Function at 0x140079450
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14018a090]
xor rax, rsp
mov qword [rbp + 0x20], rax
movzx ebx, dl
mov byte [rsp + 0x30], dl
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x34], r13d
lea rsi, [r13 - 1]
test dl, dl
je 0x140079b4d
lea r12, [rcx + 0x30]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x58], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
mov rbx, qword [r12]
test rbx, rbx
je 0x14007954a
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x1400794fa
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x1400794ea
mov rcx, qword [rax]
test rcx, rcx
je 0x1400794fa
cmp r8, 0x10
jb 0x140079501
mov rdx, qword [rax]
jmp 0x140079501
lea rdx, [0x14015892f]
mov qword [rsp + 0x38], r13
movdqa xmm0, xmmword [0x140167e50]
movdqu xmmword [rsp + 0x48], xmm0
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140079520
lea rcx, [rsp + 0x38]
call fcn.1400090e0
mov r14d, 6
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140098910
movzx ebx, al
test r14b, 2
je 0x14007955f
and r14d, 0xfffffffd
lea rcx, [rsp + 0x38]
call fcn.140009080
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
test bl, bl
jne 0x1400795a2
mov qword [rbp - 0x58], r13
lea rdx, str.product_data
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.1400998f0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
jmp 0x140079b48
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov ecx, 0x40
call fcn.1400f9588
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp - 0x58], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.1400994e0
mov rbx, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.1400408f0
or r14d, 8
mov rdi, qword [rbp + 0x10]
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
jne 0x1400798fe
mov r12, qword [rbp - 0x80]
nop word [rax + rax]
mov qword [rbp - 0x50], r13
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x140079649
cmp qword [rdx + 0x18], 0x10
jb 0x14007964c
mov rdx, qword [rdx]
jmp 0x14007964c
mov rdx, r13
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140079682
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140079672
mov rcx, qword [rax]
test rcx, rcx
je 0x140079682
cmp r8, 0x10
jb 0x140079689
mov rdx, qword [rax]
jmp 0x140079689
lea rdx, [0x14015892f]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400796a4
lea rcx, [rsp + 0x38]
call fcn.1400090e0
or r14d, 0x10
mov dword [rsp + 0x34], r14d
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.14007ca30
mov r15, rax
lea rcx, [rsp + 0x38]
call fcn.140009080
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.1400408f0
nop
mov rbx, qword [rbp - 0x10]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140079880
mov qword [rbp - 0x48], r13
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140079719
cmp qword [rdx + 0x18], 0x10
jb 0x14007971c
mov rdx, qword [rdx]
jmp 0x14007971c
mov rdx, r13
lea rcx, [rbp - 0x48]
call fcn.140098070
nop
lea rdx, [rbp - 0x48]
mov rcx, r15
call fcn.1400994e0
mov rsi, rax
mov qword [rbp - 0x58], r13
lea rdx, str.product_id
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400994e0
mov rsi, rax
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400797b4
add rdx, 0x10
lea rcx, [rsp + 0x38]
call fcn.140007be0
bts r14d, 8
mov dword [rsp + 0x34], r14d
mov qword [rbp - 0x58], r13
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x58]
call fcn.140098070
bts r14d, 7
lea rcx, [rsp + 0x38]
call fcn.140009080
jmp 0x1400797bd
mov qword [rbp - 0x58], r13
bts r14d, 7
or r14d, 0x40
mov dword [rsp + 0x34], r14d
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.14001b0b0
or r14d, 0x20
mov dword [rsp + 0x34], r14d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14007cd70
and r14d, 0xffffffdf
mov dword [rsp + 0x34], r14d
lea rcx, [rbp - 0x78]
call fcn.140009080
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.140098070
nop
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140079848
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140079843
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140079843
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140079830
mov rbx, rax
jmp 0x14007986f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14007986f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140079860
cmp byte [rbx + 0x19], 0
je 0x140079700
mov rsi, 0xffffffffffffffff
lea rcx, [rbp - 0x10]
call fcn.140040870
nop
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400798c8
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x1400798c3
nop word [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x1400798c3
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400798b0
mov rdi, rax
jmp 0x1400798ef
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400798ef
nop dword [rax]
nop dword [rax + rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400798e0
cmp byte [rdi + 0x19], 0
je 0x140079630
mov r12, qword [rsp + 0x78]
mov qword [rbp - 0x50], r13
lea rdx, str.product_data
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
lea rdx, [rbp - 0x50]
mov rcx, r12
call fcn.1400993e0
mov r12, rax
mov qword [rbp - 0x48], rax
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
lea rdx, [rbp]
mov rcx, r12
call fcn.1400408f0
nop
mov rbx, qword [rbp]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140079b20
nop word [rax + rax]
mov qword [rbp - 0x58], r13
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140079979
cmp qword [rdx + 0x18], 0x10
jb 0x14007997c
mov rdx, qword [rdx]
jmp 0x14007997c
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x1400799b2
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x1400799a2
mov rcx, qword [rax]
test rcx, rcx
je 0x1400799b2
cmp r8, 0x10
jb 0x1400799b9
mov rdx, qword [rax]
jmp 0x1400799b9
lea rdx, [0x14015892f]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov r8, rsi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400799d0
lea rcx, [rsp + 0x58]
call fcn.1400090e0
bts r14d, 9
mov rdi, qword [rbp - 0x40]
mov qword [rsp + 0x78], rdi
mov rsi, qword [rdi + 8]
mov r15, rdi
mov qword [rbp - 0x50], rdi
cmp byte [rsi + 0x19], 0
jne 0x140079a7f
mov r12, qword [rsp + 0x68]
mov rdi, 0xffffffffffffffff
nop
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r15, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140079a33
mov rcx, qword [rcx]
mov r8, r15
cmp r12, r15
cmovb r8, r12
call fcn.1400fc630
test eax, eax
jne 0x140079a55
cmp r15, r12
jae 0x140079a4f
mov eax, edi
jmp 0x140079a55
mov eax, r13d
seta al
shr eax, 0x1f
test al, al
je 0x140079a66
mov rsi, qword [rsi + 0x10]
mov r15, qword [rbp - 0x50]
jmp 0x140079a70
mov r15, rsi
mov qword [rbp - 0x50], rsi
mov rsi, qword [rsi]
cmp byte [rsi + 0x19], 0
je 0x140079a10
mov rdi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x48]
cmp byte [r15 + 0x19], 0
jne 0x140079a98
lea r8, [r15 + 0x20]
lea rdx, [rsp + 0x58]
call fcn.14001f5d0
test al, al
je 0x140079a9b
mov r15, rdi
lea rcx, [rsp + 0x58]
call fcn.140009080
cmp r15, rdi
jne 0x140079ab7
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.1400998f0
nop
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140098070
nop
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140079aef
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140079aea
cmp rbx, qword [rax + 0x10]
jne 0x140079aea
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140079ad7
mov rbx, rax
jmp 0x140079b0f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140079b0f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140079b00
cmp byte [rbx + 0x19], 0
mov rsi, 0xffffffffffffffff
je 0x140079960
lea rcx, [rbp]
call fcn.140040870
nop
lea rcx, [rbp + 0x10]
call fcn.140040870
nop
lea rcx, [rbp - 0x40]
call fcn.14004ef10
mov rsi, 0xffffffffffffffff
mov rdi, qword [rbp - 0x80]
movzx ebx, byte [rsp + 0x30]
lea rdx, str.cs.smd
lea rcx, [rbp - 0x30]
call fcn.14004f980
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140079bad
xor r8d, r8d
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.140025970
xor r8d, r8d
mov edx, dword [0x14018acc0]
lea rcx, [rbp - 0x30]
call fcn.140025970
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x140079c6a
mov qword [rbp - 0x50], r13
lea rdx, str.session_data
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
or r14d, 1
mov dword [rsp + 0x34], r14d
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x140079c50
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140079c08
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140079bf8
mov rcx, qword [rax]
test rcx, rcx
je 0x140079c08
cmp r8, 0x10
jb 0x140079c0f
mov rdx, qword [rax]
jmp 0x140079c0f
lea rdx, [0x14015892f]
mov qword [rsp + 0x38], r13
movdqa xmm0, xmmword [0x140167e50]
movdqu xmmword [rsp + 0x48], xmm0
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x140079c25
lea rcx, [rsp + 0x38]
call fcn.1400090e0
or r14d, 0xc00
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140098910
movzx ebx, al
bt r14d, 0xa
jae 0x140079c66
btr r14d, 0xa
lea rcx, [rsp + 0x38]
call fcn.140009080
test bl, bl
je 0x140079c6c
mov bl, 1
test r14b, 1
je 0x140079c7e
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x140079da4
cmp dword [rdx], 4
je 0x140079ca8
cmp qword [rdx + 0x50], 0
jne 0x140079cbc
mov rax, qword [rdx + 0x38]
cmp qword [rdx + 0x30], rax
jne 0x140079cbc
cmp qword [rdx + 0x20], 0
jne 0x140079cbc
xorps xmm0, xmm0
movsd xmm1, qword [rdx + 8]
ucomisd xmm1, xmm0
jp 0x140079cbc
je 0x140079da4
test bl, bl
je 0x140079da4
lea rcx, [rsp + 0x38]
call fcn.14009ffc0
nop
mov qword [rbp - 0x50], r13
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
lea rcx, [rsp + 0x38]
call fcn.140009080
nop
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140079d25
mov rcx, rax
mov rdx, rax
mov r8, qword [rax + 0x18]
cmp r8, 0x10
jb 0x140079d15
mov rcx, qword [rax]
test rcx, rcx
je 0x140079d25
cmp r8, 0x10
jb 0x140079d2c
mov rdx, qword [rax]
jmp 0x140079d2c
lea rdx, [0x14015892f]
mov qword [rsp + 0x58], r13
movdqa xmm0, xmmword [0x140167e50]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
inc rsi
cmp byte [rdx + rsi], 0
jne 0x140079d44
mov r8, rsi
lea rcx, [rsp + 0x58]
call fcn.1400090e0
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.140022da0
test al, al
sete r13b
lea rcx, [rsp + 0x58]
call fcn.140009080
nop
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140098070
nop
lea rcx, [rbp - 0x30]
call fcn.140008e70
mov eax, r13d
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400f9560
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret