Function at 0x14000a130
Capabilities:
Delete file
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rbp + 0x490], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x290]
call fcn.140054b20
movups xmm0, xmmword [str.ALOHABOH_bootdrvAloha20160113MicrosoftWindows]
movaps xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [0x140080e58]
movaps xmmword [rbp + 0x2a0], xmm1
movups xmm0, xmmword [0x140080e68]
movaps xmmword [rbp + 0x2b0], xmm0
mov eax, dword [0x140080e78]
mov dword [rbp + 0x2c0], eax
lea rdi, [rbp + 0x290]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..sss]
mov dword [rdi - 1], eax
movzx eax, word [0x140080ec8]
mov word [rdi + 3], ax
movzx eax, byte [0x140080eca]
mov byte [rdi + 5], al
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000a3e2
lea r15, vtable.DES.0
nop dword [rax]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x90]
call fcn.140054b20
movups xmm0, xmmword [str.ALOHABOH_bootdrvAloha20160113MicrosoftWindows]
movaps xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [0x140080e58]
movaps xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [0x140080e68]
movaps xmmword [rbp + 0xb0], xmm0
mov eax, dword [0x140080e78]
mov dword [rbp + 0xc0], eax
lea rdi, [rbp + 0x90]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140080eac]
mov word [rdi - 1], ax
lea rdi, [rbp + 0x90]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x7c]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14000a290
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x3c], eax
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jle 0x14000a3ad
lea rdx, [0x140080e24]
lea rcx, [rbp + 0x90]
call fcn.140054288
mov r13, rax
test rax, rax
je 0x14000a3ad
lea rcx, [rdi + 0x20]
call fcn.1400524d8
mov rsi, rax
lea r8, [rdi + 0x20]
xor edx, edx
mov rcx, rax
call fcn.140054b20
mov r9, r13
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.140054574
mov r12, rax
test eax, eax
jne 0x14000a31d
xor r12d, r12d
mov rcx, rsi
call case.0x1400292fb.0
xor esi, esi
mov rcx, r13
call fcn.14005482c
test rsi, rsi
je 0x14000a3ad
mov dword [rsp + 0x30], 0x70616548
mov word [rsp + 0x34], 0x57
mov qword [rsp + 0x40], r15
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x30]
mov r8d, r12d
mov rdx, rsi
mov rcx, rsi
call fcn.140003130
xor ebx, ebx
test r12d, r12d
je 0x14000a3a4
nop dword [rax + rax]
mov edi, ebx
add rdi, rsi
mov rcx, rdi
call fcn.1400041c0
cmp eax, 1
jne 0x14000a3a4
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
add ebx, ecx
cmp ebx, r12d
jb 0x14000a380
mov rcx, rsi
call case.0x1400292fb.0
nop
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a210
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140051c70
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret