Function at 0x140012990
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get disk information via ioctl
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
mov eax, 0x1478
call fcn.14001c210
sub rsp, 0x1478
mov r9d, 0x5c
mov rax, qword [0x140024c20]
xor r10d, r10d
xor rax, rsp
mov rdi, r8
mov qword [rsp + 0x1468], rax
mov r12, rdx
mov rsi, rcx
mov byte [rsp + 0x1440], r9b
xor ebp, ebp
mov byte [rsp + 0x1441], r9b
mov byte [rsp + 0x1442], 0x2e
mov byte [rsp + 0x1443], r9b
mov byte [rsp + 0x1444], 0x41
mov byte [rsp + 0x1445], 0x3a
mov byte [rsp + 0x1446], r9b
mov byte [rsp + 0x1447], r10b
mov dword [rsp + 0x1464], r10d
cmp dword [0x140024c40], 0
jne 0x140012a30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0xbe4]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x140012a81
lea rbx, str.ssproiut
lea rcx, [rsp + 0xce8]
mov qword [rsp + 0x20], rbx
lea r8, str._s_s__d.log
mov dword [rsp + 0x28], edx
mov edx, 0x104
lea r9, [rsp + 0xbe4]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x140012ac3
lea rbx, str.ssproiut
lea rcx, [rsp + 0xce8]
mov dword [rsp + 0x20], edx
mov edx, 0x104
lea r8, str.c:_temp_s__d.log
mov r9, rbx
call qword [sym.imp.MSVCR100.dll__snprintf]
mov edx, 0x104
lea rcx, [rsp + 0xbe4]
lea r8, str.c:_temp
call qword [sym.imp.MSVCR100.dll__snprintf]
movabs r13, 0
mov eax, 0x140
mov qword [rsp + rax + 0x11f4], r13
mov qword [rsp + rax + 0x11ec], r13
mov qword [rsp + rax + 0x11e4], r13
mov qword [rsp + rax + 0x11dc], r13
sub rax, 0x20
jne 0x140012ad2
mov edx, 0x103
lea rcx, [rsp + 0xdec]
lea r8, [0x1400202fc]
lea r9, [rsp + 0xbe4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0xdec]
lea rdx, [rsp + 0x11fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp r15, 0xffffffffffffffff
je 0x140013dfc
mov rcx, r15
lea rdx, [rsp + 0x11fc]
mov r14d, 1
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140012b75
mov rcx, r15
lea rdx, [rsp + 0x11fc]
inc r14d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140012b5d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp r14d, 0x3c
jbe 0x140012c96
mov eax, 0x140
mov qword [rsp + rax + 0x11f4], r13
mov qword [rsp + rax + 0x11ec], r13
mov qword [rsp + rax + 0x11e4], r13
mov qword [rsp + rax + 0x11dc], r13
sub rax, 0x20
jne 0x140012b8d
lea rcx, [rsp + 0xdec]
lea rdx, [rsp + 0x11fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp r15, 0xffffffffffffffff
je 0x140013dfc
mov edx, 0x103
lea rcx, [rsp + 0xae0]
lea r8, str._s_s
lea r9, [rsp + 0xbe4]
lea rax, [rsp + 0x1228]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0xae0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r15
lea rdx, [rsp + 0x11fc]
dec r14d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140012c8d
lea rbx, [rsp + 0x1228]
cmp r14d, 0x3c
jbe 0x140012c86
mov edx, 0x103
lea rcx, [rsp + 0xae0]
lea r8, str._s_s
lea r9, [rsp + 0xbe4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0xae0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r15
lea rdx, [rsp + 0x11fc]
dec r14d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140012c33
lea rbx, str.ssproiut
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r15d, r15d
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0xce8]
call qword [sym.imp.MSVCR100.dll_fopen]
mov r14, rax
test r15d, r15d
je 0x140012cda
test r14, r14
je 0x140012cda
mov rcx, r14
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
mov r9, rbx
lea r8, [rsp + 0xbe4]
mov dword [rsp + 0x20], r15d
call fcn.140010c10
mov ecx, 1
mov edx, 0x105
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [r12 + 0x150], rax
test rax, rax
je 0x1400139d2
mov ecx, 1
mov edx, 0x800
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [r12 + 0x158], rax
test rax, rax
je 0x14001357c
mov dword [rsp + 0x140], r13d
mov eax, 0x100
mov qword [rsp + rax + 0x38], r13
mov qword [rsp + rax + 0x30], r13
mov qword [rsp + rax + 0x28], r13
mov qword [rsp + rax + 0x20], r13
sub rax, 0x20
jne 0x140012d29
mov dword [rsp + 0x11f8], r13d
mov eax, 0x100
mov qword [rsp + rax + 0x10f0], r13
mov qword [rsp + rax + 0x10e8], r13
mov qword [rsp + rax + 0x10e0], r13
mov qword [rsp + rax + 0x10d8], r13
sub rax, 0x20
jne 0x140012d50
mov rax, qword [rsi + 0x178]
lea rdx, [rsp + 0x40]
mov rcx, qword [rax + 8]
test cl, 3
je 0x140012d9e
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x140012da3
inc rdx
test cl, 3
jne 0x140012d8b
call fcn.1400188b0
lea rbx, [rsp + 0x10f8]
mov rdx, rbx
lea rcx, [rsp + 0x40]
test cl, 3
je 0x140012dcb
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x140012dd0
inc rdx
test cl, 3
jne 0x140012db8
call fcn.1400188b0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
je 0x1400134f6
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140012e0c
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x140012e78
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140012e3c
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp byte [rax + rbx - 1], 0x5c
jne 0x140012e78
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140012e6e
mov rax, rdx
add rdx, rcx
call fcn.140018880
mov byte [rax + rbx - 1], 0
jmp 0x140012de1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400134a3
mov dword [rsp + 0x10f4], r13d
mov eax, 0x100
mov qword [rsp + rax + 0xfec], r13
mov qword [rsp + rax + 0xfe4], r13
mov qword [rsp + rax + 0xfdc], r13
mov qword [rsp + rax + 0xfd4], r13
sub rax, 0x20
jne 0x140012e97
mov rcx, rbx
lea rdx, [rsp + 0xff4]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
je 0x140013450
mov dword [rsp + 0x11f8], r13d
mov eax, 0x100
mov qword [rsp + rax + 0x10f0], r13
mov qword [rsp + rax + 0x10e8], r13
mov qword [rsp + rax + 0x10e0], r13
mov qword [rsp + rax + 0x10d8], r13
sub rax, 0x20
jne 0x140012ee9
mov rdx, rbx
lea rcx, [rsp + 0xff4]
test cl, 3
je 0x140012f32
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x140012f37
inc rdx
test cl, 3
jne 0x140012f1f
call fcn.1400188b0
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140012f62
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x140012fbd
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140012f92
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp byte [rax + rbx - 1], 0x5c
je 0x140012fbd
mov rdi, rbx
lea rdx, [0x14001e954]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140012faf
mov rcx, rbx
lea rdx, [rsp + 0xef0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x1400133fd
mov dword [rsp + 0x10f4], r13d
mov eax, 0x100
mov qword [rsp + rax + 0xfec], r13
mov qword [rsp + rax + 0xfe4], r13
mov qword [rsp + rax + 0xfdc], r13
mov qword [rsp + rax + 0xfd4], r13
sub rax, 0x20
jne 0x140012fe9
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, r15d
je 0x1400130c8
lea eax, [rbx + 0x41]
mov byte [rsp + 0x1444], al
mov dword [rsp + 0x143c], r13d
mov eax, 0x100
mov qword [rsp + rax + 0x1334], r13
mov qword [rsp + rax + 0x132c], r13
mov qword [rsp + rax + 0x1324], r13
mov qword [rsp + rax + 0x131c], r13
sub rax, 0x20
jne 0x140013043
mov r8d, 0x104
lea rcx, [rsp + 0x1440]
lea rdx, [rsp + 0x133c]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x1400130c8
lea rdi, [rsp + 0x133c]
lea rsi, [rsp + 0xef0]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1400130bb
test dl, dl
je 0x1400130b7
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1400130bb
add rdi, 2
add rsi, 2
test dl, dl
jne 0x140013099
xor eax, eax
jmp 0x1400130c0
sbb eax, eax
or eax, 1
test eax, eax
je 0x140013370
inc ebx
cmp ebx, 0x1a
jl 0x14001301a
lea rdx, [rsp + 0xff4]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140013103
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x14001313f
mov rcx, qword [r12 + 0x150]
lea rdx, [0x14001e308]
lea r8, [rsp + 0xff4]
call qword [sym.imp.MSVCR100.dll_sprintf]
test eax, eax
je 0x14001332a
movsxd rax, eax
mov qword [r12 + 0x18], rax
add dword [r12 + 4], eax
jmp 0x14001332a
mov dword [rsp + 0x10f4], r13d
mov eax, 0x100
mov qword [rsp + rax + 0xfec], r13
mov qword [rsp + rax + 0xfe4], r13
mov qword [rsp + rax + 0xfdc], r13
mov qword [rsp + rax + 0xfd4], r13
sub rax, 0x20
jne 0x14001314c
lea rdx, [0x14001e308]
lea rcx, [rsp + 0xff4]
lea r8, [rsp + 0xef0]
call qword [sym.imp.MSVCR100.dll_sprintf]
lea rdx, [rsp + 0xff4]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400131bf
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x140013266
lea rbx, [rsp + 0xff4]
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400131fb
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp byte [rax + rbx - 1], 0x5c
jne 0x140013266
mov rdx, rbx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14001322d
mov rax, rdx
add rdx, rcx
call fcn.140018880
mov rdx, rbx
mov byte [rax + rbx - 1], 0
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14001325d
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
ja 0x1400131d0
mov edx, 0xc0000000
lea rcx, [rsp + 0xff4]
mov r8d, 3
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x20000000
mov qword [rsp + 0x30], 0
call qword [sym.imp.orauts.dll_CreateFileA]
mov rbp, rax
cmp rbp, 0xffffffffffffffff
je 0x1400133a2
mov rcx, rbp
lea rax, [rsp + 0x1458]
mov edx, 0x2d1080
xor r8d, r8d
xor r9d, r9d
lea rbx, [rsp + 0x1464]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001332a
mov rcx, qword [r12 + 0x150]
lea rdx, str.DEVICEHARDDISK_dPARTITION_d
mov r8d, dword [rsp + 0x145c]
mov r9d, dword [rsp + 0x1460]
call qword [sym.imp.MSVCR100.dll_sprintf]
test eax, eax
je 0x140013321
movsxd rax, eax
mov qword [r12 + 0x18], rax
add dword [r12 + 4], eax
mov rcx, rbp
call qword [sym.imp.orauts.dll_CloseHandle]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test r14, r14
je 0x14001333e
mov rcx, r14
call qword [sym.imp.MSVCR100.dll_fclose]
test rbp, rbp
je 0x14001334c
mov rcx, rbp
call qword [sym.imp.orauts.dll_CloseHandle]
mov rcx, qword [rsp + 0x1468]
xor rcx, rsp
call fcn.14001c150
add rsp, 0x1478
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rdx, [rsp + 0xff4]
lea rcx, [rsp + 0x1440]
test cl, 3
je 0x140013398
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14001339d
inc rdx
test cl, 3
jne 0x140013385
call fcn.1400188b0
jmp 0x1400130d3
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, qword [r12 + 0x158]
lea rdx, str.__s:_d__CreateFile_failed_for__s_with_error___d_
lea r8, str.ssproiut.c
mov r9d, 0x3e0
lea rbx, [rsp + 0xff4]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], eax
call qword [sym.imp.MSVCR100.dll_sprintf]
movsxd rax, eax
mov rcx, r14
mov rdx, qword [r12 + 0x158]
mov qword [r12 + 0x20], rax
add dword [r12 + 4], eax
call fcn.140010c10
jmp 0x140013321
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, qword [r12 + 0x158]
lea rdx, str.__s:_d__GetVolumeNameForVolumeMountPoint_failed_for__s_with_error___d_
lea r8, str.ssproiut.c
mov r9d, 0x3a3
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], eax
call qword [sym.imp.MSVCR100.dll_sprintf]
movsxd rax, eax
mov rcx, r14
mov rdx, qword [r12 + 0x158]
mov qword [r12 + 0x20], rax
add dword [r12 + 4], eax
call fcn.140010c10
jmp 0x14001332a
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, qword [r12 + 0x158]
lea rdx, str.__s:_d__GetVolumePathName_failed_for__s_with_error___d_
lea r8, str.ssproiut.c
mov r9d, 0x38b
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], eax
call qword [sym.imp.MSVCR100.dll_sprintf]
movsxd rax, eax
mov rcx, r14
mov rdx, qword [r12 + 0x158]
mov qword [r12 + 0x20], rax
add dword [r12 + 4], eax
call fcn.140010c10
jmp 0x14001332a
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, qword [r12 + 0x158]
lea rdx, str.__s:_d__GetFileAttributes_failed_for__s_with_error___d_
lea r8, str.ssproiut.c
mov r9d, 0x37d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], eax
call qword [sym.imp.MSVCR100.dll_sprintf]
movsxd rax, eax
mov rcx, r14
mov rdx, qword [r12 + 0x158]
mov qword [r12 + 0x20], rax
add dword [r12 + 4], eax
call fcn.140010c10
jmp 0x14001332a
call qword [sym.imp.orauts.dll_GetLastError]
mov ebx, eax
mov rcx, qword [r12 + 0x150]
lea rdx, str._s__d
lea r8, str.Failed_to_become_named_pipe_client__error_
mov r9d, ebx
call qword [sym.imp.MSVCR100.dll_sprintf]
mov esi, eax
mov rcx, qword [r12 + 0x158]
lea rdx, str.__s:_d__ImpersonateNamedPipeClient_failed_with_error___d_
lea r8, str.ssproiut.c
mov r9d, 0x36c
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR100.dll_sprintf]
mov ebx, eax
mov rcx, r14
mov rdx, qword [r12 + 0x158]
call fcn.140010c10
add esi, ebx
movsxd rax, ebx
test ebx, ebx
mov qword [r12 + 0x20], rax
je 0x14001356a
mov qword [r12 + 0x18], rax
test esi, esi
je 0x14001332a
add dword [r12 + 4], esi
jmp 0x14001332a
mov rcx, r14
lea rdx, str._s:_dallocation_of__d_bytes_for_response_failed
lea r8, str.ssproiut.c
mov r9d, 0x352
mov dword [rsp + 0x20], 0x800
call fcn.140010c10
xor eax, eax
mov ecx, 0x1100
xor edx, edx
mov r8d, 0xe
mov r9d, 0x400
lea rsi, [rsp + 0x1450]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x1450], rax
mov dword [r12 + 0x104], 0xe
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rsi, qword [rsp + 0x1450]
test rsi, rsi
jne 0x140013615
mov rcx, qword [r12 + 0x150]
mov dword [r12 + 0x100], 1
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x14001332a
cmp dword [0x140024c40], 0
jne 0x14001362a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x14001366e
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x144]
mov dword [rsp + 0x28], edx
lea r8, str._s_s__d.log
mov edx, 0x104
lea r9, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x1400136a6
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x144]
lea r8, str.c:_temp_s__d.log
mov edx, 0x104
mov r9, rbx
call qword [sym.imp.MSVCR100.dll__snprintf]
lea r8, str.c:_temp
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll__snprintf]
movabs rax, 0
lea rdi, [rsp + 0x860]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov edx, 0x103
lea r13, [rsp + 0x34c]
mov rcx, r13
lea r8, [0x1400202fc]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
lea rdx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140013981
mov dword [rsp + 0x450], 1
mov rcx, rdi
lea rdx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14001375e
mov qword [rsp + 0xef0], r12
lea r15, [rsp + 0x860]
mov r12d, dword [rsp + 0x450]
mov rcx, rdi
mov rdx, r15
inc r12d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001373b
mov dword [rsp + 0x450], r12d
mov r12, qword [rsp + 0xef0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x450], 0x3c
jbe 0x1400138af
movabs rax, 0
lea rdi, [rsp + 0x860]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov rcx, r13
lea rdx, [rsp + 0x860]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x458], 0xffffffffffffffff
je 0x140013981
lea r15, str._s_s
lea r13, [rsp + 0x248]
mov rcx, r13
mov edx, 0x103
mov r8, r15
lea r9, [rsp + 0x40]
lea rdi, [rsp + 0x88c]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
dec dword [rsp + 0x450]
lea rdx, [rsp + 0x860]
mov rcx, qword [rsp + 0x458]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400138a1
mov qword [rsp + 0xef8], r14
mov qword [rsp + 0xf00], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0xef0], r12
lea r12, [rsp + 0x860]
mov ebx, dword [rsp + 0x450]
mov r14, qword [rsp + 0x458]
cmp ebx, 0x3c
jbe 0x140013882
mov rcx, r13
mov edx, 0x103
mov r8, r15
mov r9, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r14
mov rdx, r12
dec ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140013849
mov rbp, qword [rsp + 0xf00]
lea rbx, str.ssproiut
mov r14, qword [rsp + 0xef8]
mov r12, qword [rsp + 0xef0]
mov rcx, qword [rsp + 0x458]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x144]
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rsp + 0x450], rax
test edi, edi
je 0x1400138ff
mov rax, qword [rsp + 0x450]
test rax, rax
je 0x1400138ff
mov dword [rsp + 0x20], edi
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
mov r9, rbx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x450]
call fcn.140010c10
mov rcx, rsi
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x14001391c
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140013904
dec rax
mov rbx, rax
mov ecx, 1
lea rdi, [rbx + 1]
mov rdx, rdi
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [r12 + 0x158], rax
test rax, rax
je 0x14001399e
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.MSVCR100.dll_strncpy]
movsxd rax, dword [r12 + 4]
mov qword [r12 + 0x20], rdi
lea rdx, [rbx + rax + 1]
mov dword [r12 + 4], edx
mov rax, qword [rsp + 0x450]
test rax, rax
je 0x14001398e
mov rcx, qword [rsp + 0x1450]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400135f6
call qword [sym.imp.orauts.dll_GetLastError]
mov edi, eax
jmp 0x1400138b1
mov rcx, qword [rsp + 0x450]
call qword [sym.imp.MSVCR100.dll_fclose]
jmp 0x14001396e
mov qword [rsp + 0x20], rdi
lea rdx, str._s:_d_allocation_of__d_bytes_for_response_failed
lea r8, str.ssproiut.c
mov r9d, 0x42a
mov rcx, qword [rsp + 0x450]
call fcn.140010c10
mov dword [r12 + 0x100], 1
jmp 0x140013961
mov rcx, r14
lea rdx, str._s:_d_allocation_of__d_bytes_for_response_failed
lea r8, str.ssproiut.c
mov r9d, 0x348
mov dword [rsp + 0x20], 0x104
call fcn.140010c10
xor eax, eax
mov ecx, 0x1100
xor edx, edx
mov r8d, 0xe
mov r9d, 0x400
lea rsi, [rsp + 0x1448]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x1448], rax
mov dword [r12 + 0x104], 0xe
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rsi, qword [rsp + 0x1448]
test rsi, rsi
jne 0x140013a5d
mov dword [r12 + 0x100], 1
jmp 0x14001332a
cmp dword [0x140024c40], 0
jne 0x140013a72
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x140013abc
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x554]
mov dword [rsp + 0x28], edx
lea r8, str._s_s__d.log
mov edx, 0x104
lea r9, [rsp + 0x450]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x140013af7
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x554]
lea r8, str.c:_temp_s__d.log
mov edx, 0x104
mov r9, rbx
call qword [sym.imp.MSVCR100.dll__snprintf]
lea r8, str.c:_temp
lea rcx, [rsp + 0x450]
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll__snprintf]
movabs rax, 0
lea rdi, [rsp + 0x9a0]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov edx, 0x103
lea r13, [rsp + 0x75c]
mov rcx, r13
lea r8, [0x1400202fc]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x450]
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
lea rdx, [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140013db1
mov dword [rsp + 0x40], 1
mov rcx, rdi
lea rdx, [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140013ba9
mov qword [rsp + 0xef0], r12
lea r15, [rsp + 0x9a0]
mov r12d, dword [rsp + 0x40]
mov rcx, rdi
mov rdx, r15
inc r12d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140013b89
mov dword [rsp + 0x40], r12d
mov r12, qword [rsp + 0xef0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x40], 0x3c
jbe 0x140013ce8
movabs rax, 0
lea rdi, [rsp + 0x9a0]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov rcx, r13
lea rdx, [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x140013db1
lea r15, str._s_s
lea r13, [rsp + 0x658]
mov rcx, r13
mov edx, 0x103
mov r8, r15
lea r9, [rsp + 0x450]
lea rdi, [rsp + 0x9cc]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
dec dword [rsp + 0x40]
lea rdx, [rsp + 0x9a0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140013cdd
mov qword [rsp + 0xef8], r14
mov qword [rsp + 0xf00], rbp
lea rbp, [rsp + 0x450]
mov qword [rsp + 0xef0], r12
lea r12, [rsp + 0x9a0]
mov ebx, dword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
cmp ebx, 0x3c
jbe 0x140013cbe
mov rcx, r13
mov edx, 0x103
mov r8, r15
mov r9, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r14
mov rdx, r12
dec ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140013c85
mov rbp, qword [rsp + 0xf00]
lea rbx, str.ssproiut
mov r14, qword [rsp + 0xef8]
mov r12, qword [rsp + 0xef0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x554]
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rsp + 0x40], rax
test edi, edi
je 0x140013d32
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140013d32
mov dword [rsp + 0x20], edi
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
mov r9, rbx
lea r8, [rsp + 0x450]
mov rcx, qword [rsp + 0x40]
call fcn.140010c10
mov rcx, rsi
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140013d4f
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140013d37
dec rax
mov rbx, rax
mov ecx, 1
lea rdi, [rbx + 1]
mov rdx, rdi
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [r12 + 0x158], rax
test rax, rax
je 0x140013dcb
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.MSVCR100.dll_strncpy]
movsxd rax, dword [r12 + 4]
mov qword [r12 + 0x20], rdi
lea rdx, [rbx + rax + 1]
mov dword [r12 + 4], edx
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140013dbe
mov rcx, qword [rsp + 0x1448]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140013a4c
call qword [sym.imp.orauts.dll_GetLastError]
mov edi, eax
jmp 0x140013cea
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll_fclose]
jmp 0x140013d9e
mov qword [rsp + 0x20], rdi
lea rdx, str._s:_d_allocation_of__d_bytes_for_response_failed
lea r8, str.ssproiut.c
mov r9d, 0x42a
mov rcx, qword [rsp + 0x40]
call fcn.140010c10
mov dword [r12 + 0x100], 1
jmp 0x140013d94
call qword [sym.imp.orauts.dll_GetLastError]
mov r15d, eax
jmp 0x140012c99