Function at 0x140024210
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x110
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r14d, ecx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [r11 - 0x90]
mov qword [r11 + 0x10], rax
lea rax, [r11 - 0x70]
mov qword [r11 + 0x20], rax
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0x78], 7
mov word [rsp + 0x98], bx
lea r8d, [rbx + 9]
lea rdx, str.stemp.bat
lea rcx, [r11 - 0x90]
call fcn.14000e890
nop
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], bx
lea r8d, [rbx + 6]
lea rdx, [0x14009a3b8]
lea rcx, [rsp + 0xb8]
call fcn.14000e890
nop
lea r9, [rsp + 0x98]
mov r8d, 0x85
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x140]
call fcn.14000dfc0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0xe0], rax
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x148]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.14000bc20
nop
mov rcx, rax
call fcn.14005f300
nop
mov rcx, qword [rsp + 0x148]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x48], rcx
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140024341
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0xf8], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x50]
call fcn.14000c8e0
mov rdi, rax
lea rdx, str.Necessary_settings_has_been_changed_successfully_please_restart_your_machine_and_try_to_activate
lea rcx, [rsp + 0x58]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0x60]
call fcn.14000c8e0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r14d
call fcn.14005d360
nop
jmp 0x1400243bb
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140024506
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x138], rax
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x138]
call fcn.14000ce70
test al, al
jne 0x14002440b
lea rdx, [0x14009a1d8]
lea rcx, [rsp + 0x138]
call fcn.14000c670
nop
mov rax, qword [rsp + 0x140]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14002442a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002443b
call fcn.14000db70
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140024511
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edi, 1
mov dword [rsp + 0x30], edi
mov r9, qword [rsp + 0x138]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rsp + 0x140]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.14000d050
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400244b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400244d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400244f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80004005
call fcn.14000df80
int3