Function at 0x1400058e0
Capabilities:
Delete file
Write file on windows

Disassembly:
test rdx, rdx
je 0x140005908
test r8, r8
je 0x140005908
mov eax, dword [rdx + 8]
bt eax, 0x1c
jb 0x140005903
and eax, 0x7c0000
cmp eax, 0x1c0000
jne 0x140005910
jmp 0x140005c60
ret
test rdx, rdx
je 0x140005b0d
push rbx
push rdi
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
test rbx, rbx
je 0x140005b07
cmp qword [r8 + 0x40], 0
jne 0x14000595c
mov rax, qword [r8 + 0x28]
cmp byte [rax + 0x198], 0
je 0x14000595c
cmp byte [r8 + 0x78], 0
jne 0x140005954
mov eax, dword [r8 + 0x38]
dec eax
cmp eax, 1
jbe 0x14000595c
mov rcx, rbx
call fcn.140004860
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140005b07
mov ecx, dword [rdi + 0x28]
mov qword [rsp + 0x40], rsi
call fcn.140012dc4
mov rsi, rax
test rax, rax
je 0x140005b02
mov r8d, dword [rdi + 0x28]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x60], rbp
call fcn.140013e20
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x20], r8d
mov r9, rsi
mov dword [rsp + 0x78], ebp
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call fcn.140009cd0
test al, al
je 0x140005af5
mov ecx, dword [rsp + 0x78]
lea r9d, [rbp + 2]
mov dword [rsp + 0x34], ecx
xor r8d, r8d
xor edx, edx
lea eax, [rcx + 0xc]
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x68]
lea r8d, [rbp + 0xc]
mov dword [rsp + 0x68], ebp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
lea r9d, [rbp + 2]
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
add dword [rbx + 0x48], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
add dword [rbx + 0x48], eax
cmp dword [rbx + 0x48], 0x400000
jb 0x140005af5
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x70], 2
mov qword [rbx + 0x40], rbp
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x78], 1
jbe 0x140005af5
mov rdi, qword [rbx + 0x60]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
test rcx, rcx
jne 0x140005ab0
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x140005aaa
mov qword [rbx + 0x68], rbp
jmp 0x140005ac5
mov qword [rax + 8], rbp
jmp 0x140005ac5
test rax, rax
jne 0x140005abe
mov qword [rbx + 0x68], rcx
mov qword [rcx], rbp
jmp 0x140005ac5
mov qword [rcx], rax
mov qword [rax + 8], rcx
mov qword [rdi + 8], rbp
mov rcx, rdi
mov qword [rdi], rbp
dec dword [rbx + 0x70]
call fcn.14000a3f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call fcn.14000a1d0
mov edx, 0x120
mov rcx, rdi
call fcn.140012d84
mov rcx, rsi
call fcn.140012dcc
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
movsxd rax, dword [rdx + 0x2c]
xor r12d, r12d
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov ebx, r12d
test eax, eax
je 0x140005ccd
mov rcx, rax
mov r15, rax
call fcn.1400392a0
mov rbx, rax
test rax, rax
je 0x140005cd0
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.140013e20
mov ecx, dword [rsi + 0x30]
lea rdx, [rsi + 0x40]
mov r8d, dword [rsi + 0x2c]
add rdx, rcx
mov rcx, rbx
call fcn.140014470
jmp 0x140005cd0
mov r15, r12
mov eax, dword [rsi + 8]
cmp eax, 0x900e5601
ja 0x140005f3c
je 0x140005e45
cmp eax, 0x801c0201
je 0x140005da6
cmp eax, 0x900c0201
je 0x140005d0b
cmp eax, 0x900c0203
jne 0x1400062c7
mov eax, dword [rsi + 0xc]
and eax, 0x7f
cmp al, 3
jmp 0x140005d6d
mov eax, dword [rsi + 0xc]
and eax, 0x7f
cmp eax, 1
jne 0x140005d6a
test rbx, rbx
je 0x1400062d4
mov rcx, qword [r14 + 0x28]
mov r8d, SQLAllocHandle
mov eax, dword [rbx + 0x12c]
mov dword [rcx + 0x208], eax
mov rcx, qword [r14 + 0x28]
mov eax, dword [rbx + 0x1c]
mov dword [rcx + 0x204], eax
mov rcx, qword [r14 + 0x28]
movzx eax, word [rbx + 0x10]
mov word [rcx + 0x200], ax
lea rcx, [rbx + 0x2c]
mov rdx, qword [r14 + 0x28]
add rdx, 0x1d8
call fcn.140004fb0
jmp 0x1400062c7
cmp eax, 3
jne 0x1400062c7
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
mov r8, r14
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.140005830
jmp 0x1400062c7
cmp dword [rsi + 4], 0x67
jne 0x1400062c7
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007200
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400082d0
jmp 0x1400062c7
test rbx, rbx
je 0x1400062d4
cmp dword [rbx], 0x46
jae 0x1400062c7
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
lea rcx, [rdi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009bf0
test al, al
je 0x1400062c7
mov eax, dword [rbx]
lea rcx, [rdi + 0x84]
movups xmm0, xmmword [rbx]
mov dword [rdi + 0x58], eax
lea r8, str.Last_Tdr_Engine_Info
shl rax, 7
lea rdx, str.SoftwareAMDLOG
add rcx, rax
mov dword [rsp + 0x28], 0x80
mov r9d, 1
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov eax, dword [rbx + 0x50]
mov dword [rcx + 0x50], eax
movzx eax, word [rbx + 0x54]
mov word [rcx + 0x54], ax
mov ecx, dword [rbx]
mov eax, ecx
shl rax, 7
mov dword [rax + rdi + 0x5c], ecx
mov ecx, dword [rbx]
mov eax, dword [rbx + 4]
shl rcx, 7
mov dword [rcx + rdi + 0x60], eax
lea rcx, [rdi + 0x5c]
mov eax, dword [rbx]
movups xmm0, xmmword [rsi + 0x18]
shl rax, 7
movups xmmword [rax + rdi + 0x74], xmm0
mov eax, dword [rbx]
shl rax, 7
add rcx, rax
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call fcn.1400027b0
jmp 0x1400062c7
cmp eax, 0x900e5602
je 0x140006190
cmp eax, 0x900e5605
je 0x1400060b1
cmp eax, 0x900e5609
jne 0x1400062c7
xor eax, eax
lea rcx, [rbp - 1]
mov qword [rbp - 1], rax
mov rdx, rbx
mov eax, reloc.ODBC32.dll_SQLExecute
cmp r15, rax
cmova r15, rax
mov r8, r15
call fcn.140014470
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
lea rcx, [rdi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009bf0
test al, al
je 0x1400062c7
mov edi, dword [rbp - 1]
xor eax, eax
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
mov esi, 0x1b0
movups xmmword [rbp + 0x17], xmm0
test dil, 4
je 0x140005fdb
mov eax, 0x1a8
mov word [rbp + 0x23], ax
jmp 0x140006008
test dil, 3
je 0x140005ffd
call fcn.140008d80
cmp eax, 2
jle 0x140005ffd
mov word [rbp + 0x23], si
test dil, 8
je 0x140006008
mov eax, dword [rbp + 3]
mov dword [rbp + 0x27], eax
jmp 0x140006008
cmp word [rbp + 0x23], r12w
je 0x1400062c7
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007200
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x39]
call fcn.1400078f0
test dil, 3
je 0x14000608c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400082d0
cmp si, word [rbp + 0x23]
jne 0x1400062c7
and edi, 8
test dil, dil
jne 0x1400062c7
mov ecx, 2
call fcn.14000acc0
jmp 0x1400062c7
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
lea rcx, [rdi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009bf0
test al, al
je 0x1400062c7
cmp dword [rbx + 0x10], r12d
je 0x1400062c7
cmp dword [rbx + 0x14], 1
jne 0x1400062c7
movabs rax, 0xcccccccccccccccd
mul qword [rbx]
shr rdx, 2
lea rax, [rdx + rdx*4]
cmp qword [rbx], rax
jne 0x1400062c7
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007200
mov dl, 1
lea rcx, [rbp - 0x39]
call fcn.1400082d0
jmp 0x1400062c7
test rbx, rbx
je 0x1400062d4
xorps xmm0, xmm0
lea r8, [rsi + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rdi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x1400062c7
lea rcx, [rdi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009bf0
test al, al
je 0x1400062c7
mov qword [rsp + 0xe0], r13
mov r13d, dword [rbx]
cmp r15, 8
jb 0x1400061e5
mov r12d, dword [rbx + 4]
mov eax, dword [rdi + 0x58]
cmp eax, 0x46
jae 0x1400061fd
shl rax, 7
lea rsi, [rdi + 0x5c]
add rsi, rax
xor r15d, r15d
jmp 0x140006203
xor r15d, r15d
mov esi, r15d
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r15d
mov word [rbp - 0xf], r15w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007200
mov word [rbp + 0xd], r15w
mov dword [rbp + 0x13], r15d
test rsi, rsi
je 0x140006287
mov rax, qword [rsi + 0x18]
mov qword [rbp - 1], rax
mov eax, dword [rsi + 0x30]
mov dword [rbp + 7], eax
jmp 0x14000628f
mov qword [rbp - 1], r15
mov dword [rbp + 7], r15d
lea rdx, [rbp - 1]
mov word [rbp + 0xb], r13w
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r12d
call fcn.1400078f0
mov r13, qword [rsp + 0xe0]
test r12d, 0xff000000
jne 0x1400062c0
mov ecx, 1
call fcn.14000acc0
mov dword [rdi + 0x58], 0xffffffff
test rbx, rbx
je 0x1400062d4
mov rcx, rbx
call fcn.14003928c
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret