Function at 0x180002fb4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x110
mov rsi, qword [rsp + 0x168]
mov rdi, r9
mov r9d, r8d
xor r8d, r8d
add edx, 0xfffffefe
xor ebx, ebx
cmp edx, 0x29
mov rbp, rcx
lea r14, [0x180032d14]
lea r15d, [r8 + 1]
ja case.0x18000300e.274
lea rcx, [0x180000000]
mov edx, dword [rcx + rdx*4 + 0x3674]
add rdx, rcx
jmp rdx
mov rdx, rsi
mov rcx, rdi
call fcn.180002c94
jmp 0x180003538
test rdi, rdi
je case.0x18000300e.274
cmp dword [rsp + 0x160], ebx
je case.0x18000300e.274
and qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x8c
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1800086bc
test eax, eax
mov ebx, eax
jne 0x180003633
lea r8, [rsp + 0x70]
lea edx, [rax + 0x10]
mov r9d, 0x94
mov rcx, rbp
call fcn.18000f098
test eax, eax
je 0x18000308e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f128
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003633
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x60]
lea rcx, [0x1800321e5]
call fcn.1800045b8
test eax, eax
mov ebx, eax
jne 0x180003633
mov rbp, qword [rsp + 0x60]
mov r8d, dword [0x18002fa24]
mov edx, dword [rsp + 0x148]
mov rcx, rbp
xor r9d, r9d
call fcn.180022c40
mov rcx, qword [0x18002f818]
test rcx, rcx
je 0x1800030f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x18002f818], 0
mov r8d, dword [rsp + 0x160]
mov r9d, 5
mov rdx, rdi
mov rcx, rbp
call fcn.18001427c
test eax, eax
mov ebx, eax
jne 0x18000312b
call fcn.180004264
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.180001674
mov r8, rbp
jmp 0x1800033fa
xor r9d, r9d
jmp 0x18000313b
mov r9d, r15d
mov edx, dword [rsp + 0x160]
mov rcx, rdi
call fcn.1800018f8
jmp 0x1800031a1
mov eax, r15d
lock xadd dword [0x18002f828], eax
add eax, r15d
cmp eax, r15d
jle 0x18000316c
lock add dword [0x18002f828], 0xffffffff
jmp case.0x18000300e.274
xor r9d, r9d
mov edx, 0x117
mov rcx, rdi
call fcn.1800026ac
jmp 0x180003538
mov r8d, r15d
mov edx, dword [rsp + 0x160]
mov rcx, rdi
call fcn.180001ea8
jmp 0x1800031a1
call fcn.180001798
jmp 0x1800031a1
call fcn.1800017e0
mov ebx, eax
test eax, eax
jmp 0x1800034e9
xor edx, edx
lea rcx, [0x18000124c]
jmp 0x180003530
xor edx, edx
lea rcx, [0x180002400]
jmp 0x180003530
xor edx, edx
lea rcx, [fcn.180002424]
jmp 0x180003530
xor edx, edx
lea rcx, [0x180002598]
jmp 0x180003530
mov rax, qword [0x18002fad8]
test rax, rax
jne 0x180003203
call fcn.180004b64
test rax, rax
mov qword [0x18002fad8], rax
je case.0x18000300e.274
test rbp, rbp
je 0x180003652
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, qword [0x18002fad8]
mov edx, 0x10
lea r9d, [r15 + rax]
mov rcx, rbp
call fcn.18000f098
test eax, eax
je 0x180003652
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f128
jmp 0x180003652
mov edx, dword [rsp + 0x160]
mov rcx, rdi
call fcn.18000ecf0
jmp case.0x18000300e.274
cmp qword [0x18002f920], rbx
je 0x180003273
lea rcx, [rsp + 0x40]
call fcn.18000ee50
jmp 0x180003275
xor eax, eax
test eax, eax
mov dword [rsp + 0x148], eax
je 0x1800032c7
test rbp, rbp
je 0x1800032ae
mov r8, qword [rsp + 0x40]
mov r9d, eax
mov edx, 0x10
mov rcx, rbp
call fcn.18000f098
test eax, eax
je 0x1800032ae
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f128
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x18002f7f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x18000300e.274
mov ebx, 0x12
jmp 0x180003644
cmp qword [0x18002f808], rbx
jne case.0x18000300e.274
cmp dword [rsp + 0x160], 0x10
jne 0x1800032f5
mov rcx, rdi
call fcn.1800024d8
jmp 0x1800031a1
mov ebx, 0x57
jmp 0x180003633
xor ecx, ecx
mov ebx, 0x426
xchg qword [0x18002f808], rcx
test rcx, rcx
je 0x1800034e7
call fcn.1800191d0
xor ebx, ebx
jmp 0x1800034e7
mov rdx, r15
lea rcx, [0x1800028f0]
jmp 0x180003530
xor edx, edx
lea rcx, [0x180001c2c]
jmp 0x180003530
test rdi, rdi
je case.0x18000300e.274
test rsi, rsi
je case.0x18000300e.274
cmp dword [rsp + 0x160], 4
jne case.0x18000300e.274
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, r14
call fcn.180001674
jmp case.0x18000300e.274
mov rcx, qword [0x18002f880]
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x40]
call fcn.180014214
test eax, eax
mov ebx, eax
jne 0x180003633
mov r9d, dword [rsp + 0x148]
mov r8, qword [rsp + 0x40]
lea edx, [rax + 0x10]
mov rcx, rbp
call fcn.18000f098
test eax, eax
je 0x1800033c1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f128
mov r8, qword [rsp + 0x40]
jmp 0x1800033fa
mov rcx, qword [0x18002f880]
call fcn.180014084
test rax, rax
mov rdi, rax
je 0x180003633
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800033f7
mov rcx, rdi
call fcn.180016834
mov ebx, eax
mov r8, rdi
mov rcx, qword [0x18002f7f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003633
test rdi, rdi
je case.0x18000300e.274
mov edx, dword [rsp + 0x160]
test edx, edx
je case.0x18000300e.274
mov r8d, r15d
jmp 0x180003489
test rdi, rdi
je case.0x18000300e.274
mov edx, dword [rsp + 0x160]
test edx, edx
je case.0x18000300e.274
mov r8d, 7
jmp 0x180003489
test rdi, rdi
je case.0x18000300e.274
mov edx, dword [rsp + 0x160]
test edx, edx
je case.0x18000300e.274
mov r8d, 3
jmp 0x180003489
test rdi, rdi
je case.0x18000300e.274
mov edx, dword [rsp + 0x160]
test edx, edx
je case.0x18000300e.274
mov r8d, 0xd
mov rcx, rdi
call fcn.180002d8c
jmp 0x180003538
xor edx, edx
lea rcx, [0x180002d50]
jmp 0x180003530
test rdi, rdi
je case.0x18000300e.274
mov ebp, dword [rsp + 0x160]
test ebp, ebp
je case.0x18000300e.274
mov edx, ebp
mov rcx, rdi
mov ebx, 0x57
call fcn.18001e3d4
test eax, eax
je 0x1800034e7
lea r9d, [rbx - 0x54]
lea rcx, [0x1800321d8]
mov r8d, ebp
mov rdx, rdi
call fcn.18000469c
mov ebx, eax
test ebx, ebx
jne 0x180003633
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.180001674
jmp 0x180003633
mov eax, dword [0x18002f804]
test eax, eax
jne case.0x18000300e.274
test rdi, rdi
je case.0x18000300e.274
cmp dword [rsp + 0x160], 4
jne case.0x18000300e.274
mov edx, dword [rdi]
lea rcx, [0x1800025e8]
mov r8, rsi
call fcn.180002bb4
mov ebx, eax
jmp 0x180003633
mov ebx, r15d
test rdi, rdi
je case.0x18000300e.274
cmp dword [rsp + 0x160], r15d
jbe case.0x18000300e.274
mov eax, dword [rsp + 0x160]
and qword [rsp + 0x50], r8
xor edx, edx
mov byte [rax + rdi - 1], r8b
lea ecx, [rdx + 0x40]
mov r8d, r9d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r12, rax
je 0x1800035ff
test ebx, ebx
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000001
je 0x18000359b
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x1800035a1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x1800035f4
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x18002fa10]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], eax
and dword [rsp + 0x20], eax
lea r9, [rsp + 0x58]
mov r8, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1800035e1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x1800035e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003607
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180003633
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x10]
mov rcx, rbp
call fcn.18000f098
test eax, eax
je 0x180003633
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f128
cmp ebx, 0xffffffff
jne 0x180003640
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x180003652
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call fcn.180001674
lea r11, [rsp + 0x110]
mov eax, r15d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret