Function at 0x1400caba0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov edi, edx
mov dword [rsp + 0x30], edx
mov r14, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov esi, r15d
mov qword [rsp + 0x40], r15
mov r12d, 1
mov dword [rcx + 0x20], r12d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14010cb70
lea rcx, [rsp + 0x60]
call fcn.1400f7c20
lea rcx, [rsp + 0x60]
dec rcx
nop word [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400cac20
movsd xmm0, qword [str.msnwcfg.ini]
movsd qword [rcx], xmm0
mov eax, dword [0x140217050]
mov dword [rcx + 8], eax
mov r13d, r15d
mov dword [rsp + 0x38], r15d
lea rcx, [rsp + 0x60]
call fcn.1400fafb0
test eax, eax
je 0x1400cade6
mov rax, qword [r14 + 0x28]
mov rcx, qword [rax + 0xb0]
mov eax, dword [rcx + 0xb278]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, str.shellfolder
lea ecx, [r9 + 4]
call fcn.14010bbc0
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400cad83
mov rdi, r15
mov qword [rsp + 0x50], r15
lea rax, str.SpectorGroupName
movabs r8, 0x100000000
nop dword [rax]
nop dword [rax + rax]
cmp rdi, qword [0x140228db8]
jae 0x1400cad7f
imul rbx, rdi, 0x70
add rbx, rax
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400cad72
cmp byte [rdx], r13b
je 0x1400cad72
test qword [rbx + 0x38], r8
jne 0x1400cacf4
jmp 0x1400cad72
mov rax, qword [rsi]
mov r8d, r12d
mov rcx, rsi
call qword [rax + reloc.WSOCK32.dll_htonl]
test eax, eax
je 0x1400cad5f
movabs rax, 0x200000000
test qword [rbx + 0x38], rax
je 0x1400cad26
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400cbc90
test eax, eax
jne 0x1400cad5f
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400cbdc0
test eax, eax
jne 0x1400cad5f
mov rcx, qword [r14 + 0x28]
mov rax, qword [rcx]
mov r9d, r12d
mov r8, qword [rbx]
mov rdx, rsi
call qword [rax + gethostname]
test eax, eax
je 0x1400cad5f
mov rcx, qword [r14 + 0x28]
mov rax, qword [rcx]
mov r8d, r12d
mov rdx, qword [rbx]
call qword [rax + 0x20]
lea rax, str.SpectorGroupName
movabs r8, 0x100000000
jmp 0x1400cad72
inc rdi
mov qword [rsp + 0x50], rdi
jmp 0x1400cacc0
mov edi, dword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400cad9e
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400fd640
mov rax, qword [r14 + 0x28]
mov rbx, qword [rax + 0xb0]
mov eax, dword [rsp + 0x34]
cmp eax, dword [rbx + 0xb278]
cmovne r13d, r12d
mov dword [rsp + 0x38], r13d
call fcn.140029640
mov rcx, rax
mov edx, dword [rbx + 8]
call fcn.140028790
mov rcx, qword [r14 + 0x28]
call fcn.14010c920
mov ebx, eax
call fcn.140029640
mov rcx, rax
mov edx, ebx
call fcn.140028720
test edi, edi
je 0x1400cae15
test r13d, r13d
je 0x1400cae15
mov rcx, qword [r14 + 0x50]
test rcx, rcx
je 0x1400cae15
test r15d, r15d
je 0x1400cae0b
mov r8d, 6
mov edx, r15d
call fcn.1400b6b80
mov rcx, qword [r14 + 0x50]
call fcn.1400b6230
nop
jmp 0x1400cae28
test rsi, rsi
je 0x1400cae39
mov rax, qword [rsi]
mov edx, r12d
mov rcx, rsi
call qword [rax]
nop
mov dword [r14 + 0x20], r15d
jmp 0x1400cae4b
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret