Function at 0x1400acbb4
Capabilities:
Delete file
Move file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r15, rcx
lea rsi, [rcx + 0x28]
mov qword [rsp + 0x58], rsi
mov rcx, rsi
call sub.KERNEL32.dll_EnterCriticalSection
nop
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x40]
call fcn.1400ad59c
mov r8, rax
mov qword [rsp + 0x40], rax
mov r14d, r12d
mov rcx, qword [r15 + 0x18]
sub rcx, qword [r15 + 0x10]
movabs r13, 0xa7d36bd75acbe1d9
mov rax, r13
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400acd15
mov edi, r12d
mov bl, byte [rsp + 0x30]
mov rdx, qword [r15 + 0x10]
add rdx, 0x410
add rdx, rdi
mov qword [rbp + 0xc8], 7
mov qword [rbp + 0xc0], r12
mov word [rbp + 0xb0], r12w
cmp word [rdx], r12w
jne 0x1400acc94
mov r8, r12
jmp 0x1400acca2
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1400acc98
lea rcx, [rbp + 0xb0]
call fcn.140007090
nop
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0xb0]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400ac4e8
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0xb0]
call fcn.140006e40
inc r14
add rdi, 0x61a
mov rcx, qword [r15 + 0x18]
sub rcx, qword [r15 + 0x10]
mov rax, r13
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r14, rdx
jb 0x1400acc61
mov r8, qword [rsp + 0x40]
mov rbx, qword [r8]
cmp rbx, r8
je 0x1400ad1f2
xor r14d, r14d
lea rsi, vtable.std::ios_base.0
lea r13, [rbx + 0x20]
mov qword [rbp + 0xa8], 7
mov qword [rbp + 0xa0], r14
mov word [rbp + 0x90], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0x90]
call fcn.140007890
lea rcx, [rbp + 0x90]
call fcn.14007c8ac
test al, al
jne 0x1400ad1a5
mov rdi, r14
mov qword [rsp + 0x38], r14
mov rcx, qword [r15 + 0x18]
sub rcx, qword [r15 + 0x10]
movabs r8, 0xa7d36bd75acbe1d9
mov rax, r8
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400ad11d
mov rcx, qword [r15 + 0x18]
sub rcx, qword [r15 + 0x10]
mov rax, r8
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
sub edx, edi
dec edx
cmp qword [r13 + 0x18], 8
jb 0x1400acdda
mov rcx, qword [r13]
jmp 0x1400acddd
mov rcx, r13
movsxd rax, edx
imul r12, rax, 0x61a
mov r9, qword [r15 + 0x10]
lea rax, [r9 + 0x410]
add rax, r12
sub rcx, rax
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x1400ace0e
add rax, 2
test r8d, r8d
jne 0x1400acdf8
test edx, edx
jne 0x1400ad0e3
mov al, byte [r12 + r9 + 0x618]
test al, al
jne 0x1400acf82
mov rcx, qword [0x1402de630]
test rcx, rcx
je 0x1400acf69
mov rax, qword [rcx]
mov edx, 0x7d0
call qword [rax + 0x10]
test eax, eax
je 0x1400acf69
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rbp - 0x80]
call fcn.140040070
nop
call fcn.14010ab78
mov r8, rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
lea rdx, [rbp + 0xb0]
call fcn.140040f30
nop
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x1400acea6
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400acea6
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov r14, qword [r15 + 0x10]
add r14, r12
lea rdx, str._VirtualFilesMonitor::CheckProcesses_
lea rcx, [rbp - 0x80]
call fcn.140043d80
mov rcx, rax
lea rdx, str.DeleteFile_VirtualPath:
call fcn.140043a10
mov rcx, rax
lea rdx, [r14 + 0x208]
call fcn.140043d80
mov rcx, rax
lea rdx, [0x1402281d0]
call fcn.140043a10
mov rcx, rax
mov rdx, r14
call fcn.140043d80
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x80]
call fcn.14003ffc0
nop
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae r8, qword [rbp + 0x90]
mov rcx, qword [0x1402de630]
mov rax, qword [rcx]
mov r9, qword [rbp + 0xa0]
mov edx, 0x7d0
call qword [rax + 0x20]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.140006e40
nop
lea rcx, [rbp + 8]
call fcn.14003fff0
nop
mov qword [rbp + 8], rsi
lea rcx, [rbp + 8]
call fcn.14010acb0
nop
mov rdi, qword [rsp + 0x38]
xor r14d, r14d
mov rcx, qword [r15 + 0x10]
add rcx, 0x208
add rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400ad0e3
cmp al, 1
jne 0x1400ad0e3
mov rcx, qword [0x1402de630]
test rcx, rcx
je 0x1400ad0c9
mov rax, qword [rcx]
mov edx, 0x7d0
call qword [rax + 0x10]
test eax, eax
je 0x1400ad0c9
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rbp - 0x80]
call fcn.140040070
nop
call fcn.14010ab78
mov r8, rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
lea rdx, [rsp + 0x68]
call fcn.140040f30
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400ad006
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400ad006
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov r14, qword [r15 + 0x10]
add r14, r12
lea rdx, str._VirtualFilesMonitor::CheckProcesses_
lea rcx, [rbp - 0x80]
call fcn.140043d80
mov rcx, rax
lea rdx, str.MoveFileEx_VirtualPath:
call fcn.140043a10
mov rcx, rax
lea rdx, [r14 + 0x208]
call fcn.140043d80
mov rcx, rax
lea rdx, [0x1402281d0]
call fcn.140043a10
mov rcx, rax
mov rdx, r14
call fcn.140043d80
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x80]
call fcn.14003ffc0
nop
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae r8, qword [rbp + 0x90]
mov rcx, qword [0x1402de630]
mov rax, qword [rcx]
mov r9, qword [rbp + 0xa0]
mov edx, 0x7d0
call qword [rax + 0x20]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.140006e40
nop
lea rcx, [rbp + 8]
call fcn.14003fff0
nop
mov qword [rbp + 8], rsi
lea rcx, [rbp + 8]
call fcn.14010acb0
nop
mov rdi, qword [rsp + 0x38]
xor r14d, r14d
mov rdx, qword [r15 + 0x10]
add rdx, r12
lea rcx, [rdx + 0x208]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
inc rdi
mov qword [rsp + 0x38], rdi
mov rcx, qword [r15 + 0x18]
sub rcx, qword [r15 + 0x10]
movabs r8, 0xa7d36bd75acbe1d9
mov rax, r8
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x1400acdaa
mov rdi, qword [r15 + 0x18]
mov qword [rbp + 0xa8], 7
mov qword [rbp + 0xa0], r14
mov word [rbp + 0x90], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0x90]
call fcn.140007890
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.1400ac9e4
mov r9, rax
mov r8, qword [r15 + 0x18]
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400ac900
mov r8, rax
mov rax, qword [r15 + 0x10]
cmp qword [r8], rax
jne 0x1400ad188
cmp rdi, qword [r15 + 0x18]
je 0x1400ad1a1
cmp qword [r8], rdi
je 0x1400ad1a5
xor eax, eax
mov r9b, al
mov r8, qword [r8]
mov rdx, qword [r15 + 0x18]
mov rcx, rdi
call fcn.1400ac658
mov qword [r15 + 0x18], rax
cmp byte [rbx + 0x19], r14b
jne 0x1400ad1df
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], r14b
jne 0x1400ad1c3
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r14b
je 0x1400ad1b5
jmp 0x1400ad1df
mov rax, qword [rbx + 8]
jmp 0x1400ad1d6
cmp rbx, qword [rax + 0x10]
jne 0x1400ad1dc
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], r14b
je 0x1400ad1c9
mov rbx, rax
mov r8, qword [rsp + 0x40]
cmp rbx, r8
jne 0x1400acd2b
mov rsi, qword [rsp + 0x58]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400ad8e0
mov edx, 1
lea r8d, [rdx + 0x3f]
mov rcx, qword [rsp + 0x40]
call fcn.140002a70
nop
mov rcx, rsi
call sub.KERNEL32.dll_LeaveCriticalSection
nop
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14012a1e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret