Function at 0x180012890
Capabilities:
Delete file

Disassembly:
jmp 0x18001c6d0
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x18001c715
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18001c726
mov al, 1
jmp 0x18001cd52
mov r13, rsi
cmp qword [rsi + 0x18], 8
jb 0x18001c733
mov r13, qword [rsi]
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rcx, r13
call fcn.1800429ec
mov r12, rax
movabs r14, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [rdi - 1]
mov r15, qword [rbp - 0x48]
cmp rax, r15
ja 0x18001c7a7
lea rdi, [rbp - 0x60]
cmp r15, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18001c894
cmp r12, r14
ja 0x18001cd85
mov rbx, r12
or rbx, 7
cmp rbx, r14
jbe 0x18001c7c1
mov rbx, r14
jmp 0x18001c7e2
mov rcx, r15
shr rcx, 1
mov rax, r14
sub rax, rcx
cmp r15, rax
jbe 0x18001c7d7
mov rbx, r14
jmp 0x18001c7e2
lea rax, [r15 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x18001c7f4
mov rdx, r8
jmp 0x18001c7fd
cmp rdx, 0x1000
jb 0x18001c824
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003764c
test rax, rax
je 0x18001cd8b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001c834
test rdx, rdx
je 0x18001c834
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
cmp r15, 8
jb 0x18001c890
lea rdx, [r15*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c88b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd91
call fcn.180037644
mov qword [rbp - 0x60], rdi
lea rcx, [rbp - 0x60]
call fcn.18001c5c0
mov ebx, eax
mov dword [rbp - 0x40], eax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001c8e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c8dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd97
call fcn.180037644
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
cmp ebx, 0xffffffff
jne 0x18001c900
xor al, al
jmp 0x18001cd52
mov r13, rsi
cmp qword [rsi + 0x18], 8
jb 0x18001c90d
mov r13, qword [rsi]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rcx, r13
call fcn.1800429ec
mov r12, rax
mov r15, qword [rbp - 0x48]
cmp rax, r15
ja 0x18001c969
lea rdi, [rbp - 0x60]
cmp r15, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.180039150
xor r12d, r12d
mov word [rbx + rdi], r12w
jmp 0x18001ca70
cmp r12, r14
ja 0x18001cd9d
mov rbx, r12
or rbx, 7
cmp rbx, r14
jbe 0x18001c983
mov rbx, r14
jmp 0x18001c9a4
mov rcx, r15
shr rcx, 1
mov rax, r14
sub rax, rcx
cmp r15, rax
jbe 0x18001c999
mov rbx, r14
jmp 0x18001c9a4
lea rax, [rcx + r15]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18001c9c7
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x18001c9d7
cmp rdx, 0x1000
jb 0x18001c9fe
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x18001cda3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001ca0e
test rdx, rdx
je 0x18001ca0e
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.180039150
xor r12d, r12d
mov word [rbx + rdi], r12w
cmp r15, 8
jb 0x18001ca6c
lea rdx, [r15*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ca67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cda9
call fcn.180037644
mov qword [rbp - 0x60], rdi
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.18001c4a0
test al, al
sete bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001cac0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cabb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cdaf
call fcn.180037644
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
test bl, bl
jne 0x18001c8f9
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x18001cae6
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001c71f
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1800798b0]
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x30], r12w
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.18001cf70
test al, al
je 0x18001cb3d
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18001cb3d
mov bl, 1
jmp 0x18001cd01
cmp qword [rsi + 0x18], 8
jb 0x18001cb47
mov rsi, qword [rsi]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
mov rcx, rsi
call fcn.1800429ec
mov rbx, rax
mov r15, qword [rbp - 0x48]
cmp rax, r15
ja 0x18001cba0
lea rdi, [rbp - 0x60]
cmp r15, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
jmp 0x18001cca1
cmp rbx, r14
ja 0x18001cdb5
mov rcx, rbx
or rcx, 7
cmp rcx, r14
ja 0x18001cbd4
mov rdx, r15
shr rdx, 1
mov rax, r14
sub rax, rdx
cmp r15, rax
ja 0x18001cbd4
lea rax, [rdx + r15]
mov r14, rcx
cmp rcx, rax
cmovb r14, rax
lea rax, [r14 + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18001cbf7
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x18001cc07
cmp rdx, 0x1000
jb 0x18001cc2e
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x18001cdbb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001cc43
test rdx, rdx
je 0x18001cc40
mov rcx, rdx
call fcn.18003764c
mov rdi, rax
jmp 0x18001cc43
mov rdi, r12
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r14
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.180039150
mov word [rbx + rdi], r12w
cmp r15, 8
jb 0x18001cc9d
lea rdx, [r15*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cc98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cdc1
call fcn.180037644
mov qword [rbp - 0x60], rdi
mov edx, dword [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.18001c4a0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18001ccee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cce9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cdc7
call fcn.180037644
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
xor bl, bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18001cd3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cd7f
call fcn.180037644
movdqa xmm0, xmmword [0x1800798b0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180037620
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
nop
call fcn.180001eb0
nop
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3