Function at 0x140056ed0
Capabilities:
Delete file

Disassembly:
push r15
sub rsp, 0x30
mov r15, rcx
mov rcx, qword [rcx + 0x70]
test rcx, rcx
je 0x140056eed
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rdx, qword [r15 + 0x60]
mov r8, qword [r15 + 0x58]
mov rax, rdx
mov qword [rsp + 0x40], rbx
sub rax, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
sar rax, 3
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
test rax, rax
je 0x140057055
xor r12d, r12d
xor r14d, r14d
nop dword [rax]
sub rdx, r8
sar rdx, 3
cmp rdx, r14
jbe 0x140057204
lfence
mov rax, qword [r15 + 0x58]
xor ebp, ebp
xor edi, edi
mov rsi, qword [rax + r14*8]
mov rdx, qword [rsi]
mov r8, qword [rdx]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
test rax, rax
je 0x14005701c
nop dword [rax]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
cmp rax, rdi
jbe 0x1400571fe
lfence
mov rax, qword [rdx]
mov rbx, qword [rax + rdi*8]
mov eax, dword [rbx + 0x60]
cmp eax, 0x64
je 0x140056ffa
cmp byte [r15 + 0x15], 0
je 0x140056fbd
cmp qword [rbx + 0x38], 8
lea r8, [rbx + 0x20]
jb 0x140056fab
mov r8, qword [r8]
mov rdx, qword [rbx]
lea rcx, str._AsusSync_FileTransfer__CancelSession_0x_I64X____receiving_name:__s_n
call fcn.140095ab0
mov eax, dword [rbx + 0x60]
cmp eax, 0x64
je 0x140056fe6
cmp byte [rbx + 0x79], 0
jne 0x140056fe6
mov rcx, qword [rbx + 0x70]
mov word [rbx + 0x78], 0x100
cmp rcx, 0xffffffffffffffff
je 0x140056fe6
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
cmp qword [rbx + 0x58], 8
lea rcx, [rbx + 0x40]
jb 0x140056ff4
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rdx, qword [rsi]
inc ebp
inc rdi
movsxd rax, ebp
mov r8, qword [rdx]
mov rcx, qword [rdx + 8]
sub rcx, r8
sar rcx, 3
cmp rax, rcx
jb 0x140056f70
cmp qword [rsi + 0x30], 0
mov byte [rsi + 0x2c], 1
jne 0x140057031
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [rsi + 0x30], rax
mov rdx, qword [r15 + 0x60]
inc r12d
mov r8, qword [r15 + 0x58]
mov rcx, rdx
sub rcx, r8
movsxd rax, r12d
sar rcx, 3
inc r14
cmp rax, rcx
jb 0x140056f30
mov rcx, qword [r15 + 0x70]
test rcx, rcx
je 0x140057064
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov rcx, qword [r15 + 0x98]
test rcx, rcx
je 0x14005707b
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rdx, qword [r15 + 0x88]
mov r8, qword [r15 + 0x80]
mov rax, rdx
sub rax, r8
sar rax, 3
test rax, rax
je 0x1400571c7
xor r12d, r12d
xor r14d, r14d
nop dword [rax]
nop word [rax + rax]
sub rdx, r8
sar rdx, 3
cmp rdx, r14
jbe 0x140057204
lfence
mov rax, qword [r15 + 0x80]
xor ebp, ebp
xor edi, edi
mov rsi, qword [rax + r14*8]
mov rdx, qword [rsi]
mov r8, qword [rdx]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
test rax, rax
je 0x140057188
nop dword [rax]
mov rax, qword [rdx + 8]
sub rax, r8
sar rax, 3
cmp rax, rdi
jbe 0x1400571fe
lfence
mov rbx, qword [rdx]
mov rbx, qword [rbx + rdi*8]
mov eax, dword [rbx + 0x60]
cmp eax, 0x64
je 0x140057166
cmp byte [r15 + 0x15], 0
je 0x14005713d
cmp qword [rbx + 0x38], 8
lea r8, [rbx + 0x20]
jb 0x14005712b
mov r8, qword [r8]
mov rdx, qword [rbx]
lea rcx, str._AsusSync_FileTransfer__CancelSession_0x_I64X____receiving_name:__s_n
call fcn.140095ab0
mov eax, dword [rbx + 0x60]
cmp eax, 0x64
je 0x140057166
cmp byte [rbx + 0x79], 0
jne 0x140057166
mov rcx, qword [rbx + 0x70]
mov word [rbx + 0x78], 0x100
cmp rcx, 0xffffffffffffffff
je 0x140057166
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
mov rdx, qword [rsi]
inc ebp
inc rdi
movsxd rax, ebp
mov r8, qword [rdx]
mov rcx, qword [rdx + 8]
sub rcx, r8
sar rcx, 3
cmp rax, rcx
jb 0x1400570f0
cmp qword [rsi + 0x30], 0
mov byte [rsi + 0x2c], 1
jne 0x14005719d
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov qword [rsi + 0x30], rax
mov rdx, qword [r15 + 0x88]
inc r12d
mov r8, qword [r15 + 0x80]
mov rcx, rdx
sub rcx, r8
movsxd rax, r12d
sar rcx, 3
inc r14
cmp rax, rcx
jb 0x1400570b0
mov rcx, qword [r15 + 0x98]
test rcx, rcx
je 0x1400571d9
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r15
ret
call fcn.14000a150
int3
call fcn.14000a150
int3