Function at 0x140057210
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa70
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0xa60], rax
xor esi, esi
mov byte [rsp + 0x40], r8b
xor r15b, r15b
mov ebx, esi
mov dword [rsp + 0x44], ebx
movzx r13d, r9b
movzx edi, r8b
mov r12, rdx
mov rbp, rcx
cmp r8b, 2
jne 0x1400573e6
mov rcx, qword [rcx + 0x70]
test rcx, rcx
je 0x140057275
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x58]
mov rax, rdx
sub rax, r8
sar rax, 3
test rax, rax
je 0x1400573dd
mov r10d, esi
mov r9, rsi
nop word [rax + rax]
sub rdx, r8
sar rdx, 3
cmp rdx, r9
jbe 0x140057673
lfence
mov r8, qword [rbp + 0x58]
mov rdi, qword [r8 + r9*8]
cmp qword [rdi + 8], r12
je 0x1400572eb
mov rdx, qword [rbp + 0x60]
inc r10d
mov rcx, rdx
movsxd rax, r10d
sub rcx, r8
inc r9
sar rcx, 3
cmp rax, rcx
jb 0x1400572a0
movzx edi, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x70]
jmp 0x140057473
mov rdx, qword [rdi]
mov r14d, esi
mov r8, qword [rdx]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
test rax, rax
je 0x1400573c3
nop dword [rax + rax]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
cmp rax, rsi
jbe 0x14005766d
lfence
mov rax, qword [rdx]
mov rbx, qword [rax + rsi*8]
cmp dword [rbx + 0x60], 0x64
je 0x140057394
cmp qword [rbx + 0x38], 8
lea r8, [rbx + 0x20]
jb 0x140057342
mov r8, qword [r8]
mov rdx, r12
lea rcx, str._AsusSync_FileTransfer__CancelSession_0x_I64X____receiving_name:__s_n
call fcn.140095ab0
cmp dword [rbx + 0x60], 0x64
je 0x14005737d
cmp byte [rbx + 0x79], 0
jne 0x14005737d
mov rcx, qword [rbx + 0x70]
mov byte [rbx + 0x78], r13b
mov byte [rbx + 0x79], 1
cmp rcx, 0xffffffffffffffff
je 0x14005737d
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
mov r15b, 1
jb 0x14005738e
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rdx, qword [rdi]
inc r14d
mov ebx, dword [rsp + 0x44]
inc rsi
inc ebx
movsxd rax, r14d
mov dword [rsp + 0x44], ebx
mov r8, qword [rdx]
mov rcx, qword [rdx + 8]
sub rcx, r8
sar rcx, 3
cmp rax, rcx
jb 0x140057310
xor esi, esi
cmp qword [rdi + 0x30], 0
mov byte [rdi + 0x2c], 1
jne 0x1400573d8
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [rdi + 0x30], rax
movzx edi, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x70]
jmp 0x140057473
mov rcx, qword [rcx + 0x98]
test rcx, rcx
je 0x1400573fd
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rdx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x80]
mov rax, rdx
sub rax, r8
sar rax, 3
test rax, rax
je 0x14005746c
mov r10d, esi
mov r9, rsi
sub rdx, r8
sar rdx, 3
cmp rdx, r9
jbe 0x140057673
lfence
mov r8, qword [rbp + 0x80]
mov rdi, qword [r8 + r9*8]
cmp qword [rdi + 8], r12
je 0x140057590
mov rdx, qword [rbp + 0x88]
inc r10d
mov rcx, rdx
movsxd rax, r10d
sub rcx, r8
inc r9
sar rcx, 3
cmp rax, rcx
jb 0x140057420
movzx edi, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14005747e
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test r15b, r15b
je 0x140057561
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.1400c5120
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400c46bc
test rax, rax
je 0x1400574c4
mov word [rax + 2], si
lea r8, str.AsusLinkWP2P.exe
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400d6ec0
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x800
call fcn.1400c5120
lea rcx, [rbp + 0xa8]
cmp qword [rcx + 0x18], 8
jb 0x140057500
mov rcx, qword [rcx]
mov dword [rsp + 0x38], ebx
lea r9, [rsp + 0x50]
movzx eax, dil
lea r8, str.__s___toast___s___file_Cancel___s___d__d
mov dword [rsp + 0x30], eax
mov edx, 0x400
mov qword [rsp + 0x28], rcx
lea rax, str.B9ECED6F.ASUSPCAssistant.asToastNotifier.exe
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x20], rax
call fcn.140017d20
lea rdx, [rsp + 0x260]
lea rcx, str._AsusSync_FileTransfer__RPCCmdHandler_RPCCMD_FILE_CANCEL_SESSION____show_toast_:__s_n
call fcn.140095ab0
xor r8d, r8d
lea rcx, [rsp + 0x260]
xor edx, edx
call fcn.140097090
movzx eax, r15b
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0xac8]
add rsp, 0xa70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rdi]
mov r14d, esi
mov r8, qword [rdx]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
test rax, rax
je 0x14005764f
nop dword [rax]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
cmp rax, rsi
jbe 0x14005766d
lfence
mov rax, qword [rdx]
mov rbx, qword [rax + rsi*8]
cmp dword [rbx + 0x60], 0x64
je 0x140057620
cmp qword [rbx + 0x58], 8
lea r8, [rbx + 0x40]
jb 0x1400575e2
mov r8, qword [r8]
mov rdx, r12
lea rcx, str._AsusSync_FileTransfer__CancelSession_0x_I64X____sending_path:__s_n
call fcn.140095ab0
cmp dword [rbx + 0x60], 0x64
je 0x14005761d
cmp byte [rbx + 0x79], 0
jne 0x14005761d
mov rcx, qword [rbx + 0x70]
mov byte [rbx + 0x78], r13b
mov byte [rbx + 0x79], 1
cmp rcx, 0xffffffffffffffff
je 0x14005761d
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
mov r15b, 1
mov rdx, qword [rdi]
inc r14d
mov ebx, dword [rsp + 0x44]
inc rsi
inc ebx
movsxd rax, r14d
mov dword [rsp + 0x44], ebx
mov r8, qword [rdx]
mov rcx, qword [rdx + 8]
sub rcx, r8
sar rcx, 3
cmp rax, rcx
jb 0x1400575b0
xor esi, esi
cmp qword [rdi + 0x30], 0
mov byte [rdi + 0x2c], 1
jne 0x140057467
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [rdi + 0x30], rax
jmp 0x140057467
call fcn.14000a150
int3
call fcn.14000a150
int3