Function at 0x140053c00
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov word [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
call sub.msvcrt.dll_rand
movsxd r9, eax
imul rax, r9, 0xffffffff810e35c1
shr rax, 0x20
add eax, r9d
mov ecx, eax
shr ecx, 0x1f
sar eax, 0xf
add eax, ecx
imul eax, eax, 0xfde8
sub r9d, eax
lea r8, [0x1401fd6ab]
lea rsi, [rsp + 0x48]
mov edx, 6
mov rcx, rsi
call qword [fcn.14009b030]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rsi
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
inc rax
cmp rax, 1
ja 0x140053ca9
lea rcx, [0x1401fd6ae]
mov dl, 1
call fcn.140012160
jmp 0x140053ef9
mov dword [rsp + 0x44], 0x30d401
mov ecx, 0x30d400
call sub.msvcrt.dll_malloc
mov rdi, rax
mov ebx, 0x30d400
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, 0x30d400
call qword [0x140288370]
cmp eax, 0x80000005
je 0x140053cf5
cmp eax, 0xc0000023
je 0x140053cf5
cmp eax, 0xc0000004
jne 0x140053e68
mov eax, dword [rsp + 0x44]
lea r14d, [rax + rax]
test eax, eax
cmove r14d, ebx
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, r14
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140053d10
mov rbx, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r14d
call qword [0x140288370]
cmp eax, 0x80000005
je 0x140053d52
cmp eax, 0xc0000023
je 0x140053d52
cmp eax, 0xc0000004
jne 0x140053e65
mov eax, dword [rsp + 0x44]
lea r15d, [rax + rax]
test eax, eax
cmove r15d, r14d
mov rcx, rbx
mov rdx, r15
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140053d60
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r15d
call qword [0x140288370]
cmp eax, 0x80000005
je 0x140053da2
cmp eax, 0xc0000023
je 0x140053da2
cmp eax, 0xc0000004
jne 0x140053e68
mov eax, dword [rsp + 0x44]
lea r14d, [rax + rax]
test eax, eax
cmove r14d, r15d
mov rcx, rdi
mov rdx, r14
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140053db0
mov rbx, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r14d
call qword [0x140288370]
cmp eax, 0x80000005
je 0x140053dee
cmp eax, 0xc0000023
je 0x140053dee
cmp eax, 0xc0000004
jne 0x140053e65
mov eax, dword [rsp + 0x44]
lea r15d, [rax + rax]
test eax, eax
cmove r15d, r14d
nop dword [rax]
mov rcx, rbx
mov rdx, r15
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140053e00
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r15d
call qword [0x140288370]
cmp eax, 0x80000005
je 0x140053e3e
cmp eax, 0xc0000023
je 0x140053e3e
cmp eax, 0xc0000004
jne 0x140053e68
mov eax, dword [rsp + 0x44]
lea ebx, [rax + rax]
test eax, eax
cmove ebx, r15d
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140053e50
mov rdi, rax
jmp 0x140053ecf
mov rdi, rbx
test rdi, rdi
je 0x140053ecf
mov ecx, dword [rdi]
test rcx, rcx
je 0x140053eb1
mov eax, dword [0x1402851b4]
shl rcx, 3
lea rdx, [rcx + rcx*2]
xor ecx, ecx
jmp 0x140053e99
add rcx, 0x18
cmp rdx, rcx
je 0x140053eb1
cmp dword [rdi + rcx + 8], eax
jne 0x140053e90
cmp word [rdi + rcx + 0xe], si
jne 0x140053e90
movzx eax, byte [rdi + rcx + 0xc]
mov dword [0x1402852e0], eax
mov rcx, rdi
call fcn.1401f47c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x140053ef9
lea rcx, str.excpetion_at_sepcifing_fh_index_1
mov dl, 1
call fcn.140012160
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov rcx, rdi
call fcn.1401f47c0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret