Function at 0x140001610
Capabilities:
Delete file
Move file

Disassembly:
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x408
mov rdi, rsp
mov ecx, 0x102
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x420]
mov rax, qword [0x140009028]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140005660]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x298]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001698
lea rcx, str.Error_fetching_USERPROFILE._n
call fcn.140002af0
lea rcx, [0x140005690]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, dword [rsp + 0x20]
jmp 0x1400019ea
lea rax, [rsp + 0x2d8]
lea rcx, str..accessibility.properties
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x318]
lea rcx, str..acce__ibility.properties
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x2b8]
dec rax
cmp rax, 0xe9
ja 0x1400016f6
mov rax, qword [rsp + 0x2b8]
dec rax
cmp rax, 0xe9
jbe 0x140001718
lea rcx, str.The_USERPROFILE_environment_variable_is_too_long._n
call fcn.140002af0
lea rcx, str.It_must_be_no_longer_than_233_characters._n
call fcn.140002af0
mov eax, 0x7b
jmp 0x1400019ea
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x3e0], rax
cmp qword [rsp + 0x3e0], 0x104
jae 0x140001739
jmp 0x14000173e
call fcn.140002cf8
mov rax, qword [rsp + 0x3e0]
mov byte [rsp + rax + 0x40], 0
mov r8, qword [rsp + 0x298]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x40]
call fcn.1400027b0
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x3e8], rax
cmp qword [rsp + 0x3e8], 0x104
jae 0x140001796
jmp 0x14000179b
call fcn.140002cf8
mov rax, qword [rsp + 0x3e8]
mov byte [rsp + rax + 0x170], 0
mov r8, qword [rsp + 0x298]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x170]
call fcn.1400027b0
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x298], 0
lea r8, [0x14000565c]
lea rdx, [rsp + 0x40]
lea rcx, [0x140009110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400018e5
movzx eax, byte [rsp + 0x420]
test eax, eax
je 0x1400018d8
lea r8, [0x14000566c]
lea rdx, [rsp + 0x40]
lea rcx, [0x140009110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001871
lea rdx, [rsp + 0x40]
lea rcx, str.Couldnt_create_file:__s_n
call fcn.140002af0
lea rcx, [0x14000575c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1400018d6
lea rax, [rsp + 0x360]
lea rcx, str.assistive_technologiescom.sun.java.accessibility.AccessBridge_n
mov rdi, rax
mov rsi, rcx
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x3a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rdx, str.screen_magnifier_presenttrue_n
lea rcx, [rsp + 0x360]
call fcn.140002830
lea rdx, [rsp + 0x360]
mov rcx, qword [0x140009110]
call fcn.140002a70
mov rcx, qword [0x140009110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400018e0
mov dword [rsp + 0x20], 0
jmp 0x1400019e6
lea r8, [0x1400056b4]
lea rdx, [rsp + 0x170]
lea rcx, [0x140009118]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001936
lea rdx, [rsp + 0x170]
lea rcx, str.Couldnt_open_temp_file:__s_n
call fcn.140002af0
lea rcx, [0x140005788]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, dword [rsp + 0x20]
jmp 0x1400019ea
movzx eax, byte [rsp + 0x420]
test eax, eax
je 0x140001949
call fcn.1400010a0
jmp 0x14000194e
call fcn.140001420
mov rcx, qword [0x140009110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x140009118]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x14000199f
lea rdx, [rsp + 0x40]
lea rcx, str.Couldnt_remove_file:__s_n
call fcn.140002af0
lea rcx, [0x14000580c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x1400019ea
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
test eax, eax
je 0x1400019e6
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x170]
lea rcx, str.Couldnt_rename__s_to__s._n
call fcn.140002af0
lea rcx, str.Error
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x1400019ea
mov eax, dword [rsp + 0x20]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140006270]
call fcn.140002e8c
mov rax, rdi
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140002f90
add rsp, 0x408
pop rdi
pop rsi
ret