Function at 0x10042f7e0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x11e0]
mov eax, 0x12e0
call fcn.10046b370
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1318], rbx
mov qword [rsp + 0x1320], rsi
mov rax, qword [0x100499010]
xor rax, rsp
mov qword [rbp + 0x11d0], rax
mov r15, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0xbc0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0x3a0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x9b0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x5b0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xdd0]
call sub.VCRUNTIME140.dll_memset
test r15, r15
jne 0x10042f8c0
xor eax, eax
jmp 0x10042ffb8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
lea r8d, [r12 + 0xc]
lea rdx, str.ErrorLogFile
lea rcx, [rsp + 0x30]
call fcn.10040da90
nop
call fcn.10044da70
mov rcx, rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.10040a3c0
nop
cmp qword [rsp + 0x70], r12
jbe 0x10042fdc4
cmp qword [0x1004a9360], r12
je 0x10042fdc4
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
mov edx, 0x106
lea rcx, [rbp - 0x80]
lea rax, [rbp - 0x80]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffef8]
test rax, rax
je 0x10042f973
movzx eax, word [r8 + rcx]
test ax, ax
je 0x10042f973
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10042f950
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov edx, 0x2e
lea rcx, [rbp - 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x10042fa91
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
mov ecx, r12d
mov rax, r12
nop word [rax + rax]
movzx edx, word [rbp + rax - 0x80]
cmp dx, 0x2e
je 0x10042f9d1
mov word [rbp + rax + 0x9b0], dx
inc ecx
add rax, 2
cmp ecx, 0x105
jb 0x10042f9b0
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
mov edx, 0x2e
lea rcx, [rbp - 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
lea r9, [rax + 2]
mov r8d, 0x106
lea rdx, [rbp + 0xbc0]
lea rax, [rbp + 0xbc0]
sub r9, rax
nop dword [rax + rax]
lea rcx, [r8 + 0x7ffffef8]
test rcx, rcx
je 0x10042fa33
movzx eax, word [r9 + rdx]
test ax, ax
je 0x10042fa33
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x10042fa10
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r12w
lea rcx, [rbp + 0xbc0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsrev]
mov r8d, 0x106
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
sub rax, rcx
lea rcx, [r8 + 0x7ffffef8]
test rcx, rcx
je 0x10042fa82
movzx ecx, word [rax + rdx]
test cx, cx
je 0x10042fa82
mov word [rdx], cx
add rdx, 2
sub r8, 1
jne 0x10042fa60
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r12w
lea r9, [rbp - 0x80]
lea r8, str._s.9
mov edx, 0x106
lea rcx, [rbp + 0x190]
call fcn.10040b460
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10042fb1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x10042fb1b
mov r9d, 0x200
lea r8, [rbp + 0xdd0]
mov edx, 0xf5
mov rcx, qword [0x1004a90d8]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rbp + 0x5b0]
mov ecx, ebx
call fcn.10044bfe0
lea r8, [rbp + 0x5b0]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xdd0]
call fcn.10043bdc0
mov ebx, 0x38
mov dword [rsp + 0x20], ebx
lea r9, [rbp - 0x80]
lea r8, str._s._c
mov edx, 0x106
lea rcx, [rbp + 0x190]
call fcn.10040b460
lea eax, [rbx + 1]
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x80]
lea r8, str._s._c
mov edx, 0x106
lea rcx, [rbp + 0x3a0]
call fcn.10040b460
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
test eax, eax
je 0x10042fbdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x10042fbdf
mov r9d, 0x200
lea r8, [rbp + 0xdd0]
mov edx, 0xf4
mov rcx, qword [0x1004a90d8]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rbp + 0x5b0]
mov ecx, edi
call fcn.10044bfe0
lea r9, [rbp + 0x5b0]
lea r8, [rbp + 0x3a0]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xdd0]
call fcn.10043bdc0
dec ebx
cmp ebx, 0x30
jg 0x10042fb20
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9338]
mov rax, qword [0x1004a90d0]
call qword [case.0x10044bd0b.0]
test eax, eax
jne 0x10042fc36
cmp dword [0x1004a8ebc], eax
je 0x10042fc29
test bl, bl
je 0x10042fc29
lea rdx, str.ProcessCycleLogFile
lea rcx, str.__s_____Waiting_for_CritSec__n
call fcn.10043bdc0
lea rcx, [0x1004a9338]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10042fc56
test bl, bl
je 0x10042fc56
lea rdx, str.ProcessCycleLogFile
lea rcx, str.__s_____Enters_CritSec__n
call fcn.10043bdc0
mov rcx, qword [0x1004a9360]
test rcx, rcx
je 0x10042fd8f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x1004a9360], r12
lea rax, [rbp + 0x9b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, str._s._s
mov edx, 0x106
lea rcx, [rbp + 0x190]
call fcn.10040b460
lea r9, [rbp - 0x80]
lea r8, str._s.1
mov edx, 0x106
lea rcx, [rbp + 0x3a0]
call fcn.10040b460
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
test eax, eax
je 0x10042fd30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
je 0x10042fd30
mov r9d, 0x200
lea r8, [rbp + 0xdd0]
mov edx, 0xf4
mov rcx, qword [0x1004a90d8]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rbp + 0x5b0]
mov ecx, ebx
call fcn.10044bfe0
lea r9, [rbp + 0x5b0]
lea r8, [rbp + 0x3a0]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0xdd0]
call fcn.10043bdc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rbx
call fcn.10043d480
test rax, rax
jne 0x10042fd69
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.10043d480
mov qword [0x1004a9360], rax
test rax, rax
jne 0x10042fd8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov r8d, 0x400
lea rdx, [rbp + 0x5b0]
call fcn.10044bfe0
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9338]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10042fdc4
test bl, bl
je 0x10042fdc4
lea rdx, str.ProcessCycleLogFile
lea rcx, str.__s_____Leaves_CritSec__n
call fcn.10043bdc0
cmp word [rbp + 0x5b0], 0
je 0x10042ff29
lea r14, [rbp + 0x5b0]
mov rdi, r12
cmp word [r15 + 0x204], di
je 0x10042feea
lea rcx, [rbp + 0x5b0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x10042fe00
test rax, rax
je 0x10042feea
cmp word [rbp + rax*2 + 0x5ae], 0x2e
je 0x10042fe77
lea ebx, [rax*2 + 4]
mov r8d, 0x756
lea rdx, str.SignalNotificationXP
mov ecx, ebx
call fcn.10043acf0
mov rdi, rax
test rax, rax
je 0x10042fe77
movsxd rbx, ebx
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x5b0]
mov rdx, rbx
mov rcx, rdi
call fcn.10040b320
lea r8, [0x100472a38]
mov rdx, rbx
mov rcx, rdi
call fcn.10042b640
mov r14, rdi
lea r8, [r15 + 0x204]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rsi, rax
test rax, rax
je 0x10042feea
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x10042fee1
mov eax, SQLBindParameter
mov word [rbx], ax
lea rcx, [rbx + 2]
mov r9d, 0x1fe
mov r8, r14
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbx + 0x3fe], r12w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [r15 + 4]
cmp word [r8], 0
je 0x10042ff1a
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x10042ff1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x10042ff5a
mov rcx, rdi
call fcn.10043b3b0
jmp 0x10042ff5a
lea r8, [r15 + 4]
cmp word [r8], 0
je 0x10042ff5a
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x10042ff5a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x10042ff9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x10042ff9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x10042ff9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.100469388
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov eax, 1
mov rcx, qword [rbp + 0x11d0]
xor rcx, rsp
call fcn.100469360
lea r11, [rsp + 0x12e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret