Function at 0x180003580
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x100
mov rsi, qword [rsp + 0x158]
mov rdi, r9
add edx, 0xfffffefe
mov r9d, r8d
xor r12d, r12d
or ebx, 0xffffffff
xor r8d, r8d
cmp edx, 0x2c
mov rbp, rcx
lea r15, [0x180033d65]
ja case.0x1800035dc.274
mov eax, edx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x3bf8]
add rcx, rdx
jmp rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180002cd8
jmp 0x180003a90
test rdi, rdi
je case.0x1800035dc.274
cmp dword [rsp + 0x150], r8d
je case.0x1800035dc.274
and qword [rsp + 0x60], r8
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x8c
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180009294
test eax, eax
mov ebx, eax
jne 0x180003bb8
lea r8, [rsp + 0x60]
lea edx, [rax + 0x10]
mov r9d, 0x94
mov rcx, rbp
call fcn.18000f1bc
test eax, eax
je 0x18000365d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f24c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003bb8
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180003348
jmp 0x180003a9f
xor r9d, r9d
jmp 0x18000368c
mov r9d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001920
jmp 0x180003a9f
mov eax, 1
lock xadd dword [0x180030800], eax
add eax, 1
cmp eax, 1
jg 0x1800036cf
xor r9d, r9d
mov edx, 0x117
mov rcx, rdi
call fcn.1800026f0
test eax, eax
mov ebx, eax
je 0x180003bb8
lock add dword [0x180030800], 0xffffffff
jmp 0x180003bb8
mov r8d, 1
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.180001e24
jmp 0x180003a9f
call fcn.1800017c0
jmp 0x180003a9f
call fcn.180001808
jmp 0x180003a9f
xor edx, edx
lea rcx, [0x180001248]
jmp 0x180003a88
xor edx, edx
lea rcx, [0x18000237c]
jmp 0x180003a88
xor edx, edx
lea rcx, [fcn.1800023a0]
jmp 0x180003a88
xor edx, edx
lea rcx, [fcn.180006300]
jmp 0x180003a88
xor edx, edx
lea rcx, [0x180002514]
jmp 0x180003a88
mov rax, qword [0x180030a78]
test rax, rax
jne 0x180003771
call fcn.1800051a0
test rax, rax
mov qword [0x180030a78], rax
je case.0x1800035dc.274
test rbp, rbp
je 0x180003bd7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8, qword [0x180030a78]
mov edx, 0x10
lea r9d, [rax + 1]
mov rcx, rbp
call fcn.18000f1bc
test eax, eax
je 0x180003bd7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f24c
jmp 0x180003bd7
mov edx, dword [rsp + 0x150]
mov rcx, rdi
call fcn.18000ee14
jmp case.0x1800035dc.274
cmp qword [0x180030908], r8
je 0x1800037e1
lea rcx, [rsp + 0x40]
call fcn.18000ef74
jmp 0x1800037e3
xor eax, eax
test eax, eax
je 0x18000382e
test rbp, rbp
je 0x180003815
mov r8, qword [rsp + 0x40]
mov r9d, eax
mov edx, 0x10
mov rcx, rbp
call fcn.18000f1bc
test eax, eax
je 0x180003815
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f24c
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x1800307d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x1800035dc.274
mov ebx, 0x12
jmp 0x180003bc9
cmp qword [0x1800307e8], r8
jne case.0x1800035dc.274
cmp dword [rsp + 0x150], 0x10
jne 0x18000385c
mov rcx, rdi
call fcn.180002454
jmp 0x180003a9f
mov ebx, 0x57
jmp 0x180003bb8
xor ecx, ecx
mov ebx, 0x426
xchg qword [0x1800307e8], rcx
test rcx, rcx
je 0x180003a56
call fcn.18001e430
xor ebx, ebx
jmp 0x180003a56
mov edx, 1
lea rcx, [0x180002934]
jmp 0x180003a88
xor edx, edx
lea rcx, [0x180001acc]
jmp 0x180003a88
test rdi, rdi
je case.0x1800035dc.274
test rsi, rsi
je case.0x1800035dc.274
cmp dword [rsp + 0x150], 4
jne case.0x1800035dc.274
mov r8d, dword [rdi]
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp case.0x1800035dc.274
mov rcx, qword [0x180030858]
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x40]
call fcn.180014dd0
test eax, eax
mov ebx, eax
jne 0x180003bb8
mov r9d, dword [rsp + 0x138]
mov r8, qword [rsp + 0x40]
lea edx, [rax + 0x10]
mov rcx, rbp
call fcn.18000f1bc
test eax, eax
je 0x18000392a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f24c
mov r8, qword [rsp + 0x40]
jmp 0x180003965
mov rcx, qword [0x180030858]
xor ebx, ebx
call fcn.180014c44
test rax, rax
mov rdi, rax
je 0x180003bb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180003962
mov rcx, rdi
call fcn.18001746c
mov ebx, eax
mov r8, rdi
mov rcx, qword [0x1800307d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003bb8
test rdi, rdi
je case.0x1800035dc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800035dc.274
mov r8d, 1
jmp 0x1800039f7
test rdi, rdi
je case.0x1800035dc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800035dc.274
mov r8d, 7
jmp 0x1800039f7
test rdi, rdi
je case.0x1800035dc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800035dc.274
mov r8d, 3
jmp 0x1800039f7
test rdi, rdi
je case.0x1800035dc.274
mov edx, dword [rsp + 0x150]
test edx, edx
je case.0x1800035dc.274
mov r8d, 0xd
mov rcx, rdi
call fcn.180002dd0
jmp 0x180003a90
xor edx, edx
lea rcx, [0x180002d94]
jmp 0x180003a88
test rdi, rdi
je case.0x1800035dc.274
mov ebx, dword [rsp + 0x150]
test ebx, ebx
je case.0x1800035dc.274
mov edx, ebx
mov rcx, rdi
call fcn.18001997c
test eax, eax
je 0x180003a51
lea rcx, [0x1800331e1]
mov r9d, 3
mov r8d, ebx
mov rdx, rdi
call fcn.180004cf0
mov ebx, eax
jmp 0x180003a56
mov ebx, 0xbf
test ebx, ebx
jmp 0x180003aa3
mov eax, dword [0x1800307e4]
test eax, eax
jne case.0x1800035dc.274
test rdi, rdi
je case.0x1800035dc.274
cmp dword [rsp + 0x150], 4
jne case.0x1800035dc.274
mov edx, dword [rdi]
lea rcx, [0x180002564]
mov r8, rsi
call fcn.180002bf8
mov ebx, eax
jmp 0x180003bb8
mov rcx, rdi
call fcn.180002ff8
mov ebx, eax
test eax, eax
jne 0x180003bb8
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.180001690
jmp 0x180003bb8
mov r12d, 1
test rdi, rdi
je case.0x1800035dc.274
cmp dword [rsp + 0x150], 1
jbe case.0x1800035dc.274
mov eax, dword [rsp + 0x150]
and qword [rsp + 0x50], r8
xor edx, edx
mov byte [rax + rdi - 1], r8b
lea ecx, [rdx + 0x40]
mov r8d, r9d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r13, rax
je 0x180003b84
test r12d, r12d
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000001
je 0x180003b20
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x180003b26
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x180003b79
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x1800309c8]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], eax
and dword [rsp + 0x20], eax
lea r9, [rsp + 0x58]
mov r8, r13
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x180003b66
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x180003b6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180003bb8
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x10]
mov rcx, rbp
call fcn.18000f1bc
test eax, eax
je 0x180003bb8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.18000f24c
cmp ebx, 0xffffffff
jne 0x180003bc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x180003bd7
mov r8d, ebx
mov rdx, rsi
mov rcx, r15
call fcn.180001690
lea r11, [rsp + 0x100]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret