Function at 0x140005800
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x5f0], rbx
mov rax, qword [0x14021ca50]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov qword [rsp + 0x68], rdx
mov rbx, rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rdx
call fcn.140012980
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140005873
mov ecx, 0x80004005
call fcn.14000a340
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x38], rdi
call fcn.140012980
mov r11, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400058a5
mov ecx, 0x80004005
call fcn.14000a340
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r8, str.INF
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140009c80
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rbx, [rdi - 0x18]
or r15, 0xffffffffffffffff
cmp rcx, rbx
je 0x140005a1e
cmp dword [rbx + 0x10], 0
jl 0x14000591c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000591c
call fcn.140009f10
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140005913
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
jmp 0x140005a19
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x140005981
mov rsi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x140005a1e
cmp dword [rbx + 0x10], 0
jge 0x140005955
cmp dword [rdi - 0xc], 0
jge 0x140005948
mov ecx, 0x80070057
call fcn.14000a340
int3
mov dword [rdi - 0x10], r14d
mov word [rdi], r14w
jmp 0x140005a1e
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14000596f
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140005a19
test r13, r13
jne 0x140005991
mov ecx, 0x80070057
call fcn.14000a340
int3
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rdi
sar r12, 1
test esi, esi
jns 0x1400059b0
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, esi
or eax, ecx
jge 0x1400059d2
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.14000a1c0
mov rdi, qword [rsp + 0x38]
mov eax, dword [rsp + 0x28]
lea rbx, [rsi + rsi]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r12, rax
ja 0x1400059f7
lea r8, [rdi + r12*2]
call fcn.140161bac
jmp 0x1400059ff
mov r8, r13
call fcn.140161b24
cmp esi, dword [rdi - 0xc]
jg 0x140005a0e
mov dword [rdi - 0x10], esi
mov word [rbx + rdi], r14w
jmp 0x140005a1e
mov ecx, 0x80070057
call fcn.14000a340
int3
mov qword [rsp + 0x38], rax
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005a3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.OEM.INF
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140009c80
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
mov rdi, qword [rsp + 0x40]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x140005ba8
cmp dword [rbx + 0x10], 0
jl 0x140005aa6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140005aa6
call fcn.140009f10
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140005a9d
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
jmp 0x140005ba3
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x140005b0b
mov rsi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x140005ba8
cmp dword [rbx + 0x10], 0
jge 0x140005adf
cmp dword [rdi - 0xc], 0
jge 0x140005ad2
mov ecx, 0x80070057
call fcn.14000a340
int3
mov dword [rdi - 0x10], r14d
mov word [rdi], r14w
jmp 0x140005ba8
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x140005af9
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140005ba3
test r13, r13
jne 0x140005b1b
mov ecx, 0x80070057
call fcn.14000a340
int3
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rdi
sar r12, 1
test esi, esi
jns 0x140005b3a
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, esi
or eax, ecx
jge 0x140005b5c
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.14000a1c0
mov rdi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
lea rbx, [rsi + rsi]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r12, rax
ja 0x140005b81
lea r8, [rdi + r12*2]
call fcn.140161bac
jmp 0x140005b89
mov r8, r13
call fcn.140161b24
cmp esi, dword [rdi - 0xc]
jg 0x140005b98
mov dword [rdi - 0x10], esi
mov word [rbx + rdi], r14w
jmp 0x140005ba8
mov ecx, 0x80070057
call fcn.14000a340
int3
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005bc8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400066c5
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x58], rbx
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x140005c13
cmp rax, qword [rbx]
jne 0x140005c13
mov rdi, rbx
lock inc dword [rbx + 0x10]
jmp 0x140005c4f
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400066bf
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140161b24
lea rax, [rdi + 0x18]
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x1c]
lea rcx, [rbp - 0x30]
call fcn.140004d20
cmp eax, 1
jne 0x140006578
call fcn.140012980
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400066a9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor eax, eax
mov rcx, r15
lea rdi, [rbp + 0x1c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140005d04
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140005d7a
cmp dword [rdx + 0x10], eax
jge 0x140005cd9
cmp dword [rbx - 0xc], eax
jl 0x140006596
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140005d7a
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005cf0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x140005d7a
mov r12d, dword [rbx - 0x10]
lea rsi, [rbp + 0x1c]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
js 0x14000669e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140005d3c
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14000a1c0
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r12
lea r12, [rax + rax]
mov r9, r12
ja 0x140005d60
lea r8, [rbx + rsi*2]
call fcn.140161bac
jmp 0x140005d69
lea r8, [rbp + 0x1c]
call fcn.140161b24
cmp edi, dword [rbx - 0xc]
jg 0x140006693
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], r14w
lea r8, [0x1401dd414]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x38]
call fcn.140009c80
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140009240
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140005ed8
cmp dword [rdi + 0x10], 0
jl 0x140005df4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140005df4
call fcn.140009f10
mov rbx, rax
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140005de6
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140005ed8
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x140005e57
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x140005ed8
cmp dword [rdi + 0x10], 0
jge 0x140005e26
cmp dword [rbx - 0xc], 0
jl 0x1400065a1
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140005ed8
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140005e40
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x140005ed8
test r13, r13
je 0x1400065c2
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test esi, esi
js 0x1400065b7
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, esi
or eax, ecx
jge 0x140005e9a
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.14000a1c0
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
lea rdi, [rsi + rsi]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x140005ebf
lea r8, [rbx + r12*2]
call fcn.140161bac
jmp 0x140005ec7
mov r8, r13
call fcn.140161b24
cmp esi, dword [rbx - 0xc]
jg 0x1400065ac
mov dword [rbx - 0x10], esi
mov word [rdi + rbx], r14w
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005ef8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005f17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140012980
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140006688
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
xor eax, eax
mov rcx, r15
lea rdi, [rbp + 0x1c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140005fb9
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14000602f
cmp dword [rdx + 0x10], eax
jge 0x140005f8e
cmp dword [rbx - 0xc], eax
jl 0x1400065cd
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x14000602f
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005fa5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
jmp 0x14000602f
mov r12d, dword [rbx - 0x10]
lea rsi, [rbp + 0x1c]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
js 0x14000667d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140005ff1
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000a1c0
mov rbx, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r12
lea r12, [rax + rax]
mov r9, r12
ja 0x140006015
lea r8, [rbx + rsi*2]
call fcn.140161bac
jmp 0x14000601e
lea r8, [rbp + 0x1c]
call fcn.140161b24
cmp edi, dword [rbx - 0xc]
jg 0x140006672
mov dword [rbx - 0x10], edi
mov word [r12 + rbx], r14w
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x140006667
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or ecx, eax
jge 0x14000605d
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000a1c0
mov rbx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401621a4
cmp edi, dword [rbx - 0xc]
jg 0x14000665c
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r14w
cmp dword [rbx - 0x10], 3
jl 0x140006537
lea rcx, [rbx + 6]
lea rdx, [0x1401dd418]
call fcn.140161e64
test rax, rax
je 0x140006537
sub rax, rbx
sar rax, 1
test eax, eax
jle 0x140006537
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400091a0
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400061f6
cmp dword [rdi + 0x10], 0
jl 0x140006112
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140006112
call fcn.140009f10
mov rbx, rax
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140006104
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1400061f6
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x140006175
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x1400061f6
cmp dword [rdi + 0x10], 0
jge 0x140006144
cmp dword [rbx - 0xc], 0
jl 0x1400065d8
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x1400061f6
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000615e
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x1400061f6
test r13, r13
je 0x1400065f9
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test esi, esi
js 0x1400065ee
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, esi
or eax, ecx
jge 0x1400061b8
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14000a1c0
mov rbx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
lea rdi, [rsi + rsi]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x1400061dd
lea r8, [rbx + r12*2]
call fcn.140161bac
jmp 0x1400061e5
mov r8, r13
call fcn.140161b24
cmp esi, dword [rbx - 0xc]
jg 0x1400065e3
mov dword [rbx - 0x10], esi
mov word [rdi + rbx], r14w
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006216
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1401dd420]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x48]
call fcn.140009c80
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
mov rdi, qword [rsp + 0x20]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x140006367
cmp dword [rbx + 0x10], 0
jl 0x140006283
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140006283
call fcn.140009f10
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140006275
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x140006367
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x1400062e6
mov rsi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x140006367
cmp dword [rbx + 0x10], 0
jge 0x1400062b5
cmp dword [rdi - 0xc], 0
jl 0x140006604
mov dword [rdi - 0x10], r14d
mov word [rdi], r14w
jmp 0x140006367
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400062cf
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140006367
test r13, r13
je 0x140006625
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rdi
sar r12, 1
test esi, esi
js 0x14000661a
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, esi
or eax, ecx
jge 0x140006329
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14000a1c0
mov rdi, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
lea rbx, [rsi + rsi]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r12, rax
ja 0x14000634e
lea r8, [rdi + r12*2]
call fcn.140161bac
jmp 0x140006356
mov r8, r13
call fcn.140161b24
cmp esi, dword [rdi - 0xc]
jg 0x14000660f
mov dword [rdi - 0x10], esi
mov word [rbx + rdi], r14w
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006386
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1401dd414]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x40]
call fcn.140009c80
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140009240
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
mov rdi, qword [rsp + 0x20]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x1400064e9
cmp dword [rbx + 0x10], 0
jl 0x140006405
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140006405
call fcn.140009f10
mov rdi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400063f7
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1400064e9
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x140006468
mov rsi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x1400064e9
cmp dword [rbx + 0x10], 0
jge 0x140006437
cmp dword [rdi - 0xc], 0
jl 0x140006630
mov dword [rdi - 0x10], r14d
mov word [rdi], r14w
jmp 0x1400064e9
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x140006451
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x1400064e9
test r13, r13
je 0x140006651
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x28], eax
mov r12, r13
sub r12, rdi
sar r12, 1
test esi, esi
js 0x140006646
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, esi
or eax, ecx
jge 0x1400064ab
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14000a1c0
mov rdi, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
lea rbx, [rsi + rsi]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r12, rax
ja 0x1400064d0
lea r8, [rdi + r12*2]
call fcn.140161bac
jmp 0x1400064d8
mov r8, r13
call fcn.140161b24
cmp esi, dword [rdi - 0xc]
jg 0x14000663b
mov dword [rdi - 0x10], esi
mov word [rbx + rdi], r14w
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006509
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006528
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006553
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006573
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
lea rdx, [rbp - 0x10]
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400066b4
jmp 0x140005bf3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80004005
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
int3
mov ecx, 0x80070057
call fcn.14000a340
nop
mov ecx, 0x80004005
call fcn.14000a340
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400066c5
call fcn.14000a160
int3
lea rdx, [0x1401dce10]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call fcn.140009410
test al, al
je 0x1400068f0
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
jl 0x1400068f0
lea rdx, str.WINDOWSSYSTEM32DRVSTORE
call fcn.140161e64
test rax, rax
je 0x1400068f0
sub rax, qword [rsi]
sar rax, 1
test eax, eax
jle 0x1400068f0
call fcn.140012980
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140006731
mov ecx, 0x80004005
call fcn.14000a340
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r8, [0x1401dd428]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140009c80
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140009fa0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006786
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp + 0x240]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400068cf
call fcn.140012980
mov rcx, rax
test rax, rax
setne r14b
test r14d, r14d
jne 0x1400067c4
mov ecx, 0x80004005
call fcn.14000a340
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
nop word [rax + rax]
xor eax, eax
mov rcx, r15
lea rdi, [rbp + 0x26c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x26c]
lea rcx, [rsp + 0x48]
call fcn.14000a220
lea r8, [0x1401dd414]
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.140009c80
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140009240
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140009fa0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000685b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000687a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x240]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400067e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400068cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400068f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006911
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006932
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006955
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r15d
dec r15d
test r15d, r15d
jg 0x140006973
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140161940
mov rbx, qword [rsp + 0x5f0]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret