Function at 0x1800cff70
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x528
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x548]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x4f0], rax
mov rdx, qword [rbp + 0x520]
lea rcx, [0x180377b10]
call fcn.1800ce6f0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdx, str.default.bin
mov rcx, qword [rbp + 8]
call fcn.1800cbb00
test eax, eax
jne 0x1800d00ca
mov byte [rbp + 0x3d8], 0x5b
mov byte [rbp + 0x3d9], 0x63
mov byte [rbp + 0x3da], 0x6f
mov byte [rbp + 0x3db], 0x6e
mov byte [rbp + 0x3dc], 0x66
mov byte [rbp + 0x3dd], 0x69
mov byte [rbp + 0x3de], 0x67
mov byte [rbp + 0x3df], 0x2e
mov byte [rbp + 0x3e0], 0x63
mov byte [rbp + 0x3e1], 0x70
mov byte [rbp + 0x3e2], 0x70
mov byte [rbp + 0x3e3], 0x3a
mov byte [rbp + 0x3e4], 0x33
mov byte [rbp + 0x3e5], 0x35
mov byte [rbp + 0x3e6], 0x34
mov byte [rbp + 0x3e7], 0x5d
mov byte [rbp + 0x3e8], 0x20
mov byte [rbp + 0x3e9], 0
lea rcx, [rbp + 0x3d8]
call fcn.1800cefd0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x4d8], rax
lea rdx, str.unable_to_remove_default_configuration_file:__
mov rcx, qword [rbp + 0x4d8]
call fcn.18015e890
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x4e0]
call fcn.18015e8e0
mov qword [rbp + 0x4e8], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x4e8]
call fcn.18015e890
jmp 0x1800d0267
lea rdx, [0x180378530]
lea rcx, [rbp + 0x30]
call fcn.1800c2950
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1800c28a0
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1800d0267
lea rax, [rbp + 0x408]
mov qword [rbp + 0x438], rax
lea rdx, [rbp + 0x458]
lea rcx, [0x180377b10]
call fcn.1800d2960
mov qword [rbp + 0x4d8], rax
mov rax, qword [rbp + 0x4d8]
mov qword [rbp + 0x4e0], rax
mov r8, qword [rbp + 0x520]
mov rdx, qword [rbp + 0x438]
mov rcx, qword [rbp + 0x4e0]
call fcn.1800ce7d0
mov qword [rbp + 0x4e8], rax
mov r8, qword [rbp + 0x4e8]
lea rdx, [rbp + 0x488]
lea rcx, [0x180377b10]
call fcn.1800d2bc0
lea rcx, [rbp + 0x488]
call fcn.1800ce540
lea rcx, [rbp + 0x458]
call fcn.1800ce510
mov byte [rbp + 0x4b8], 0x5b
mov byte [rbp + 0x4b9], 0x63
mov byte [rbp + 0x4ba], 0x6f
mov byte [rbp + 0x4bb], 0x6e
mov byte [rbp + 0x4bc], 0x66
mov byte [rbp + 0x4bd], 0x69
mov byte [rbp + 0x4be], 0x67
mov byte [rbp + 0x4bf], 0x2e
mov byte [rbp + 0x4c0], 0x63
mov byte [rbp + 0x4c1], 0x70
mov byte [rbp + 0x4c2], 0x70
mov byte [rbp + 0x4c3], 0x3a
mov byte [rbp + 0x4c4], 0x33
mov byte [rbp + 0x4c5], 0x36
mov byte [rbp + 0x4c6], 0x36
mov byte [rbp + 0x4c7], 0x5d
mov byte [rbp + 0x4c8], 0x20
mov byte [rbp + 0x4c9], 0
lea rcx, [rbp + 0x4b8]
call fcn.1800cefd0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x4d8], rax
lea rdx, str.removed_configuration_file:__
mov rcx, qword [rbp + 0x4d8]
call fcn.18015e890
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x4e0]
call fcn.18015e8e0
mov qword [rbp + 0x4e8], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x4e8]
call fcn.18015e890
lea rcx, [rbp - 0x20]
lea rdx, [0x180257850]
call fcn.180225a10
mov rcx, qword [rbp + 0x4f0]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x508]
pop rdi
pop rbp
ret