Function at 0x140005260
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
mov eax, 0x2208
call fcn.140036e80
sub rsp, rax
mov rax, qword [0x140049fa0]
xor rax, rsp
mov qword [rsp + 0x21b0], rax
mov rax, qword [0x14004c138]
test rax, rax
je 0x140005dc3
cmp dword [rax + 0x2c], 1
jb 0x140005dc3
lea rdx, [rsp + 0x20a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140005db6
lea r9, [rsp + 0x20a0]
lea rdx, str.TxSnp
lea rcx, [rsp + 0x20a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x140005db6
lea rdx, [0x140039124]
lea rcx, [rsp + 0x20a0]
mov qword [rsp + 0x2210], rbx
call fcn.14001dc10
test rax, rax
mov rbx, rax
mov qword [rsp + 0x68], rax
je 0x140005324
call fcn.140002fc0
test eax, eax
jne 0x140005346
mov rcx, rbx
call fcn.14001d780
lea rcx, [rsp + 0x20a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov rbx, qword [rsp + 0x2210]
mov rcx, qword [rsp + 0x21b0]
xor rcx, rsp
call fcn.14001b2b0
add rsp, 0x2208
ret
mov qword [rsp + 0x2218], rbp
mov qword [rsp + 0x2220], rsi
mov qword [rsp + 0x2200], rdi
mov eax, 0x100
mov qword [rsp + 0x21f8], r12
mov qword [rsp + 0x21f0], r13
mov rcx, rax
mov qword [rsp + 0x21e8], r14
mov qword [rsp + 0x21e0], r15
mov qword [rsp + 0x88], rax
call fcn.14001af10
xor ecx, ecx
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x58
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call fcn.140002e70
lea rcx, [rsp + 0xa0]
xor edi, edi
xor r13d, r13d
xor edx, edx
mov r8d, 0x800
mov dword [rsp + 0x4c], edi
or esi, 0xffffffff
mov dword [rsp + 0x40], r13d
call fcn.14001b8f0
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x800
call fcn.14001b8f0
mov r14d, dword [0x14004c18c]
test r14d, r14d
je 0x1400054e3
xor r12d, r12d
nop
mov ecx, edi
call fcn.140002e70
mov ebp, dword [0x14004c190]
mov r14d, dword [0x14004c18c]
xor ebx, ebx
test ebp, ebp
jle 0x1400054d3
mov r11, qword [0x14004c1a8]
cmp edi, dword [r11]
jne 0x1400054bf
lea eax, [rbp - 1]
xor r9d, r9d
cmp ebx, eax
jge 0x14000545a
mov ecx, dword [r11 + 4]
jmp 0x14000545d
mov ecx, r14d
add ecx, 0xffffffff
cmp edi, ecx
jge 0x1400054b1
mov rax, qword [0x14004c1a0]
sub ecx, edi
lea r8, [r12 + rax + 0x18]
mov r10d, ecx
nop
nop
nop
movzx eax, word [r8 - 6]
mov edx, dword [r8]
sub edx, eax
sub edx, dword [r8 - 0x14]
test edx, edx
jle 0x1400054a7
movzx ecx, word [r8 - 8]
lea eax, [rdx + rdx*4]
add eax, eax
cdq
idiv ecx
test eax, eax
jle 0x1400054a7
add r9d, 1
add r8, 0x14
sub r10, 1
jne 0x140005480
cmp r9d, r13d
cmovg r13d, r9d
cmp esi, 0xffffffff
cmove esi, r9d
add ebx, 1
add r11, 4
cmp ebx, ebp
jl 0x140005445
mov dword [rsp + 0x40], r13d
add edi, 1
add r12, 0x14
cmp edi, r14d
jb 0x140005420
xor esi, esi
mov eax, 3
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x80], rax
nop
nop
nop
xor ebx, ebx
test r14d, r14d
mov dword [rsp + 0x44], ebx
je 0x140005912
xor edi, edi
mov qword [rsp + 0x58], rdi
mov ecx, ebx
call fcn.140002e70
mov ebp, dword [0x14004c190]
xor r15d, r15d
test ebp, ebp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x48], r15d
jle 0x1400058df
mov r14d, dword [0x14004c18c]
xor r12d, r12d
mov qword [rsp + 0x70], r12
nop
nop
mov rsi, qword [0x14004c1a8]
cmp ebx, dword [r12 + rsi]
jne 0x14000586c
lea rcx, [rsp + 0x18a0]
xor edx, edx
mov r8d, 0x800
xor edi, edi
xor ebx, ebx
call fcn.14001b8f0
lea rcx, [rsp + 0x10a0]
xor edx, edx
mov r8d, 0x800
call fcn.14001b8f0
lea r11d, [rbp - 1]
cmp r15d, r11d
jge 0x14000559f
mov ecx, dword [r12 + rsi + 4]
jmp 0x1400055a2
mov ecx, r14d
mov edx, dword [rsp + 0x44]
add ecx, 0xffffffff
cmp edx, ecx
jge 0x140005626
mov rax, qword [0x14004c1a0]
mov r8, qword [rsp + 0x58]
sub ecx, edx
lea r8, [r8 + rax + 4]
mov r10d, ecx
nop
nop
nop
nop
movzx eax, word [r8 + 0xe]
mov edx, dword [r8 + 0x14]
sub edx, eax
sub edx, dword [r8]
test edx, edx
jle 0x14000561c
movzx ecx, word [r8 + 0xc]
lea eax, [rdx + rdx*4]
add eax, eax
cdq
idiv ecx
test eax, eax
jle 0x14000561c
cmp rbx, 0x200
jge 0x14000561c
mov ecx, dword [r8 + 0x14]
movzx eax, word [r8 + 0x22]
add edi, 1
add eax, ecx
mov dword [rsp + rbx*4 + 0x18a0], ecx
add rbx, 1
mov dword [rsp + rbx*4 + 0x109c], eax
add r8, 0x14
sub r10, 1
jne 0x1400055d0
mov rsi, qword [rsp + 0x50]
test rsi, rsi
jne 0x140005642
cmp edi, r13d
je 0x140005893
mov ebx, dword [rsp + 0x44]
jmp 0x14000586c
cmp rsi, 1
jne 0x140005656
cmp edi, r13d
jl 0x140005660
mov ebx, dword [rsp + 0x44]
jmp 0x14000586c
cmp rsi, 2
jne 0x140005868
mov rax, qword [rsp + 0x90]
movsxd r12, edi
xor r13d, r13d
movzx ecx, word [rax + 0x68]
mov eax, 0x66666667
mov qword [rsp + 0x78], r12
imul ecx
mov r15d, edx
sar r15d, 3
mov eax, r15d
shr eax, 0x1f
add r15d, eax
test edi, edi
jle 0x140005853
mov r14d, dword [rsp + 0x40]
nop
nop
xor ebx, ebx
xor ecx, ecx
test r14d, r14d
movsxd rdi, r14d
jle 0x14000573f
mov r11d, dword [rsp + r13*4 + 0x18a0]
nop
nop
mov r8d, dword [rsp + rcx*4 + 0xa0]
mov eax, r11d
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
cmp eax, r15d
jle 0x14000571a
mov r9d, dword [rsp + r13*4 + 0x10a0]
mov r10d, dword [rsp + rcx*4 + 0x8a0]
mov eax, r9d
sub eax, r10d
cdq
xor eax, edx
sub eax, edx
cmp eax, r15d
jle 0x14000571a
cmp r11d, r8d
jge 0x140005702
cmp r9d, r10d
jg 0x14000571a
cmp r11d, r8d
jle 0x14000570c
cmp r9d, r10d
jl 0x14000571a
add rcx, 1
add ebx, 1
cmp rcx, rdi
jl 0x1400056c0
jmp 0x14000573f
cmp r11d, r8d
jge 0x140005727
mov dword [rsp + rcx*4 + 0xa0], r11d
mov eax, dword [rsp + r13*4 + 0x10a0]
cmp eax, dword [rsp + rcx*4 + 0x8a0]
jle 0x14000573f
mov dword [rsp + rcx*4 + 0x8a0], eax
cmp rsi, 2
jne 0x14000581f
cmp ebx, r14d
jl 0x14000581f
xor ebp, ebp
xor esi, esi
test r14d, r14d
jle 0x1400057ec
mov r12d, dword [rsp + r13*4 + 0x18a0]
nop
nop
nop
cmp r12d, dword [rsp + rsi*4 + 0xa0]
jl 0x14000578d
add rsi, 1
add ebp, 1
cmp rsi, rdi
jl 0x140005770
mov r12, qword [rsp + 0x78]
jmp 0x1400057ec
mov eax, r14d
movsxd rbx, ebp
sub eax, ebp
lea rdx, [rsp + rbx*4 + 0xa0]
lea rcx, [rsp + rbx*4 + 0xa4]
movsxd rdi, eax
shl rdi, 2
mov r8, rdi
call fcn.14001c500
lea rdx, [rsp + rbx*4 + 0x8a0]
lea rcx, [rsp + rbx*4 + 0x8a4]
mov r8, rdi
call fcn.14001c500
mov eax, dword [rsp + r13*4 + 0x10a0]
mov dword [rsp + rsi*4 + 0xa0], r12d
mov r12, qword [rsp + 0x78]
mov dword [rsp + rsi*4 + 0x8a0], eax
add r14d, 1
cmp ebp, r14d
jne 0x14000581a
mov eax, dword [rsp + r13*4 + 0x18a0]
add r14d, 1
mov dword [rsp + rsi*4 + 0xa0], eax
mov eax, dword [rsp + r13*4 + 0x10a0]
mov dword [rsp + rsi*4 + 0x8a0], eax
mov rsi, qword [rsp + 0x50]
jmp 0x14000581f
mov rsi, qword [rsp + 0x50]
add r13, 1
cmp r13, r12
jl 0x1400056a0
mov ebp, dword [0x14004c190]
mov r12, qword [rsp + 0x70]
mov r15d, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x44]
mov dword [rsp + 0x40], r14d
mov r14d, dword [0x14004c18c]
mov r13d, dword [rsp + 0x40]
jmp 0x14000586c
mov r13d, dword [rsp + 0x40]
mov r12, qword [rsp + 0x70]
mov r15d, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x44]
jmp 0x14000586c
mov ebx, dword [rsp + 0x44]
add r15d, 1
add r12, 4
cmp r15d, ebp
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x70], r12
jl 0x140005550
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
jmp 0x1400058f1
cmp dword [rsp + 0x4c], 0
jne 0x1400058e8
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x18a0]
mov r8d, 0x800
mov dword [rsp + 0x4c], edi
call fcn.14001c500
lea rcx, [rsp + 0x8a0]
lea rdx, [rsp + 0x10a0]
mov r8d, 0x800
call fcn.14001c500
mov ebx, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x58]
jmp 0x1400058f1
mov r14d, dword [0x14004c18c]
jmp 0x1400058f1
mov ebx, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x58]
add ebx, 1
add rdi, 0x14
cmp ebx, r14d
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x58], rdi
jb 0x140005516
mov rax, qword [rsp + 0x80]
add rsi, 1
sub rax, 1
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], rsi
jne 0x140005500
xor edi, edi
mov ebx, 1
xor r15d, r15d
test r14d, r14d
movsxd r13, r13d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x48], edi
je 0x140005cac
mov rbp, qword [rsp + 0x68]
movaps xmmword [rsp + 0x21d0], xmm6
movsd xmm6, qword [0x140038f50]
movaps xmmword [rsp + 0x21c0], xmm7
movsd xmm7, qword [0x140038f48]
xor r14d, r14d
mov ecx, edi
call fcn.140002e70
mov r12, rax
movzx ecx, word [rax + 0x68]
mov eax, 0x66666667
imul ecx
mov esi, edx
sar esi, 3
mov ecx, esi
shr ecx, 0x1f
add esi, ecx
test ebx, ebx
je 0x140005a48
mov r8, qword [0x14004c1a0]
mov eax, dword [r14 + r8 + 4]
lea ecx, [rsi + rax]
cmp ecx, dword [rsp + 0xa0]
jl 0x140005a48
movzx r10d, word [r14 + r8 + 0x12]
xor edi, edi
xor ecx, ecx
add r10d, eax
test r13, r13
mov r11d, eax
jle 0x140005a14
nop
mov r8d, dword [rsp + rcx*4 + 0xa0]
mov eax, r11d
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jle 0x140005a14
mov r9d, dword [rsp + rcx*4 + 0x8a0]
mov eax, r10d
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jle 0x140005a14
cmp r11d, r8d
jle 0x140005a08
cmp r10d, r9d
jl 0x140005a14
add rcx, 1
add edi, 1
cmp rcx, r13
jl 0x1400059d0
mov eax, 1
sub eax, r15d
add edi, eax
test edi, edi
jle 0x140005a45
mov ebx, edi
nop
nop
nop
lea rdx, reloc.OLEAUT32.dll_VariantCopy
mov rcx, rbp
call fcn.14001e000
sub rbx, 1
jne 0x140005a30
add r15d, edi
xor edi, edi
lea rbp, [r12 + 0x6c]
mov dword [rsp + 0x4c], edi
movzx ebx, word [r12]
call qword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
lea rax, [rsp + 0x4c]
lea r9d, [rbx + 1]
mov qword [rsp + 0x38], rax
lea rax, [0x140038fc0]
mov r8, rbp
mov qword [rsp + 0x30], rax
mov edx, 0x400
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
cmp dword [rsp + 0x88], edi
jg 0x140005abd
mov rcx, qword [rsp + 0x60]
lea eax, [rdi + 0x100]
movsxd rdx, eax
mov qword [rsp + 0x88], rax
call fcn.14001b100
mov qword [rsp + 0x60], rax
movzx ebx, word [r12]
call qword [sym.imp.KERNEL32.dll_GetACP]
mov r12, qword [rsp + 0x60]
mov ecx, eax
xor eax, eax
lea r9d, [rbx + 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov r8, rbp
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbp, qword [rsp + 0x68]
mov rcx, r12
mov rdx, rbp
mov byte [rdi + r12 - 1], 0
call fcn.14001e1f0
mov r11d, dword [0x14004c18c]
mov edi, dword [rsp + 0x48]
add r11d, 0xffffffff
cmp edi, r11d
jae 0x140005c7f
mov r8, qword [0x14004c1a0]
movzx ecx, word [r14 + r8 + 0x20]
movzx r10d, word [r14 + r8 + 0xc]
mov r11d, dword [r14 + r8 + 8]
mov r9d, dword [r14 + r8 + 0x1c]
mov eax, r11d
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
cmp r10d, ecx
cmovl ecx, r10d
cvtsi2sd xmm0, ecx
mulsd xmm0, xmm6
addsd xmm0, xmm7
cvttsd2si ecx, xmm0
cmp eax, ecx
jg 0x140005c22
movzx eax, word [r14 + r8 + 0x12]
mov ecx, dword [r14 + r8 + 0x18]
xor ebx, ebx
sub ecx, eax
mov dword [rsp + 0x40], ebx
sub ecx, dword [r14 + r8 + 4]
test ecx, ecx
jle 0x140005c83
mov r11d, dword [r14 + r8 + 0x18]
movzx r10d, word [r14 + r8 + 0x26]
xor ecx, ecx
add r10d, r11d
test r13, r13
jle 0x140005be4
nop
mov r8d, dword [rsp + rcx*4 + 0xa0]
mov eax, r11d
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jle 0x140005be4
mov r9d, dword [rsp + rcx*4 + 0x8a0]
mov eax, r10d
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jle 0x140005be4
cmp r11d, r8d
jle 0x140005bd8
cmp r10d, r9d
jl 0x140005be4
add rcx, 1
add ebx, 1
cmp rcx, r13
jl 0x140005ba0
mov eax, 1
sub eax, r15d
add ebx, eax
test ebx, ebx
jle 0x140005c19
mov edi, ebx
nop
nop
nop
lea rdx, reloc.OLEAUT32.dll_VariantCopy
mov rcx, rbp
call fcn.14001e000
sub rdi, 1
jne 0x140005c00
mov edi, dword [rsp + 0x48]
add r15d, ebx
mov ebx, dword [rsp + 0x40]
jmp 0x140005c83
sub r9d, r11d
mov ebx, 1
cmp r10d, r9d
mov dword [rsp + 0x40], ebx
jge 0x140005c6b
cvtsi2sd xmm1, r9d
cvtsi2sd xmm0, r10d
divsd xmm1, xmm0
cvttsd2si eax, xmm1
cmp eax, ebx
jl 0x140005c83
xor r15d, r15d
mov ebx, eax
nop
lea rcx, [0x1400390f4]
mov rdx, rbp
call fcn.14001e1f0
sub rbx, 1
jne 0x140005c50
mov ebx, dword [rsp + 0x40]
jmp 0x140005c83
lea rcx, [0x1400390f4]
mov rdx, rbp
xor r15d, r15d
call fcn.14001e1f0
jmp 0x140005c83
mov ebx, dword [rsp + 0x40]
add edi, 1
add r14, 0x14
cmp edi, dword [0x14004c18c]
mov dword [rsp + 0x48], edi
jb 0x140005973
movaps xmm7, xmmword [rsp + 0x21c0]
movaps xmm6, xmmword [rsp + 0x21d0]
jmp 0x140005cb6
mov rbp, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov rcx, qword [0x14004c1a8]
call fcn.14001afe0
mov rcx, qword [0x14004c1a0]
mov qword [0x14004c1a8], 0
call fcn.14001afe0
mov rcx, qword [0x14004c198]
mov r15, qword [rsp + 0x21e0]
test rcx, rcx
mov r14, qword [rsp + 0x21e8]
mov r13, qword [rsp + 0x21f0]
mov qword [0x14004c1a0], 0
je 0x140005d0d
call fcn.14001d780
mov rcx, r12
mov qword [0x14004c198], 0
call fcn.14001afe0
mov rcx, rbp
call fcn.14001d650
movsxd rbx, eax
lea ecx, [rbx + 1]
movsxd rdx, ecx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, qword [rsp + 0x21f8]
test rax, rax
mov rsi, rax
je 0x140005d80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbp
mov rdi, rax
call fcn.14001ddf0
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.14001cf00
mov rcx, rsi
mov byte [rbx + rdi], 0
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbp
call fcn.14001d780
lea rcx, [rsp + 0x20a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdi, qword [rsp + 0x2200]
mov rbp, qword [rsp + 0x2218]
mov rax, rsi
mov rsi, qword [rsp + 0x2220]
jmp 0x140005326
lea rcx, str.Cannot_get_temp_path_in_ProcessCaptureTabDelimited___r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0x21b0]
xor rcx, rsp
call fcn.14001b2b0
add rsp, 0x2208
ret