Function at 0x1800036f4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rsi, qword [rsp + 0x158]
xor r14d, r14d
add edx, 0xfffffefe
or ebx, 0xffffffff
mov rdi, r9
mov r10d, r8d
mov rbp, rcx
mov r12d, r14d
lea r15, [0x18003dce5]
mov r8d, r14d
mov r9d, r14d
cmp edx, 0x2c
ja case.0x18000375c.275
mov eax, edx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x3e88]
add rcx, rdx
jmp rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180002d50
jmp 0x180003d0f
cmp rdi, r14
je case.0x18000375c.275
cmp dword [rsp + 0x150], r14d
je case.0x18000375c.275
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x8c
mov qword [rsp + 0x60], r14
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.18000976c
mov ebx, eax
cmp eax, r14d
jne 0x180003e41
lea r8, [rsp + 0x60]
mov r9d, 0x94
mov edx, 0x10
mov rcx, rbp
call fcn.18000f844
cmp eax, r14d
je 0x1800037e1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f8d4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003e41
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180003468
jmp 0x180003d1e
mov r9d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001920
jmp 0x180003d1e
mov eax, 1
lock xadd dword [0x180039b70], eax
inc eax
cmp eax, 1
jg 0x18000384b
mov edx, 0x117
mov rcx, rdi
call fcn.1800026f4
mov ebx, eax
cmp eax, r14d
je 0x180003e41
lock add dword [0x180039b70], 0xffffffff
jmp 0x180003e41
mov r8d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001e04
jmp 0x180003d1e
call fcn.1800017c0
jmp 0x180003d1e
call fcn.180001808
jmp 0x180003d1e
xor edx, edx
lea rcx, [0x180001248]
jmp 0x180003d07
xor edx, edx
lea rcx, [0x180002380]
jmp 0x180003d07
xor edx, edx
lea rcx, [fcn.1800023a4]
jmp 0x180003d07
xor edx, edx
lea rcx, [fcn.1800067d0]
jmp 0x180003d07
xor edx, edx
lea rcx, [0x180002518]
jmp 0x180003d07
mov rax, qword [0x180039db8]
cmp rax, r14
jne 0x1800038ed
call fcn.18000553c
mov qword [0x180039db8], rax
cmp rax, r14
je case.0x18000375c.275
cmp rbp, r14
je 0x180003e61
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, qword [0x180039db8]
mov edx, 0x10
lea r9d, [rax + 1]
mov rcx, rbp
call fcn.18000f844
cmp eax, r14d
je 0x180003e61
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f8d4
jmp 0x180003e61
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.18000f49c
jmp case.0x18000375c.275
cmp qword [0x180039c78], r14
je 0x18000395e
lea rcx, [rsp + 0x40]
call fcn.18000f5fc
jmp 0x180003961
mov eax, r14d
cmp eax, r14d
je 0x1800039ae
cmp rbp, r14
je 0x180003995
mov r8, qword [rsp + 0x40]
mov r9d, eax
mov edx, 0x10
mov rcx, rbp
call fcn.18000f844
cmp eax, r14d
je 0x180003995
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f8d4
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x18000375c.275
mov ebx, 0x12
jmp 0x180003e53
cmp qword [0x180039b58], r14
jne case.0x18000375c.275
cmp dword [rsp + 0x150], 0x10
jne 0x1800039dc
mov rcx, rdi
call fcn.180002458
jmp 0x180003d1e
mov ebx, 0x57
jmp 0x180003e41
mov rcx, r14
mov ebx, 0x426
xchg qword [0x180039b58], rcx
cmp rcx, r14
je 0x180003ccd
call fcn.180021418
mov ebx, r14d
jmp 0x180003ccd
mov r12d, 1
cmp r12d, r14d
cmovne rbp, r14
mov rcx, rbp
call fcn.180002f9c
jmp 0x180003d0f
cmp rdi, r14
jne 0x180003a38
lea rcx, [0x18003d1ce]
xor edx, edx
call fcn.180004f08
mov dword [0x180039e38], r14d
mov dword [0x180039ed0], r14d
xor ecx, ecx
mov dword [0x180039e68], r14d
call fcn.180002f9c
mov rcx, rdi
call fcn.18001ec78
mov r9d, 4
lea r12d, [r9 - 3]
movzx r8d, word [0x180038644]
mov ecx, dword [0x180038640]
mov dword [0x180039e38], r12d
mov eax, 0xfffb
mov dword [0x180039ed0], r12d
xor edx, edx
and r8w, ax
mov dword [0x180039e68], r12d
mov byte [rsp + 0x20], 0xff
or r8w, r9w
mov r9b, 0xff
call fcn.1800052ac
mov ebx, eax
cmp rdi, r14
je 0x180003ccd
mov r8d, dword [0x180039d10]
mov edx, dword [rsp + 0x150]
xor r9d, r9d
mov rcx, rdi
call fcn.18002b210
mov r8d, dword [rsp + 0x150]
lea rcx, [0x18003d1ce]
mov r9d, 3
mov rdx, rdi
call fcn.180004f08
jmp 0x180003ccd
mov edx, 1
lea rcx, [0x180002934]
jmp 0x180003d07
xor edx, edx
lea rcx, [0x180001ad4]
jmp 0x180003d07
cmp rdi, r14
je case.0x18000375c.275
cmp rsi, r14
je case.0x18000375c.275
mov r9d, 4
cmp dword [rsp + 0x150], r9d
jne case.0x18000375c.275
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp case.0x18000375c.275
mov rcx, qword [0x180039bc8]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x40]
call fcn.1800157c0
mov ebx, eax
cmp eax, r14d
jne 0x180003e41
mov r9d, dword [rsp + 0x138]
mov r8, qword [rsp + 0x40]
mov edx, 0x10
mov rcx, rbp
call fcn.18000f844
cmp eax, r14d
je 0x180003b96
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f8d4
mov r8, qword [rsp + 0x40]
jmp 0x180003bd3
mov rcx, qword [0x180039bc8]
mov ebx, r14d
call fcn.180015634
mov rdi, rax
cmp rax, r14
je 0x180003e41
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x180003bd0
mov rcx, rdi
call fcn.180018084
mov ebx, eax
mov r8, rdi
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003e41
cmp rdi, r14
je case.0x18000375c.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x18000375c.275
mov r8d, 1
jmp 0x180003c69
cmp rdi, r14
je case.0x18000375c.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x18000375c.275
mov r8d, 7
jmp 0x180003c69
cmp rdi, r14
je case.0x18000375c.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x18000375c.275
mov r8d, 3
jmp 0x180003c69
cmp rdi, r14
je case.0x18000375c.275
mov edx, dword [rsp + 0x150]
cmp edx, r14d
je case.0x18000375c.275
mov r8d, 0xd
mov rcx, rdi
call fcn.180002e4c
jmp 0x180003d0f
xor edx, edx
lea rcx, [0x180002e10]
jmp 0x180003d07
cmp rdi, r14
je case.0x18000375c.275
mov ebx, dword [rsp + 0x150]
cmp ebx, r14d
je case.0x18000375c.275
mov edx, ebx
mov rcx, rdi
call fcn.18001aa14
cmp eax, r14d
je 0x180003cc8
lea rcx, [0x18003d1ca]
mov r9d, 3
mov r8d, ebx
mov rdx, rdi
call fcn.180004f08
mov ebx, eax
jmp 0x180003ccd
mov ebx, 0xbf
cmp ebx, r14d
jmp 0x180003d23
mov eax, dword [0x180039b54]
cmp eax, r14d
jne case.0x18000375c.275
cmp rdi, r14
je case.0x18000375c.275
mov r9d, 4
cmp dword [rsp + 0x150], r9d
jne case.0x18000375c.275
mov edx, dword [rdi]
lea rcx, [0x180002568]
mov r8, rsi
call fcn.180002c70
mov ebx, eax
jmp 0x180003e41
mov rcx, rdi
call fcn.180003108
mov ebx, eax
cmp eax, r14d
jne 0x180003e41
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp 0x180003e41
mov r12d, 1
cmp rdi, r14
je case.0x18000375c.275
cmp dword [rsp + 0x150], 1
jbe case.0x18000375c.275
mov eax, dword [rsp + 0x150]
xor edx, edx
mov r8d, r10d
lea ecx, [rdx + 0x40]
mov qword [rsp + 0x50], r14
mov byte [rax + rdi - 1], r14b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
cmp rax, r14
je 0x180003e08
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000001
cmp r12d, r14d
je 0x180003da0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x180003da6
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
cmp eax, r14d
jne 0x180003dfd
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x180039ce8]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x58]
mov r8, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, r14d
je 0x180003dea
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x180003df2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003e10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180003e41
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, rbp
lea edx, [r9 + 8]
call fcn.18000f844
cmp eax, r14d
je 0x180003e41
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f8d4
cmp ebx, 0xffffffff
jne 0x180003e4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
je 0x180003e61
mov r8d, ebx
mov rdx, rsi
mov rcx, r15
call fcn.180001690
lea r11, [rsp + 0x100]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret