Function at 0x180036b30
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x458]
sub rsp, 0x6e0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801270d0]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov rdi, rcx
mov qword [rbp - 0x68], rcx
call fcn.180025000
nop
mov qword [rdi + 0x1c8], 7
xor r13d, r13d
mov qword [rdi + 0x1c0], r13
mov word [rdi + 0x1b0], r13w
lea rcx, [rdi + 0x1d8]
call fcn.180058330
mov dword [rdi + 0x510], r13d
mov qword [rdi + 0x518], 0xffffffff80000000
mov qword [rdi + 0x540], 0xf
mov qword [rdi + 0x538], r13
mov byte [rdi + 0x528], r13b
mov byte [rdi + 0x550], r13b
cmp qword [0x18012e528], r13
jne 0x18003709c
mov ecx, 0x218
call fcn.18003caf0
mov rbx, rax
mov qword [0x18012e528], rax
movabs rax, 0x5cc053c08
mov qword [rsp + 0x220], rax
movabs rax, 0xddfd28b0d04c82b
mov qword [rsp + 0x218], rax
movabs rax, 0xa971fed82ab2d351
mov qword [rsp + 0x210], rax
movabs rax, 0x22e05b40e6c0c5a1
mov qword [rsp + 0x208], rax
movabs rax, 0xb2582929804a8719
mov qword [rsp + 0x200], rax
movabs rax, 0x2940d65c8244a2cf
mov qword [rsp + 0x1f8], rax
movabs rax, 0xd4cd71488bb1ee10
mov qword [rsp + 0x1f0], rax
movabs rax, 0xdbef52b9a6255e5a
mov qword [rsp + 0x1e8], rax
movabs rax, 0xac331749b6521156
mov qword [rsp + 0x1e0], rax
movabs rax, 0xfb4dce0924308bb3
mov qword [rsp + 0x1d8], rax
movabs rax, 0xe47b29d7c326a948
mov qword [rsp + 0x1d0], rax
movabs rax, 0x1f329af8da8ebaf7
mov qword [rsp + 0x1c8], rax
movabs rax, 0x213a3a3304a59806
mov qword [rsp + 0x1c0], rax
movabs rax, 0x68c7669d2c2b019f
mov qword [rsp + 0x1b8], rax
movabs rax, 0x6e537ed1deec7d63
mov qword [rsp + 0x1b0], rax
movabs rax, 0x969963dc7b406406
mov qword [rsp + 0x1a8], rax
movabs rax, 0xb4f209f0c5555fb9
mov qword [rsp + 0x1a0], rax
movabs rax, 0x7ed1cb3ad0b1e996
mov qword [rsp + 0x198], rax
movabs rax, 0x7fbee9355d8108ba
mov qword [rsp + 0x190], rax
movabs rax, 0xab0b067a257bbb8c
mov qword [rsp + 0x188], rax
movabs rax, 0xa1630e81be2e7fa
mov qword [rsp + 0x180], rax
movabs rax, 0x9a8423121a0be5d2
mov qword [rsp + 0x178], rax
movabs rax, 0xa9a18c8d59fa743c
mov qword [rsp + 0x170], rax
movabs rax, 0xda39c60f6c2981e9
mov qword [rsp + 0x168], rax
movabs rax, 0x4b2202af0dc48180
mov qword [rsp + 0x160], rax
movabs rax, 0x552c9b0bd8ca3dcd
mov qword [rsp + 0x158], rax
movabs rax, 0xd88b3eaaf66b63d
mov qword [rsp + 0x150], rax
movabs rax, 0x4883efacd845da26
mov qword [rsp + 0x148], rax
movabs rax, 0x81289e7f589dc2b3
mov qword [rsp + 0x140], rax
movabs rax, 0x9aaf787cb9074a3
mov qword [rsp + 0x138], rax
movabs rax, 0x1257f41dfc4efd67
mov qword [rsp + 0x130], rax
movabs rax, 0x51d2c1643aa9519f
mov qword [rsp + 0x128], rax
movabs rax, 0x2398186f4389d62a
mov qword [rsp + 0x120], rax
movabs rax, 0xfcfbe24a317690ed
mov qword [rsp + 0x118], rax
movabs rax, 0x4c4106a51870145a
mov qword [rsp + 0x110], rax
movabs rax, 0x23462bf040d0f6f9
mov qword [rsp + 0x108], rax
movabs rax, 0xea7ae597926db91d
mov qword [rsp + 0x100], rax
movabs rax, 0x97be27d399ee0a4e
mov qword [rsp + 0xf8], rax
movabs rax, 0xfe2165c1fdc9a919
mov qword [rsp + 0xf0], rax
movabs rax, 0xdd2521c70b1a650c
mov qword [rsp + 0xe8], rax
movabs rax, 0x70103f28515c5dbb
mov qword [rsp + 0xe0], rax
movabs rax, 0xb624860dff8c4e3
mov qword [rsp + 0xd8], rax
movabs rax, 0xdff79f823e893f3
mov qword [rsp + 0xd0], rax
movabs rax, 0x5ebb277023d7e5fc
mov qword [rsp + 0xc8], rax
movabs rax, 0x1ba8a65d08fc302b
mov qword [rsp + 0xc0], rax
movabs rax, 0xd7df7cadc691d20a
mov qword [rsp + 0xb8], rax
movabs rax, 0xb08b2ab4c4919e71
mov qword [rsp + 0xb0], rax
movabs rax, 0xd0d649c4a2b87419
mov qword [rsp + 0xa8], rax
movabs rax, 0xd5d5f9b4c024d500
mov qword [rsp + 0xa0], rax
movabs rax, 0xca035791ada94b30
mov qword [rsp + 0x98], rax
movabs rax, 0x6085d3fac377e76a
mov qword [rsp + 0x90], rax
movabs rax, 0xfefaad848d771ee3
mov qword [rsp + 0x88], rax
movabs rax, 0xbba857bd57c31e1
mov qword [rsp + 0x80], rax
movabs rax, 0xfd71189175da0003
mov qword [rsp + 0x78], rax
movabs rax, 0xb6e60ca337361c29
mov qword [rsp + 0x70], rax
movabs rax, 0xdc3050ef6a733c02
mov qword [rsp + 0x68], rax
movabs rax, 0x5f80016bbc7a39d6
mov qword [rsp + 0x60], rax
movabs rax, 0xdcfac63f2f175bd7
mov qword [rsp + 0x58], rax
movabs rax, 0x8c4e0fba355dbe1
mov qword [rsp + 0x50], rax
movabs rax, 0xe66afeced0b9cac
mov qword [rsp + 0x48], rax
movabs rax, 0xeb92484f68b82973
mov qword [rsp + 0x40], rax
movabs rax, 0xfa29aed79c98124c
mov qword [rsp + 0x38], rax
movabs rax, 0xe0c4ab9dd4c21ba5
mov qword [rsp + 0x30], rax
movabs rax, 0xc674f4782fdd40fa
mov qword [rsp + 0x28], rax
movabs rax, 0x1ecf53c00040007a
mov qword [rsp + 0x20], rax
mov edx, 0x214
movabs r9, 0x80018a0a9a900
movabs r8, 0x5200000001030
lea rcx, [rbp + 0xe0]
call fcn.18004e5b0
mov rcx, rbx
mov rdx, rax
mov r8d, 0x218
call fcn.1800e7bc0
mov rcx, rdi
call fcn.18003dff0
mov rdx, qword [0x18012e528]
add rdx, 0x64
mov rcx, rdi
call fcn.180018840
mov r8d, 6
lea rdx, str.CLSID_
lea rcx, [rdi + 0x1b0]
call fcn.18000e970
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.CLSID_
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.180042a40
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rdi + 0x1b0]
call fcn.18005e8b0
nop
cmp qword [rbp - 0x28], 8
jb 0x180037113
mov rcx, qword [rbp - 0x40]
call fcn.180014a38
mov rcx, rdi
call fcn.180025260
mov edx, 5
movabs r8, 0x27ae2ef28
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
lea r12, [rdi + 0x368]
mov rcx, r12
sub rax, r12
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x180037155
add rcx, 2
test edx, edx
jne 0x180037140
test r8d, r8d
jne 0x180037164
or dword [rdi + 0x33c], 0x400
mov byte [rbp + 0x310], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x311]
call fcn.1800e96b0
mov dword [rbp - 0x80], 0x104
mov qword [rsp + 0x20], 0x1cdc1c0
movabs r14, 0x903a28ae2a28ae20
mov r9, r14
movabs r15, 0x2b930bbba3337a9b
mov r8, r15
mov edx, 0x13
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov ecx, 0x54a4a06b
call fcn.18005bf70
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x310]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
mov r9d, 2
lea r8, [0x180109ea0]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x1800374e6
mov ecx, 0x54a7a0a3
call fcn.180051c90
lea r8, [0x180109ea0]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call rax
cmp dword [rbp - 0x80], 0
je 0x1800374e6
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movabs r11, 0x353635343946370
mov qword [rsp + 0x78], r11
movabs rax, 0xa2181a9922a1a11a
mov qword [rsp + 0x70], rax
movabs rax, 0x6668666a70866e60
mov qword [rsp + 0x68], rax
movabs rax, 0xa19b211a19a31c18
mov qword [rsp + 0x60], rax
movabs rax, 0x5c73746375646f3
mov qword [rsp + 0x58], rax
movabs rax, 0x94170e0c4b4d4b5c
mov qword [rsp + 0x50], rax
movabs rax, 0x12d535c617461443
mov qword [rsp + 0x48], rax
movabs rax, 0x995cd5571c995b1c
mov qword [rsp + 0x40], rax
movabs rax, 0x185d1cdb92571b9b
mov qword [rsp + 0x38], rax
movabs rax, 0xded2e6e4caace8dc
mov qword [rsp + 0x30], rax
movabs rax, 0xae4e4ea86b8e6eec
mov qword [rsp + 0x28], rax
movabs rax, 0xbd91b9a55d71d199
mov qword [rsp + 0x20], rax
movabs rsi, 0xb9b7b931b4a6ae37
mov r9, rsi
movabs r8, 0x2a920abaa2327a9a
mov edx, 0x6f
lea rcx, [rbp - 0x10]
call fcn.18004e5b0
mov rbx, rax
mov r8, rax
movzx eax, byte [r8]
inc r8
test al, al
jne 0x180037311
sub r8d, ebx
dec r8d
cmp r8d, 1
jle 0x180037357
movsxd rax, r8d
test r8d, r8d
js 0x180037357
lea r9, [rax + rbx]
nop word [rax + rax]
movsx edx, byte [r9]
lea eax, [r8 + r8]
movsxd rcx, eax
mov word [rcx + rbx], dx
dec r9
dec r8d
jns 0x180037340
mov ecx, 0x54a7a059
call fcn.180051c90
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
mov qword [rsp + 0x68], 0x3e9b00
movabs rax, 0x5343546393537303
mov qword [rsp + 0x60], rax
movabs rax, 0x191a96a1a299a122
mov qword [rsp + 0x58], rax
movabs rax, 0xd383533342d31302
mov qword [rsp + 0x50], rax
movabs rax, 0xa196981c23199a1b
mov qword [rsp + 0x48], rax
movabs rax, 0x8d90ded71b1b1850
mov qword [rsp + 0x40], rax
movabs rax, 0x1cdb9a5b95571b9d
mov qword [rsp + 0x38], rax
movabs rax, 0xded2e6e4caace8dc
mov qword [rsp + 0x30], rax
movabs rax, 0xae4e4ea86b8e6eec
mov qword [rsp + 0x28], rax
movabs rax, 0xbd91b9a55d71d199
mov qword [rsp + 0x20], rax
mov r9, rsi
mov edx, 0x5a
movabs r8, 0x2a920abaa2327a9a
lea rcx, [rbp - 0x10]
call fcn.18004e5b0
mov rbx, rax
mov r9, rax
nop
movzx eax, byte [r9]
inc r9
test al, al
jne 0x180037420
sub r9d, ebx
dec r9d
cmp r9d, 1
jle 0x180037468
movsxd rax, r9d
test r9d, r9d
js 0x180037468
lea r10, [rax + rbx]
nop word [rax + rax]
movsx r8d, byte [r10]
lea eax, [r9 + r9]
movsxd rdx, eax
mov word [rdx + rbx], r8w
dec r10
dec r9d
jns 0x180037450
mov ecx, 0x54a7a059
call fcn.180051c90
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
mov edx, 0xb
mov r9d, 0x3737b48
movabs r8, 0xa30b1b4b6383820b
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov rcx, rax
call fcn.180017000
mov edx, 6
movabs r8, 0x36b2ba39bca98
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov rcx, rax
call fcn.180017000
xor r9d, r9d
lea edx, [r9 + 8]
movabs r8, 0xcba34b93ab1b2a9b
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov rcx, rax
call fcn.180017000
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x78], r13d
mov ebx, r13d
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], 0x1cdc1c0
mov r9, r14
mov r8, r15
mov edx, 0x13
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov ecx, 0x54a4a06b
call fcn.18005bf70
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x74]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [0x180109ea4]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x180037592
mov ecx, 0x54a7a0a3
call fcn.180051c90
lea r8, [0x180109ea4]
lea rdx, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call rax
cmp dword [rbp - 0x80], ebx
je 0x180037592
cmp dword [rbp - 0x74], 1
jne 0x180037592
or dword [rdi + 0x33c], 0x100
mov byte [rdi + 0x550], bl
mov ebx, 1
mov edx, 2
mov r8d, 0x38398
lea rcx, [rbp - 0x60]
call fcn.18004e5b0
mov rsi, rax
mov dword [rbp - 0x80], 4
mov qword [rsp + 0x20], 0x1cdc1c0
mov r9, r14
mov r8, r15
mov edx, 0x13
lea rcx, [rbp - 0x40]
call fcn.18004e5b0
mov ecx, 0x54a4a06b
call fcn.18005bf70
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
mov r9d, 0x10
mov r8, rsi
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x18003763b
mov ecx, 0x54a7a0a3
call fcn.180051c90
mov r8, rsi
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000002
call rax
cmp dword [rbp - 0x80], 0
je 0x18003763b
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x18003763b
mov word [rdi + 0x39c], ax
mov ebx, 1
mov byte [rbp + 0x300], 0
xor eax, eax
mov qword [rbp + 0x301], rax
mov dword [rbp + 0x309], eax
mov word [rbp + 0x30d], ax
mov byte [rbp + 0x30f], al
mov dword [rbp - 0x80], 0x10
mov qword [rsp + 0x20], 0x1cdc1c0
mov r9, r14
mov r8, r15
lea edx, [rax + 0x13]
lea rcx, [rbp - 0x40]
call fcn.18004e5b0
mov ecx, 0x54a4a06b
call fcn.18005bf70
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x300]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 2
lea r8, [0x180109ea8]
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x1800376fd
mov ecx, 0x54a7a0a3
call fcn.180051c90
lea r8, [0x180109ea8]
lea rdx, [rbp - 0x40]
mov rcx, 0xffffffff80000002
call rax
cmp dword [rbp - 0x80], 0
je 0x1800376fd
mov r8d, 9
lea rdx, [rbp + 0x300]
mov rcx, r12
call fcn.180002b54
jmp 0x180037701
test ebx, ebx
je 0x18003771f
lea r8, [rdi + 0x338]
mov dword [r8], 0x50000ee
xor edx, edx
mov r9d, DllRegisterServer
mov rcx, rdi
call fcn.1800529b0
mov qword [0x18012e530], rdi
mov rax, rdi
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1800e7b90
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret