Function at 0x180002d10
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x180140080]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
lea r8d, [r12 + 0x12]
lea rdx, str.Windowsprefetch_
lea rcx, [rbp - 0x20]
call fcn.180006a60
nop
lea rdx, [rbp - 0x40]
call fcn.180002bc0
nop
lea rdi, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdi, r8
lea rcx, [rbp - 0x40]
cmova rcx, r8
mov rsi, qword [rbp - 0x30]
add rsi, rcx
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rbx, r8
cmp rbx, rsi
je 0x180002dc4
sub rdi, rbx
nop
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jne 0x180002db0
mov rdi, qword [rbp - 0x10]
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rbx, qword [rbp - 0x20]
call fcn.180100590
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.180001c80
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.1800029f0
nop
lea rcx, [rsp + 0x40]
call fcn.1800058a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x180002e28
lock inc dword [rbx + 8]
mov rbx, qword [rbp - 0x48]
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x60], xmm0
test rbx, rbx
je 0x180002e3e
lock inc dword [rbx + 8]
mov rbx, qword [rbp - 0x48]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r15d, 0xffffffff
test rbx, rbx
je 0x180002e7d
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180002e7d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180002e7d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
movabs r13, 0x7fffffffffffffff
nop word [rax + rax]
mov r14, qword [rbp - 0x60]
test r14, r14
je 0x180003138
movups xmm0, xmmword [r14]
movaps xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rbp + 0x40], xmm1
lea rdx, [r14 + 0x20]
lea rcx, [rbp + 0x50]
call fcn.180005480
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp]
call fcn.180005480
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
seta r8b
cmova rdx, qword [rbp]
mov rax, qword [rbp + 0x10]
lea rsi, [rdx + rax*2]
lea rdi, [rbp]
test r8b, r8b
cmovne rdi, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
cmp rdi, rsi
jne 0x180002f12
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], rax
mov byte [rbp - 0x80], 0
jmp 0x180003003
sub rsi, rdi
sar rsi, 1
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
cmp rsi, r13
ja 0x1800031e9
mov ebx, reloc.WS2_32.dll_ntohs
cmp rsi, rbx
jbe 0x180002fc8
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x180002f56
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180002f7d
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180002fa7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800031ef
mov rcx, rax
call fcn.180100f70
mov rcx, rax
test rax, rax
je 0x180003131
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x180002fcc
test rcx, rcx
je 0x180002fbb
call fcn.180100f70
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x180002fcc
mov rax, r12
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
jmp 0x180002fcc
mov rax, qword [rbp - 0x80]
lea r8, [rbp - 0x80]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x180002ff6
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x180002fe3
mov qword [rbp - 0x70], rsi
mov byte [r8 + rsi], 0
mov rax, qword [rbp - 0x68]
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x80]
cmp rax, 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x18000303d
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
lea rdx, str.WMIC
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180003071
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp - 0x80]
call fcn.180005910
nop
lea rcx, [rbp]
call fcn.1800058a0
nop
lea rcx, [rbp + 0x50]
call fcn.1800058a0
nop
lea rdx, [rbp + 0x70]
mov rcx, qword [r14 + 0x40]
call fcn.180100868
cmp eax, 0x12
je 0x1800030e1
test eax, eax
jne 0x1800031f5
cmp word [rbp + 0x9c], 0x2e
jne 0x1800030d0
movzx eax, word [rbp + 0x9e]
test ax, ax
je 0x180003090
cmp ax, 0x2e
jne 0x1800030d0
cmp word [rbp + 0xa0], 0
je 0x180003090
lea rdx, [rbp + 0x70]
mov rcx, r14
call fcn.1800028a0
jmp 0x180002e94
mov r14, r12
mov qword [rbp - 0x60], r12
mov rbx, qword [rbp - 0x58]
mov qword [rbp - 0x58], r12
test rbx, rbx
je 0x180002e94
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180002e90
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180002e90
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x180002e90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180003172
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180003172
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180003172
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x1800031a6
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800031a6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r15d
cmp r15d, 1
jne 0x1800031a6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rbp - 0x40]
call fcn.180005910
nop
lea rcx, [rbp - 0x20]
call fcn.180005910
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.180100f50
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180001630
nop
call fcn.180001590
nop
mov edx, eax
call fcn.1800025e0
int3