Function at 0x140005930
Capabilities:
Delete file
Write file on windows

Disassembly:
test rdx, rdx
je 0x140005928
test r8, r8
je 0x140005928
mov eax, dword [rdx + 8]
bt eax, 0x1c
jb 0x140005923
and eax, 0x7c0000
cmp eax, 0x1c0000
jne 0x140005930
jmp 0x140005c80
ret
test rdx, rdx
je 0x140005b2d
push rbx
push rdi
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
test rbx, rbx
je 0x140005b27
cmp qword [r8 + 0x40], 0
jne 0x14000597c
mov rax, qword [r8 + 0x28]
cmp byte [rax + 0x198], 0
je 0x14000597c
cmp byte [r8 + 0x78], 0
jne 0x140005974
mov eax, dword [r8 + 0x38]
dec eax
cmp eax, 1
jbe 0x14000597c
mov rcx, rbx
call fcn.140004860
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140005b27
mov ecx, dword [rdi + 0x28]
mov qword [rsp + 0x40], rsi
call fcn.140012de4
mov rsi, rax
test rax, rax
je 0x140005b22
mov r8d, dword [rdi + 0x28]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x60], rbp
call fcn.140013e40
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x20], r8d
mov r9, rsi
mov dword [rsp + 0x78], ebp
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call fcn.140009d40
test al, al
je 0x140005b15
mov ecx, dword [rsp + 0x78]
lea r9d, [rbp + 2]
mov dword [rsp + 0x34], ecx
xor r8d, r8d
xor edx, edx
lea eax, [rcx + 0xc]
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x68]
lea r8d, [rbp + 0xc]
mov dword [rsp + 0x68], ebp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
lea r9d, [rbp + 2]
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
add dword [rbx + 0x48], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
add dword [rbx + 0x48], eax
cmp dword [rbx + 0x48], 0x400000
jb 0x140005b15
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x70], 2
mov qword [rbx + 0x40], rbp
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x78], 1
jbe 0x140005b15
mov rdi, qword [rbx + 0x60]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
test rcx, rcx
jne 0x140005ad0
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x140005aca
mov qword [rbx + 0x68], rbp
jmp 0x140005ae5
mov qword [rax + 8], rbp
jmp 0x140005ae5
test rax, rax
jne 0x140005ade
mov qword [rbx + 0x68], rcx
mov qword [rcx], rbp
jmp 0x140005ae5
mov qword [rcx], rax
mov qword [rax + 8], rcx
mov qword [rdi + 8], rbp
mov rcx, rdi
mov qword [rdi], rbp
dec dword [rbx + 0x70]
call fcn.14000a460
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call fcn.14000a240
mov edx, 0x120
mov rcx, rdi
call fcn.140012da4
mov rcx, rsi
call fcn.140012dec
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
movsxd rax, dword [rdx + 0x2c]
xor r12d, r12d
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov edi, r12d
test eax, eax
je 0x140005ced
mov rcx, rax
mov r15, rax
call fcn.1400392c0
mov rdi, rax
test rax, rax
je 0x140005cf0
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.140013e40
mov ecx, dword [rbx + 0x30]
lea rdx, [rbx + 0x40]
mov r8d, dword [rbx + 0x2c]
add rdx, rcx
mov rcx, rdi
call fcn.140014490
jmp 0x140005cf0
mov r15, r12
mov eax, dword [rbx + 8]
cmp eax, 0x900e5601
ja 0x140005f7a
je 0x140005e79
cmp eax, 0x801c0201
je 0x140005dda
cmp eax, 0x900c0201
je 0x140005d35
cmp eax, 0x900c0203
jne 0x14000632b
cmp dword [rbx + 4], 0xfffffffe
jne 0x14000632b
mov eax, dword [rbx + 0xc]
and eax, 0x7f
cmp al, 3
jmp 0x140005da1
cmp dword [rbx + 4], 0xfffffffe
jne 0x14000632b
mov eax, dword [rbx + 0xc]
and eax, 0x7f
cmp eax, 1
jne 0x140005d9e
test rdi, rdi
je 0x140006338
mov rcx, qword [r14 + 0x28]
mov r8d, SQLAllocHandle
mov eax, dword [rdi + 0x12c]
mov dword [rcx + 0x208], eax
mov rcx, qword [r14 + 0x28]
mov eax, dword [rdi + 0x1c]
mov dword [rcx + 0x204], eax
mov rcx, qword [r14 + 0x28]
movzx eax, word [rdi + 0x10]
mov word [rcx + 0x200], ax
lea rcx, [rdi + 0x2c]
mov rdx, qword [r14 + 0x28]
add rdx, 0x1d8
call fcn.140004fb0
jmp 0x14000632b
cmp eax, 3
jne 0x14000632b
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
mov r8, r14
lea rdx, [rbp - 0x49]
mov rcx, rsi
call fcn.140005850
jmp 0x14000632b
cmp dword [rbx + 4], 0x67
jne 0x14000632b
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007270
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140008340
jmp 0x14000632b
cmp dword [rbx + 4], 0x67
jne 0x14000632b
test rdi, rdi
je 0x140006338
cmp dword [rdi], 0x46
jae 0x14000632b
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
lea rcx, [rsi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009c60
test al, al
je 0x14000632b
mov eax, dword [rdi]
lea rcx, [rsi + 0x84]
movups xmm0, xmmword [rdi]
mov dword [rsi + 0x58], eax
lea r8, str.Last_Tdr_Engine_Info
shl rax, 7
lea rdx, str.SoftwareAMDLOG
add rcx, rax
mov dword [rsp + 0x28], 0x80
mov r9d, 1
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov eax, dword [rdi + 0x50]
mov dword [rcx + 0x50], eax
movzx eax, word [rdi + 0x54]
mov word [rcx + 0x54], ax
mov ecx, dword [rdi]
mov eax, ecx
shl rax, 7
mov dword [rax + rsi + 0x5c], ecx
mov ecx, dword [rdi]
mov eax, dword [rdi + 4]
shl rcx, 7
mov dword [rcx + rsi + 0x60], eax
lea rcx, [rsi + 0x5c]
mov eax, dword [rdi]
movups xmm0, xmmword [rbx + 0x18]
shl rax, 7
movups xmmword [rax + rsi + 0x74], xmm0
mov eax, dword [rdi]
shl rax, 7
add rcx, rax
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call fcn.1400027b0
jmp 0x14000632b
cmp eax, 0x900e5602
je 0x1400061ea
cmp eax, 0x900e5605
je 0x140006101
cmp eax, 0x900e5609
jne 0x14000632b
cmp dword [rbx + 4], 0x67
jne 0x14000632b
xor eax, eax
lea rcx, [rbp - 1]
mov qword [rbp - 1], rax
mov rdx, rdi
mov eax, reloc.ODBC32.dll_SQLExecute
cmp r15, rax
cmova r15, rax
mov r8, r15
call fcn.140014490
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
lea rcx, [rsi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009c60
test al, al
je 0x14000632b
mov ebx, dword [rbp - 1]
xor eax, eax
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
mov eax, ebx
and eax, 0x12
movups xmmword [rbp + 0x17], xmm0
cmp al, 0x12
je 0x14000632b
mov esi, 0x1b0
test bl, 4
je 0x14000602f
mov eax, 0x1a8
mov word [rbp + 0x23], ax
jmp 0x14000605a
test bl, 3
je 0x14000604f
call fcn.140008df0
cmp eax, 2
jle 0x14000604f
mov word [rbp + 0x23], si
test bl, 8
je 0x14000605a
mov eax, dword [rbp + 3]
mov dword [rbp + 0x27], eax
jmp 0x14000605a
cmp word [rbp + 0x23], r12w
je 0x14000632b
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007270
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x39]
call fcn.140007960
test bl, 3
je 0x1400060dd
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140008340
cmp si, word [rbp + 0x23]
jne 0x14000632b
and ebx, 8
test bl, bl
jne 0x14000632b
mov ecx, 2
call fcn.14000ad30
jmp 0x14000632b
cmp dword [rbx + 4], 0x67
jne 0x14000632b
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
lea rcx, [rsi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009c60
test al, al
je 0x14000632b
cmp dword [rdi + 0x10], r12d
je 0x14000632b
cmp dword [rdi + 0x14], 1
jne 0x14000632b
movabs rax, 0xcccccccccccccccd
mul qword [rdi]
shr rdx, 2
lea rax, [rdx + rdx*4]
cmp qword [rdi], rax
jne 0x14000632b
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r12d
mov word [rbp - 0xf], r12w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007270
mov dl, 1
lea rcx, [rbp - 0x39]
call fcn.140008340
jmp 0x14000632b
cmp dword [rbx + 4], 0x67
jne 0x14000632b
test rdi, rdi
je 0x140006338
xorps xmm0, xmm0
lea r8, [rbx + 0x18]
lea rdx, [rbp - 0x49]
mov rcx, rsi
movups xmmword [rbp - 0x49], xmm0
call fcn.140005030
test al, al
je 0x14000632b
lea rcx, [rsi + 0x2390]
lea rdx, [rbp - 0x49]
call fcn.140009c60
test al, al
je 0x14000632b
mov qword [rsp + 0xe0], r13
mov r13d, dword [rdi]
cmp r15, 8
jb 0x140006249
mov r12d, dword [rdi + 4]
mov eax, dword [rsi + 0x58]
cmp eax, 0x46
jae 0x140006261
shl rax, 7
lea rbx, [rsi + 0x5c]
add rbx, rax
xor r15d, r15d
jmp 0x140006267
xor r15d, r15d
mov ebx, r15d
mov rcx, qword [r14 + 0x28]
lea rdx, str._04d__02d__02d
movzx r9d, word [rbp - 0x47]
xorps xmm0, xmm0
movzx r8d, word [rbp - 0x49]
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x15], r15d
mov word [rbp - 0xf], r15w
movzx eax, word [rcx + 4]
mov word [rbp - 0x11], ax
mov eax, dword [rcx + 0x20]
mov rcx, qword [r14 + 0x20]
mov dword [rbp - 0xd], eax
mov eax, dword [rcx + 0x20c]
mov dword [rbp - 9], eax
movups xmm0, xmmword [rcx + 0x348]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [rcx + 0x358]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x29], eax
movzx eax, word [rbp - 0x43]
mov dword [rsp + 0x20], eax
call fcn.140007270
mov word [rbp + 0xd], r15w
mov dword [rbp + 0x13], r15d
test rbx, rbx
je 0x1400062eb
mov rax, qword [rbx + 0x18]
mov qword [rbp - 1], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 7], eax
jmp 0x1400062f3
mov qword [rbp - 1], r15
mov dword [rbp + 7], r15d
lea rdx, [rbp - 1]
mov word [rbp + 0xb], r13w
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r12d
call fcn.140007960
mov r13, qword [rsp + 0xe0]
test r12d, 0xff000000
jne 0x140006324
mov ecx, 1
call fcn.14000ad30
mov dword [rsi + 0x58], 0xffffffff
test rdi, rdi
je 0x140006338
mov rcx, rdi
call fcn.1400392ac
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret