Function at 0x18000ddf0
Capabilities:
Delete file

Disassembly:
push r12
push r13
push r14
mov eax, 0x4cb10
call fcn.18004c5b0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x4cb30], rbx
mov qword [rsp + 0x4cb38], rbp
mov qword [rsp + 0x4cb40], rsi
mov qword [rsp + 0x4cb48], rdi
mov rax, qword [0x180067480]
xor rax, rsp
mov qword [rsp + 0x4cb00], rax
mov r12, rcx
xor r13d, r13d
mov dword [rsp + 0x3ad80], r13d
xor edx, edx
mov r8d, 0x2f78
lea rcx, [rsp + 0x3ad84]
call fcn.180031f80
mov dword [rsp + 0x3af84], r13d
call fcn.180021654
mov rcx, rax
mov edx, r13d
test rax, rax
setne dl
test edx, edx
jne 0x18000de89
mov ecx, 0x80004005
call fcn.180001750
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [0x180068f60]
or rbp, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x18000decd
movzx edi, dx
mov ecx, edi
call fcn.180022598
test rax, rax
je 0x18000dee9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180001e10
jmp 0x18000dee9
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.180001a70
nop
xor eax, eax
mov rcx, rbp
lea rdi, str._authmail.flg
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._authmail.flg
lea rcx, [rsp + 0x20]
call fcn.180006a60
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [0x180108cc0]
mov dword [rsp + 0x3ad80], edx
mov rcx, r13
lea r14, [0x180000000]
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0x108cc4]
mov byte [rsp + rcx + 0x3ad84], al
inc rcx
test al, al
jne 0x18000df40
mov rax, qword [0x1800d9b58]
test rax, rax
je 0x18000df85
lea rdi, [rsp + 0x37e00]
lea rsi, [rsp + 0x3ad80]
mov ecx, 0x2f7c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x37e00]
call rax
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x18000df9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov r8d, 0x87b4
lea rcx, [rsp + 0x3e654]
call fcn.180031f80
mov dword [rsp + 0x3e854], r13d
mov eax, dword [0x1801004b0]
mov dword [rsp + 0x3e650], eax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0x1004b4]
mov byte [rsp + rcx + 0x3e654], al
inc rcx
test al, al
jne 0x18000dfd0
mov rax, qword [0x1800d9b50]
test rax, rax
je 0x18000e014
lea rdi, [rsp + 0x37b0]
lea rsi, [rsp + 0x3e650]
mov ecx, 0x87b8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x37b0]
call rax
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x37004]
call fcn.180031f80
mov dword [rsp + 0x37204], r13d
mov eax, dword [0x1800fff50]
mov dword [rsp + 0x37000], eax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0xfff54]
mov byte [rsp + rcx + 0x37004], al
inc rcx
test al, al
jne 0x18000e050
mov rdi, qword [0x1800d9b48]
test rdi, rdi
je 0x18000e098
lea rcx, [rsp + 0x1f10]
lea rdx, [rsp + 0x37000]
mov r8d, 0x404
call fcn.1800336d0
lea rcx, [rsp + 0x1f10]
call rdi
xor edx, edx
mov r8d, 0x9ec
lea rcx, [rsp + 0x37414]
call fcn.180031f80
mov dword [rsp + 0x37614], r13d
mov eax, dword [0x1800ff510]
mov dword [rsp + 0x37410], eax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0xff514]
mov byte [rsp + rcx + 0x37414], al
inc rcx
test al, al
jne 0x18000e0d0
mov rdi, qword [0x1800d9b40]
test rdi, rdi
je 0x18000e118
lea rcx, [rsp + 0x2dc0]
lea rdx, [rsp + 0x37410]
mov r8d, 0x9f0
call fcn.1800336d0
lea rcx, [rsp + 0x2dc0]
call rdi
xor edx, edx
mov r8d, 0x2954
lea rcx, [rsp + 0x37e04]
call fcn.180031f80
mov dword [rsp + 0x38004], r13d
mov eax, dword [0x1800fcb20]
mov dword [rsp + 0x37e00], eax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0xfcb24]
mov byte [rsp + rcx + 0x37e04], al
inc rcx
test al, al
jne 0x18000e150
mov rax, qword [0x1800d9b38]
test rax, rax
je 0x18000e194
lea rdi, [rsp + 0x3ad80]
lea rsi, [rsp + 0x37e00]
mov ecx, 0x2958
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x3ad80]
call rax
xor edx, edx
mov r8d, 0x38c4
lea rcx, [rsp + 0x46e14]
call fcn.180031f80
mov dword [rsp + 0x47014], r13d
mov eax, dword [0x1800f9250]
mov dword [rsp + 0x46e10], eax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + r14 + 0xf9254]
mov byte [rsp + rcx + 0x46e14], al
inc rcx
test al, al
jne 0x18000e1d0
mov rax, qword [0x1800d9b30]
test rax, rax
je 0x18000e214
lea rdi, [rsp + 0x3ad80]
lea rsi, [rsp + 0x46e10]
mov ecx, 0x38c8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x3ad80]
call rax
mov dword [0x180113fb0], r13d
mov rax, qword [0x18011a348]
test rax, rax
je 0x18000e247
lea rdi, [rsp + 0x46e10]
lea rsi, [0x180113eb0]
mov ecx, 0x5cec
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x46e10]
call rax
mov dword [0x1800dd070], r13d
mov rdi, qword [0x18011a458]
test rdi, rdi
je 0x18000e27e
lea rcx, [rsp + 0x150]
lea rdx, [0x1800dcf70]
mov r8d, 0x10c
call fcn.1800336d0
lea rcx, [rsp + 0x150]
call rdi
mov dword [0x1800dc910], r13d
mov rdi, qword [0x18011a5a8]
test rdi, rdi
je 0x18000e2b5
lea rcx, [rsp + 0x260]
lea rdx, [0x1800dc810]
mov r8d, 0x610
call fcn.1800336d0
lea rcx, [rsp + 0x260]
call rdi
mov dword [0x1800dbaa0], r13d
mov rdi, qword [0x18011bc48]
test rdi, rdi
je 0x18000e2ec
lea rcx, [rsp + 0x870]
lea rdx, [0x1800dbaa0]
mov r8d, 0xc20
call fcn.1800336d0
lea rcx, [rsp + 0x870]
call rdi
mov dword [0x180119cf0], r13d
mov rdi, qword [0x18011bc98]
test rdi, rdi
je 0x18000e323
lea rcx, [rsp + 0x28b0]
lea rdx, [0x180119cf0]
mov r8d, 0x508
call fcn.1800336d0
lea rcx, [rsp + 0x28b0]
call rdi
mov dword [0x18011a350], r13d
mov rdi, qword [0x18011c228]
test rdi, rdi
je 0x18000e354
lea rcx, [rsp + 0x40]
lea rdx, [0x18011a350]
mov r8d, pe_nt_image_headers64
call fcn.1800336d0
lea rcx, [rsp + 0x40]
call rdi
mov dword [0x18011a5b0], r13d
mov rax, qword [0x18011c278]
test rax, rax
je 0x18000e387
lea rdi, [rsp + 0x870]
lea rsi, [0x18011a5b0]
mov ecx, 0x1698
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x870]
call rax
mov dword [0x18011bca0], r13d
mov rdi, qword [0x18011d7d8]
test rdi, rdi
je 0x18000e3be
lea rcx, [rsp + 0x2320]
lea rdx, [0x18011bca0]
mov r8d, 0x584
call fcn.1800336d0
lea rcx, [rsp + 0x2320]
call rdi
mov dword [0x18011c280], r13d
mov rax, qword [0x180148878]
test rax, rax
je 0x18000e3f1
lea rdi, [rsp + 0x870]
lea rsi, [0x18011c280]
mov ecx, 0x150c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x870]
call rax
mov dword [0x18011d7e0], r13d
mov rax, qword [0x1801488c8]
test rax, rax
je 0x18000e424
lea rdi, [rsp + 0xbf68]
lea rsi, [0x18011d7e0]
mov ecx, 0x2b094
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xbf68]
call rax
cmp qword [0x180148920], 0
je 0x18000e478
mov rax, qword [0x1801488e8]
test rax, rax
je 0x18000e478
mov dword [rsp + 0x28], r13d
lea rdx, [rsp + 0x28]
lea rcx, [0x180069170]
call rax
mov r8d, 0x66768
lea rdx, [0x180069170]
mov rcx, qword [0x180148920]
call fcn.1800336d0
mov rcx, qword [0x180148928]
test rcx, rcx
je 0x18000e478
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r12
call fcn.180004510
xor eax, eax
mov rcx, qword [rsp + 0x4cb00]
xor rcx, rsp
call fcn.180031f50
lea r11, [rsp + 0x4cb10]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret