Function at 0x14000a4f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1400a31a0]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, rdx
mov qword [rbp - 0x38], rdx
lea rsi, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
mov qword [rbp - 0x40], rsi
call fcn.1400099e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
lea rdx, str._08x
lea rcx, [rbp + 0x140]
call fcn.14000fcb0
lea rax, str.0_h_:__1
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], socket
xor r14d, r14d
mov qword [rsp + 0x58], r14
movaps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rbp + 0x120], xmm0
movsd xmm1, qword [rsp + 0x60]
movsd qword [rbp + 0x130], xmm1
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea rdx, [rbp + 0x120]
mov rcx, qword [rbx + 0x50]
call fcn.1400181e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea ecx, [r14 + 0x50]
call fcn.14002df0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x30], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x160]
call fcn.14004c400
lea rax, str..log
mov qword [rsp + 0x20], rax
lea r9, str.process_ui_
mov r8, rdi
lea rdx, str._s_s_s
lea rcx, [rbp + 0x160]
call fcn.14000fbf0
call fcn.1400099e0
mov rcx, rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, str.check_path_:__s
mov r8, rsi
lea edx, [r14 + 2]
call fcn.14000a100
xor ecx, ecx
call fcn.140055bac
mov rsi, rax
mov qword [rbp + 0x120], rax
mov r12d, r14d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov r15d, 1
mov r13d, r15d
movsd xmm9, qword [0x140090268]
cmp rax, 0xffffffffffffffff
je 0x14000a910
movabs r8, 0x2b6109100
movabs rcx, 0xd6bf94d5e57a42bd
mov edi, dword [rbp - 4]
shl rdi, 0x20
mov eax, dword [rbp]
add rdi, rax
add r12, rdi
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 8]
mov dword [rbp - 0x3c], eax
mov rax, rcx
mul qword [rbp - 0x40]
mov rbx, rdx
shr rbx, 0x17
sub rbx, r8
mov rdx, rbx
mov rcx, rsi
call fcn.140050770
movaps xmm7, xmm0
xorps xmm6, xmm6
cvtsi2sd xmm6, rdi
mulsd xmm6, xmm9
call fcn.1400099e0
mov rcx, rax
lea rax, [rbp + 0xc]
mov qword [rsp + 0x38], rax
movsd qword [rsp + 0x30], xmm6
movsd qword [rsp + 0x28], xmm7
mov dword [rsp + 0x20], r13d
lea r9, str.add_log_file__d__:diff__.02f_s____filesize__.02f_kb___s
lea r8, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
mov edx, 2
call fcn.14000a100
inc r13d
mov rdx, rbx
mov rcx, rsi
call fcn.140050770
movsd qword [rbp - 0x70], xmm0
mov qword [rbp - 0x68], rdi
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], recvfrom
mov byte [rbp - 0x60], dil
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14000a7a0
lea rdx, [rbp + 0xc]
lea rcx, [rbp - 0x60]
call fcn.14000c9d0
nop
mov rsi, qword [rbp - 0x30]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], edi
mov rdi, rsi
cmp byte [rbx + 0x19], 0
jne 0x14000a806
mov qword [rsp + 0x50], rbx
lea rdx, [rbx + 0x20]
lea r8, [rbp - 0x70]
call fcn.140018e90
test al, al
je 0x14000a7f5
mov dword [rsp + 0x58], 0
mov rbx, qword [rbx + 0x10]
jmp 0x14000a800
mov dword [rsp + 0x58], r15d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14000a7d1
cmp byte [rdi + 0x19], 0
jne 0x14000a826
lea r8, [rdi + 0x20]
lea rdx, [rbp - 0x70]
call fcn.140018e90
test al, al
jne 0x14000a826
mov rbx, qword [rbp - 0x48]
jmp 0x14000a8b2
movabs rax, 0x333333333333333
cmp qword [rbp - 0x28], rax
je 0x14000ac13
lea rax, [rbp - 0x30]
mov qword [rsp + 0x70], rax
xor edi, edi
mov qword [rsp + 0x78], rdi
lea ecx, [rdi + 0x50]
call fcn.14002df0c
mov r8, rax
movsd xmm0, qword [rbp - 0x70]
movsd qword [rax + 0x20], xmm0
mov rax, qword [rbp - 0x68]
mov qword [r8 + 0x28], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [r8 + 0x30], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [r8 + 0x40], xmm1
lea ebx, [rdi + 0xf]
mov byte [rbp - 0x60], dil
mov qword [r8], rsi
mov qword [r8 + 8], rsi
mov qword [r8 + 0x10], rsi
mov word [r8 + 0x18], di
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rbp + 0x140], xmm0
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.140017340
nop
cmp rbx, 0x10
jb 0x14000a8ea
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a8e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ac19
call fcn.14002dc64
lea rdx, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000a907
mov rsi, qword [rbp + 0x120]
jmp 0x14000a6d2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rbp - 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x14000aaf8
movsd xmm8, qword [0x1400902d8]
mov r13, qword [rbp - 0x38]
nop
cmp r12, 0x6400000
jae 0x14000a950
movsd xmm7, qword [rbx + 0x20]
comisd xmm8, xmm7
ja 0x14000aaaa
cmp r12, 0x6400000
jbe 0x14000a9b4
lea r14, [rbx + 0x30]
cmp qword [r14 + 0x18], 0x10
jb 0x14000a960
mov r14, qword [r14]
mov rsi, qword [rbx + 0x28]
mov rdi, r12
sub rdi, rsi
call fcn.1400099e0
mov rcx, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], 0x6400000
mov qword [rsp + 0x20], r12
lea r9, str.because_dwLogFolderSize:__d___max_size____d___delete_log_file__d____s__filesize__d___after_delete_dwLogFolderSize___d
lea rsi, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
mov r8, rsi
mov edx, 2
call fcn.14000a100
inc r15d
jmp 0x14000a9bb
lea rsi, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
movsd xmm6, qword [rbx + 0x20]
comisd xmm6, xmm8
jbe 0x14000aa0b
lea rdi, [rbx + 0x30]
cmp qword [rdi + 0x18], 0x10
jb 0x14000a9d5
mov rdi, qword [rdi]
call fcn.1400099e0
mov rcx, rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r15d
movsd qword [rsp + 0x28], xmm8
movsd qword [rsp + 0x20], xmm6
lea r9, str.because_item.time_diff__I64d____max_second_diff__I64d____delete_log_file__d____s_
mov r8, rsi
mov edx, 2
call fcn.14000a100
inc r15d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x160]
call fcn.14004c400
lea r9, [rbx + 0x30]
cmp qword [r9 + 0x18], 0x10
jb 0x14000aa2d
mov r9, qword [r9]
mov r8, r13
lea rdx, str._s_s
lea rcx, [rbp + 0x160]
call fcn.14000fbf0
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
sub r12, qword [rbx + 0x28]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000aa80
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000aa7b
cmp rbx, qword [rax + 0x10]
jne 0x14000aa7b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000aa68
mov rbx, rax
jmp 0x14000aa9f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000aa9f
nop dword [rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000aa90
cmp byte [rbx + 0x19], 0
jne 0x14000aaf8
jmp 0x14000a930
xorps xmm6, xmm6
cvtsi2sd xmm6, r12
mulsd xmm6, xmm9
call fcn.1400099e0
mov rcx, rax
movsd qword [rsp + 0x38], xmm8
movsd qword [rsp + 0x30], xmm7
movsd xmm0, qword [0x1400902e0]
movsd qword [rsp + 0x28], xmm0
movsd qword [rsp + 0x20], xmm6
lea r9, str.dwLogFolderSize:__.02f_kb__max_size____.02f_kb__item.time_diff___f__max_second_diff___f___break
lea r8, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
mov edx, 2
call fcn.14000a100
lea rax, str.LogHelper::DeleteFileWhileExceedMaxSizeAndTime
mov qword [rbp - 0x38], rax
call fcn.1400099e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x130], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
lea rdx, str._08x
lea rcx, [rbp + 0x120]
call fcn.14000fcb0
lea rax, str.0_h_:___1
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], recvfrom
xor eax, eax
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x140], xmm0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movsd xmm1, qword [rsp + 0x60]
movsd qword [rbp - 0x80], xmm1
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x140]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x50]
call fcn.1400181e0
nop
mov r8, qword [rbp - 0x30]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140016660
mov edx, 0x50
mov rcx, qword [rbp - 0x30]
call fcn.14002dc64
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14002dc40
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400099c0
nop
call fcn.140056774
int3