Function at 0x180009bc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3c0
mov qword [rsp + reloc.mfc90.dll_Ordinal_760], 0xfffffffffffffffe
mov rax, qword [0x18004b0d0]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x3c], 0x200000
mov ecx, dword [rsp + 0x3c]
call sub.mfc90.dll_Ordinal_265
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x98], rax
mov ecx, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x98]
xor eax, eax
rep stosb byte [rdi], al
call fcn.180007c50
test eax, eax
je 0x180009c4b
lea rax, [0x18003eea0]
mov qword [0x18004b390], rax
lea rax, str.cdn.wb009.com_adhunter_protect.html
mov qword [rsp + 0x68], rax
lea rax, str.home.wb009.com:8080_md_adhunter_protect.html
mov qword [rsp + 0x70], rax
lea rax, str.122.224.171.229:8080_md_protect.html
mov qword [rsp + 0x78], rax
lea rax, str.dh.ywcywl.com_md_protect.html
mov qword [rsp + 0x80], rax
lea rax, str.d.wb009.com:8081_md_adhunter_protect.html
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 5
div ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x90], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0xa0], eax
jmp 0x180009ce0
mov eax, dword [rsp + 0xa0]
add eax, 1
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
cmp rax, 5
jae 0x180009d60
movsxd rax, dword [rsp + 0xa0]
movsxd rcx, dword [rsp + 0x90]
mov rax, qword [rsp + rax*8 + 0x68]
mov qword [rsp + rcx*8 + 0x40], rax
mov eax, dword [rsp + 0x90]
add eax, 1
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
cmp rax, 5
jne 0x180009d29
jmp 0x180009d60
movsxd rdx, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x38]
mov eax, 5
sub rax, rcx
cmp rdx, rax
jb 0x180009d5b
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xa0], eax
jl 0x180009d5b
mov dword [rsp + 0xa0], 0xffffffff
jmp 0x180009ccf
call fcn.180007c50
test eax, eax
je 0x180009d75
lea rax, str.192.168.145.1:8080_protect.html.zip
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x180009d8a
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
cmp rax, 5
jae 0x18000a66c
xor ecx, ecx
call entry0
mov dword [rsp + 0x1b0], eax
mov byte [rsp + 0xb0], 0
lea rdi, [rsp + 0xb1]
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
movsxd r8, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x1b0]
mov r8, qword [rsp + r8*8 + 0x40]
lea rdx, str.http:___s_tsts_d
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCR90.dll_sprintf]
mov byte [rsp + 0x1af], 0
lea rcx, [rsp + 0x1b8]
call fcn.180013760
nop
mov dword [rsp + 0x1b4], 0
mov ecx, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x98]
xor eax, eax
rep stosb byte [rdi], al
lea r8, [0x18003efc8]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x210]
call fcn.180004170
mov qword [rsp + 0x300], rax
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x210]
call qword [sym.imp.mfc90.dll_Ordinal_589]
lea r8, [0x18003efe0]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x218]
call fcn.180004170
mov qword [rsp + reloc.mfc90.dll_Ordinal_776], rax
mov rcx, qword [rsp + reloc.mfc90.dll_Ordinal_776]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x218]
call qword [sym.imp.mfc90.dll_Ordinal_589]
lea rax, [rsp + 0x220]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x248], rax
lea rax, [rsp + reloc.mfc90.dll_Ordinal_592]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x268], rax
lea rdx, [0x180039347]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.mfc90.dll_Ordinal_310]
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x318], rax
lea rdx, [0x18003934a]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.mfc90.dll_Ordinal_310]
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x328], rax
lea rdx, [0x18003ee7c]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.mfc90.dll_Ordinal_310]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x338], rax
lea r8, [0x18003f000]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x258]
call fcn.180004170
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x348], rax
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.mfc90.dll_Ordinal_310]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x328]
mov r8, qword [rsp + 0x338]
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x350]
call fcn.1800124c0
test eax, eax
jne 0x18000a029
lea r8, [rsp + 0xb0]
lea rdx, str.PWPP_g_hnr_c__failed___url_s___n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
jmp 0x18000a659
mov dword [rsp + 0x1c0], 0
mov byte [rsp + 0x1c4], 0
lea rdi, [rsp + 0x1c5]
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x270]
mov qword [rsp + 0x278], rax
lea r8, [0x18003f040]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x278]
call fcn.180004170
mov qword [rsp + 0x358], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x1c4]
mov rcx, qword [rsp + 0x358]
call fcn.180010a90
test eax, eax
jne 0x18000a0db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.PWPP_g_hnr_c_:_read_hnr_c_z_file_failed___error_d__r_n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
movsx eax, byte [rsp + 0x1c4]
cmp eax, 0x50
jne 0x18000a45a
movsx eax, byte [rsp + 0x1c5]
cmp eax, 0x4b
jne 0x18000a45a
lea rax, [rsp + 0x280]
mov qword [rsp + 0x288], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x298], rax
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.mfc90.dll_Ordinal_300]
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x368], rax
lea r8, [0x18003f090]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x298]
call fcn.180004170
mov qword [rsp + 0x370], rax
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x370]
call fcn.180011100
test eax, eax
jne 0x18000a245
lea rdx, str.PWPP_g_hnr_c_:_UnZip_failed__r_n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
lea r8, [0x18003f0c8]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2a0]
call fcn.180004170
mov qword [rsp + reloc.mfc90.dll_Ordinal_888], rax
mov rcx, qword [rsp + reloc.mfc90.dll_Ordinal_888]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.mfc90.dll_Ordinal_589]
lea r8, [0x18003f0e0]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2a8]
call fcn.180004170
mov qword [rsp + 0x380], rax
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2a8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
lea r8, [0x18003f100]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x2b8]
call fcn.180004170
mov qword [rsp + 0x388], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x388]
call fcn.180010970
mov dword [rsp + 0x1c0], eax
mov ecx, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x98]
xor eax, eax
rep stosb byte [rdi], al
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x2c8], rax
lea r8, [0x18003f120]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004170
mov qword [rsp + 0x390], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x390]
call fcn.180010a90
test eax, eax
jne 0x18000a3c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.PWPP_g_hnr_c_:_fReadFile_Buf_key_u_z_f_failed___error_d__r_n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
lea r8, [0x18003f180]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2d0]
call fcn.180004170
mov qword [rsp + 0x398], rax
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.mfc90.dll_Ordinal_589]
lea r8, [0x18003f198]
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2d8]
call fcn.180004170
mov qword [rsp + 0x3a0], rax
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2d8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
lea r8, str.zlogpp13394243.txt
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2e0]
call fcn.180004170
mov qword [rsp + 0x3a8], rax
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.mfc90.dll_Ordinal_589]
lea r8, str.protect__get_hnr_config.html
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x2e8]
call fcn.180004170
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
mov eax, dword [rsp + 0x3c]
sub eax, 1
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov byte [rax + rcx], 0
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_310]
nop
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_2973]
test eax, eax
jle 0x18000a64a
mov eax, dword [rsp + 0x3c]
sub eax, 1
mov edi, eax
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_888]
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.MSVCR90.dll_strncpy]
lea rdx, [0x18003ee9c]
mov rcx, qword [rsp + 0x98]
call fcn.180009200
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
jne 0x18000a510
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
mov rax, qword [rsp + 0x1d8]
add rax, 2
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1d0], 0
lea rdx, [0x18003eedc]
mov rcx, qword [rsp + 0x1d8]
call fcn.180009200
mov qword [rsp + 0x1d0], rax
cmp qword [rsp + 0x1d0], 0
jne 0x18000a579
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
cmp qword [rsp + 0x1d0], 0
je 0x18000a58f
mov rax, qword [rsp + 0x1d0]
mov byte [rax], 0
mov edx, 0x48
mov rcx, qword [rsp + 0x1d8]
call fcn.180009a80
mov rdx, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x1e0]
call fcn.1800092e0
test eax, eax
je 0x18000a5ed
lea rcx, [0x18004c740]
call fcn.18000bb80
mov r8, rax
lea rdx, str.PWPP_g_c__parse_r_done_r_count_d__n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
jmp 0x18000a600
lea rdx, str.PWPP_g_c__parse_r_failed__n
mov rcx, qword [0x18004c3a8]
call fcn.18000f190
mov eax, dword [rsp + 0x30]
mov dword [0x18004c38c], eax
mov dword [rsp + 0x2f0], 1
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
mov eax, dword [rsp + 0x2f0]
jmp 0x18000a66e
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
nop
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.mfc90.dll_Ordinal_589]
jmp 0x180009d7f
xor eax, eax
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.180032590
add rsp, 0x3c0
pop rdi
ret