Function at 0x18007c860
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x220
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r14, r8
mov r13d, edx
mov r12, rcx
mov esi, edx
lea ebx, [rdx + 0x9ae]
xor edi, edi
lea r8, [0x180000000]
lea r9d, [rdi + 0x6f]
lea r10d, [rdi + 0x78]
cmp edx, ebx
jae 0x18007cffd
movabs rcx, 0x6b007300610074
lea rdx, str.false
movsd xmm6, qword [0x18009bec8]
movsd xmm7, qword [0x18009be98]
mov r15d, dword [rsp + 0x40]
nop dword [rax]
cmp esi, 0xaa
ja 0x18007c92a
je 0x18007d050
cmp esi, 0x3d
je 0x18007c917
cmp esi, 0x6b
jne case.default.0x18007c961
mov r15d, 0x1388
jmp case.default.0x18007c961
mov qword [rbp + 0x88], rcx
mov word [rbp + 0x90], di
jmp case.default.0x18007c961
cmp esi, 0x1df
ja 0x18007cd6f
je 0x18007cb60
lea eax, [rsi - 0xb3]
cmp eax, 0xec
ja case.default.0x18007c961
movzx eax, byte [r8 + rax + 0x7d4c8]
mov ecx, dword [r8 + rax*4 + 0x7d4a0]
add rcx, r8
jmp rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea r9, [0x180097750]
mov r8d, 0x7b
lea rdx, str._d__s
lea rcx, [rsp + 0x60]
call fcn.18008e4e0
jmp 0x18007cfd0
mov dword [rsp + 0x48], edi
jmp case.0x18007c961.188
mov eax, dword [0x180097796]
mov dword [rbp + 0x94], eax
movzx eax, word [0x18009779a]
mov word [rbp + 0x98], ax
jmp case.0x18007c961.188
mov ebx, 0xa4
mov eax, ebx
sub eax, 0xa4
je 0x18007c9f7
cmp eax, 0x7b
jne 0x18007ca33
mov edx, r15d
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18007ca33
mov esi, 0xe1
lea ebx, [r13 + 0x9ae]
jmp 0x18007cfd0
mov rdx, qword [0x1800a3df8]
mov ecx, 0x107
call fcn.18008cb40
mov qword [rsp + 0x38], rdi
mov rax, qword [0x1800a3df8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x5f]
call fcn.180020530
add ebx, 0x7b
cmp ebx, 0x19a
jb 0x18007c9c5
jmp case.0x18007c961.181
mov r8d, 0x30
mov rdx, r12
lea rcx, [rbp + 0x50]
call fcn.180030880
test eax, eax
je 0x18007ca77
mov dword [rsp + 0x40], 0x194
xor r9d, r9d
mov r8, r14
lea edx, [r9 + 0x60]
lea rcx, [rsp + 0x40]
call fcn.18003e010
jmp 0x18007cfd0
mov eax, 0x4000
test word [rbp + 0x56], ax
je 0x18007cae7
mov ebx, 0x109
cmp ebx, 0x109
je 0x18007cab5
cmp ebx, 0x1ae
jne 0x18007cacd
mov dword [rsp + 0x40], 0xcc
xor r9d, r9d
mov r8, r14
lea edx, [r9 + 0x60]
lea rcx, [rsp + 0x40]
call fcn.18003e010
jmp 0x18007cacd
mov dword [rsp + 0x20], 0xbe
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
call fcn.180070f70
add ebx, 0xa5
cmp ebx, 0x253
jb 0x18007ca87
lea ebx, [r13 + 0x9ae]
jmp 0x18007cfd0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
mov r8, r14
lea edx, [r9 + 0x60]
lea rcx, [rsp + 0x40]
test eax, eax
jne 0x18007cb15
mov dword [rsp + 0x40], 0xcc
call fcn.18003e010
jmp 0x18007cfd0
mov dword [rsp + 0x40], 0x1a7
call fcn.18003e010
jmp 0x18007cfd0
mov edi, 0x6a
nop dword [rax]
cmp edi, 0x6a
jne 0x18007cbfb
inc dword [0x1800a3e40]
cmp qword [rbp - 0x40], 0xc
je 0x18007cbfb
mov ebx, r9d
nop dword [rax]
mov eax, ebx
sub eax, 0x6f
je 0x18007cb99
cmp eax, 0x2c
jne 0x18007cbe6
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.18008f350
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x40]
xorps xmm1, xmm1
test rcx, rcx
js 0x18007cbac
cvtsi2sd xmm1, rcx
jmp 0x18007cbc1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
movaps xmm2, xmm6
movq r8, xmm6
movq rdx, xmm1
lea rcx, str._f____f_n
call fcn.18008e9c0
lea rdx, str.false
mov qword [rsp + 0x50], rdx
add ebx, 0x2c
cmp ebx, 0xc7
jb 0x18007cb50
mov r9d, 0x6f
add edi, 0x86
cmp edi, 0xf0
jb 0x18007cb30
mov edi, 0x2b
cmp edi, 0x2b
jne 0x18007ccb0
inc dword [0x1800a3e40]
mov rax, qword [rbp - 0x48]
movabs rcx, 0x206f7420454e494c
cmp qword [rax], rcx
jne 0x18007cc3d
cmp dword [rax + 8], 0x454e494c
je 0x18007ccb0
mov ebx, 0x3a
cmp ebx, 0x3a
je 0x18007cc64
cmp ebx, 0xc7
je 0x18007cc5d
cmp ebx, 0x154
je 0x18007cb60
jmp 0x18007cc9b
mov qword [rsp + 0x50], rdx
jmp 0x18007cc9b
mov r8d, 0xc
lea rdx, str.emdf_payload
mov rcx, qword [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcmp
movd xmm1, eax
cvtdq2pd xmm1, xmm1
xorps xmm2, xmm2
movq r8, xmm2
movq rdx, xmm1
lea rcx, str._f____f_n
call fcn.18008e9c0
add ebx, 0x8d
cmp ebx, 0x1e1
lea rdx, str.false
jb 0x18007cc42
add edi, 0x1b8c
cmp edi, 0x1b8c
lea rdx, str.false
jbe 0x18007cc12
lea ebx, [r13 + 0x9ae]
xor edi, edi
jmp 0x18007cfd0
mov word [rbp + 0x9a], di
jmp case.0x18007c961.188
mov dword [rbp + 0x90], 0x67006d
mov word [rbp + 0x94], di
jmp case.0x18007c961.188
test r14, r14
je 0x18007cd2f
mov rcx, qword [r14]
cmp rcx, 0xffffffffffffffff
je 0x18007cd19
call qword [sym.imp.KERNEL32.dll_FindClose]
neg eax
sbb eax, eax
neg eax
dec eax
mov dword [rsp + 0x48], eax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
jmp 0x18007cfd0
mov ebx, 0xd1
cmp ebx, 0xd1
jne 0x18007cd4d
mov dword [rsp + 0x48], 0xffffffff
lea ecx, [rbx - 0x31]
call qword [sym.imp.KERNEL32.dll_SetLastError]
add ebx, 0x67af
cmp ebx, 0x67af
jbe 0x18007cd34
lea ebx, [r13 + 0x9ae]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
jmp 0x18007cfd0
cmp esi, 0x2f6
ja 0x18007cf77
je 0x18007ceb5
mov eax, esi
sub eax, 0x20a
je 0x18007ce8e
sub eax, 0xb
je 0x18007ce81
sub eax, 0x6b
je 0x18007cdb1
cmp eax, 0xb
jne case.default.0x18007c961
mov word [rbp + 0x9c], di
jmp case.default.0x18007c961
mov qword [rsp + 0x40], rdi
mov r9d, 0x91
lea r8, [rsp + 0x40]
lea rdx, [0x180092c27]
lea rcx, [rsp + 0x60]
call fcn.180018080
mov edi, 0xca
cmp edi, 0xca
je 0x18007ce5b
cmp edi, 0x4704
jne 0x18007ce61
cmp qword [rbp - 0x40], 5
je 0x18007ce61
mov ebx, 0x38
mov eax, ebx
sub eax, 0x38
je 0x18007ce05
cmp eax, 1
je 0x18007cb60
jmp 0x18007ce52
mov rcx, qword [rbp - 0x40]
xorps xmm1, xmm1
test rcx, rcx
js 0x18007ce18
cvtsi2sd xmm1, rcx
jmp 0x18007ce2d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
movaps xmm2, xmm7
movq r8, xmm7
movq rdx, xmm1
lea rcx, str._f____f_n
call fcn.18008e9c0
lea rax, str.false
mov qword [rsp + 0x50], rax
inc ebx
cmp ebx, 0x3a
jb 0x18007cdf3
jmp 0x18007ce61
inc dword [0x1800a3e40]
add edi, 0x463a
cmp edi, 0x8c74
jbe 0x18007cdd7
lea ebx, [r13 + 0x9ae]
xor edi, edi
jmp 0x18007cfd0
mov word [rbp + 0x9a], r10w
jmp case.default.0x18007c961
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x48]
mov edx, 0x119
xor ecx, ecx
call fcn.180042520
jmp 0x18007cfd0
mov edi, IUnknown_GetWindow
nop word [rax + rax]
mov eax, edi
sub eax, 0xa9
je 0x18007cf58
cmp eax, 1
jne 0x18007cf5e
mov rax, qword [rbp - 0x48]
cmp word [rax], 0xd30
jne 0x18007cee7
cmp byte [rax + 2], 0xa
je 0x18007cf5e
mov ebx, 0x40
nop dword [rax]
cmp ebx, 0x40
je 0x18007cf09
cmp ebx, 0x7c0
jne 0x18007cf48
lea rax, str.false
jmp 0x18007cb65
mov rax, qword [rbp - 0x48]
cmp byte [rax], 0x30
jne 0x18007cf22
cmp byte [rax + 1], 0xd
jne 0x18007cf22
cmp byte [rax + 2], 0xa
jne 0x18007cf22
xor eax, eax
jmp 0x18007cf27
sbb eax, eax
or eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
xorps xmm2, xmm2
movq r8, xmm2
movq rdx, xmm1
lea rcx, str._f____f_n
call fcn.18008e9c0
add ebx, 0x780
cmp ebx, 0xf00
jbe 0x18007cef0
jmp 0x18007cf5e
inc dword [0x1800a3e40]
inc edi
cmp edi, 0xab
jb 0x18007cec0
lea ebx, [r13 + 0x9ae]
xor edi, edi
jmp 0x18007cfd0
mov eax, esi
sub eax, 0x301
je 0x18007cfb6
sub eax, 0x6b
je 0x18007ce8e
cmp eax, 0x76
jne case.default.0x18007c961
mov eax, 0x17
cmp eax, 0x17
je 0x18007cfa5
cmp eax, 0x64a
je 0x18007cb60
jmp 0x18007cfaa
mov qword [rsp + 0x50], rdi
add eax, 0x633
cmp eax, 0xc66
jbe 0x18007cf93
mov r8d, 1
lea rdx, [0x180097770]
lea rcx, [rbp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r10d, 0x78
lea r9d, [r10 - 9]
lea r8, [0x180000000]
lea rdx, str.false
movabs rcx, 0x6b007300610074
add esi, 0x76
cmp esi, ebx
jb 0x18007c8f0
lea edi, [r13 - 0x14]
cmp r13d, edi
jbe 0x18007cb60
lea ebx, [r13 - 0x2a]
mov esi, 0x70
lea edx, [rsi + 2]
lea r15d, [rsi - 0xb]
movabs r12, 0x66007200650070
lea r13d, [rsi - 0x42]
nop dword [rax + rax]
cmp ebx, 0x13
ja case.default.0x18007d044
mov ecx, dword [r8 + rbx*4 + 0x7d5b8]
add rcx, r8
jmp rcx
test r12, r12
cmovne r14, r12
mov rax, qword [r14]
jmp 0x18007cb65
mov r8d, 0xa
lea rdx, [rbp + 0xae]
lea ecx, [r8 - 4]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov r8d, 0xa
lea rdx, [rbp + 0xb0]
lea ecx, [r8 - 6]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov edx, 0x72
jmp case.default.0x18007d044
mov dword [rbp + 0xec], 0x65
jmp case.default.0x18007d044
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], ax
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18007d0d0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x30]
call fcn.1800274c0
nop
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x18007d117
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp + 0x30], ax
add qword [r14 + 8], 0x20
jmp 0x18007d127
lea r8, [rbp + 0x30]
mov rcx, r14
call fcn.1800017a0
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x18007d08d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18007d162
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007d499
call fcn.18008eb9c
mov edx, 0x72
jmp case.default.0x18007d044
mov eax, dword [0x1800977b8]
mov dword [rbp + 0xa2], eax
movzx eax, word [0x1800977bc]
mov word [rbp + 0xa6], ax
jmp case.default.0x18007d044
xor eax, eax
mov word [rbp + 0x9e], ax
jmp case.default.0x18007d044
mov dword [rbp + 0xc0], 0x720070
jmp case.default.0x18007d044
mov qword [rbp + 0xd8], r12
jmp case.default.0x18007d044
mov dword [rbp + 0xc6], 0x650063
mov word [rbp + 0xca], r10w
jmp case.default.0x18007d044
mov word [rbp + 0xb2], r13w
jmp case.default.0x18007d044
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], ax
lea rax, [rbp + 0xa0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18007d200
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x30]
call fcn.1800274c0
nop
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x18007d247
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp + 0x30], ax
add qword [r14 + 8], 0x20
jmp 0x18007d257
lea r8, [rbp + 0x30]
mov rcx, r14
call fcn.1800017a0
mov rdx, qword [rbp + 0x48]
jmp 0x18007d127
xor eax, eax
mov word [rbp + 0xe4], ax
lea r8d, [rax + 4]
lea rdx, [0x1800977d2]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, 0x72
jmp case.default.0x18007d044
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], ax
lea rax, [rbp + 0x88]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18007d2b0
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x30]
call fcn.1800274c0
nop
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x18007d2f7
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp + 0x30], ax
add qword [r14 + 8], 0x20
jmp 0x18007d307
lea r8, [rbp + 0x30]
mov rcx, r14
call fcn.1800017a0
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x18007d343
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007d33e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007d499
call fcn.18008eb9c
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], ax
lea rax, [rbp + 0xd8]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18007d363
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x30]
call fcn.1800274c0
nop
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x18007d3aa
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp + 0x30], ax
add qword [r14 + 8], 0x20
jmp 0x18007d3ba
lea r8, [rbp + 0x30]
mov rcx, r14
call fcn.1800017a0
mov rdx, qword [rbp + 0x48]
jmp 0x18007d127
xor eax, eax
mov word [rbp + 0xd6], ax
mov dword [rbp + 0xa0], esi
jmp case.default.0x18007d044
xor eax, eax
mov word [rbp + 0xb4], ax
lea r8d, [rax + 3]
lea rdx, [0x1800977e8]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, 0x72
jmp case.default.0x18007d044
mov word [rbp + 0xc4], r9w
jmp case.default.0x18007d044
mov dword [rbp + 0xa6], 0x63
mov eax, dword [0x1800977f0]
mov dword [rbp + 0xa8], eax
movzx eax, word [0x1800977f4]
mov word [rbp + 0xac], ax
jmp case.default.0x18007d044
mov dword [rbp + 0xd0], 0x780065
mov word [rbp + 0xd4], r15w
jmp case.default.0x18007d044
mov dword [rbp + 0xe0], 0x6f006d
jmp case.default.0x18007d044
mov r8d, 2
lea rdx, [0x1800977e0]
lea rcx, [rbp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, 0x72
jmp case.default.0x18007d044
mov dword [rbp + 0xcc], 0x2e0070
dec ebx
lea eax, [rbx + 0x2a]
cmp eax, edi
jbe 0x18007cb60
lea r8, [0x180000000]
mov r9d, 0x6f
lea r10d, [r9 + 9]
jmp 0x18007d030
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3