Function at 0x140113ed8
Capabilities:
Delete file
Move file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x298
mov qword [rsp + 0x48], 0xfffffffffffffffe
movaps xmmword [rax - 0x58], xmm6
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14d, r9d
mov r15d, r8d
mov r13, rdx
mov rsi, rcx
xor ebp, ebp
mov edi, ebp
mov r12d, r8d
shl r12, 0x20
or r12, r14
mov bl, 1
mov ecx, dword [rcx + 0x48]
imul ecx, dword [rsi + 0x4c]
or eax, 0xffffffff
sub eax, ecx
mov ecx, eax
cmp r12, rcx
jb 0x140113f83
lea rcx, [rsp + 0x40]
call fcn.14000cb18
nop
lea rcx, [rsp + 0x40]
call fcn.140024ec0
mov rcx, qword [rsp + 0x40]
call fcn.140111538
movzx ebx, bl
test al, al
cmovne ebx, ebp
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140113f83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebp, 0x88000080
test bl, bl
je 0x140113fa1
mov rdx, r13
mov rcx, rsi
call fcn.140111698
mov ecx, 0xa8000080
test eax, eax
cmove ebp, ecx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x140114117
test r14d, r14d
jne 0x140113fec
xor r14d, r14d
test r15d, r15d
je 0x1401140c2
jmp 0x140113fef
xor r14d, r14d
mov edi, dword [rsi + 0x68]
cmp r12, rdi
jae 0x14011405b
bt ebp, 0x1d
jae 0x14011405b
mov eax, dword [rsi + 0x4c]
pxor xmm6, xmm6
cvtsi2sd xmm6, rax
pxor xmm0, xmm0
cvtsi2sd xmm0, r12
test r12, r12
jns 0x14011401f
addsd xmm0, qword [0x14038c590]
divsd xmm0, xmm6
call fcn.1402e6638
mulsd xmm0, xmm6
xor eax, eax
movsd xmm1, qword [0x140398b78]
comisd xmm0, xmm1
jbe 0x140114053
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x140114053
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si r12, xmm0
add r12, rax
shr ebp, 0x1d
and bpl, 1
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], bpl
mov r9d, edi
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.140112b18
mov edi, eax
test eax, eax
jne 0x1401140c2
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
test al, al
jne 0x1401140b4
cmp qword [rsi + 0xe0], r14
je 0x1401140b9
mov rcx, qword [rsi + 0xe0]
mov rax, qword [rcx]
call qword [rax + 0x30]
test al, al
jne 0x1401140b9
mov edi, 0x4c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test rbx, rbx
je 0x1401140d3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
test edi, edi
jne 0x14011411f
mov word [rsp + 0x60], r14w
mov r8b, byte [rsi + 0x5c]
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.140110cf8
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14011411f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, r13
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14011411f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rbx, rbx
je 0x14011412d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400be110
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret