmp 0x180003ad1
lea rcx, [0x180002570]
jmp 0x180003ad1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.18000ec48
jmp case.0x180003638.275
cmp qword [0x180037c10], r14
je 0x1800037c0
lea rcx, [rsp + 0x40]
call fcn.18000eda8
jmp 0x1800037c3
mov eax, r14d
cmp eax, r14d
je 0x180003810
cmp rbp, r14
je 0x1800037f7
mov r8, qword [rsp + 0x40]
mov r9d, eax
mov edx, 0x10
mov rcx, rbp
call fcn.18000eff0
cmp eax, r14d
je 0x1800037f7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f080
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x180003638.275
mov ebx, 0x12
jmp 0x180003c6a
cmp qword [0x180037af8], r14
jne case.0x180003638.275
cmp dword [rsp + 0x150], 0x10
jne 0x18000383e
mov rcx, rdi
call fcn.1800024b0
jmp 0x180003b38
mov ebx, 0x57
jmp 0x180003c58
mov rcx, r14
mov ebx, 0x426
xchg qword [0x180037af8], rcx
cmp rcx, r14
je 0x180003b2b
call fcn.18001eef8
mov ebx, r14d
jmp 0x180003b2b
mov r12d, r13d
cmp r12d, r14d
cmovne rbp, r14
mov rcx, rbp
call fcn.180002e68
jmp 0x180003adb
cmp rdi, r14
jne 0x180003897
lea rcx, [0x18003b1a9]
xor edx, edx
call fcn.180004d1c
mov dword [0x180037d54], r14d
mov dword [0x180037e48], r14d
xor ecx, ecx
mov dword [0x180037de0], r14d
call fcn.180002e68
mov rcx, rdi
call fcn.18001c758
mov r9d, 4
mov r12d, r13d
movzx r8d, word [0x180036634]
mov ecx, dword [0x180036630]
mov dword [0x180037d54], r12d
mov eax, 0xfffb
mov dword [0x180037e48], r12d
xor edx, edx
and r8w, ax
mov dword [0x180037de0], r12d
mov byte [rsp + 0x20], 0xff
or r8w, r9w
mov r9b, 0xff
call fcn.180004f44
mov ebx, eax
cmp rdi, r14
je 0x180003b2b
mov r8d, dword [0x180037c94]
mov edx, dword [rsp + 0x150]
xor r9d, r9d
mov rcx, rdi
call fcn.180028cf0
mov r8d, dword [rsp + 0x150]
lea rcx, [0x18003b1a9]
mov r9d, 3
mov rdx, rdi
call fcn.180004d1c
jmp 0x180003b2b
mov rdx, r13
lea rcx, [0x180002800]
jmp 0x180003ad3
lea rcx, [0x180001b04]
jmp 0x180003ad1
cmp rdi, r14
je case.0x180003638.275
cmp rsi, r14
je case.0x180003638.275
mov r9d, 4
cmp dword [rsp + 0x150], r9d
jne case.0x180003638.275
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp case.0x180003638.275
mov rcx, qword [0x180037b60]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x40]
call fcn.1800145d0
mov ebx, eax
cmp eax, r14d
jne 0x180003c58
mov r9d, dword [rsp + 0x138]
mov r8, qword [rsp + 0x40]
mov edx, 0x10
mov rcx, rbp
call fcn.18000eff0
cmp eax, r14d
je 0x1800039f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f080
mov r8, qword [rsp + 0x40]
jmp 0x180003a2d
mov rcx, qword [0x180037b60]
mov ebx, r14d
call fcn.180014444
mov rdi, rax
cmp rax, r14
je 0x180003c58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x180003a2a
mov rcx, rdi
call fcn.180016e64
mov ebx, eax
mov r8, rdi
mov rcx, qword [0x180037ae8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003c58
cmp rdi, r14
je case.0x180003638.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x180003638.275
mov r8d, r13d
jmp 0x180003ac0
cmp rdi, r14
je case.0x180003638.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x180003638.275
mov r8d, 7
jmp 0x180003ac0
cmp rdi, r14
je case.0x180003638.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x180003638.275
mov r8d, 3
jmp 0x180003ac0
cmp rdi, r14
je case.0x180003638.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x180003638.275
mov r8d, 0xd
mov rcx, rdi
call fcn.180002d18
jmp 0x180003adb
lea rcx, [0x180002cdc]
xor edx, edx
mov r8, rsi
call fcn.180002b3c
mov ebx, eax
jmp 0x180003c58
cmp rdi, r14
je case.0x180003638.275
mov ebx, dword [rsp + 0x150]
cmp ebx, r14d
je case.0x180003638.275
mov edx, ebx
mov rcx, rdi
call fcn.18001955c
cmp eax, r14d
je 0x180003b26
lea rcx, [0x18003b1a5]
mov r9d, 3
mov r8d, ebx
mov rdx, rdi
call fcn.180004d1c
mov ebx, eax
jmp 0x180003b2b
mov ebx, 0xbf
cmp ebx, r14d
jmp 0x180003b3d
mov rcx, rdi
call fcn.180002fd4
mov ebx, eax
cmp eax, r14d
jne 0x180003c58
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp 0x180003c58
mov r12d, r13d
cmp rdi, r14
je case.0x180003638.275
cmp dword [rsp + 0x150], r13d
jbe case.0x180003638.275
mov eax, dword [rsp + 0x150]
xor edx, edx
mov r8d, r10d
lea ecx, [rdx + 0x40]
mov qword [rsp + 0x50], r14
mov byte [rax + rdi - 1], r14b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
cmp rax, r14
je 0x180003c1f
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000001
cmp r12d, r14d
je 0x180003bb7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x180003bbd
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
cmp eax, r14d
jne 0x180003c14
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x180037c80]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x58]
mov r8, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, r14d
je 0x180003c01
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x180003c09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003c27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180003c58
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, rbp
lea edx, [r9 + 8]
call fcn.18000eff0
cmp eax, r14d
je 0x180003c78
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f080
cmp ebx, 0xffffffff
jne 0x180003c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
je 0x180003c78
mov r8d, ebx
mov rdx, rsi
mov rcx, r15
call fcn.180001690
lea r11, [rsp + 0x100]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret