Function at 0x1401c5d10
Capabilities:
Delete file
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov rbx, rcx
mov r12d, 1
lea rcx, [rsp + 0x30]
call fcn.14007ba30
nop
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14006d170
xor r14d, r14d
test eax, eax
je 0x1401c62d9
mov rdi, qword [str.CREATE_TABLE__LOG____ID__INTEGER_NOT_NULL_PRIMARY_KEY_AUTOINCREMENT___PAGE__INTEGER___PATH__TEXT___NAME__TEXT___DATA__TEXT___TYPE__INTEGER___FIRST__INTEGER___LAST__INTEGER___GONE__INTEGER___CHANGE__INTEGER___FLAGS__TEXT___PUBLISHER__TEXT___FID__TEXT___]
mov ebx, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c5d9a
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x248]
mov rdx, rdi
call qword [rax]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1401c5dd9
mov rbx, qword [rbp + 0x248]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c5dce
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], r14
mov r9d, 1
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x248]
call fcn.1400e4b70
movdqa xmm0, xmmword [0x14029c3d0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], r14b
lea rax, [rbp + 0xe0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x1401c5e20
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x60]
call fcn.1400b29c0
nop
lea rdi, [rbp - 0x60]
mov r15, qword [rbp - 0x60]
mov r13, qword [rbp - 0x48]
cmp r13, 0x10
cmovae rdi, r15
mov r14, qword [rbp - 0x50]
cmp r14, 8
jb 0x1401c5ec7
lea rsi, [r14 + rdi]
lea r8, [rsi - 7]
sub r8, rdi
mov edx, 0x57
mov rcx, rdi
call fcn.14024a300
mov rbx, rax
test rax, rax
je 0x1401c5ec7
nop dword [rax + rax]
mov r8d, 8
lea rdx, str.WINDOWS7
mov rcx, rbx
call fcn.140249ce0
test eax, eax
je 0x1401c5eba
inc rbx
lea r8, [rsi - 7]
sub r8, rbx
mov edx, 0x57
mov rcx, rbx
call fcn.14024a300
mov rbx, rax
test rax, rax
jne 0x1401c5e80
jmp 0x1401c5ec7
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1401c608e
lea rbx, [rbp - 0x60]
cmp r13, 0x10
cmovae rbx, r15
cmp r14, 5
jb 0x1401c5f51
lea rdi, [r14 + rbx]
lea r8, [rdi - 4]
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.14024a300
mov r9, rax
test rax, rax
je 0x1401c5f51
lea rsi, str.VISTA
xor ecx, ecx
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x1401c5f1a
cmp rcx, 5
jne 0x1401c5f02
xor eax, eax
jmp 0x1401c5f1f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1401c5f44
inc r9
lea r8, [rdi - 4]
sub r8, r9
mov edx, 0x56
mov rcx, r9
call fcn.14024a300
mov r9, rax
test rax, rax
jne 0x1401c5f00
jmp 0x1401c5f51
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1401c608e
lea rbx, [rbp - 0x60]
cmp r13, 0x10
cmovae rbx, r15
cmp r14, 5
jb 0x1401c5fe1
lea rdi, [r14 + rbx]
lea r8, [rdi - 4]
sub r8, rbx
mov edx, 0x57
mov rcx, rbx
call fcn.14024a300
mov r9, rax
test rax, rax
je 0x1401c5fe1
lea rsi, str.WINXP
nop
xor ecx, ecx
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x1401c5faa
cmp rcx, 5
jne 0x1401c5f92
xor eax, eax
jmp 0x1401c5faf
sbb eax, eax
or eax, 1
test eax, eax
je 0x1401c5fd4
inc r9
lea r8, [rdi - 4]
sub r8, r9
mov edx, 0x57
mov rcx, r9
call fcn.14024a300
mov r9, rax
test rax, rax
jne 0x1401c5f90
jmp 0x1401c5fe1
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1401c608e
lea rbx, [rbp - 0x60]
cmp r13, 0x10
cmovae rbx, r15
cmp r14, 5
jb 0x1401c60a8
lea rdi, [r14 + rbx]
lea r8, [rdi - 4]
sub r8, rbx
mov edx, 0x57
mov rcx, rbx
call fcn.14024a300
mov r9, rax
xor r14d, r14d
test rax, rax
je 0x1401c60ab
lea rsi, str.WIN2K
nop word [rax + rax]
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x1401c6059
cmp rcx, 5
jne 0x1401c6040
mov eax, r14d
jmp 0x1401c605e
sbb eax, eax
or eax, 1
test eax, eax
je 0x1401c6083
inc r9
lea r8, [rdi - 4]
sub r8, r9
mov edx, 0x57
mov rcx, r9
call fcn.14024a300
mov r9, rax
test rax, rax
jne 0x1401c6030
jmp 0x1401c60ab
sub r9, rbx
cmp r9, 0xffffffffffffffff
je 0x1401c60ab
jmp 0x1401c6091
xor r14d, r14d
lea r8, str.DELETE_FROM_LOG
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.14000b150
jmp 0x1401c60c6
xor r14d, r14d
mov r9d, reloc.COMCTL32.dll_InitCommonControls
lea r8, str.DELETE_FROM_LOG_WHERE_PAGE_u
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.14000b150
mov ebx, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c60f3
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x248]
lea rdx, [rbp - 0x30]
call qword [rax]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1401c6132
mov rbx, qword [rbp + 0x248]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c6127
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140253eb8
call fcn.140253e8c
mov edi, eax
mov dword [rsp + 0x20], eax
mov r9d, reloc.COMCTL32.dll_InitCommonControls
lea r8, str.INSERT_INTO_LOG__PAGE_DATA__VALUES___u__u_
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.14000b150
mov ebx, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c6193
mov r10, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x248]
lea rdx, [rbp - 0x30]
call qword [r10]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1401c61d2
mov rbx, qword [rbp + 0x248]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c61c7
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9d, reloc.COMCTL32.dll_InitCommonControls
lea r8, str.SELECT_DATA_FROM_LOG_WHERE_PAGE_u
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.14000b150
mov ebx, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c621a
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x250]
lea rdx, [rbp - 0x30]
call qword [rax]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1401c629b
mov rcx, qword [rbp + 0x250]
mov rax, qword [rcx]
lea r9, [rbp + 0x248]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x28]
test eax, eax
je 0x1401c626a
mov rcx, qword [rbp + 0x248]
cmp byte [rcx], 0
je 0x1401c626a
mov r8d, 0xa
lea rdx, [rbp + 0x258]
call fcn.140251de0
cmp edi, eax
cmove r12d, r14d
mov rbx, qword [rbp + 0x250]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c628f
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp r13, 0x10
jb 0x1401c62d2
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1401c62ca
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c636e
mov rcx, r15
call fcn.140247060
mov rbx, qword [rbp + 0x240]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c62ea
mov rax, qword [rcx]
call qword [rax + 0x28]
nop
lea rax, vtable.CSABSQL.0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401c631b
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x40]
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rax, vtable.CSABByteString.0
mov qword [rsp + 0x38], rax
mov edx, 1
mov rcx, qword [rsp + 0x40]
call fcn.140247060
test r12d, r12d
je 0x1401c635a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1402500e8
nop
int3