Function at 0x18d84
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
xor edi, edi
push edi
mov esi, 0x24a28
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [0x1ed18]
add esp, 0xc
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [0x24a28], eax
mov eax, dword [0x1ed1c]
push 0x27110
mov dword [0x24a2c], eax
call esi
push 0x1f3fa
lea eax, [ebp - 0x20]
push eax
call esi
push 0x20e60
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, 0x464b5147
cmp dword [0x24e7c], eax
je 0x18df5
mov dword [0x24e7c], eax
jmp 0x18f22
xor eax, eax
cmp ax, word [0x24e80]
je 0x18f22
push 0x24e80
lea eax, [ebp - 0x10]
push eax
call esi
xor eax, eax
mov word [ebp - 8], ax
mov eax, ebx
push ebx
mov word [ebp - 6], ax
call fcn.00015ae6
mov dword [ebp - 4], eax
cmp eax, edi
je 0x18f22
push ebx
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18e94
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18e94
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18e94
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
xor eax, eax
cmp ax, word [0x250c0]
je 0x18f1a
push 0x250c0
lea eax, [ebp - 0x10]
push eax
call esi
xor eax, eax
push ebx
mov word [ebp - 8], ax
push edi
push dword [ebp - 4]
mov eax, ebx
mov word [ebp - 6], ax
call sub.ntoskrnl.exe_memset
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18f1a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18f1a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x18f1a
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
push dword [ebp - 4]
call fcn.00015b00
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x1948e
mov eax, dword [ebx + 0x18]
cmp eax, edi
je 0x1948e
cmp dword [eax + 0x10], edi
je 0x1948e
push 0x40
push edi
mov esi, 0x24e80
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebx + 0x18]
movzx ecx, word [eax + 0xc]
push ecx
push dword [eax + 0x10]
push esi
call sub.ntoskrnl.exe_memcpy
push 0x40
push edi
push 0x250c0
call sub.ntoskrnl.exe_memset
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
movzx eax, word [eax]
add esp, 0x24
push 0x74
pop ecx
lea esi, [ecx + 0xc]
cmp cx, ax
jne 0x190e0
push esi
push edi
push 0x21640
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21640], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x21642], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x21644], dx
call fcn.00011c78
xor edx, edx
push 7
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, 0x73
mov word [0x21646], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x21648], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x216c0
mov word [0x2164a], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x216c0], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x216c2], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x216c4], dx
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x216c8], ax
add edx, edi
mov word [0x216c6], dx
call fcn.00011c78
push 0xb
xor edx, edx
pop ecx
div ecx
add edx, 0x68
push esi
push 0
push 0x21740
mov word [0x216ca], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21740], ax
call fcn.00011c78
and eax, 0xf
add eax, 0x6b
mov word [0x21742], ax
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x21744], dx
call fcn.00011c78
push 0xc
xor edx, edx
pop ecx
div ecx
add edx, 0x6c
mov word [0x21746], dx
jmp 0x19466
push 0x6e
pop ecx
cmp cx, ax
jne 0x19200
push esi
push edi
push 0x21640
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x21640], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x21642], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x21644], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x21646], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x21648], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x216c0
mov word [0x2164a], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x216c0], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x216c2], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x216c4], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x216c8], ax
add edx, edi
mov word [0x216c6], dx
call fcn.00011c78
push 0xb
xor edx, edx
pop ecx
div ecx
add edx, 0x68
push esi
push 0
push 0x21740
mov word [0x216ca], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
jmp 0x19428
push 0x77
pop ecx
push esi
push edi
push 0x21640
cmp cx, ax
jne 0x19320
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
mov word [0x21640], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x21642], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x21644], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x21646], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x21648], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x216c0
mov word [0x2164a], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
mov word [0x216c0], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x216c2], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x216c4], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x216c8], ax
add edx, edi
mov word [0x216c6], dx
call fcn.00011c78
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
add edx, 0x68
mov word [0x216ca], dx
push 0x21740
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
jmp 0x19428
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21640], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x21642], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x21644], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x21646], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x21648], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x216c0
mov word [0x2164a], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x216c0], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x216c2], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x216c4], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x216c8], ax
add edx, edi
mov word [0x216c6], dx
call fcn.00011c78
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
add edx, 0x68
mov word [0x216ca], dx
push 0x21740
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21740], ax
call fcn.00011c78
and eax, 0xf
add eax, 0x6b
mov word [0x21742], ax
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x21744], dx
call fcn.00011c78
and eax, 0xf
add eax, 0x66
mov word [0x21746], ax
push 0xd
xor edx, edx
pop ecx
mov eax, ebx
div ecx
add edx, 0x65
mov word [0x21748], dx
call fcn.00011c78
push 9
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x2174a], dx
pop edi
pop esi
pop ebx
leave
ret 4