Function at 0x6013e3f0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x6014b842
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x244
mov eax, dword [0x6015b6f8]
push ebx
push esi
push edi
mov ecx, 0x6015b6f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x260]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x48]
push edx
xor ebx, ebx
push esi
mov dword [esp + 0x264], ebx
call fcn.6011be20
mov edi, eax
cmp edi, ebx
jge 0x6013e478
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x258], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6013e471
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, edi
jmp 0x6013e838
push ebp
mov ebp, dword [esp + 0x268]
mov ecx, ebp
call fcn.6011d340
cmp esi, ebx
jne 0x6013e48f
xor eax, eax
jmp 0x6013e49d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6013e494
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.60104370
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x18]
push eax
push SysReAllocStringLen
push ebx
push ecx
push edx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x6013e4fe
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x150]
push eax
push 0x104
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x6013e587
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x6013e53c
call esi
mov esi, eax
jmp 0x6013e54c
jle 0x6013e50a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x25c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6013e535
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
jmp 0x6013e837
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp edi, ebx
je 0x6013e557
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x25c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6013e535
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
jmp 0x6013e837
lea eax, [esp + 0x4c]
push eax
push ebx
push 0x60150454
lea ecx, [esp + 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x6013e5f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x6013e5b6
call esi
mov esi, eax
jmp 0x6013e5c6
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp edi, ebx
je 0x6013e5d1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x25c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x6013e52b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x4c]
push eax
call esi
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
call fcn.6011af90
add esp, 0xc
mov dword [esp + 0x24], 0x60150410
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x25c], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x6013e662
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6013e684
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push ebx
push str.SeBackupPrivilege
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.6013d520
push ebx
lea ecx, [esp + 0x50]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
cmp eax, ebx
je 0x6013e6b3
jle 0x6013e6a1
and eax, 0xffff
or eax, 0x80070000
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.6013cbb0
mov edx, dword [esp + 0x20]
push edx
jmp 0x6013e6f1
lea ecx, [esp + 0x24]
call fcn.6013cbb0
mov dword [esp + 0x14], ebx
push ebx
push ebx
push 0x80
push 3
push ebx
push SysReAllocStringLen
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x30]
call fcn.601180d0
mov esi, eax
cmp esi, ebx
jge 0x6013e716
lea ecx, [esp + 0x14]
call fcn.6011e400
mov ecx, dword [esp + 0x20]
push ecx
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x18]
call fcn.60109020
lea ecx, [esp + 0x10]
call fcn.601042d0
mov eax, esi
jmp 0x6013e837
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x14]
push 4
push 2
push ebx
push ebx
push ebx
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x274], 5
call fcn.60130de0
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x44], edi
jge 0x6013e7b0
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, ebx
je 0x6013e761
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x6013e761
call fcn.601180b0
mov esi, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x6013e77d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x6013e77d
cmp esi, ebx
jl 0x6013e77d
call fcn.601180b0
lea ecx, [esp + 0x14]
call fcn.6011e400
mov eax, dword [esp + 0x20]
push eax
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x18]
call fcn.60109020
lea ecx, [esp + 0x10]
call fcn.601042d0
mov eax, edi
jmp 0x6013e837
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add edx, 0xfffff000
push edx
lea eax, [esi + 0x1000]
push eax
lea ecx, [eax + 0x20]
push ecx
push ebp
call fcn.6013e010
add esp, 0x10
xor edi, edi
cmp esi, ebx
je 0x6013e7eb
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x6013e7eb
call fcn.601180b0
mov edi, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x6013e807
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x6013e807
cmp edi, ebx
jl 0x6013e807
call fcn.601180b0
lea ecx, [esp + 0x14]
call fcn.6011e400
mov eax, dword [esp + 0x20]
push eax
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x18]
call fcn.60109020
lea ecx, [esp + 0x10]
call fcn.601042d0
mov eax, dword [esp + 0x44]
pop ebp
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x250
ret 8