Function at 0x140007570
Capabilities:
Create directory
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 0x52]
mov dword [rsp + 0x60], eax
movzx ebp, byte [rsp + 0x56]
movzx r13d, byte [rsp + 0x58]
movzx edi, byte [rsp + 0x5a]
movzx r14d, byte [rsp + 0x5c]
mov rbx, qword [0x1400c7288]
mov rsi, qword [0x1400c7290]
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r12, [0x1400c67c0]
nop word cs:[rax + rax]
mov ecx, dword [r12 + r15*4 + 0x10]
cmp ecx, eax
je 0x140007627
mov ecx, dword [r12 + r15*4 + 0x14]
cmp ecx, eax
je 0x140007618
mov ecx, dword [r12 + r15*4 + 0x18]
cmp ecx, eax
je 0x14000761d
mov ecx, dword [r12 + r15*4 + 0x1c]
cmp ecx, eax
je 0x140007623
add r15, 4
cmp r15, 0x80
jne 0x1400075e0
mov eax, 0xffffffff
jmp 0x14000762a
inc r15
jmp 0x140007627
add r15, 2
jmp 0x140007627
add r15, 3
mov eax, r15d
shl rax, 4
mov rdx, qword [rax + r12 + 0x218]
mov rcx, qword [rax + r12 + 0x210]
add rcx, rdx
add rdx, rsi
add rdx, 6
mov qword [rax + r12 + 0x218], rdx
test rsi, rsi
mov qword [rsp + 0x78], rcx
je 0x140007673
mov rdx, rbx
mov r8, rsi
call fcn.140091e40
mov rcx, qword [rsp + 0x78]
mov byte [rcx + rsi], 0x2f
inc rsi
jmp 0x140007675
xor esi, esi
mov dword [rcx + rsi], 0x73676f6c
mov qword [rsp + 0x70], rsi
lea rbx, [rsi + 4]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rbx
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
mov ecx, dword [r12 + r15*4 + 0x10]
cmp ecx, eax
je 0x1400076e7
mov ecx, dword [r12 + r15*4 + 0x14]
cmp ecx, eax
je 0x1400076d8
mov ecx, dword [r12 + r15*4 + 0x18]
cmp ecx, eax
je 0x1400076dd
mov ecx, dword [r12 + r15*4 + 0x1c]
cmp ecx, eax
je 0x1400076e3
add r15, 4
cmp r15, 0x80
jne 0x1400076a0
mov eax, 0xffffffff
jmp 0x1400076ea
inc r15
jmp 0x1400076e7
add r15, 2
jmp 0x1400076e7
add r15, 3
mov eax, r15d
shl rax, 4
mov rcx, qword [rax + r12 + 0x218]
mov r8, qword [rax + r12 + 0x210]
add r8, rcx
lea rcx, [rcx + rbx*4]
add rcx, 2
mov qword [rax + r12 + 0x218], rcx
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x80]
call fcn.1400030a0
mov r15, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov word [r15 + rax], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x140007799
mov r15, qword [rsp + 0x78]
mov byte [r15 + rbx], 0
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebp
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
lea rdx, str._s_log__llu__u__u__uh__um__us.txt
lea rcx, [rsp + 0xb0]
mov r8, r15
mov r9, qword [rsp + 0x68]
call fcn.140002610
mov byte [r15 + rbx], 0
jmp 0x1400077d2
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebp
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
lea rdx, str._s_log__llu__u__u__uh__um__us.txt
xor r15d, r15d
lea rcx, [rsp + 0xb0]
xor r8d, r8d
mov r9, qword [rsp + 0x68]
call fcn.140002610
lea r8, [0x1400aa39e]
lea rcx, [rsp + 0x80]
mov rdx, r15
mov r9d, 0x20
call fcn.140005440
movsxd r15, dword [rsp + 0x8c]
cmp r15, 9
jb 0x140007a1d
mov r8d, dword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
lea r9, [0x140007a80]
mov rcx, r14
mov edx, r15d
call fcn.140001d30
imul rax, r15, 0x838
add rax, r14
mov qword [rsp + 0x68], rax
cmp r14, rax
jae 0x140007a1d
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 6]
mov qword [rsp + 0x60], rcx
add rax, 5
mov qword [rsp + 0x70], rax
xor edi, edi
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov rbp, qword [r14]
mov r13, qword [r14 + 8]
call r15
xor ecx, ecx
nop dword [rax]
mov edx, dword [r12 + rcx*4 + 0x10]
cmp edx, eax
je 0x1400078ca
mov edx, dword [r12 + rcx*4 + 0x14]
cmp edx, eax
je 0x1400078b0
mov edx, dword [r12 + rcx*4 + 0x18]
cmp edx, eax
je 0x1400078c0
mov edx, dword [r12 + rcx*4 + 0x1c]
cmp edx, eax
je 0x1400078c6
add rcx, 4
cmp rcx, 0x80
jne 0x140007870
mov eax, 0xffffffff
jmp 0x1400078cc
inc rcx
jmp 0x1400078ca
add rcx, 2
jmp 0x1400078ca
add rcx, 3
mov eax, ecx
shl rax, 4
mov rcx, qword [rax + r12 + 0x218]
mov r15, qword [rax + r12 + 0x210]
add r15, rcx
mov rdx, qword [rsp + 0x60]
add rdx, r13
add rdx, rcx
mov qword [rax + r12 + 0x218], rdx
mov qword [rsp + 0xa0], r15
test rbx, rbx
je 0x140007920
mov rcx, r15
mov rdx, qword [rsp + 0x78]
mov r8, rbx
call fcn.140091e40
mov byte [r15 + rbx], 0x2f
mov rsi, qword [rsp + 0x70]
jmp 0x140007922
xor esi, esi
add r15, rsi
mov rcx, r15
mov rdx, rbp
mov r8, r13
call fcn.140091e40
add rsi, r13
mov qword [rsp + 0xa8], rsi
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call r15
xor ecx, ecx
nop word [rax + rax]
mov edx, dword [r12 + rcx*4 + 0x10]
cmp edx, eax
je 0x1400079aa
mov edx, dword [r12 + rcx*4 + 0x14]
cmp edx, eax
je 0x140007990
mov edx, dword [r12 + rcx*4 + 0x18]
cmp edx, eax
je 0x1400079a0
mov edx, dword [r12 + rcx*4 + 0x1c]
cmp edx, eax
je 0x1400079a6
add rcx, 4
cmp rcx, 0x80
jne 0x140007950
mov eax, 0xffffffff
jmp 0x1400079ac
inc rcx
jmp 0x1400079aa
add rcx, 2
jmp 0x1400079aa
add rcx, 3
mov eax, ecx
shl rax, 4
mov rcx, qword [rax + r12 + 0x218]
mov r8, qword [rax + r12 + 0x210]
add r8, rcx
lea rcx, [rcx + rsi*4]
add rcx, 2
mov qword [rax + r12 + 0x218], rcx
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call fcn.1400030a0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
mov eax, dword [rsp + 0x8c]
sub eax, edi
cmp eax, 8
je 0x140007a1d
add r14, 0x838
cmp r14, qword [rsp + 0x68]
jb 0x140007860
mov esi, dword [0x1400c72a0]
mov rdi, qword [0x1400c7298]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x90], rcx
call fcn.140096a30
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8d, esi
call fcn.140004940
mov qword [0x1400c72a0], 0
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret