Function at 0x7fff25d8ddb0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file attributes
Get kernel32 base address
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xc8], r8
mov r14, rdx
mov r15, rcx
mov r13, qword [rsp + 0x1d8]
or qword [rsp + 0x68], 0xffffffffffffffff
xor ebx, ebx
mov byte [rsp + 0x60], bl
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0xa0], rbx
test rdx, rdx
je 0x7fff25d8de28
mov rcx, rdx
call qword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
nop dword [rax + rax]
test eax, eax
jne 0x7fff25d8e332
mov esi, dword [rsp + 0x1d0]
mov r12d, esi
and r12d, 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x98]
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25d8e33c
mov eax, esi
and eax, 0x14
cmp al, 0x14
je 0x7fff25d8e071
mov dword [rsp + 0xf0], 0x30
mov qword [rsp + 0xf8], rbx
mov dword [rsp + 0x108], 0x40
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x110], xmm0
mov edi, esi
and edi, 8
or edi, 0x10080
shr edi, 2
mov eax, edi
bts eax, 0x15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xf0]
mov edx, 0x110080
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d8e346
mov dword [rsp + 0x20], 0x23
mov r9d, 8
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d8e3d4
mov ebx, 0xc000000d
test eax, eax
js 0x7fff25d8df41
test dword [rsp + 0xa8], 0x400
jne 0x7fff25d8e3ee
mov edi, esi
and edi, 4
jne 0x7fff25d8e078
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25d8e33c
test edi, edi
jne 0x7fff25d8e099
movzx r8d, word [rsp + 0x70]
add r8, 0x18
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0xc0], rax
xor r13d, r13d
test rax, rax
je 0x7fff25d8e4b3
movzx r8d, word [rsp + 0x70]
lea rcx, [rax + 0x14]
mov rdx, qword [rsp + 0x78]
call sub.ntdll.dll_memcpy
mov byte [rbx], r12b
mov qword [rbx + 8], r13
movzx eax, word [rsp + 0x70]
mov dword [rbx + 0x10], eax
mov eax, esi
and eax, 0x10
or eax, 0xa0
shr eax, 4
movzx r9d, word [rsp + 0x70]
add r9d, 0x18
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x90], eax
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xc0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x90]
test ecx, ecx
js 0x7fff25d8e04f
mov byte [rsp + 0x60], 1
jmp 0x7fff25d8e529
cmp ecx, 0xc00000d4
je 0x7fff25d8e130
cmp ecx, 0xc0190038
je 0x7fff25d8e130
call fcn.7fff25d6b370
jmp 0x7fff25d8e529
mov ecx, 0xc000000d
jmp 0x7fff25d8e067
test r14, r14
jne 0x7fff25d8df4c
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
jmp 0x7fff25d8df6e
test r12b, r12b
jne 0x7fff25d8e426
mov edi, 2
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
nop dword [rax + rax]
mov r14d, 1
cmp eax, r14d
je 0x7fff25d8e4e1
test dil, sil
jne 0x7fff25d8e4e1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, edi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call fcn.7fff25dc7468
mov ebx, eax
cmp eax, 0xc0000034
jne 0x7fff25d8e11e
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call fcn.7fff25dc7468
mov ebx, eax
cmp eax, 0xc000009a
je 0x7fff25d8e4bd
test ebx, ebx
js 0x7fff25d8e4e1
mov byte [rsp + 0x60], r14b
jmp 0x7fff25d8e529
mov edi, 2
test dil, sil
je 0x7fff25d8e067
mov dword [rsp + 0x20], 4
lea r9d, [rdi + 0x26]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d8e17d
test byte [rsp + 0x158], 0x10
jne 0x7fff25d8e4e8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0xd8], rax
lea rax, [0x7fff25dce4e0]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], r13
mov dword [rsp + 0x120], esi
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x130], rax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
mov ecx, r12d
xor ecx, 1
or ecx, 0x804
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x120]
lea r8, [rsp + 0xe0]
mov rdx, r14
mov rcx, r15
call sym.KERNELBASE.dll_BasepCopyFileExW
mov ebx, eax
mov byte [rsp + 0x60], bl
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
test bl, bl
je 0x7fff25d8e2c8
cmp qword [rsp + 0x88], 0xffffffffffffffff
je 0x7fff25d8e2c8
mov rcx, qword [rsp + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d8e2c8
lea r9, [rsp + 0x70]
mov r8, rcx
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x88]
call sym.KERNELBASE.dll_BasepNotifyTrackingService
mov edi, eax
test eax, eax
jns 0x7fff25d8e2c8
test sil, 0x20
jne 0x7fff25d8e4f2
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d8e2e4
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x88], 0xffffffffffffffff
mov rcx, qword [rsp + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d8e300
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x80], 0xffffffffffffffff
test bl, bl
je 0x7fff25d8e529
mov rcx, r15
call sym.KERNELBASE.dll_DeleteFileW
test eax, eax
jne 0x7fff25d8e529
mov edx, 0x80
mov rcx, r15
call sym.KERNELBASE.dll_SetFileAttributesW
mov rcx, r15
call sym.KERNELBASE.dll_DeleteFileW
jmp 0x7fff25d8e529
mov ecx, 0xc0000035
jmp 0x7fff25d8e067
mov ecx, 0xc000003a
jmp 0x7fff25d8e067
test sil, 4
je 0x7fff25d8e371
lea ecx, [rax + 0x3fffffcc]
cmp ecx, 0xf
ja 0x7fff25d8e371
mov edx, 0x8041
bt edx, ecx
jae 0x7fff25d8e371
or qword [rsp + 0x68], 0xffffffffffffffff
mov ebx, 0xc000000d
jmp 0x7fff25d8df41
mov ebx, 0xc000000d
cmp eax, ebx
je 0x7fff25d8e393
jmp 0x7fff25d8e3c5
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x68], 0xffffffffffffffff
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xf0]
mov edx, 0x110000
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25d8df41
mov ecx, eax
jmp 0x7fff25d8e067
cmp eax, 0xc0000002
je 0x7fff25d8df27
mov ebx, 0xc000000d
cmp eax, ebx
je 0x7fff25d8df2c
jmp 0x7fff25d8e3cd
mov ecx, dword [rsp + 0xac]
lea eax, [rcx + 0x7fffffdd]
cmp eax, 3
jbe 0x7fff25d8df41
add ecx, 0x5ffffffd
cmp ecx, 0x1a
ja 0x7fff25d8e37c
mov eax, 0x4000201
bt eax, ecx
jb 0x7fff25d8df41
jmp 0x7fff25d8e37c
movzx eax, word [rsp + 0x70]
test ax, ax
je 0x7fff25d8e0a2
mov edi, 2
lea r8, [rdi + rax]
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x7fff25d8e4b3
lea eax, [rdi + 0x1f]
mov word [r14], ax
movzx r8d, word [rsp + 0x70]
lea rcx, [r14 + 2]
mov rdx, qword [rsp + 0x78]
call sub.ntdll.dll_memcpy
add word [rsp + 0x70], di
add word [rsp + 0x72], di
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x78], r14
jmp 0x7fff25d8e0a7
mov ecx, 0xc0000017
jmp 0x7fff25d8e067
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov r8d, edi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call fcn.7fff25dc7468
mov ebx, eax
jmp 0x7fff25d8e11e
mov ecx, ebx
jmp 0x7fff25d8e067
mov ecx, 0xc00000ba
jmp 0x7fff25d8e067
mov rcx, qword [rsp + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d8e505
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x80], 0xffffffffffffffff
mov rcx, r14
call sym.KERNELBASE.dll_DeleteFileW
mov bl, r13b
mov byte [rsp + 0x60], bl
mov ecx, edi
call fcn.7fff25d6b370
jmp 0x7fff25d8e2c8
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x7fff25d8e540
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret