Function at 0x140016ec0
Capabilities:
Delete file
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x3b0
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
mov qword [rsp + 0x40], rax
call fcn.14000b0a0
movsx ebx, al
call fcn.14000b090
movsx esi, al
mov r9d, esi
imul r9d, ebx
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx r10d, al
xor r12d, r12d
add ecx, r10d
lea ebp, [r12 + 0xa]
lea eax, [rcx + r9*8]
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400171d2
movsx eax, byte [0x14005bcd2]
cmp r14, 0xffffffffffffffff
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, r12d
sete al
xor edx, edx
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
lea eax, [r9 + r9*4]
lea r14d, [r10 + rax*2]
mulsd xmm1, xmm0
movsd qword [rsp + 0x28], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r14d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140016ff2
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x140016ff2
mov r11d, ebp
jmp 0x140017055
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r10d
lea eax, [rax + r9*2]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017050
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea edx, [r9 + r9*2]
movsx ecx, byte [0x14005bcd0]
add eax, r10d
xorps xmm0, xmm0
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x28]
cvttsd2si r11d, xmm0
jmp 0x140017055
mov r11d, dword [rsp + 0x28]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r11d
test eax, eax
je 0x1400171cd
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r10d
xorps xmm2, xmm2
lea eax, [rax + r9*4]
div ecx
movsx ecx, byte [0x14005bcd3]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x28], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r14d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001713c
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x1400171c6
call fcn.14000b0d0
movsx edx, al
mov ecx, esi
imul ecx, ebx
lea eax, [rdx + rcx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400171bd
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x28]
cvttsd2si eax, xmm0
jmp 0x1400171c1
mov eax, dword [rsp + 0x28]
cmp r12d, eax
jge 0x1400171cd
xor al, al
jmp 0x140018340
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x3f0], r15
xor r15b, r15b
mov dword [rsp + 0x50], 0x238
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400179c3
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x3e8], r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
movd xmm2, eax
movsx eax, byte [0x14005bcd2]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x28], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea r13d, [rcx + rdx*2]
movsx ecx, byte [0x14005bcd0]
add eax, r13d
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400172fa
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x1400172fa
mov r9d, ebp
jmp 0x14001738f
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001738a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x28]
cvttsd2si r9d, xmm0
jmp 0x14001738f
mov r9d, dword [rsp + 0x28]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r13d
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x1400179bb
call fcn.14000b090
movsx edx, al
call fcn.14000b0a0
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*8]
mov dword [rsp + 0x3c], eax
call fcn.14000b090
movsx edx, al
call fcn.14000b0a0
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r15d, [rcx + rdx*2]
call fcn.14000b090
movsx ebx, al
call fcn.14000b0a0
movsx ecx, al
imul ebx, ecx
call fcn.14000b0d0
movsx esi, al
lea eax, [rsi + rbx*8]
add eax, ebx
mov dword [rsp + 0x28], eax
mov r12d, dword [rsp + 0x28]
nop word [rax + rax]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r15d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001788f
movsx eax, byte [0x14005bcd2]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, r14
mulsd xmm1, xmm0
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r13d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400174ff
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x1400174ff
mov dword [rsp + 0x30], ebp
jmp 0x140017555
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, esi
lea eax, [rax + rbx*2]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017555
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r15d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si eax, xmm0
mov dword [rsp + 0x30], eax
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, ebx
add eax, esi
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, dword [rsp + 0x30]
test eax, eax
je 0x14001788f
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
imul ecx, ebx, 7
add ecx, esi
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017886
mov r9d, 0x104
lea r8, [rsp + 0x290]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov eax, eax
xorps xmm2, xmm2
xor edx, edx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r13d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001765a
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001765a
mov dword [rsp + 0x34], ebp
jmp 0x1400176b0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, esi
lea eax, [rax + rbx*2]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400176b0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r15d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si eax, xmm0
mov dword [rsp + 0x34], eax
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea r9d, [rsi + rbx*2]
movsx ecx, byte [0x14005bcd0]
add eax, r9d
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, dword [rsp + 0x34]
test eax, eax
je 0x140017886
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
add eax, dword [rsp + 0x3c]
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017886
cmp qword [rdi + 0x18], 0xf
mov r8, rdi
jbe 0x140017711
mov r8, qword [rdi]
lea rax, [rsp + 0x290]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140017733
inc rax
test ecx, ecx
jne 0x140017720
xor eax, eax
xorps xmm2, xmm2
test edx, edx
sete al
xor edx, edx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r13d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400177d0
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x1400177d0
mov dword [rsp + 0x38], ebp
jmp 0x140017824
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017824
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r15d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si eax, xmm0
mov dword [rsp + 0x38], eax
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea ecx, [rbx + rsi]
lea ecx, [rcx + rbx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, dword [rsp + 0x38]
test eax, eax
je 0x140017886
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.Terminated_process_using_file:
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
lea rdx, [rsp + 0x290]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
xor edx, edx
movd xmm2, eax
movsx eax, byte [0x14005bcd2]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r13d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017937
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x140017937
mov r12d, ebp
jmp 0x14001798a
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, esi
lea eax, [rax + rbx*2]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001798a
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r15d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si r12d, xmm0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
add eax, dword [rsp + 0x28]
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r12d
test eax, eax
jne 0x140017430
xor r15b, r15b
xor r12d, r12d
mov r13, qword [rsp + 0x3e8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400181a9
cmp qword [rdi + 0x18], 0xf
mov rcx, rdi
jbe 0x140017a1e
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movd xmm2, eax
movsx eax, byte [0x14005bcd2]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea esi, [rcx + rdx*2]
movsx ecx, byte [0x14005bcd0]
add eax, esi
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017adc
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x140017adc
mov r9d, ebp
jmp 0x140017b71
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017b6c
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si r9d, xmm0
jmp 0x140017b71
mov r9d, dword [rsp + 0x28]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, esi
div ecx
movsx edx, byte [0x14005bcd3]
sub eax, edx
imul eax, r9d
test eax, eax
je 0x140017bd2
lea rdx, str.File_deleted:
lea rcx, [0x14005c4f0]
call fcn.140021a20
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x140017bb6
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.1400237e0
mov rcx, rax
call fcn.140021cd0
mov r15b, 1
jmp 0x1400181a9
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*8]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400181a9
call fcn.14000b0b0
movsx r10d, al
call fcn.14000b0e0
movsx r11d, al
call fcn.14000b0c0
movsx edx, byte [0x14005e1b0]
xorps xmm2, xmm2
movsx ebx, al
movsx eax, byte [0x14005bcd4]
imul edx, r10d
shl edx, 3
sub edx, r11d
add edx, ebx
add eax, edx
xor edx, edx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, esi
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017cca
movsx ecx, byte [0x14005e1b0]
imul ecx, r10d
lea edx, [rcx + rcx*4]
movsx ecx, byte [0x14005bcd4]
sub edx, r11d
add edx, ebx
add ecx, edx
je 0x140017cca
mov r9d, ebp
jmp 0x140017d5f
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017d5a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si r9d, xmm0
jmp 0x140017d5f
mov r9d, dword [rsp + 0x28]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*4]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x140018175
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x140053f48]
movsd qword [rsp + 0x20], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017e38
movsx ecx, byte [0x14005e1b0]
imul ecx, r10d
lea edx, [rcx + rcx*4]
movsx ecx, byte [0x14005bcd4]
sub edx, r11d
add edx, ebx
add ecx, edx
jne 0x140017e90
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017e90
movzx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movzx eax, byte [0x14005bcd0]
movzx eax, byte [0x14005bcd3]
movsd xmm0, qword [rsp + 0x20]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
imul r9d, edx, 7
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400181a9
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r10d, [rdx + rdx]
call fcn.14000b0d0
movsx r9d, al
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add r9d, r10d
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm2, xmm2
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140017fc6
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14001803c
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x140018038
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si ebp, xmm0
jmp 0x14001803c
mov ebp, dword [rsp + 0x28]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*8]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, ebp
test eax, eax
je 0x1400181a9
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x140053f50]
movsd qword [rsp + 0x20], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001812e
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x1400181a9
call fcn.14000b0d0
movsx ecx, al
xor edx, edx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add ecx, r10d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x1400181a9
movzx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movzx eax, byte [0x14005bcd0]
movzx eax, byte [0x14005bcd3]
movsd xmm0, qword [rsp + 0x20]
jmp 0x1400181a9
lea rdx, str.Failed_to_delete_file:
lea rcx, [0x14005c670]
call fcn.140021a20
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x140018195
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.1400237e0
mov rcx, rax
call fcn.140021cd0
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
xorps xmm2, xmm2
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001829c
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x140018334
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14001832b
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x20]
cvttsd2si eax, xmm0
jmp 0x14001832f
mov eax, dword [rsp + 0x28]
cmp r12d, eax
jge 0x140018338
movzx eax, r15b
mov r15, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.140025340
mov rbx, qword [rsp + 0x3f8]
add rsp, 0x3b0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret