Function at 0x180067d40
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x70]
lea r13d, [rcx + 0xa56]
mov rsi, r9
mov r14, r8
mov r15, rdx
mov ebp, ecx
cmp ecx, r13d
jae 0x18006803d
mov r12d, dword [rsp + 0x70]
xor edx, edx
lea rcx, str.mehrdeutige_Teil_Spezialisierungen_von__0
cmp ebp, 0x211
ja 0x180067ee2
je 0x180067ed1
cmp ebp, 0x12c
ja 0x180067e28
je 0x180067e19
mov eax, ebp
sub eax, 0x6f
je 0x180067e11
sub eax, 1
je 0x180067dcd
cmp eax, 0x27
jne 0x18006802e
mov qword [0x180195048], rcx
mov r12d, edx
jmp 0x18006802e
mov rax, qword [r15]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor ecx, ecx
lea edx, [r8 + 0x21]
call fcn.180038720
xor r9d, r9d
mov qword [r15], rax
mov r8d, 0x90
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.18005d4a0
mov rcx, qword [rsi]
mov qword [rcx + 8], rax
jmp 0x18006802e
mov dword [rsi + 0x10], edx
jmp 0x18006802e
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x18006802e
mov eax, ebp
sub eax, 0x12d
je 0x180067ec2
sub eax, 0x27
je 0x180067e5d
cmp eax, 0x95
jne 0x18006802e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], rax
jmp 0x18006802e
test r15, r15
jne 0x18006802e
mov edi, 0x8c
nop dword [rax + rax]
cmp edi, 0x8c
je 0x180067e86
cmp edi, 0x2c4c
je 0x18006803d
jmp 0x180067eaf
mov rax, qword [0x180195048]
lea r9, str.Exempted_regions__alloc
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r14
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov ebx, 0xffffffff
add edi, 0x2bc0
cmp edi, 0x5780
jbe 0x180067e70
jmp 0x18006802e
mov rcx, qword [rsi]
mov rax, qword [r15]
mov qword [rcx + 0x18], rax
jmp 0x18006802e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12d, eax
jmp 0x18006802e
cmp ebp, 0x38b
ja 0x180068020
je 0x180067f4e
mov eax, ebp
sub eax, 0x2a6
je 0x180067fd0
sub eax, 0x28
je 0x180067f58
cmp eax, 0x95
jne 0x18006802e
cmp qword [rsi + 8], 0
jne 0x180067f4e
mov edi, 0x66
nop dword [rax]
mov eax, edi
sub eax, 0x64
je 0x18006803d
sub eax, 1
je 0x180067f42
cmp eax, 1
jne 0x180067f47
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
jmp 0x180067f47
mov qword [rsi], rdx
mov ebx, edx
dec edi
cmp edi, 0x63
ja 0x180067f20
mov ebx, 1
jmp 0x18006802e
test r12d, r12d
jne 0x18006802e
mov edi, 0xe6
cmp edi, 0xe6
je 0x180067f8b
cmp edi, 0x4ff6
je 0x180067f84
cmp edi, 0x9f06
je 0x18006803d
jmp 0x180067fc0
mov ebx, 0xffffffff
jmp 0x180067fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180195048]
mov edx, 0x49
mov qword [rsp + 0x28], rcx
mov r9d, eax
lea rcx, str.u_u_uHuNuPuRuluruquzuuu
mov dword [r15], eax
mov qword [rsp + 0x20], rcx
mov rcx, r14
lea r8d, [rdx - 0x40]
call fcn.1800c8de0
add edi, 0x4f10
cmp edi, 0xed30
jbe 0x180067f66
jmp 0x18006802e
cmp qword [rsi], 0
jne 0x180068008
mov ecx, 0xfe
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xfe
je 0x180067ff9
sub eax, 0x55
je 0x180067ff5
cmp eax, 0x55
je 0x18006803d
jmp 0x180067ffd
mov ebx, edx
jmp 0x180067ffd
mov qword [rsi + 8], rdx
add ecx, 0x55
cmp ecx, 0x1fd
jb 0x180067fe0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
jmp 0x18006802e
mov eax, ebp
sub eax, 0x420
je 0x18006803d
cmp eax, 0x28
je 0x18006803d
add ebp, 0xbd
cmp ebp, r13d
jb 0x180067d80
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret