Function at 0x1800cfad0
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x528
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x548]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x4f0], rax
mov rdx, qword [rbp + 0x520]
lea rcx, [0x180376b30]
call fcn.1800ce250
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdx, str.default.bin
mov rcx, qword [rbp + 8]
call fcn.1800cb660
test eax, eax
jne 0x1800cfc2a
mov byte [rbp + 0x3d8], 0x5b
mov byte [rbp + 0x3d9], 0x63
mov byte [rbp + 0x3da], 0x6f
mov byte [rbp + 0x3db], 0x6e
mov byte [rbp + 0x3dc], 0x66
mov byte [rbp + 0x3dd], 0x69
mov byte [rbp + 0x3de], 0x67
mov byte [rbp + 0x3df], 0x2e
mov byte [rbp + 0x3e0], 0x63
mov byte [rbp + 0x3e1], 0x70
mov byte [rbp + 0x3e2], 0x70
mov byte [rbp + 0x3e3], 0x3a
mov byte [rbp + 0x3e4], 0x33
mov byte [rbp + 0x3e5], 0x35
mov byte [rbp + 0x3e6], 0x34
mov byte [rbp + 0x3e7], 0x5d
mov byte [rbp + 0x3e8], 0x20
mov byte [rbp + 0x3e9], 0
lea rcx, [rbp + 0x3d8]
call fcn.1800ceb30
mov r8, rax
mov dl, 2
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x4d8], rax
lea rdx, str.unable_to_remove_default_configuration_file:__
mov rcx, qword [rbp + 0x4d8]
call fcn.18015de80
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x4e0]
call fcn.18015ded0
mov qword [rbp + 0x4e8], rax
lea rdx, [0x180257224]
mov rcx, qword [rbp + 0x4e8]
call fcn.18015de80
jmp 0x1800cfdc7
lea rdx, [0x1803775f0]
lea rcx, [rbp + 0x30]
call fcn.1800c1900
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1800c1850
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1800cfdc7
lea rax, [rbp + 0x408]
mov qword [rbp + 0x438], rax
lea rdx, [rbp + 0x458]
lea rcx, [0x180376b30]
call fcn.1800d24c0
mov qword [rbp + 0x4d8], rax
mov rax, qword [rbp + 0x4d8]
mov qword [rbp + 0x4e0], rax
mov r8, qword [rbp + 0x520]
mov rdx, qword [rbp + 0x438]
mov rcx, qword [rbp + 0x4e0]
call fcn.1800ce330
mov qword [rbp + 0x4e8], rax
mov r8, qword [rbp + 0x4e8]
lea rdx, [rbp + 0x488]
lea rcx, [0x180376b30]
call fcn.1800d2720
lea rcx, [rbp + 0x488]
call fcn.1800ce0a0
lea rcx, [rbp + 0x458]
call fcn.1800ce070
mov byte [rbp + 0x4b8], 0x5b
mov byte [rbp + 0x4b9], 0x63
mov byte [rbp + 0x4ba], 0x6f
mov byte [rbp + 0x4bb], 0x6e
mov byte [rbp + 0x4bc], 0x66
mov byte [rbp + 0x4bd], 0x69
mov byte [rbp + 0x4be], 0x67
mov byte [rbp + 0x4bf], 0x2e
mov byte [rbp + 0x4c0], 0x63
mov byte [rbp + 0x4c1], 0x70
mov byte [rbp + 0x4c2], 0x70
mov byte [rbp + 0x4c3], 0x3a
mov byte [rbp + 0x4c4], 0x33
mov byte [rbp + 0x4c5], 0x36
mov byte [rbp + 0x4c6], 0x36
mov byte [rbp + 0x4c7], 0x5d
mov byte [rbp + 0x4c8], 0x20
mov byte [rbp + 0x4c9], 0
lea rcx, [rbp + 0x4b8]
call fcn.1800ceb30
mov r8, rax
mov dl, 1
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x4d8], rax
lea rdx, str.removed_configuration_file:__
mov rcx, qword [rbp + 0x4d8]
call fcn.18015de80
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x4e0]
call fcn.18015ded0
mov qword [rbp + 0x4e8], rax
lea rdx, [0x180257224]
mov rcx, qword [rbp + 0x4e8]
call fcn.18015de80
lea rcx, [rbp - 0x20]
lea rdx, [0x180256ac0]
call fcn.180224a80
mov rcx, qword [rbp + 0x4f0]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x508]
pop rdi
pop rbp
ret