Function at 0x18001d2a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x1800312f8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
lea r12d, [rcx - 0x12]
mov qword [rbp - 0x51], rdx
mov r14, r8
cmp ecx, r12d
jbe case.0x18001d32e.0
mov r8d, dword [rbp - 0x49]
lea r13d, [rcx - 0x62]
mov esi, 0x74
mov dword [rbp - 0x59], r8d
lea r9, [0x180000000]
xor ebx, ebx
movabs r10, 0x7fffffffffffffff
lea edi, [rsi - 8]
lea r15d, [rsi - 0x46]
lea r11d, [rsi - 0x42]
nop dword [rax]
cmp r13d, 0x28
ja case.0x18001d32e.17
movzx eax, byte [r9 + r13 + 0x1d720]
mov ecx, dword [r9 + rax*4 + 0x1d6d8]
add rcx, r9
jmp rcx
mov dword [rbp + 7], 0x730077
jmp case.0x18001d32e.17
lea rcx, [rbp - 9]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d343
mov eax, dword [str.ocko]
lea rdx, [0x1800284c4]
mov dword [rcx], eax
mov r8d, 1
movzx eax, byte [0x1800284c0]
mov byte [rcx + 4], al
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001d5fe
lea rcx, str.Va_I2FromUI1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [rbp - 0x55], 1
jmp 0x18001d5fe
mov word [rbp], si
jmp case.0x18001d32e.17
mov word [rbp + 0x13], r15w
jmp case.0x18001d32e.17
mov eax, r8d
cmp rax, qword [rbp - 0x39]
jb case.0x18001d32e.17
mov byte [rbp - 0x55], 0
mov eax, dword [rbp - 0x55]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800245e0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x33
mov dword [rbp + 0xb], 0x5f0032
mov word [rbp + 0xf], ax
jmp case.0x18001d32e.17
cmp byte [rdx], 0
lea r9, [rbp - 0x49]
mov rcx, qword [r14]
mov eax, ebx
mov edx, 6
mov dword [rsp + 0x20], 4
setne al
mov dword [rbp - 0x49], eax
lea r8d, [rdx - 5]
call qword [rbp - 0x41]
test eax, eax
sete byte [rbp - 0x55]
jmp 0x18001d5fe
mov word [rbp + 0x11], r11w
jmp case.0x18001d32e.17
mov dword [rbp + 0x15], 0x6c0064
mov dword [rbp + 0x19], 0x6c
jmp case.0x18001d32e.17
mov eax, dword [str.sets]
mov dword [rbp - 9], eax
movzx eax, byte [0x1800284e0]
mov byte [rbp - 5], al
jmp case.0x18001d32e.17
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x31], 8
cmp rax, 8
jb 0x18001d3b1
add rax, 0xfffffffffffffff8
cmp qword [r14 + 0x18], 0x10
mov qword [rbp - 0x39], rax
mov rax, r14
jb 0x18001d485
mov rax, qword [r14]
mov r8d, dword [rax]
xor ebx, ebx
mov dword [rbp - 0x59], r8d
jmp case.0x18001d32e.17
cmp qword [r14 + 0x18], 0x10
mov rax, r14
jb 0x18001d4a0
mov rax, qword [r14]
mov ecx, dword [rax + 4]
cmp rcx, qword [rbp - 0x39]
jae 0x18001d3b1
mov rbx, qword [rbp - 0x31]
mov dword [rdx + 0x20], r8d
mov dword [rdx + 0x24], ecx
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
cmp rax, rbx
jb 0x18001d6c6
sub rax, rbx
mov rsi, 0xffffffffffffffff
cmp rax, rsi
cmovb rsi, rax
cmp qword [r14 + 0x18], 0x10
mov rax, r14
jb 0x18001d4ef
mov rax, qword [r14]
lea r15, [rax + rbx]
cmp rsi, 0xf
ja 0x18001d516
mov r8, rsi
mov qword [rbp - 0x19], rsi
mov rdx, r15
lea rcx, [rbp - 0x29]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x29], 0
jmp 0x18001d5aa
cmp rsi, r10
ja 0x18001d6d2
mov rdi, rsi
or rdi, 0xf
cmp rdi, r10
jbe 0x18001d530
mov rdi, r10
jmp 0x18001d53d
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001d576
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001d6cc
mov rcx, rax
call fcn.180023dfc
test rax, rax
je 0x18001d66d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001d587
test rcx, rcx
je 0x18001d585
call fcn.180023dfc
mov rbx, rax
jmp 0x18001d587
xor ebx, ebx
mov r8, rsi
mov qword [rbp - 0x19], rsi
mov rdx, r15
mov qword [rbp - 0x11], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov edi, 0x6c
mov qword [rbp - 0x29], rbx
mov rcx, qword [rbp - 0x51]
lea rdx, [rbp - 0x29]
call fcn.180008fb0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18001d5f2
mov rcx, qword [rbp - 0x29]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d5ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001d66d
call fcn.180023e38
mov r15d, 0x2e
xor ebx, ebx
lea esi, [r15 + 0x46]
mov r8d, dword [rbp - 0x59]
lea r9, [0x180000000]
mov rdx, qword [rbp - 0x51]
mov r11d, 0x32
movabs r10, 0x7fffffffffffffff
dec r13d
lea ecx, [r13 + 0x62]
cmp ecx, r12d
ja 0x18001d310
jmp case.0x18001d32e.0
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 7]
xor r9d, r9d
mov dword [rsp + 0x20], 0x70
xor r8d, r8d
lea rcx, [rbp - 9]
call fcn.18000a1b0
mov rdx, r14
mov qword [rbp - 0x41], rax
mov ecx, 0xff
call fcn.18000a320
test al, al
je 0x18001d3b1
jmp 0x18001d5fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x7f]
call fcn.180009900
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x1800313e0], rbx
je case.0x18001d32e.5
cmp ecx, 0x78
jae 0x18001d6a2
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x7f]
call fcn.180009900
mov ecx, eax
xor eax, eax
lock cmpxchg qword [0x1800313e0], rbx
jne 0x18001d692
mov eax, ebx
jmp 0x18001d3b8
call fcn.180020220
int3
call fcn.1800200a0
int3
call fcn.1800201e0
int3