Function at 0x180003760
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x100
mov rsi, qword [rsp + 0x158]
mov rdi, r9
add edx, 0xfffffefe
mov r9d, r8d
xor r12d, r12d
or ebx, 0xffffffff
xor r8d, r8d
cmp edx, 0x2c
mov rbp, rcx
lea r15, [0x180039d55]
ja case.0x1800037bc.274
mov eax, edx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x3dd8]
add rcx, rdx
jmp rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180002eb8
jmp 0x180003c70
test rdi, rdi
je case.0x1800037bc.274
cmp dword [rsp + 0x150], r8d
je case.0x1800037bc.274
and qword [rsp + 0x60], r8
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x8c
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.18000953c
test eax, eax
mov ebx, eax
jne 0x180003d98
lea r8, [rsp + 0x60]
lea edx, [rax + 0x10]
mov r9d, 0x94
mov rcx, rbp
call fcn.18000f680
test eax, eax
je 0x18000383d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f710
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003d98
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180003528
jmp 0x180003c7f
xor r9d, r9d
jmp 0x18000386c
mov r9d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001b04
jmp 0x180003c7f
mov eax, 1
lock xadd dword [0x180036860], eax
add eax, 1
cmp eax, 1
jg 0x1800038af
xor r9d, r9d
mov edx, 0x117
mov rcx, rdi
call fcn.1800028d0
test eax, eax
mov ebx, eax
je 0x180003d98
lock add dword [0x180036860], 0xffffffff
jmp 0x180003d98
mov r8d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180002008
jmp 0x180003c7f
call fcn.1800019a4
jmp 0x180003c7f
call fcn.1800019ec
jmp 0x180003c7f
xor edx, edx
lea rcx, [0x180001248]
jmp 0x180003c68
xor edx, edx
lea rcx, [0x18000255c]
jmp 0x180003c68
xor edx, edx
lea rcx, [fcn.180002580]
jmp 0x180003c68
xor edx, edx
lea rcx, [fcn.1800064e0]
jmp 0x180003c68
xor edx, edx
lea rcx, [0x1800026f4]
jmp 0x180003c68
mov rax, qword [0x180036ad0]
test rax, rax
jne 0x180003951
call fcn.180005380
test rax, rax
mov qword [0x180036ad0], rax
je case.0x1800037bc.274
test rbp, rbp
je 0x180003db7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, qword [0x180036ad0]
mov edx, 0x10
lea r9d, [rax + 1]
mov rcx, rbp
call fcn.18000f680
test eax, eax
je 0x180003db7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f710
jmp 0x180003db7
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.18000f2d8
jmp case.0x1800037bc.274
cmp qword [0x180036968], r8
je 0x1800039c1
lea rcx, [rsp + 0x40]
call fcn.18000f438
jmp 0x1800039c3
xor eax, eax
test eax, eax
je 0x180003a0e
test rbp, rbp
je 0x1800039f5
mov r8, qword [rsp + 0x40]
mov r9d, eax
mov edx, 0x10
mov rcx, rbp
call fcn.18000f680
test eax, eax
je 0x1800039f5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f710
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x1800037bc.274
mov ebx, 0x12
jmp 0x180003da9
cmp qword [0x180036848], r8
jne case.0x1800037bc.274
cmp dword [rsp + 0x150], 0x10
jne 0x180003a3c
mov rcx, rdi
call fcn.180002634
jmp 0x180003c7f
mov ebx, 0x57
jmp 0x180003d98
xor ecx, ecx
mov ebx, 0x426
xchg qword [0x180036848], rcx
test rcx, rcx
je 0x180003c36
call fcn.18001e820
xor ebx, ebx
jmp 0x180003c36
mov edx, 1
lea rcx, [0x180002b14]
jmp 0x180003c68
xor edx, edx
lea rcx, [0x180001cb0]
jmp 0x180003c68
test rdi, rdi
je case.0x1800037bc.274
test rsi, rsi
je case.0x1800037bc.274
cmp dword [rsp + 0x150], 4
jne case.0x1800037bc.274
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, r15
call fcn.180001874
jmp case.0x1800037bc.274
mov rcx, qword [0x1800368b8]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x40]
call fcn.1800151dc
test eax, eax
mov ebx, eax
jne 0x180003d98
mov r9d, dword [rsp + 0x138]
mov r8, qword [rsp + 0x40]
lea edx, [rax + 0x10]
mov rcx, rbp
call fcn.18000f680
test eax, eax
je 0x180003b0a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f710
mov r8, qword [rsp + 0x40]
jmp 0x180003b45
mov rcx, qword [0x1800368b8]
xor ebx, ebx
call fcn.180015050
test rax, rax
mov rdi, rax
je 0x180003d98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180003b42
mov rcx, rdi
call fcn.180017854
mov ebx, eax
mov r8, rdi
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003d98
test rdi, rdi
je case.0x1800037bc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800037bc.274
mov r8d, 1
jmp 0x180003bd7
test rdi, rdi
je case.0x1800037bc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800037bc.274
mov r8d, 7
jmp 0x180003bd7
test rdi, rdi
je case.0x1800037bc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800037bc.274
mov r8d, 3
jmp 0x180003bd7
test rdi, rdi
je case.0x1800037bc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800037bc.274
mov r8d, 0xd
mov rcx, rdi
call fcn.180002fb0
jmp 0x180003c70
xor edx, edx
lea rcx, [0x180002f74]
jmp 0x180003c68
test rdi, rdi
je case.0x1800037bc.274
mov ebx, dword [rsp + 0x150]
test ebx, ebx
je case.0x1800037bc.274
mov edx, ebx
mov rcx, rdi
call fcn.180019d50
test eax, eax
je 0x180003c31
lea rcx, [0x180039200]
mov r9d, 3
mov r8d, ebx
mov rdx, rdi
call fcn.180004ed0
mov ebx, eax
jmp 0x180003c36
mov ebx, 0xbf
test ebx, ebx
jmp 0x180003c83
mov eax, dword [0x180036844]
test eax, eax
jne case.0x1800037bc.274
test rdi, rdi
je case.0x1800037bc.274
cmp dword [rsp + 0x150], 4
jne case.0x1800037bc.274
mov edx, dword [rdi]
lea rcx, [0x180002744]
mov r8, rsi
call fcn.180002dd8
mov ebx, eax
jmp 0x180003d98
mov rcx, rdi
call fcn.1800031d8
mov ebx, eax
test eax, eax
jne 0x180003d98
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180001874
jmp 0x180003d98
mov r12d, 1
test rdi, rdi
je case.0x1800037bc.274
cmp dword [rsp + 0x150], 1
jbe case.0x1800037bc.274
mov eax, dword [rsp + 0x150]
and qword [rsp + 0x50], r8
xor edx, edx
mov byte [rax + rdi - 1], r8b
lea ecx, [rdx + 0x40]
mov r8d, r9d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r13, rax
je 0x180003d64
test r12d, r12d
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000001
je 0x180003d00
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x180003d06
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x180003d59
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x180036a20]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], eax
and dword [rsp + 0x20], eax
lea r9, [rsp + 0x58]
mov r8, r13
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x180003d46
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x180003d4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003d6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180003d98
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x10]
mov rcx, rbp
call fcn.18000f680
test eax, eax
je 0x180003d98
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f710
cmp ebx, 0xffffffff
jne 0x180003da5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x180003db7
mov r8d, ebx
mov rdx, rsi
mov rcx, r15
call fcn.180001874
lea r11, [rsp + 0x100]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret