Function at 0x140016860
Capabilities:
Delete file
Download url
Get common file path
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2000]
mov eax, 0x2100
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x1ff0], rax
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x48], r8
xor r13d, r13d
mov rcx, qword [0x14034dce0]
test rcx, rcx
je 0x1400168c4
mov rax, qword [rcx]
lea edx, [r13 + 1]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [0x14034dce0], r13
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x14001696d
mov rcx, rdi
call fcn.140019360
cmp byte [rax], 0x20
jne 0x140016901
dec rbx
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400168ee
mov rax, qword [rdi]
mov qword [rdi + 0x10], rbx
mov byte [rax + rbx], r13b
mov rbx, qword [rdi + 0x10]
test rbx, rbx
jne 0x1400168d1
jmp 0x14001696d
xor edx, edx
mov rcx, rdi
call fcn.140019380
cmp byte [rax], 0x20
jne 0x14001696d
mov rcx, qword [rdi + 0x18]
mov edx, 1
cmp rcx, 0x10
jb 0x14001692b
mov r8, r13
cmp rbx, rdx
cmovb rdx, rbx
jmp 0x140016947
mov r8, rdi
sub r8, rdi
mov rax, rbx
sub rax, r8
cmp rax, rdx
cmovb rdx, rax
mov rax, rdi
cmp rcx, 0x10
jb 0x14001694a
mov rax, qword [rdi]
lea rcx, [rax + r8]
sub rbx, rdx
mov qword [rdi + 0x10], rbx
sub rbx, r8
lea r8, [rbx + 1]
add rdx, rcx
call fcn.1402414f0
mov rbx, qword [rdi + 0x10]
test rbx, rbx
jne 0x140016901
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x10]
call fcn.140241ba0
lea rdx, [rbp - 0x10]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140016b80
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x78]
call fcn.14000fd70
nop
mov rsi, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x1400169c9
mov rbx, qword [r14]
add rsi, rbx
jmp 0x1400169cf
add rsi, r14
mov rbx, r14
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
mov rdx, rsi
sub rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400192a0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
cmp rbx, rsi
je 0x140016a59
nop word [rax + rax]
movsx r9d, byte [rbx]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
cmp rcx, rdx
jae 0x140016a47
lea rax, [rcx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rdx, 8
cmovae rax, qword [rsp + 0x68]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r13w
jmp 0x140016a51
lea rcx, [rsp + 0x68]
call fcn.1400101b0
inc rbx
cmp rbx, rsi
jne 0x140016a10
lea r8, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r8, qword [rbp - 0x78]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea r14, [rbp - 0x78]
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x60]
cmp r8, 8
cmovae r14, rdx
mov qword [rsp + 0x58], r14
test eax, eax
je 0x140016bca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Could_not_download_background_picture._Error___d
mov r8d, 0x1a4
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesgui.cpp
mov ecx, 1
call fcn.1400473d0
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016b1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140016b17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001702f
call fcn.1400081a0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140016b6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017035
call fcn.1400081a0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r13w
mov ebx, 0xffffffff
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140016ba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x1ff0]
xor rcx, rsp
call fcn.1402155d0
mov rbx, qword [rsp + 0x2140]
add rsp, 0x2100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x78]
cmp r8, 8
cmovae rcx, rdx
lea rdx, [rsp + 0x40]
call fcn.140216f24
cmp eax, 8
je 0x140016f91
cmp eax, 0xffffffff
je 0x140016f91
mov ecx, 0x7e8
call fcn.140095d1c
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140016c91
mov edx, 2
mov rcx, rax
call fcn.140009cf0
lea rax, vtable.CNotification_Advert.0
mov qword [rsi], rax
mov qword [rsi + 0x7b0], r13
mov qword [rsi + 0x7c0], r13
mov qword [rsi + 0x7c8], 0xf
mov byte [rsi + 0x7b0], 0
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14001703b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi + 0x7d0], rax
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140017046
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi + 0x7d8], rax
mov byte [rsi + 0x7e0], 0
jmp 0x140016c94
mov rsi, r13
mov qword [0x14034dce0], rsi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [rsi]
mov rbx, qword [rcx + 0x2c8]
mov rcx, rax
call fcn.14009a424
mov r8, rax
mov edx, 0x66
mov rcx, rsi
call rbx
test eax, eax
je 0x140016ad1
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r13w
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x68]
lea r8, [rdx + rax*2]
sub r8, rdx
sar r8, 1
lea rcx, [rbp - 0x58]
call fcn.14000f170
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140016d6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017051
call fcn.1400081a0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r13w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x38]
call fcn.14000d880
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14000a7b0
test al, al
jne 0x140016dea
mov rdx, qword [rbx]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140016de5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15b, 1
jmp 0x140016e1e
lea rcx, [rsi + 0x7d8]
mov rdx, rbx
call fcn.14000d7c0
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140016e1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r15b, r15b
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140016e5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017057
call fcn.1400081a0
test r15b, r15b
je 0x140016f50
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Could_not_load_the_BK_pic_of_the_advert_wnd._Error___d
mov r8d, 0x1b5
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesgui.cpp
mov ecx, 1
call fcn.1400473d0
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016ee7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140016ee2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001702f
call fcn.1400081a0
mov word [rsp + 0x68], r13w
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r13
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140016f3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140016f35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017035
call fcn.1400081a0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r13w
jmp 0x140016b85
lea rcx, [rsi + 0x7b0]
cmp rcx, rdi
je 0x140016f72
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x140016f6a
mov rdi, qword [rdi]
mov rdx, rdi
call fcn.1400155c0
lea rcx, [rsi + 0x7d0]
mov rdx, r12
call fcn.14000d7c0
xor r8d, r8d
mov rcx, rsi
call fcn.14000a2f0
jmp 0x140016e9c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016fd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001702f
call fcn.1400081a0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140016b6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017035
jmp 0x140016b6a
call fcn.14024b534
nop
call fcn.14024b534
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
nop
call fcn.14024b534
int3
call fcn.14024b534
int3