Function at 0x6f0e3be0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [rsp + 0x1d8]
mov r10d, dword [rsp + 0x1d0]
mov r11w, word [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1c0]
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x138], r8
mov qword [rsp + 0x130], r9
mov dword [rsp + 0x128], 0
mov dword [rsp + 0x7c], 0
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x6c], r10d
mov word [rsp + 0x6a], r11w
mov qword [rsp + 0x60], rsi
call fcn.6ed6fa70
cmp dword [rsp + 0x1d0], 0
jge 0x6f0e3c82
mov dword [rsp + 0x1d0], 6
cmp qword [rsp + 0x148], 0
je 0x6f0e3d67
cmp qword [rsp + 0x140], 0
je 0x6f0e3d67
cmp qword [rsp + 0x130], 0
je 0x6f0e3cbe
cmp qword [rsp + 0x138], 0
je 0x6f0e3d67
movzx eax, word [rsp + 0x1c8]
cmp eax, 0
je 0x6f0e3cde
cmp qword [rsp + 0x1c0], 0
je 0x6f0e3d67
mov eax, dword [rsp + 0x1d0]
mov ecx, 0xffffffff
mov edx, ecx
xor edx, 0xf
and edx, 0xfddc36a0
mov r8d, ecx
xor r8d, 0xfddc36a0
mov r9d, r8d
and r9d, 0xf
mov r10d, ecx
xor r10d, 0xffffffff
and r10d, 0xfddc36a0
and r8d, 0xffffffff
or edx, r9d
or r10d, r8d
xor edx, r10d
mov r8d, eax
xor r8d, 0xffffffff
mov r9d, edx
and r9d, r8d
xor edx, 0xffffffff
mov r8d, eax
and r8d, edx
or r9d, r8d
xor r9d, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0x473c795c
or r9d, eax
or ecx, 0x473c795c
xor r9d, 0xffffffff
and r9d, ecx
cmp r9d, 0xa
jbe 0x6f0e3d94
cmp qword [rsp + 0x1d8], 0
je 0x6f0e3d84
mov rax, qword [rsp + 0x1d8]
mov dword [rax], 0x18
mov dword [rsp + 0x154], 0
jmp 0x6f0e4499
mov rcx, qword [rsp + 0x140]
call fcn.6eeff070
cmp eax, 0
jne 0x6f0e3dd7
cmp qword [rsp + 0x1d8], 0
je 0x6f0e3dc7
mov rax, qword [rsp + 0x1d8]
mov dword [rax], 0x19
mov dword [rsp + 0x154], 0
jmp 0x6f0e4499
mov rcx, qword [rsp + 0x148]
lea rdx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll__stat64]
cmp eax, 0
je 0x6f0e3e61
xor eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x148]
mov r9d, dword [rsp + 0x1d0]
lea rcx, [rsp + 0xb8]
call fcn.6ee634d0
cmp eax, 0
jne 0x6f0e3e51
cmp qword [rsp + 0x1d8], 0
je 0x6f0e3e41
mov eax, dword [rsp + 0xd4]
mov rcx, qword [rsp + 0x1d8]
mov dword [rcx], eax
mov dword [rsp + 0x154], 0
jmp 0x6f0e4499
mov dword [rsp + 0x128], 1
jmp 0x6f0e4192
xor eax, eax
mov r9d, eax
mov rdx, qword [rsp + 0x148]
mov eax, dword [rsp + 0x1d0]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x5017c9b9
mov r8d, 0xffffffff
mov r10d, r8d
xor r10d, 0x5017c9b9
mov r11d, eax
and r11d, r10d
mov esi, r8d
xor esi, 0xffffffff
and esi, 0x5017c9b9
and r10d, 0xffffffff
or ecx, r11d
or esi, r10d
xor ecx, esi
mov r10d, r8d
xor r10d, 0x800
and r10d, 0x69a8e42d
mov r11d, r8d
xor r11d, 0x69a8e42d
mov esi, r11d
and esi, 0x800
mov edi, r8d
xor edi, 0xffffffff
and edi, 0x69a8e42d
and r11d, 0xffffffff
or r10d, esi
or edi, r11d
xor r10d, edi
mov r11d, r8d
xor r11d, 0xe6b443f6
and r11d, 0xffffffff
mov esi, r8d
xor esi, 0xffffffff
and esi, 0xe6b443f6
or r11d, esi
mov esi, ecx
xor esi, 0xffffffff
mov edi, r8d
xor edi, 0xe6b443f6
mov ebx, r8d
xor ebx, 0x84939c00
or esi, edi
or ebx, 0x84939c00
xor esi, 0xffffffff
and esi, ebx
mov edi, r11d
xor edi, 0xffffffff
mov ebx, eax
xor ebx, edi
and ebx, eax
mov eax, r8d
xor eax, 0xe6b443f6
mov edi, r10d
xor edi, eax
and edi, r10d
mov eax, r8d
xor eax, 0x800
mov ebp, r11d
xor ebp, 0xffffffff
mov r14d, r8d
xor r14d, 0xa62920d2
or eax, ebp
or r14d, 0xa62920d2
xor eax, 0xffffffff
and eax, r14d
mov ebp, esi
xor ebp, 0xffffffff
mov r14d, ebx
xor r14d, 0xffffffff
mov r15d, r8d
xor r15d, 0x77aa55bc
mov r12d, ebp
and r12d, 0x77aa55bc
and esi, r15d
mov r13d, r14d
and r13d, 0x77aa55bc
and ebx, r15d
or r12d, esi
or r13d, ebx
xor r12d, r13d
or ebp, r14d
xor ebp, 0xffffffff
or r15d, 0x77aa55bc
and ebp, r15d
or r12d, ebp
mov esi, edi
xor esi, 0xffffffff
mov ebx, eax
xor ebx, 0xffffffff
mov ebp, r8d
xor ebp, 0xbee81f7
mov r14d, esi
and r14d, 0xbee81f7
and edi, ebp
mov r15d, ebx
and r15d, 0xbee81f7
and eax, ebp
or r14d, edi
or r15d, eax
xor r14d, r15d
or esi, ebx
xor esi, 0xffffffff
or ebp, 0xbee81f7
and esi, ebp
or r14d, esi
mov eax, r12d
xor eax, 0xffffffff
mov esi, r14d
and esi, eax
xor r14d, 0xffffffff
and r12d, r14d
or esi, r12d
mov eax, ecx
and eax, r10d
xor ecx, r10d
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x79b104a9
mov r10d, r8d
xor r10d, 0x79b104a9
and eax, r10d
mov edi, r8d
xor edi, 0xffffffff
and edi, 0x79b104a9
and r10d, 0xffffffff
or ecx, eax
or edi, r10d
xor ecx, edi
mov eax, r8d
xor eax, 0xe6b443f6
mov r10d, r11d
xor r10d, 0xffffffff
mov edi, r8d
xor edi, 0xe7cf6494
mov ebx, eax
and ebx, 0xe7cf6494
mov ebp, edi
and ebp, 0xe6b443f6
mov r14d, r10d
and r14d, 0xe7cf6494
and r11d, edi
or ebx, ebp
or r14d, r11d
xor ebx, r14d
or eax, r10d
xor eax, 0xffffffff
or edi, 0xe7cf6494
and eax, edi
or ebx, eax
xor ecx, 0xffffffff
xor ebx, 0xffffffff
xor r8d, 0x21a1d172
or ecx, ebx
or r8d, 0x21a1d172
xor ecx, 0xffffffff
and ecx, r8d
mov eax, esi
and eax, ecx
xor esi, ecx
or eax, esi
lea rcx, [rsp + 0xb8]
mov r8d, eax
mov qword [rsp + 0x20], 0
call fcn.6eda5c80
cmp eax, 0
jne 0x6f0e4128
cmp qword [rsp + 0x1d8], 0
je 0x6f0e4118
mov eax, dword [rsp + 0xd4]
mov rcx, qword [rsp + 0x1d8]
mov dword [rcx], eax
mov dword [rsp + 0x154], 0
jmp 0x6f0e4499
mov rdx, qword [rsp + 0x148]
mov r8d, dword [rsp + 0x1d0]
lea rcx, [rsp + 0xb8]
call fcn.6ee6a6d0
cmp eax, 0
jne 0x6f0e418d
cmp qword [rsp + 0x1d8], 0
je 0x6f0e416e
mov eax, dword [rsp + 0xd4]
mov rcx, qword [rsp + 0x1d8]
mov dword [rcx], eax
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.6ed6fe10
mov dword [rsp + 0x154], 0
jmp 0x6f0e4499
jmp 0x6f0e4192
xor eax, eax
mov ecx, eax
xor eax, eax
mov rdx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x138]
mov r9, qword [rsp + 0x130]
mov r10, qword [rsp + 0x1c0]
mov r11w, word [rsp + 0x1c8]
mov esi, dword [rsp + 0x1d0]
lea rdi, [rsp + 0xb8]
mov qword [rsp + 0x58], rcx
mov rcx, rdi
mov qword [rsp + 0x20], r10
mov word [rsp + 0x28], r11w
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x54], eax
call fcn.6ee78e70
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0xd4]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0xb8]
call fcn.6f053240
cmp eax, 0
jne 0x6f0e424a
cmp dword [rsp + 0x7c], 0
jne 0x6f0e423f
mov eax, dword [rsp + 0xd4]
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x12c], 0
xor eax, eax
mov ecx, dword [0x6f152a74]
mov edx, dword [0x6f152dcc]
sub eax, 0x651c4df7
mov r8d, ecx
add r8d, eax
add r8d, 0x55a87dc0
sub r8d, 1
sub r8d, 0x55a87dc0
add r8d, 0x1516a613
add r8d, 0x651c4df7
sub r8d, 0x1516a613
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
and r11b, 0
mov sil, 1
mov dil, sil
xor dil, 0
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0
and r10b, dil
or r11b, r9b
or bpl, r10b
xor r11b, bpl
mov r9b, bl
xor r9b, 0xff
mov r10b, r11b
xor r10b, 0xff
xor sil, 1
mov dil, r9b
and dil, 0xff
and bl, sil
mov bpl, r10b
and bpl, 0xff
and r11b, sil
or dil, bl
or bpl, r11b
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 1
and r9b, sil
or dil, r9b
test dil, 1
jne 0x6f0e432d
jmp 0x6f0e44b4
mov edx, dword [rsp + 0x12c]
lea rcx, [rsp + 0xb8]
call fcn.6ee60600
xor edx, edx
cmp eax, 0
setne r8b
mov eax, dword [0x6f152a74]
mov r9d, dword [0x6f152dcc]
mov r10d, edx
sub r10d, 1
add r10d, 0
sub edx, r10d
mov r10d, eax
sub r10d, edx
imul eax, r10d
and eax, 1
cmp eax, 0
sete r11b
cmp r9d, 0xa
setl bl
mov sil, r11b
xor sil, 0xff
mov dil, bl
xor dil, 0xff
mov bpl, 1
mov r14b, bpl
xor r14b, 1
or sil, dil
or r14b, 1
xor sil, 0xff
and sil, r14b
mov dil, r11b
xor dil, 0xff
mov r14b, bl
and r14b, dil
xor bl, 0xff
and r11b, bl
or r14b, r11b
mov r11b, sil
xor r11b, 0xff
mov bl, r14b
xor bl, 0xff
xor bpl, 1
mov dil, r11b
and dil, 0xff
and sil, bpl
mov r15b, bl
and r15b, 0xff
and r14b, bpl
or dil, sil
or r15b, r14b
xor dil, r15b
or r11b, bl
xor r11b, 0xff
or bpl, 1
and r11b, bpl
or dil, r11b
test dil, 1
mov byte [rsp + 0x53], r8b
jne 0x6f0e440f
jmp 0x6f0e44b4
mov al, byte [rsp + 0x53]
test al, 1
jne 0x6f0e4441
jmp 0x6f0e4420
cmp dword [rsp + 0x7c], 0
jne 0x6f0e4436
mov eax, dword [rsp + 0xd4]
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x12c], 0
cmp dword [rsp + 0x12c], 0
jne 0x6f0e446e
cmp dword [rsp + 0x128], 0
je 0x6f0e446e
mov rcx, qword [rsp + 0x148]
call sub.msvcrt.dll_remove
mov dword [rsp + 0x78], eax
cmp qword [rsp + 0x1d8], 0
je 0x6f0e448b
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1d8]
mov dword [rcx], eax
mov eax, dword [rsp + 0x12c]
mov dword [rsp + 0x154], eax
mov eax, dword [rsp + 0x154]
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [rsp + 0x12c]
lea rcx, [rsp + 0xb8]
call fcn.6ee60600
jmp 0x6f0e432d