Function at 0x18eee
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
xor edi, edi
push edi
mov esi, 0x249a8
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [0x1ee38]
add esp, 0xc
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [0x249a8], eax
mov eax, dword [0x1ee3c]
push 0x27090
mov dword [0x249ac], eax
call esi
push 0x1f51a
lea eax, [ebp - 0x20]
push eax
call esi
push 0x20f48
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, 0x464b5147
cmp dword [0x24dfc], eax
je 0x18f5f
mov dword [0x24dfc], eax
jmp 0x1908c
xor eax, eax
cmp ax, word [0x24e00]
je 0x1908c
push 0x24e00
lea eax, [ebp - 0x10]
push eax
call esi
xor eax, eax
mov word [ebp - 8], ax
mov eax, ebx
push ebx
mov word [ebp - 6], ax
call fcn.00015c50
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1908c
push ebx
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18ffe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18ffe
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18ffe
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
xor eax, eax
cmp ax, word [0x25040]
je 0x19084
push 0x25040
lea eax, [ebp]
sal byte [esi], 0x83
xor eax, eax
push ebx
mov word [ebp - 8], ax
push edi
push dword [ebp - 4]
mov eax, ebx
mov word [ebp - 6], ax
call sub.ntoskrnl.exe_memset
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x19084
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x19084
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jl 0x19084
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
push dword [ebp - 4]
call fcn.00015c6a
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x195f8
mov eax, dword [ebx + 0x18]
cmp eax, edi
je 0x195f8
cmp dword [eax + 0x10], edi
je 0x195f8
push 0x40
push edi
mov esi, 0x24e00
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebx + 0x18]
movzx ecx, word [eax + 0xc]
push ecx
push dword [eax + 0x10]
push esi
call sub.ntoskrnl.exe_memcpy
push 0x40
push edi
push 0x25040
call sub.ntoskrnl.exe_memset
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
movzx eax, word [eax]
add esp, 0x24
push 0x74
pop ecx
lea esi, [ecx + 0xc]
cmp cx, ax
jne 0x1924a
push esi
push edi
push 0x215a8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x215a8], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x215aa], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x215ac], dx
call fcn.00011c78
xor edx, edx
push 7
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, 0x73
mov word [0x215ae], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x215b0], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x21628
mov word [0x215b2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21628], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x2162a], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x2162c], dx
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x21630], ax
add edx, edi
mov word [0x2162e], dx
call fcn.00011c78
push 0xb
xor edx, edx
pop ecx
div ecx
add edx, 0x68
push esi
push 0
push 0x216a8
mov word [0x21632], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x216a8], ax
call fcn.00011c78
and eax, 0xf
add eax, 0x6b
mov word [0x216aa], ax
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x216ac], dx
call fcn.00011c78
push 0xc
xor edx, edx
pop ecx
div ecx
add edx, 0x6c
mov word [0x216ae], dx
jmp 0x195d0
push 0x6e
pop ecx
cmp cx, ax
jne 0x1936a
push esi
push edi
push 0x215a8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x215a8], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x215aa], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x215ac], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x215ae], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x215b0], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x21628
mov word [0x215b2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
pop eax
mov word [0x21628], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x2162a], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x2162c], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x21630], ax
add edx, edi
mov word [0x2162e], dx
call fcn.00011c78
push 0xb
xor edx, edx
pop ecx
div ecx
add edx, 0x68
push esi
push 0
push 0x216a8
mov word [0x21632], dx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x77
jmp 0x19592
push 0x77
pop ecx
push esi
push edi
push 0x215a8
cmp cx, ax
jne 0x1948a
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
mov word [0x215a8], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x215aa], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x215ac], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x215ae], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x215b0], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x21628
mov word [0x215b2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
pop eax
mov word [0x21628], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x2162a], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x2162c], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x21630], ax
add edx, edi
mov word [0x2162e], dx
call fcn.00011c78
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
add edx, 0x68
mov word [0x21632], dx
push 0x216a8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x74
jmp 0x19592
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x215a8], ax
call fcn.00011c78
push 0x1a
pop ecx
xor edx, edx
div ecx
push 0x61
pop edi
add edx, edi
mov word [0x215aa], dx
call fcn.00011c78
push 0xd
xor edx, edx
pop ecx
div ecx
add edx, 0x68
mov word [0x215ac], dx
call fcn.00011c78
xor edx, edx
push 0x1a
pop ecx
div ecx
push 0xb
pop ecx
mov eax, ebx
add edx, edi
mov word [0x215ae], dx
xor edx, edx
div ecx
add edx, 0x67
mov word [0x215b0], dx
call fcn.00011c78
push esi
and eax, 7
add eax, 0x6b
push 0
push 0x21628
mov word [0x215b2], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x21628], ax
call fcn.00011c78
push 0xa
xor edx, edx
pop ecx
div ecx
add edx, 0x74
mov word [0x2162a], dx
call fcn.00011c78
push 0x14
xor edx, edx
pop ecx
div ecx
add edx, 0x66
mov word [0x2162c], dx
call fcn.00011c78
push 0x17
xor edx, edx
pop ecx
div ecx
mov eax, ebx
and eax, 7
add eax, 0x6f
mov word [0x21630], ax
add edx, edi
mov word [0x2162e], dx
call fcn.00011c78
push 0xb
pop ecx
xor edx, edx
div ecx
push esi
push 0
add edx, 0x68
mov word [0x21632], dx
push 0x216a8
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x6e
pop eax
mov word [0x216a8], ax
call fcn.00011c78
and eax, 0xf
add eax, 0x6b
mov word [0x216aa], ax
call fcn.00011c78
push 0x1a
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x216ac], dx
call fcn.00011c78
and eax, 0xf
add eax, 0x66
mov word [0x216ae], ax
push 0xd
xor edx, edx
pop ecx
mov eax, ebx
div ecx
add edx, 0x65
mov word [0x216b0], dx
call fcn.00011c78
push 9
xor edx, edx
pop ecx
div ecx
add edx, edi
mov word [0x216b2], dx
pop edi
pop esi
pop ebx
leave
ret 4