Function at 0x1400324d0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x14038d940]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rdi, r9
mov rbx, r8
mov r13, rdx
mov rsi, qword [rbp + 0x1d0]
mov r12, qword [rbp + 0x1d8]
mov rax, qword [rbp + 0x1e0]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 0x1e8]
xor r14d, r14d
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 2]
mov r8, rcx
lea rcx, [rbp + 0xb0]
call fcn.14002dac0
nop
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.14003d5d0
mov rdx, rdi
lea rcx, [rbp + 0xc8]
call fcn.14003d5d0
lea edx, [r14 + 0x68]
lea rcx, [rbp + 0x20]
call fcn.1400111e0
mov rbx, rax
mov rdi, qword [rax + 0x10]
mov rcx, rax
call fcn.140042b10
test al, al
je 0x140032586
mov ecx, r14d
jmp 0x140032598
mov rax, qword [rbx + 8]
lea rcx, [0x14025ad40]
test rax, rax
cmovne rcx, rax
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rcx
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call fcn.14008d7e0
nop
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.1400329c0
nop
mov ebx, 0xffffffff
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400325ed
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400325ed
mov rcx, qword [rbp - 0x10]
call fcn.1402275a0
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14003260a
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14003260a
mov rcx, qword [rbp + 0x20]
call fcn.1402275a0
xor r15b, r15b
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xb0]
call fcn.140032ae0
test al, al
jne 0x140032637
mov edi, 1
jmp 0x140032895
mov rcx, rsi
call fcn.140043040
test al, al
je 0x1400326b0
mov rdx, r12
mov rcx, rsi
call fcn.140043f40
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x50]
call fcn.1400111e0
nop
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14000e890
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x38]
mov rcx, r13
call fcn.14001df30
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400326b0
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400326b0
mov rcx, qword [rbp + 0x50]
call fcn.1402275a0
nop dword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140042d40
nop
lea rcx, [rsp + 0x78]
call fcn.1400433b0
mov edx, 2
lea rcx, [rsp + 0x78]
call fcn.1400430b0
test al, al
je 0x1400326f3
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x78]
call fcn.140049bd0
test rax, rax
jle 0x1400326f3
mov dil, 1
jmp 0x1400326f6
xor dil, dil
lea rcx, [rsp + 0x78]
call fcn.140044720
nop
lea rcx, [rsp + 0x78]
call fcn.140042e20
test dil, dil
jne 0x140032725
mov edi, 5
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400327c9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.14002b640
test al, al
jne 0x14003276f
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400327a8
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400327a8
mov rcx, qword [rbp - 0x68]
call fcn.1402275a0
jmp 0x1400327a8
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x68]
call fcn.14002b7f0
movzx edi, al
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x14003279f
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14003279f
mov rcx, qword [rbp - 0x68]
call fcn.1402275a0
test dil, dil
jne 0x14003286e
mov rcx, rsi
call fcn.140094620
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 2
inc r14d
cmp r14d, 3
jl 0x1400326b0
mov rcx, r12
call fcn.140043040
test al, al
je 0x140032892
mov rcx, rsi
call fcn.140043040
test al, al
jne 0x140032892
mov rdx, rsi
mov rcx, r12
call fcn.140043f40
mov edx, 0x139
lea rcx, [rbp + 0x80]
call fcn.1400111e0
nop
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14000e890
mov byte [rsp + 0x38], 0
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.14001df30
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140032895
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140032895
mov rcx, qword [rbp + 0x80]
call fcn.1402275a0
jmp 0x140032895
mov r15b, 1
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x38]
call fcn.140002500
mov edi, 3
test al, al
mov r14d, 0
cmovne edi, r14d
jmp 0x140032895
xor r14d, r14d
mov edx, 0x137
lea rcx, [rbp + 0x98]
call fcn.1400111e0
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14000e890
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0
mov qword [rbp - 0x78], 0
mov dword [rbp - 0x70], r14d
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rbp + 8], xmm1
movsd xmm0, qword [rbp - 0x40]
movsd qword [rbp + 0x18], xmm0
movq rax, xmm1
test rax, rax
je 0x1400328ef
lock inc dword [rax]
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 8]
mov rcx, r13
call fcn.14001e000
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140032940
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140032940
mov rcx, qword [rbp - 0x50]
call fcn.1402275a0
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140032964
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140032964
mov rcx, qword [rbp + 0x98]
call fcn.1402275a0
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140032980
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x140032980
mov rcx, qword [rbp - 0x38]
call fcn.1402275a0
nop
lea rcx, [rbp + 0xb0]
call fcn.14002dc00
movzx eax, r15b
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1402200b0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret