Function at 0x180006490
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x18004b058]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
lea rcx, [rbp - 0x69]
call fcn.180004b10
nop
mov edi, 7
mov r8d, edi
lea rdx, str.en_EN_
mov rcx, rax
call fcn.18000d520
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x18000653f
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000653a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f6b
call fcn.1800115b0
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 0xf
mov byte [rbp - 0x69], 0
movabs r13, 0x7fffffffffffffff
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 0xa
jb 0x180006f71
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 0xa
lea rsi, str.detail.txt
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.18000f5f0
nop
lea rcx, [rsp + 0x40]
cmp qword [rbp - 0x71], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.180005540
test al, al
sete bl
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x1800065f6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f77
call fcn.1800115b0
test bl, bl
je 0x18000665b
lea rax, [rbp - 0x39]
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x39]
call fcn.1800037e0
mov rbx, rax
mov rcx, r13
mov rdx, qword [rbp - 9]
sub rcx, rdx
cmp rcx, 0xa
jb 0x180006f7d
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 0xa
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x40]
call fcn.18000f5f0
nop
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800032d0
mov ecx, 0x12f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 6
jb 0x180006f83
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 6
lea rsi, str.Up.txt
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.18000f5f0
nop
lea rcx, [rsp + 0x40]
cmp qword [rbp - 0x71], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.180005540
test al, al
sete bl
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x180006703
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f89
call fcn.1800115b0
test bl, bl
je 0x180006786
lea rax, [rsp + 0x40]
mov qword [rbp - 0x49], rax
mov qword [rsp + 0x40], r12
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], 0xf
mov r8d, 3
lea rdx, [0x180042514]
lea rcx, [rsp + 0x40]
call fcn.18000d3c0
nop
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 6
jb 0x180006f8f
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x39]
call fcn.18000f5f0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x39]
call fcn.1800032d0
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 0xa
jb 0x180006f95
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 0xa
lea rsi, str.binUp.txt
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.18000f5f0
nop
lea rcx, [rsp + 0x40]
cmp qword [rbp - 0x71], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.180005540
test al, al
sete bl
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x180006823
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000681e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f9b
call fcn.1800115b0
test bl, bl
je 0x1800068a6
lea rax, [rsp + 0x40]
mov qword [rbp - 0x49], rax
mov qword [rsp + 0x40], r12
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], 0xf
mov r8d, 3
lea rdx, [0x180042514]
lea rcx, [rsp + 0x40]
call fcn.18000d3c0
nop
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 0xa
jb 0x180006fa1
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 0xa
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x39]
call fcn.18000f5f0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x39]
call fcn.1800032d0
mov rax, r13
mov rcx, qword [rbp - 9]
sub rax, rcx
cmp rax, 0x19
jb 0x180006fa7
lea r9, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae r9, qword [rbp - 0x19]
mov qword [rsp + 0x30], 0x19
lea rax, str.MpDefenderCoreService.txt
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 7]
call fcn.18000f5f0
nop
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
lea rsi, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rsi, qword [rbp + 7]
add rsi, qword [rbp + 0x17]
lea rbx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rbx, qword [rbp + 7]
mov qword [rsp + 0x40], r12
mov rcx, r12
mov qword [rbp - 0x79], rcx
mov qword [rbp - 0x71], rdi
mov rdx, rsi
sub rdx, rbx
cmp rdx, 8
jb 0x180006951
lea rcx, [rsp + 0x40]
call fcn.18000e180
mov rcx, r12
mov qword [rbp - 0x79], rcx
mov rdi, qword [rbp - 0x71]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x49], rax
cmp rbx, rsi
je 0x1800069b0
nop
movsx r9d, byte [rbx]
cmp rcx, rdi
jae 0x18000698d
lea rax, [rcx + 1]
mov qword [rbp - 0x79], rax
lea rax, [rsp + 0x40]
cmp rdi, 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x18000699e
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x40]
call fcn.18000e2f0
inc rbx
mov rdi, qword [rbp - 0x71]
cmp rbx, rsi
je 0x1800069b0
mov rcx, qword [rbp - 0x79]
jmp 0x180006960
lea rcx, [rsp + 0x40]
cmp rdi, 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x71]
cmp rdx, 8
jb 0x180006a06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fad
call fcn.1800115b0
mov ecx, 0x12f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
lea rdx, [0x180042544]
lea rcx, [rbp - 0x39]
call fcn.18000d3c0
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], 0xf
mov r8d, 8
lea rdx, str.core.exe
lea rcx, [rbp - 0x69]
call fcn.18000d3c0
lea rdx, [rbp - 0x69]
call fcn.180006210
mov rcx, qword [rbp - 0x29]
test al, al
mov rax, r13
je 0x180006a77
sub rax, rcx
cmp rax, 2
jb 0x180006f65
lea rax, [0x180042554]
jmp 0x180006a8b
sub rax, rcx
cmp rax, 2
jb 0x180006f65
lea rax, [0x180042558]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
mov qword [rsp + 0x20], rcx
cmovae r9, qword [rbp - 0x39]
lea rcx, [rbp - 0x69]
call fcn.18000f5f0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x180006af0
inc rdx
mov rcx, qword [rbp - 0x39]
cmp rdx, 0x1000
mov rax, rcx
jb 0x180006aeb
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f5f
call fcn.1800115b0
movups xmm1, xmmword [rbp - 0x59]
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x39], xmm0
mov rax, r13
mov rcx, qword [rbp - 0x29]
sub rax, rcx
cmp byte [0x18004da53], 0
je 0x180006be4
cmp rax, 1
jb 0x180006f65
lea r9, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae r9, qword [rbp - 0x39]
mov qword [rsp + 0x30], 1
lea rax, [0x18004255c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x69]
call fcn.18000f5f0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x180006b8d
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f5f
call fcn.1800115b0
movups xmm1, xmmword [rbp - 0x59]
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x39], xmm0
lea rax, [rbp - 0x69]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], r12
lea rdi, [rbp - 0x39]
mov rsi, qword [rbp - 0x39]
mov r15, qword [rbp - 0x21]
cmp r15, 0x10
cmovae rdi, rsi
mov r14, qword [rbp - 0x29]
cmp r14, 0x10
jae 0x180006c62
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x69], xmm0
mov ebx, 0xf
jmp 0x180006cce
cmp rax, 1
jb 0x180006f65
lea r9, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae r9, qword [rbp - 0x39]
mov qword [rsp + 0x30], 1
lea rax, [0x180042560]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x69]
call fcn.18000f5f0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x180006b8d
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f5f
jmp 0x180006b88
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180006cac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180006fb3
mov rcx, rax
call fcn.1800115e4
mov rcx, rax
test rax, rax
je 0x180006fc5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180006cbb
test rcx, rcx
je 0x180006cb8
call fcn.1800115e4
jmp 0x180006cbb
mov rax, r12
mov qword [rbp - 0x69], rax
lea r8, [r14 + 1]
mov rdx, rdi
mov rcx, rax
call fcn.180013540
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], rbx
mov qword [rsp + 0x40], r12
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], r12
mov rdi, qword [rbp + 0x17]
lea r14, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r14, qword [rbp + 7]
cmp rdi, 0x10
jae 0x180006d0b
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
mov ebx, 0xf
jmp 0x180006d78
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180006d55
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180006fb9
mov rcx, rax
call fcn.1800115e4
mov rcx, rax
test rax, rax
je 0x180006fbf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180006d64
test rcx, rcx
je 0x180006d61
call fcn.1800115e4
jmp 0x180006d64
mov rax, r12
mov qword [rsp + 0x40], rax
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.180013540
mov qword [rbp - 0x79], rdi
mov qword [rbp - 0x71], rbx
lea rcx, [rsp + 0x40]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x40]
lea rdx, [0x1800423f8]
call fcn.180019960
mov rbx, rax
lea r8, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r8, qword [rbp - 0x69]
lea rdx, [0x180042400]
mov rcx, rax
call fcn.1800010a0
mov rcx, rbx
call fcn.1800199f0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x180006dff
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006dfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fc5
call fcn.1800115b0
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x180006e4b
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fc5
call fcn.1800115b0
mov ecx, 0x12f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180003a70
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp r15, 0x10
jb 0x180006eaa
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180006ea1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fcb
mov rcx, rsi
call fcn.1800115b0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x180006ee5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ee0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fd1
call fcn.1800115b0
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180006f2c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f59
call fcn.1800115b0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180011590
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.1800193ac
int3
call fcn.180001290
int3
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.180001290
int3
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.180001290
int3
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.180001290
nop
call fcn.1800193ac
int3
call fcn.1800011f0
nop
call fcn.1800011f0
int3
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3