Function at 0x6c135d00
Capabilities:
Delete file

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x3a8
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x37c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x384], eax
test byte [0x6c145288], 8
jne 0x6c136230
lea eax, [ebx - 1]
cmp eax, 0x63
ja 0x6c136220
mov dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x6c135d95
cmp word [eax], 0
je 0x6c13678e
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6c135d68
mov esi, dword [ebp - 0x37c]
sub eax, esi
lea edx, [eax - 2]
sar eax, 1
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x37c]
cmp word [eax + edx], 0x5c
je 0x6c1364e0
mov edi, dword [0x6c145280]
cmp ebx, 0x64
jne 0x6c135e50
mov eax, dword [ebp - 0x384]
test eax, eax
jne 0x6c135e50
mov eax, dword [ebp - 0x370]
add eax, eax
mov dword [ebp - 0x36c], eax
cmp edi, 0x6c145280
je 0x6c135df0
lea esi, [esi]
nop
mov eax, dword [ebp - 0x370]
test eax, eax
jne 0x6c135e00
mov eax, dword [edi + 8]
cmp byte [eax], 0
je 0x6c1360c0
mov edi, dword [edi]
cmp edi, 0x6c145280
jne 0x6c135dda
mov eax, 1
jmp 0x6c1361b6
mov eax, dword [ebp - 0x370]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
test eax, eax
jne 0x6c135e44
mov eax, dword [edi + 0xc]
mov ebx, dword [ebp - 0x36c]
movzx eax, word [eax + ebx]
test ax, ax
je 0x6c1360c0
cmp ax, 0x5c
je 0x6c1360c0
mov edi, dword [edi]
cmp edi, 0x6c145280
jne 0x6c135e00
jmp 0x6c135df0
cmp edi, 0x6c145280
je 0x6c135df0
mov eax, dword [ebp - 0x370]
add eax, eax
mov dword [ebp - 0x388], eax
mov eax, 0x64
sub eax, ebx
mov ebx, dword [ebp - 0x370]
mov dword [ebp - 0x394], eax
test ebx, ebx
jne 0x6c13606b
lea esi, [esi]
mov eax, dword [edi + 8]
cmp byte [eax], 0
jne 0x6c136208
mov edx, pe_nt_image_headers32
mov eax, edi
call fcn.6c136900
mov dword [ebp - 0x380], eax
test eax, eax
jne 0x6c13604f
mov eax, edi
call fcn.6c1372a0
mov dword [ebp - 0x36c], eax
test eax, eax
je 0x6c13604f
mov ebx, dword [eax + 0x224]
lea esi, [eax + 0x224]
test ebx, ebx
je 0x6c135f22
mov ecx, ebx
mov dword [ebp - 0x378], edi
mov ebx, esi
mov esi, dword [ebp - 0x36c]
jmp 0x6c135ef2
mov ecx, dword [edi + 0x2c]
lea ebx, [edi + 0x2c]
test ecx, ecx
je 0x6c135f1c
mov eax, dword [ebp - 0x378]
lea edi, [esi + ecx]
mov edx, esi
mov ecx, edi
call fcn.6c135230
test eax, eax
js 0x6c135ee8
mov eax, dword [edi + 0x2c]
mov edx, edi
mov dword [ebx], eax
mov eax, esi
call fcn.6c133ee0
mov ecx, dword [ebx]
test ecx, ecx
jne 0x6c135ef2
mov edi, dword [ebp - 0x378]
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x394]
mov esi, dword [eax + 0x34]
mov ebx, eax
mov eax, ecx
mul dword [ebx + 0x30]
imul esi, ecx
mov ebx, edx
mov ecx, eax
add ebx, esi
mov esi, eax
mov edx, ebx
and esi, 0xfffff
shrd eax, edx, 0x14
and eax, 0xfffff
lea edx, [esi + eax]
mov eax, ebx
shr eax, 8
and eax, 0xfffff
add edx, eax
mov eax, ebx
shr eax, 0x1c
lea esi, [edx + eax]
mov eax, 0x51eb851f
mul esi
shr edx, 3
lea eax, [edx + edx*4]
mov edx, esi
mov esi, dword [ebp - 0x36c]
lea eax, [eax + eax*4]
sub edx, eax
sub ecx, edx
sbb ebx, 0
imul eax, ecx, 0x8f5c28f5
imul ebx, ebx, 0xc28f5c29
add ebx, eax
mov eax, 0xc28f5c29
mul ecx
mov ecx, dword [esi + 0x40]
add edx, ebx
mov ebx, dword [esi + 0x44]
shrd eax, edx, 2
shr edx, 2
add ecx, dword [esi + 0x38]
adc ebx, dword [esi + 0x3c]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], edx
cmp eax, ecx
mov eax, edx
sbb eax, ebx
jae 0x6c13602e
mov eax, ecx
mov edx, ebx
sub eax, dword [ebp - 0x390]
sbb edx, dword [ebp - 0x38c]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], edx
shld edx, eax, 1
add eax, eax
add eax, dword [ebp - 0x378]
adc edx, dword [ebp - 0x374]
shld edx, eax, 3
shl eax, 3
add eax, dword [ebp - 0x378]
adc edx, dword [ebp - 0x374]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
shld edx, eax, 2
shl eax, 2
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6c144390
mov ebx, eax
test eax, eax
jne 0x6c136280
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x36c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov edi, dword [edi]
cmp edi, 0x6c145280
je 0x6c135df0
mov ebx, dword [ebp - 0x370]
test ebx, ebx
je 0x6c135e88
mov ebx, dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov eax, dword [ebp - 0x370]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x37c]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call ebx
test eax, eax
jne 0x6c1360b1
mov eax, dword [edi + 0xc]
mov esi, dword [ebp - 0x388]
movzx eax, word [eax + esi]
test ax, ax
je 0x6c135e94
cmp ax, 0x5c
je 0x6c135e94
mov edi, dword [edi]
cmp edi, 0x6c145280
jne 0x6c136071
jmp 0x6c135df0
mov dword [esp + 4], 0xffffffff
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x10]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [edi + 0xc]
mov dword [edi + 0x10], 0
sub esp, 4
cmp word [esi], 0
mov eax, esi
je 0x6c136500
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6c136100
sub eax, esi
cmp eax, 0x206
ja 0x6c136199
sar eax, 1
lea ebx, [ebp - 0x224]
xor edx, edx
movzx ecx, word [esi + edx]
mov word [ebx + edx], cx
add edx, 2
test cx, cx
jne 0x6c136120
xor esi, esi
mov dword [ebp - 0x348], ebx
mov word [ebp + eax*2 - 0x222], si
mov eax, 0x10
mov word [ebp - 0x340], ax
lea eax, [ebp - 0x350]
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x34c], 3
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x33e], 0
mov dword [esp], eax
call dword [sym.imp.shell32.dll_SHFileOperationW]
sub esp, 4
mov esi, eax
test eax, eax
je 0x6c1361c8
test byte [0x6c145288], 2
jne 0x6c136510
mov edx, pe_nt_image_headers32
mov eax, edi
call fcn.6c136900
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
sub esp, 4
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov edx, pe_nt_image_headers32
mov eax, edi
mov esi, dword [ebp - 0x33e]
call fcn.6c136900
mov ebx, eax
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
sub esp, 4
or ebx, esi
jne 0x6c1361b4
mov edi, dword [edi]
cmp edi, 0x6c145280
jne 0x6c135dd0
jmp 0x6c135df0
mov edi, dword [edi]
cmp edi, 0x6c145280
jne 0x6c135e88
jmp 0x6c135df0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
jmp 0x6c1361b4
mov eax, dword [ebp - 0x37c]
call fcn.6c133bc0
mov esi, dword [ebp - 0x384]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___lx___lx__n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 0x18], esi
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c135d38
mov dword [ebp - 0x360], 0
lea eax, [ebp - 0x358]
mov dword [ebp - 0x35c], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 0x380]
sub esp, 4
lea esi, [esi]
lea eax, [ebp - 0x364]
mov dword [esp + 4], eax
lea eax, [ebp - 0x368]
mov dword [esp], eax
mov eax, dword [ebp - 0x36c]
lea ecx, [ebp - 0x35c]
lea edx, [ebp - 0x360]
call fcn.6c1332c0
test eax, eax
je 0x6c136548
mov eax, dword [ebp - 0x364]
cmp dword [eax], 0x204c5255
je 0x6c136320
test byte [0x6c145288], 4
je 0x6c1362b0
mov dword [esp + 0xc], str.only_url_entries_are_currently_supported_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp], 2
call fcn.6c133fb0
jmp 0x6c1362b0
mov edx, dword [ebp - 0x384]
and edx, dword [eax + 0x40]
jne 0x6c1362b0
mov ecx, dword [ebp - 0x354]
mov edx, dword [ebp - 0x358]
call fcn.6c133e00
mov dword [ebp + esi*4 - 0x224], eax
cmp eax, 0xffffffff
je 0x6c1362b0
add esi, 1
cmp esi, 0x64
jne 0x6c1362b0
mov dword [ebp - 0x380], esi
mov dword [esp + 0xc], 0x6c1333a0
lea eax, [ebp - 0x224]
mov dword [esp + 8], 4
mov esi, dword [ebp - 0x380]
mov dword [esp], eax
mov dword [esp + 4], esi
imul esi, ebx
call dword [sym.imp.ucrtbase.dll_qsort]
mov eax, 0x51eb851f
mul esi
movzx eax, byte [0x6c145288]
shr edx, 5
mov esi, dword [ebp + edx*4 - 0x224]
mov byte [ebp - 0x378], al
test al, 8
jne 0x6c136798
mov dword [ebp - 0x360], 0
lea esi, [esi]
lea eax, [ebp - 0x364]
mov dword [esp + 4], eax
lea eax, [ebp - 0x368]
mov dword [esp], eax
mov eax, dword [ebp - 0x36c]
lea ecx, [ebp - 0x35c]
lea edx, [ebp - 0x360]
call fcn.6c1332c0
test eax, eax
je 0x6c1366e6
mov ebx, dword [ebp - 0x364]
cmp dword [ebx], 0x204c5255
jne 0x6c1363c0
mov eax, dword [ebp - 0x384]
and eax, dword [ebx + 0x40]
jne 0x6c1363c0
mov ecx, dword [ebp - 0x354]
mov eax, ebx
mov edx, dword [ebp - 0x358]
call fcn.6c133e00
cmp esi, eax
jb 0x6c1363c0
test byte [ebp - 0x378], 8
jne 0x6c13658c
mov ebx, dword [ebp - 0x36c]
mov eax, edi
mov ecx, dword [ebp - 0x368]
mov edx, ebx
call fcn.6c1353d0
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 0x390]
add eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x44]
adc edx, dword [ebx + 0x3c]
mov ebx, dword [ebp - 0x38c]
cmp ecx, eax
sbb ebx, edx
jae 0x6c1366d9
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x36c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [0x6c15303c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x6c1368ad
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, edi
sub esp, 4
call fcn.6c1372a0
mov dword [ebp - 0x36c], eax
movzx eax, byte [0x6c145288]
mov byte [ebp - 0x378], al
jmp 0x6c1363c0
sub dword [ebp - 0x370], 1
mov edi, dword [0x6c145280]
cmp ebx, 0x64
je 0x6c135da4
jmp 0x6c135e50
xor eax, eax
jmp 0x6c136118
mov eax, ebx
call fcn.6c133bc0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SHFileOperationW_on__s_returned__i_n
mov dword [esp + 8], str.cache_container_delete_dir
mov dword [esp + 4], 0x6c145288
mov dword [esp], 1
call fcn.6c133fb0
jmp 0x6c136199
mov dword [ebp - 0x380], esi
test esi, esi
jne 0x6c13635e
test byte [0x6c145288], 8
je 0x6c13602e
mov dword [esp + 0xc], str.nothing_to_delete_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c13602e
add ebx, dword [ebx + 0x3c]
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x6c136809
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x6c14e447
test edx, edx
jne 0x6c1366ac
cmp byte [ebx], 0
je 0x6c1368e3
add ebx, 1
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
mov byte [ebp - 0x350], 0x22
lea ecx, [eax - 1]
mov dword [ebp - 0x380], esi
lea eax, [ebp - 0x34f]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x378], ebx
jmp 0x6c13663f
cmp dl, 9
je 0x6c1367e5
cmp dl, 0xa
jne 0x6c13681e
mov edx, 0x6e5c
add eax, 2
mov word [eax - 2], dx
lea esi, [esi]
cmp ecx, 0xffffffff
je 0x6c136896
lea edx, [ebp - 0x22d]
lea esi, [ecx - 1]
cmp edx, eax
jb 0x6c136674
mov ebx, dword [ebp - 0x378]
mov ecx, esi
add ebx, 1
mov dword [ebp - 0x378], ebx
mov ebx, dword [ebp - 0x378]
movzx edx, byte [ebx - 1]
cmp dl, 0xd
je 0x6c1367d2
jle 0x6c1365f7
cmp dl, 0x22
je 0x6c1367f6
cmp dl, 0x5c
jne 0x6c136852
mov esi, 0x5c5c
add eax, 2
mov word [eax - 2], si
jmp 0x6c136618
mov esi, dword [ebp - 0x380]
mov byte [eax], 0x22
mov edi, dword [ebp - 0x398]
test ecx, ecx
je 0x6c1368a5
mov edx, 0x2e2e
mov byte [eax + 3], 0x2e
mov word [eax + 1], dx
lea edx, [eax + 4]
lea eax, [ebp - 0x350]
mov byte [edx], 0
mov dword [esp], eax
call fcn.6c143d90
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.deleting_file:__s_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c13642f
movzx eax, byte [0x6c145288]
mov byte [ebp - 0x378], al
test byte [ebp - 0x378], 8
je 0x6c13602e
mov eax, dword [ebp - 0x36c]
xor edx, edx
mov ebx, dword [eax + 0x34]
mov ecx, dword [eax + 0x30]
mov eax, ebx
or eax, edx
je 0x6c13687b
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str._lx_08lx
call fcn.6c1333b0
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 0x40]
mov ebx, dword [eax + 0x44]
add ecx, dword [eax + 0x38]
adc ebx, dword [eax + 0x3c]
xor edx, edx
mov eax, ebx
or eax, edx
je 0x6c136866
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str._lx_08lx
call fcn.6c1333b0
mov ebx, dword [ebp - 0x378]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.cache_size_after_cleaning_0x_s_0x_s_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp + 0x14], ebx
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c13602e
mov edx, 0xfffffffe
jmp 0x6c135d84
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.deleting_files_with_rating__ld_or_less_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
movzx eax, byte [0x6c145288]
mov byte [ebp - 0x378], al
jmp 0x6c1363b0
movzx ebx, word [0x6c14f8d4]
add eax, 2
mov word [eax - 2], bx
jmp 0x6c136618
mov edi, 0x745c
add eax, 2
mov word [eax - 2], di
jmp 0x6c136618
movzx ebx, word [0x6c14f8d6]
add eax, 2
mov word [eax - 2], bx
jmp 0x6c136618
mov dword [esp + 4], ebx
mov dword [esp], 0x6c14e451
call fcn.6c1333b0
jmp 0x6c1366ac
mov ebx, 0x785c
xor esi, esi
add eax, 4
mov word [eax - 4], bx
mov ebx, edx
and edx, 0xf
shr bl, 4
movzx edi, bl
mov ebx, esi
mov bl, byte [edi + str.0123456789abcdef]
mov esi, ebx
mov ebx, esi
mov bh, byte [edx + str.0123456789abcdef]
mov word [eax - 2], bx
jmp 0x6c136618
lea esi, [edx - 0x20]
mov ebx, esi
cmp bl, 0x5e
ja 0x6c13681e
mov byte [eax], dl
add eax, 1
jmp 0x6c136618
mov dword [esp + 4], ecx
mov dword [esp], 0x6c14e78f
call fcn.6c1333b0
jmp 0x6c136757
mov dword [esp + 4], ecx
mov dword [esp], 0x6c14e78f
call fcn.6c1333b0
mov dword [ebp - 0x378], eax
jmp 0x6c136725
mov esi, dword [ebp - 0x380]
mov byte [eax], 0x22
mov edi, dword [ebp - 0x398]
lea edx, [eax + 1]
jmp 0x6c13669b
test byte [0x6c145288], 8
je 0x6c135df0
mov dword [esp + 0xc], str.got_dll_unload_event___finishing_n
mov dword [esp + 8], str.FreeUrlCacheSpaceW
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c135df0
lea edx, [ebp - 0x34e]
mov ecx, 0x2222
mov word [ebp - 0x350], cx
jmp 0x6c13669b