Function at 0x14005f4d0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rdi, rcx
mov byte [rbp - 0x60], 0
mov dword [rbp - 0x5c], 0xffffffff
xor r12d, r12d
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], r12b
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], r12b
mov qword [rbp - 0x18], r12
mov qword [rbp - 8], r12
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], r12b
mov dword [rbp + 8], r12d
mov dword [rbp + 0xc], 1
mov r15d, r12d
xor r8d, r8d
lea rdx, [rbp - 0x60]
call fcn.140060db0
test al, al
jne 0x14005f567
mov r15d, dword [rdi + 0x30]
mov byte [rdi + 0x40], 0
cmp dword [rbp + 0xc], 2
jne 0x14005f6ac
cmp qword [rbp - 0x48], 0
je 0x14005f6ac
cmp dword [rdi + 0x30], 0
je 0x14005f61c
mov dword [rdi + 0x30], r12d
mov byte [rdi + 0xf0], 0
mov rcx, rdi
call fcn.140060a20
mov edx, 0x136
lea rcx, [rbp - 0x80]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
call fcn.140064720
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14005f61c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f617
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fda6
call fcn.140133e68
cmp byte [rdi + 0xc], 0
je 0x14005f68b
lea rdx, [rdi + 0x160]
lea rcx, [rsp + 0x60]
call fcn.14000cca0
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14005f687
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdac
call fcn.140133e68
mov byte [rdi + 0xc], 0
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x58]
mov rcx, rdi
call fcn.140060530
test al, al
je 0x14005fd76
mov byte [rdi + 0x5c], 1
jmp 0x14005fd76
lea rcx, [rdi + 0x1c0]
lea rax, [rbp - 0x18]
cmp rcx, rax
je 0x14005f6d3
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
call fcn.1400157e0
cmp byte [rdi + 0xc], 0
je 0x14005f916
lea rcx, [rdi + 0x128]
lea rdx, [rbp + 0x10]
call fcn.140054d90
mov rbx, rax
lea rdx, [rdi + 0x160]
lea rcx, [rsp + 0x60]
call fcn.14000cca0
nop
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003e160
movzx esi, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14005f74f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f74a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdb2
call fcn.140133e68
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14005f7a8
mov rdx, qword [rbp + 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f797
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdb8
call fcn.140133e68
mov qword [rbp + 0x10], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
test sil, sil
je 0x14005f82a
lea rdx, [rdi + 0x180]
lea rcx, [rsp + 0x40]
call fcn.14000cca0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005f812
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f80d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdbe
call fcn.140133e68
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
jmp 0x14005f912
lea rdx, [rdi + 0x160]
lea rcx, [rbp - 0x80]
call fcn.14000cca0
nop
lea rdx, [rdi + 0x180]
lea rcx, [rsp + 0x40]
call fcn.14000cca0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005f8b4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f8af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdc4
call fcn.140133e68
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14005f902
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f8fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdca
call fcn.140133e68
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov byte [rdi + 0xc], 0
cmp dword [rbp + 0xc], 1
jne 0x14005f958
mov r8d, dword [rbp - 0x5c]
cmp dword [rdi + 0xa8], r8d
je 0x14005f958
test r8d, r8d
jg 0x14005f93a
mov r8d, 0xe10
mov dword [rbp - 0x5c], r8d
jmp 0x14005f940
cmp r8d, 5
jl 0x14005f947
mov dword [rdi + 0xa8], r8d
lea rcx, [rdi + 0x230]
mov edx, 3
call fcn.140061d10
test r15d, r15d
setg al
mov byte [rdi + 0xac], al
mov byte [rdi + 0xad], 0
mov ebx, dword [rbp + 8]
mov dword [rdi + 0x3c], r12d
cmp ebx, 0x64
ja 0x14005f97e
mov eax, dword [rdi + 0x30]
cmp eax, ebx
jne 0x14005f991
cmp byte [rdi + 0x41], 0
je 0x14005fd76
mov byte [rdi + 0x40], 1
jmp 0x14005fd76
lea rsi, [rdi + 0x100]
mov rcx, rdi
test eax, eax
jne 0x14005fad6
mov edx, ebx
call fcn.140060cf0
mov r14d, eax
cmp eax, 1
jne 0x14005fa46
mov edx, 0x134
lea rcx, [rbp + 0x28]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14005fa31
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fa2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdd0
call fcn.140133e68
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
jmp 0x14005fd5e
mov edx, 0x135
lea rcx, [rbp + 0x48]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14005fac1
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fabc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fdd6
call fcn.140133e68
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
jmp 0x14005fd5a
call fcn.140060a20
test ebx, ebx
jne 0x14005fb78
mov edx, 0x136
lea rcx, [rbp + 0x68]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], bl
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x14005fb60
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fb5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fddc
call fcn.140133e68
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
jmp 0x14005fd68
cmp byte [rdi + 0x5c], 0
je 0x14005fc09
mov edx, 0x136
lea rcx, [rsp + 0x60]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14005fd76
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fbff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fde2
call fcn.140133e68
jmp 0x14005fd76
mov edx, ebx
mov rcx, rdi
call fcn.140060cf0
mov r14d, eax
cmp eax, 1
jne 0x14005fcc1
mov edx, 0x137
lea rcx, [rbp + 0x88]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x14005fca3
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fc9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fde8
call fcn.140133e68
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x88], 0
jmp 0x14005fd5e
mov edx, 0x138
lea rcx, [rbp + 0xa8]
call fcn.1400175a0
nop
mov r8d, r12d
cmp byte [rdi + 0x200], r8b
setne r8b
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.140064720
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14005fd41
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fd3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005fda0
call fcn.140133e68
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa8], 0
mov dword [rdi + 0x30], r12d
cmp r14d, 2
sete al
mov byte [rdi + 0x5c], al
mov dword [rdi + 0x30], ebx
test ebx, ebx
setg al
mov byte [rdi + 0xf0], al
lea rcx, [rbp - 0x60]
call fcn.140062530
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.1401462a8
int3