Function at 0x140055e20
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x1400d1040]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
lea r8d, [r12 + 0x12]
lea rdx, str.Windowsprefetch_
lea rcx, [rbp - 0x70]
call fcn.140046a10
nop
lea rcx, [rsp + 0x50]
call fcn.140054cd0
nop
lea rsi, [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 0xf
jbe 0x140055eb2
mov rsi, qword [rsp + 0x50]
add rbx, rsi
mov rdi, rsi
jmp 0x140055ebf
lea rcx, [rsp + 0x50]
add rbx, rcx
lea rdi, [rsp + 0x50]
cmp rdi, rbx
je 0x140055edb
sub rsi, rdi
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x140055ec7
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x28]
call fcn.140058010
nop
mov ecx, 8
call fcn.140062b28
mov qword [rax], r12
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1400581a0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x80]
call fcn.1400575f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r12w
movdqa xmm0, xmmword [0x1400c5650]
movdqa xmmword [rbp + 0xc0], xmm0
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova rdx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll__Open_dir]
mov rcx, qword [rbp + 0x70]
mov qword [rcx], rax
test rax, rax
je 0x140055f99
mov r8d, dword [rsp + 0x20]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x70]
call fcn.140057920
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140055fde
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055fd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055fd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062610
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14005600a
lock inc dword [rcx + 8]
mov rcx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rcx
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.1400575f0
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x20]
call fcn.1400575f0
mov rax, qword [rbp + 0xc0]
mov qword [rbp], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov ecx, 8
call fcn.140062b28
mov qword [rax], r12
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400581a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
movdqa xmm0, xmmword [0x1400c5650]
movdqa xmmword [rbp + 0x60], xmm0
movabs r13, 0x7fffffffffffffff
mov r14, qword [rbp + 0x10]
mov rbx, qword [rbp - 0x50]
nop dword [rax]
test rbx, rbx
je 0x1400560e2
test r14, r14
je 0x1400560eb
mov rax, qword [r14]
cmp qword [rbx], rax
jmp 0x1400560e5
test r14, r14
je 0x14005642a
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xd0]
call fcn.1400575f0
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x70]
call fcn.1400575f0
or r15d, 1
lea rcx, [rsp + 0x70]
mov rax, qword [rbp - 0x80]
cmp qword [rbp - 0x78], 7
jbe 0x140056141
mov rbx, qword [rsp + 0x70]
lea rdi, [rbx + rax*2]
jmp 0x14005614a
lea rdi, [rcx + rax*2]
lea rbx, [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
cmp rbx, rdi
jne 0x140056170
mov eax, 0xf
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x28], 0
jmp 0x140056272
sub rdi, rbx
sar rdi, 1
mov qword [rsp + 0x40], 0xf
cmp rdi, r13
ja 0x140056509
mov esi, 0xf
cmp rdi, rsi
jbe 0x14005622d
mov rsi, rdi
or rsi, 0xf
cmp rsi, r13
jbe 0x1400561b5
mov rsi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400561dc
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140056208
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005650f
mov rcx, rax
call fcn.140062b28
mov rcx, rax
test rax, rax
je 0x140056415
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140056232
test rcx, rcx
je 0x14005621e
call fcn.140062b28
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140056232
mov rax, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rsi
jmp 0x140056232
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
cmp rsi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rdi
test rdi, rdi
je 0x140056263
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rbx, [rbx + 2]
sub rdx, 1
jne 0x140056250
mov qword [rsp + 0x38], rdi
mov byte [r8 + rdi], 0
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
cmp rax, 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400562b4
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
lea rdx, str.WMIC
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400562ee
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14005632b
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056415
call fcn.140062610
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140056380
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005637a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005641c
call fcn.140062610
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x1400563c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400563bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056423
call fcn.140062610
mov rbx, qword [rbp - 0x50]
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400560d0
lea r8, [rsp + 0x20]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll__Read_dir]
cmp word [rax], 0
jne 0x1400563fb
mov rcx, qword [rbx]
call qword [sym.imp.MSVCP140.dll__Close_dir]
mov qword [rbx], r12
jmp 0x1400560d0
mov r8d, dword [rsp + 0x20]
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x50]
call fcn.140057920
jmp 0x1400560c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x10]
call fcn.140054bd0
nop
lea rcx, [rbp - 0x50]
call fcn.140054bd0
nop
lea rcx, [rbp + 0x70]
call fcn.140054bd0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140056488
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056483
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062610
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400564d9
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400564d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400564d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140062610
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140062520
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400395b0
nop
call fcn.140039510
int3