Function at 0x1400012a0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbx
push rsi
sub rsp, 0x38
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r8d, ecx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
xor edx, edx
mov edi, ecx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rsi, [0x140007048]
mov rbp, rax
test rax, rax
je 0x140001548
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x20]
lea r14, [0x140007730]
mov dword [rsp + 0x20], 0x104
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140001502
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.The_process_with_PID
call fcn.140001ad0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._is_running_from_the_file:
call fcn.140001ad0
mov rcx, rax
mov rdx, r14
call fcn.140001ad0
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001a90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001ce0
cmp qword [0x140007060], 8
mov rdx, rsi
mov r8, qword [0x140007058]
mov rcx, rax
cmovae rdx, qword [0x140007048]
call fcn.1400021e0
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp dword [0x140007938], 1
je 0x140001416
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [r14 + rdx*2], 0
jne 0x1400013c0
mov rax, qword [0x140007060]
cmp rdx, rax
ja 0x140001407
lea rbx, [rdx + rdx]
mov qword [0x140007058], rdx
cmp rax, 8
mov rdi, rsi
mov r8, rbx
mov rdx, r14
cmovae rdi, qword [0x140007048]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x14000140c
call fcn.140002040
mov dword [0x140007938], 1
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140001538
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140001481
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Deleted:
call fcn.140001ad0
mov rcx, rax
mov rdx, r14
call fcn.140001ad0
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rbp
mov dword [0x140007938], 2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x30]
jmp 0x140001598
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_delete:
mov ebx, eax
call fcn.140001ad0
mov rcx, rax
mov rdx, r14
call fcn.140001ad0
mov rcx, rax
lea rdx, str.._Error_code:
call fcn.140001ad0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
cmp eax, 0xffffffff
jne 0x1400014f4
lea rdx, str.The_file_does_not_exist.
call fcn.140001ad0
jmp 0x140001528
lea rdx, str.The_file_exists_but_couldnt_be_deleted.
call fcn.140001ad0
jmp 0x140001528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_retrieve_the_process_image_name._Error_code:
mov ebx, eax
call fcn.140001ad0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001ca0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x30]
jmp 0x140001598
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_open_the_process_with_PID
mov ebx, eax
call fcn.140001ad0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str.._Error_code:
call fcn.140001ad0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp qword [0x140007058], 0
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
je 0x1400016d0
cmp qword [0x140007060], 8
mov rcx, rsi
cmovae rcx, qword [0x140007048]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140001621
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Deleted:
call fcn.140001ad0
cmp qword [0x140007060], 8
mov rcx, rax
mov r8, qword [0x140007058]
cmovae rsi, qword [0x140007048]
mov rdx, rsi
call fcn.1400021e0
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [0x140007938], 2
jmp 0x1400016d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_delete:
mov ebx, eax
call fcn.140001ad0
cmp qword [0x140007060], 8
mov rdx, rsi
mov r8, qword [0x140007058]
mov rcx, rax
cmovae rdx, qword [0x140007048]
call fcn.1400021e0
lea rdx, str.._Error_code:
mov rcx, rax
call fcn.140001ad0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp qword [0x140007060], 8
cmovae rsi, qword [0x140007048]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.The_file_does_not_exist.
cmp eax, 0xffffffff
je 0x1400016bb
lea rdx, str.The_file_exists_but_couldnt_be_deleted.
call fcn.140001ad0
lea rdx, [0x140001ca0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002400
add rsp, 0x38
pop rsi
pop rbx
ret