Function at 0x140053ac0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x1400f90c0]
xor rax, rsp
mov qword [rbp + 0x520], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
lea r8d, [r12 + 0x12]
lea rdx, str.Windowsprefetch_
lea rcx, [rbp - 0x40]
call fcn.14005d010
nop
lea rdx, [rsp + 0x50]
call fcn.1400521d0
nop
lea rsi, [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 0xf
jbe 0x140053b52
mov rsi, qword [rsp + 0x50]
add rbx, rsi
mov rdi, rsi
jmp 0x140053b5f
lea rcx, [rsp + 0x50]
add rbx, rcx
lea rdi, [rsp + 0x50]
cmp rdi, rbx
je 0x140053b7b
sub rsi, rdi
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi + rsi], al
inc rdi
cmp rdi, rbx
jne 0x140053b67
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r12w
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x310]
call qword [sym.imp.MSVCP140.dll__To_wide]
test eax, eax
jne 0x140053bdb
lea rcx, str.invalid_char_filename_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
lea rax, [rbp + 0x310]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140053bf0
lea rdx, [rbp + 0x310]
lea rcx, [rsp + 0x70]
call fcn.14005c5b0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14005c650
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140053c5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053c59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053c59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r12w
mov ecx, 8
call fcn.1400c8e90
mov qword [rax], r12
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14005ccd0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0xb0]
call fcn.14005b8d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r12w
movdqa xmm0, xmmword [0x1400e5cc0]
movdqa xmmword [rbp + 0xf0], xmm0
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll__Open_dir]
mov rcx, qword [rbp + 0xa0]
mov qword [rcx], rax
test rax, rax
je 0x140053d28
mov r8d, dword [rsp + 0x20]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xa0]
call fcn.14005be30
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140053d6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053d68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140053d9f
lock inc dword [rcx + 8]
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0xa0]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x10]
call fcn.14005b8d0
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x10]
call fcn.14005b8d0
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
mov ecx, 8
call fcn.1400c8e90
mov qword [rax], r12
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14005ccd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r12w
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
movdqa xmm0, xmmword [0x1400e5cc0]
movdqa xmmword [rbp + 0x90], xmm0
movabs r13, 0x7fffffffffffffff
mov r14, qword [rbp + 0x40]
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140053e86
test r14, r14
je 0x140053e8f
mov rax, qword [r14]
cmp qword [rbx], rax
jmp 0x140053e89
test r14, r14
je 0x1400541b4
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call fcn.14005b8d0
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x68], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.14005b8d0
or r15d, 1
lea rcx, [rbp - 0x60]
mov rax, qword [rbp - 0x50]
cmp qword [rbp - 0x48], 7
jbe 0x140053ed8
mov rbx, qword [rbp - 0x60]
lea rdi, [rbx + rax*2]
jmp 0x140053ee0
lea rdi, [rcx + rax*2]
lea rbx, [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
cmp rbx, rdi
jne 0x140053f06
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x28], 0
jmp 0x140054002
sub rdi, rbx
sar rdi, 1
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
cmp rdi, r13
ja 0x140054296
mov esi, reloc.WS2_32.dll_ntohs
cmp rdi, rsi
jbe 0x140053fc3
mov rsi, rdi
or rsi, 0xf
cmp rsi, r13
jbe 0x140053f4b
mov rsi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140053f72
cmp rsi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140053f9e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005429c
mov rcx, rax
call fcn.1400c8e90
mov rcx, rax
test rax, rax
je 0x14005419f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140053fc8
test rcx, rcx
je 0x140053fb4
call fcn.1400c8e90
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140053fc8
mov rax, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140053fc8
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
cmp rsi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rdi
test rdi, rdi
je 0x140053ff3
movzx eax, byte [rbx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rbx, [rbx + 2]
sub rdx, 1
jne 0x140053fe0
mov qword [rsp + 0x38], rdi
mov byte [r8 + rdi], 0
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
cmp rax, 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140054044
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
lea rdx, str.WMIC
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14005407e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400540bb
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400540b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005419f
call fcn.1400c910c
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14005410f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400541a6
call fcn.1400c910c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14005414c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054147
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400541ad
call fcn.1400c910c
mov rbx, qword [rbp - 0x20]
mov rdx, qword [rbx]
test rdx, rdx
je 0x140053e74
lea r8, [rsp + 0x20]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll__Read_dir]
cmp word [rax], 0
jne 0x140054185
mov rcx, qword [rbx]
call qword [sym.imp.MSVCP140.dll__Close_dir]
mov qword [rbx], r12
jmp 0x140053e74
mov r8d, dword [rsp + 0x20]
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x20]
call fcn.14005be30
jmp 0x140053e70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x40]
call fcn.1400520d0
nop
lea rcx, [rbp - 0x20]
call fcn.1400520d0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400520d0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140054215
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054210
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140054266
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054261
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400c8d50
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140051000
nop
call fcn.1400014c0
int3