Function at 0x1400786b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140189090]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx ebx, dl
mov byte [rsp + 0x30], dl
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x34], r13d
lea rsi, [r13 - 1]
test dl, dl
je 0x140078dad
lea r12, [rcx + 0x30]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x58], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
mov rbx, qword [r12]
test rbx, rbx
je 0x1400787aa
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x14007875a
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x14007874a
mov rcx, qword [rax]
test rcx, rcx
je 0x14007875a
cmp r8, 0x10
jb 0x140078761
mov rdx, qword [rax]
jmp 0x140078761
lea rdx, [0x1401578ef]
mov qword [rsp + 0x38], r13
movdqa xmm0, xmmword [0x140166ac0]
movdqu xmmword [rsp + 0x48], xmm0
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140078780
lea rcx, [rsp + 0x38]
call fcn.140009250
mov r14d, 6
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140097cd0
movzx ebx, al
test r14b, 2
je 0x1400787bf
and r14d, 0xfffffffd
lea rcx, [rsp + 0x38]
call fcn.1400091f0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
test bl, bl
jne 0x140078802
mov qword [rbp - 0x58], r13
lea rdx, str.product_data
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.140098cb0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
jmp 0x140078da8
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov ecx, 0x40
call fcn.1400f89d8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp - 0x58], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.1400988a0
mov rbx, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.140040fe0
or r14d, 8
mov rdi, qword [rbp + 0x10]
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
jne 0x140078b5e
mov r12, qword [rbp - 0x80]
nop word [rax + rax]
mov qword [rbp - 0x50], r13
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x1400788a9
cmp qword [rdx + 0x18], 0x10
jb 0x1400788ac
mov rdx, qword [rdx]
jmp 0x1400788ac
mov rdx, r13
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x1400788e2
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x1400788d2
mov rcx, qword [rax]
test rcx, rcx
je 0x1400788e2
cmp r8, 0x10
jb 0x1400788e9
mov rdx, qword [rax]
jmp 0x1400788e9
lea rdx, [0x1401578ef]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x140078904
lea rcx, [rsp + 0x38]
call fcn.140009250
or r14d, 0x10
mov dword [rsp + 0x34], r14d
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.14007bc90
mov r15, rax
lea rcx, [rsp + 0x38]
call fcn.1400091f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.140040fe0
nop
mov rbx, qword [rbp - 0x10]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140078ae0
mov qword [rbp - 0x48], r13
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140078979
cmp qword [rdx + 0x18], 0x10
jb 0x14007897c
mov rdx, qword [rdx]
jmp 0x14007897c
mov rdx, r13
lea rcx, [rbp - 0x48]
call fcn.140097430
nop
lea rdx, [rbp - 0x48]
mov rcx, r15
call fcn.1400988a0
mov rsi, rax
mov qword [rbp - 0x58], r13
lea rdx, str.product_id
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400988a0
mov rsi, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
mov rdx, qword [rsi]
test rdx, rdx
je 0x140078a14
add rdx, 0x10
lea rcx, [rsp + 0x38]
call fcn.140007d50
bts r14d, 8
mov dword [rsp + 0x34], r14d
mov qword [rbp - 0x58], r13
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x58]
call fcn.140097430
bts r14d, 7
lea rcx, [rsp + 0x38]
call fcn.1400091f0
jmp 0x140078a1d
mov qword [rbp - 0x58], r13
bts r14d, 7
or r14d, 0x40
mov dword [rsp + 0x34], r14d
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.14001b1e0
or r14d, 0x20
mov dword [rsp + 0x34], r14d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14007bfd0
and r14d, 0xffffffdf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp - 0x78]
call fcn.1400091f0
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.140097430
nop
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140078aa8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140078aa3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140078aa3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140078a90
mov rbx, rax
jmp 0x140078acf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140078acf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140078ac0
cmp byte [rbx + 0x19], 0
je 0x140078960
mov rsi, 0xffffffffffffffff
lea rcx, [rbp - 0x10]
call fcn.140040f60
nop
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x140078b28
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x140078b23
nop word [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x140078b23
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140078b10
mov rdi, rax
jmp 0x140078b4f
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140078b4f
nop dword [rax]
nop dword [rax + rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140078b40
cmp byte [rdi + 0x19], 0
je 0x140078890
mov r12, qword [rsp + 0x78]
mov qword [rbp - 0x50], r13
lea rdx, str.product_data
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
lea rdx, [rbp - 0x50]
mov rcx, r12
call fcn.1400987a0
mov r12, rax
mov qword [rbp - 0x48], rax
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
lea rdx, [rbp]
mov rcx, r12
call fcn.140040fe0
nop
mov rbx, qword [rbp]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140078d80
nop word [rax + rax]
mov qword [rbp - 0x58], r13
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140078bd9
cmp qword [rdx + 0x18], 0x10
jb 0x140078bdc
mov rdx, qword [rdx]
jmp 0x140078bdc
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x140078c12
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140078c02
mov rcx, qword [rax]
test rcx, rcx
je 0x140078c12
cmp r8, 0x10
jb 0x140078c19
mov rdx, qword [rax]
jmp 0x140078c19
lea rdx, [0x1401578ef]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov r8, rsi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140078c30
lea rcx, [rsp + 0x58]
call fcn.140009250
bts r14d, 9
mov rdi, qword [rbp - 0x40]
mov qword [rsp + 0x78], rdi
mov rsi, qword [rdi + 8]
mov r15, rdi
mov qword [rbp - 0x50], rdi
cmp byte [rsi + 0x19], 0
jne 0x140078cdf
mov r12, qword [rsp + 0x68]
mov rdi, 0xffffffffffffffff
nop
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r15, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140078c93
mov rcx, qword [rcx]
mov r8, r15
cmp r12, r15
cmovb r8, r12
call fcn.1400fba80
test eax, eax
jne 0x140078cb5
cmp r15, r12
jae 0x140078caf
mov eax, edi
jmp 0x140078cb5
mov eax, r13d
seta al
shr eax, 0x1f
test al, al
je 0x140078cc6
mov rsi, qword [rsi + 0x10]
mov r15, qword [rbp - 0x50]
jmp 0x140078cd0
mov r15, rsi
mov qword [rbp - 0x50], rsi
mov rsi, qword [rsi]
cmp byte [rsi + 0x19], 0
je 0x140078c70
mov rdi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x48]
cmp byte [r15 + 0x19], 0
jne 0x140078cf8
lea r8, [r15 + 0x20]
lea rdx, [rsp + 0x58]
call fcn.14001fce0
test al, al
je 0x140078cfb
mov r15, rdi
lea rcx, [rsp + 0x58]
call fcn.1400091f0
cmp r15, rdi
jne 0x140078d17
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.140098cb0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140097430
nop
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140078d4f
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140078d4a
cmp rbx, qword [rax + 0x10]
jne 0x140078d4a
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140078d37
mov rbx, rax
jmp 0x140078d6f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140078d6f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140078d60
cmp byte [rbx + 0x19], 0
mov rsi, 0xffffffffffffffff
je 0x140078bc0
lea rcx, [rbp]
call fcn.140040f60
nop
lea rcx, [rbp + 0x10]
call fcn.140040f60
nop
lea rcx, [rbp - 0x40]
call fcn.14004f600
mov rsi, 0xffffffffffffffff
mov rdi, qword [rbp - 0x80]
movzx ebx, byte [rsp + 0x30]
lea rdx, str.cs.smd
lea rcx, [rbp - 0x30]
call fcn.140050070
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140078e07
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.140025da0
mov edx, dword [0x140189cc0]
lea rcx, [rbp - 0x30]
call fcn.140025da0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x140078ec5
mov qword [rbp - 0x50], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
or r14d, 1
mov dword [rsp + 0x34], r14d
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140078eab
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140078e62
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140078e52
mov rcx, qword [rax]
test rcx, rcx
je 0x140078e62
cmp r8, 0x10
jb 0x140078e69
mov rdx, qword [rax]
jmp 0x140078e69
lea rdx, [0x1401578ef]
mov qword [rsp + 0x38], r13
movdqa xmm0, xmmword [0x140166ac0]
movdqu xmmword [rsp + 0x48], xmm0
mov r8, rsi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140078e80
lea rcx, [rsp + 0x38]
call fcn.140009250
or r14d, 0xc00
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140097cd0
movzx ebx, al
bt r14d, 0xa
jae 0x140078ec1
btr r14d, 0xa
lea rcx, [rsp + 0x38]
call fcn.1400091f0
test bl, bl
je 0x140078ec7
mov bl, 1
test r14b, 1
je 0x140078ed9
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x140079000
cmp dword [rdx], 4
je 0x140078f03
cmp qword [rdx + 0x50], 0
jne 0x140078f17
mov rax, qword [rdx + 0x38]
cmp qword [rdx + 0x30], rax
jne 0x140078f17
cmp qword [rdx + 0x20], 0
jne 0x140078f17
xorps xmm0, xmm0
movsd xmm1, qword [rdx + 8]
ucomisd xmm1, xmm0
jp 0x140078f17
je 0x140079000
test bl, bl
je 0x140079000
lea rcx, [rsp + 0x38]
call fcn.14009f410
nop
mov qword [rbp - 0x50], r13
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
lea rcx, [rsp + 0x38]
call fcn.1400091f0
nop
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140078f80
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140078f70
mov rcx, qword [rax]
test rcx, rcx
je 0x140078f80
cmp r8, 0x10
jb 0x140078f87
mov rdx, qword [rax]
jmp 0x140078f87
lea rdx, [0x1401578ef]
mov qword [rsp + 0x58], r13
movdqa xmm0, xmmword [0x140166ac0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
nop
inc rsi
cmp byte [rdx + rsi], 0
jne 0x140078fa0
mov r8, rsi
lea rcx, [rsp + 0x58]
call fcn.140009250
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.1400234e0
test al, al
sete r13b
lea rcx, [rsp + 0x58]
call fcn.1400091f0
nop
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140097430
nop
lea rcx, [rbp - 0x30]
call fcn.140008fe0
mov eax, r13d
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400f89b0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret