Function at 0x140013360
Capabilities:
Delete file
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x600
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
xor r15d, r15d
mov dword [rsp + 0x44], r15d
call fcn.140012a00
mov rcx, rsi
call fcn.140012e70
cmp qword [rsi + 8], r15
je 0x140013887
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
lea r8d, [r15 + 0xa]
lea rdx, [rsp + 0x4e0]
call fcn.1400c6220
mov rdx, qword [rsi + 8]
mov rdi, qword [rdx + 0x168]
mov ecx, 0x3d8
call fcn.14008c4a0
mov rcx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140013430
mov rax, qword [rsi]
mov r8, qword [rax + 0x298]
lea rax, [r8 + 0x1358]
lea r9, [r8 + 0x1254]
add r8, 0xe44
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.140013d30
mov rbx, rax
jmp 0x140013433
mov rbx, r15
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call fcn.140015ed0
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140014e60
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140014c60
mov r14, rax
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140038b50
nop
nop
nop
lea rcx, [rsp + 0x80]
call fcn.140039440
mov rdi, rax
test rax, rax
je 0x1400134cf
mov rdx, r13
mov rcx, rax
call r12
test eax, eax
je 0x1400134cd
mov rdx, rdi
mov rcx, rbx
call fcn.1400154d0
jmp 0x1400134a0
mov rcx, rbx
call fcn.140015aa0
mov rcx, r14
call fcn.1400151c0
lea rcx, [rsp + 0x58]
call fcn.140014290
test rbx, rbx
je 0x1400134fb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, rsi
call fcn.140012a00
mov word [rsp + 0x40], 0x2e
mov rax, qword [rsi]
mov rcx, qword [rax + 0x298]
add rcx, 0xe44
lea rdx, [rsp + 0xa0]
nop
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x140013530
lea rcx, [rsp + 0xa0]
call fcn.1400b3390
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1b0]
nop
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x140013560
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x3d0]
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x140013581
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x2c0]
nop
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400135b0
mov r8, qword [rsi]
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx + 0x53a0]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400135e0
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013610
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx + 0x1254]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013640
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx + 0x53a0]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013670
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400136a0
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx + 0x1358]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400136d0
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x4e0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013700
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013730
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx + 0x1254]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013760
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x4e0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140013790
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
xor edx, edx
nop
nop
nop
movzx eax, byte [r9 + rdx]
mov byte [rdi + rdx - 1], al
add rdx, 1
test al, al
jne 0x1400137c0
mov rdx, qword [r8 + 0x298]
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx + 0x1358]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400137f0
lea rcx, [rsp + 0x3d0]
call fcn.1400b6a90
test eax, eax
je 0x140013879
lea rcx, [rsp + 0x2c0]
call fcn.1400b6a90
test eax, eax
je 0x140013879
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r15d, 1
mov dword [rsp + 0x44], r15d
lea rcx, [rsp + 0x80]
call fcn.140038b70
nop
mov eax, r15d
jmp 0x140013890
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret