Function at 0x18008df40
Capabilities:
Create thread
Delete file
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x920
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x968], rbx
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x910], rax
mov r13, r8
mov r12, rdx
mov rbp, rcx
xor esi, esi
mov qword [0x1801e0078], rsi
mov r9d, 0x104
lea r8, [0x18025cab0]
mov edx, r9d
lea rcx, [0x18025c9a0]
call fcn.18006ade0
test rbp, rbp
je 0x18008e47c
lea rdx, [0x1802598b0]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov word [rsp + 0x4f0], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x4f2]
call fcn.1800f4fb0
lea rdx, [rsp + 0x4f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, 0x208
lea rdx, [0x18025a0b0]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov r8d, 0x208
lea rdx, [0x18025a4d0]
lea rcx, [0x18025a0b0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edx, 0x104
lea rcx, [0x180259c90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r8d, 0x104
lea rdx, [0x180259ea0]
lea rcx, [0x180259c90]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [r13], esi
mov rcx, rbp
lea rdx, [rsp + 0x70]
sub rdx, rbp
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x18008e060
lea rcx, [rsp + 0x70]
call fcn.1800fd3f0
mov rcx, rbp
call fcn.1800fd3f0
lea rdx, str.MMC.EXE
lea rcx, [rsp + 0x70]
call fcn.1800f9ff0
test eax, eax
jne 0x18008e0da
lea r8, str.42ee850d_1a3e_4b7d_ad36_32ed4fa5d7ee
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rdi, rax
test rax, rax
je 0x18008e0da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x18008e0d1
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x70]
call fcn.18010b680
test eax, eax
jne 0x18008e132
mov ebx, 1
mov dword [0x180259e9c], ebx
cmp qword [0x1801e0078], rsi
jne 0x18008e159
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18006abf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1801e0078], rax
jmp 0x18008e159
lea rdx, str.ACAD.EXE
lea rcx, [rsp + 0x70]
call fcn.18010b680
mov ecx, dword [0x18025a0a8]
mov ebx, 1
test eax, eax
cmove ecx, ebx
mov dword [0x18025a0a8], ecx
lea r8, [rsp + 0x70]
lea rdx, [0x180153844]
lea rcx, [rsp + 0x3c0]
call fcn.1800f509c
lea rdx, [rsp + 0x3c0]
lea rcx, str._QQ.EXE_MSNMSGR.EXE_
call fcn.1800f4d08
mov ecx, dword [0x18025a0ac]
test rax, rax
cmovne ecx, ebx
mov dword [0x18025a0ac], ecx
lea rdx, [rsp + 0x70]
lea rcx, str._UNIFRM2.EXE_EDPTRAYICON.EXE_SMSS.EXE_LLSSRV.EXE_SERVICES.EXE_LSASS.EXE_CSRSS.EXE_VRVEDP_M.EXE_BACKUPCLIENT.EXE_USBEXPLORE.EXE_EDP802XKEY.EXE_JAVAW.EXE_MSVSMON.EXE_STIKYNOT.EXE_BACKUPCLIENT.EXE_WATCHCLIENT.EXE_WATCHCLIENT__01.EXE_EDPREMOTE.EXE_SCRFILES_C.EXE_SCRFILES_S.EXE_VRVSAFEC.EXE_VRVSAFEC__01.EXE_STDSAFEC.EXE_EDPSAFEC.EXE_VRVEDP_M.EXE_VRVEDP_M__01.EXE_REGIONMANAGE.EXE_EDPUSBTOOLS.EXE_DEVICEREGIST.EXE_VRVPERMANAGEMENT.EXE_KEYINITIALIZE.EXE_TASKHOSTEX.EXE_TASKHOST.EXE_CLIENTREGIST.EXE_
call fcn.1800f4d08
test rax, rax
je 0x18008e1b7
mov dword [r12], ebx
jmp 0x18008e47c
lea rdx, [0x180259780]
lea rcx, str.WINWORD.EXE_
call fcn.1800f4d08
mov ecx, dword [0x180259558]
test rax, rax
cmovne ecx, ebx
mov dword [0x180259558], ecx
mov byte [rsp + 0x1a0], sil
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x1a1]
call fcn.1800f4fb0
mov r8, rbp
lea rdx, [0x180153844]
lea rcx, [rsp + 0x1a0]
call fcn.1800f509c
lea rdx, [rsp + 0x1a0]
mov rcx, qword [str._IEXPLORE.EXE_CHROME.EXE_FIREFOX.EXE_360SE.EXE_QQBROWSER.EXE_SOGOUEXPLORER.EXE_BAIDUBROWSER.EXE_HAO123JUZI.EXE_LIEBAO.EXE_TANGO3.EXE_TWCHROME.EXE_THEWORLD.EXE_UCBROWSER.EXE_JUZI.EXE_360CHROME.EXE_115BR.EXE_MAXTHON.EXE_2345EXPLORER.EXE_115CHROME.EXE_HAO123BROWSER.EXE_MYIE.EXE_]
call fcn.1800f4d08
test rax, rax
je 0x18008e3f2
mov dword [0x180259be8], ebx
lea rcx, [0x18025b320]
call fcn.18005f310
mov r8d, 0x208
lea rdx, [0x18025b740]
lea rcx, [0x18025b320]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
call fcn.18005f3e0
mov ecx, 0x50
test eax, eax
cmovle eax, ecx
mov dword [0x1801b0fb4], eax
cmp dword [0x180220be4], esi
je 0x18008e3f2
cmp dword [0x1802210f0], esi
je 0x18008e3f2
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdi, [rsp + 0x2b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
mov r8d, ebx
lea rdx, str.edparc.dat
lea rcx, [rsp + 0x38]
call fcn.180085540
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008e2d6
mov rdx, qword [rax + 8]
jmp 0x18008e2da
lea rdx, [rax + 8]
lea rdi, [rsp + 0x2b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x18008e2f0
cmp qword [rsp + 0x58], 0x10
jb 0x18008e311
mov rcx, qword [rsp + 0x40]
call fcn.1800f4b9c
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x2b0]
lea rcx, [0x18028e220]
call fcn.18000f960
lea rcx, [0x18028e220]
call fcn.1800109c0
mov edx, 0x104
lea rcx, [0x18025bce0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdi, [0x18025bce0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
mov r8d, ebx
lea rdx, str.edpdpflg.log
lea rcx, [rsp + 0x38]
call fcn.180085540
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008e392
mov r8, qword [rax + 8]
jmp 0x18008e396
lea r8, [rax + 8]
lea rdi, [0x18025bce0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rdi + rdx - 1], al
inc rdx
test al, al
jne 0x18008e3b0
cmp qword [rsp + 0x58], 0x10
jb 0x18008e3d2
mov rcx, qword [rsp + 0x40]
call fcn.1800f4b9c
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x40], 0
lea rcx, [0x18025bce0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x18021adf0], 0
jle 0x18008e47c
lea r12, [0x18021eb5c]
nop word [rax + rax]
movsxd rdi, esi
imul rdi, rdi, 0x208
add rdi, r12
mov rdx, rbp
mov rcx, rdi
call fcn.1800f4d08
test rax, rax
je 0x18008e451
mov dword [r13], ebx
lea rdx, str.iexplore.exe
mov rcx, rbp
call fcn.18010b680
mov edx, dword [0x1802599dc]
test eax, eax
cmove edx, ebx
mov dword [0x1802599dc], edx
lea rdx, str.IEXPLORE.EXE
mov rcx, rdi
call fcn.1800f4d08
mov ecx, dword [0x180259bec]
test rax, rax
cmovne ecx, ebx
mov dword [0x180259bec], ecx
inc esi
cmp esi, dword [0x18021adf0]
jl 0x18008e410
mov rcx, qword [rsp + 0x910]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x968]
add rsp, 0x920
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret