Function at 0x140024020
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x110
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r14d, ecx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [r11 - 0x90]
mov qword [r11 + 0x10], rax
lea rax, [r11 - 0x70]
mov qword [r11 + 0x20], rax
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0x78], 7
mov word [rsp + 0x98], bx
lea r8d, [rbx + 9]
lea rdx, str.stemp.bat
lea rcx, [r11 - 0x90]
call fcn.14000e6a0
nop
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
lea r8d, [rbx + 6]
lea rdx, [0x14009a3a8]
lea rcx, [rsp + 0xb8]
call fcn.14000e6a0
nop
lea r9, [rsp + 0x98]
mov r8d, 0x85
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x140]
call fcn.14000ddd0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0xe0], rax
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x148]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.14000ba30
nop
mov rcx, rax
call fcn.14005f110
nop
mov rcx, qword [rsp + 0x148]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x48], rcx
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140024151
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0xf8], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x50]
call fcn.14000c6f0
mov rdi, rax
lea rdx, str.Necessary_settings_has_been_changed_successfully_please_restart_your_machine_and_try_to_activate
lea rcx, [rsp + 0x58]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0x60]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r14d
call fcn.14005d170
nop
jmp 0x1400241cb
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140024316
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x138], rax
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x138]
call fcn.14000cc80
test al, al
jne 0x14002421b
lea rdx, [0x14009a1c8]
lea rcx, [rsp + 0x138]
call fcn.14000c480
nop
mov rax, qword [rsp + 0x140]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14002423a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002424b
call fcn.14000d980
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140024321
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edi, 1
mov dword [rsp + 0x30], edi
mov r9, qword [rsp + 0x138]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rsp + 0x140]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000ce60
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400242c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400242e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140024302
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3