Function at 0x101382c
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, qword [0x01044b78]
mov r13d, dword [0x01044b68]
mov dword [rsp + 0xb8], r13d
mov rdi, qword [0x01044b88]
mov r8, rbx
mov edx, r13d
lea rcx, [0x01006a30]
call fcn.0100fdd0
mov r8d, 8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea edx, [r8 - 4]
mov r9, rdx
lea rcx, [0x01006ab0]
call fcn.0100fdd0
mov rdx, rbx
lea rcx, [rdi + 0x18]
call fcn.0101f91c
xor esi, esi
lea r14d, [rsi + 1]
cmp eax, esi
je 0x10139bf
mov r14d, esi
mov rcx, qword [rdi + 0x78]
cmp qword [rcx - 0x10], rsi
je 0x10139b1
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x10139b1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x101398c
lea rax, [rbp + 2]
mov qword [rsp + 0xa0], rax
mov rcx, rax
call fcn.010270b8
mov rbx, rax
cmp rax, rsi
je 0x101398c
mov r8, qword [rsp + 0xa0]
xor edx, edx
mov rcx, rax
call fcn.010328a0
mov dword [rsp + 0xa0], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xa0]
mov r8d, ebp
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x1013984
cmp dword [rsp + 0xa0], ebp
jne 0x1013984
mov rdx, rbx
lea rcx, [rdi + 0x18]
call fcn.0101f91c
mov r14d, eax
mov rcx, rbx
call fcn.01027054
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rdi + 0x78]
call fcn.0100d95c
cmp r14d, esi
jne 0x10138c0
mov r13d, dword [rsp + 0xb8]
mov r14d, 1
lea rcx, [0x01006b80]
call fcn.0100fdd0
mov r11, qword [0x01043880]
mov qword [rsp + 0x48], r11
lea rcx, [rsp + 0x48]
call fcn.0100d95c
lea r15, [0x01006bec]
cmp dword [rdi + 0x20], 4
jne 0x1013a47
lea r8, [rdi + 0x30]
lea rdx, [0x01006bf8]
lea rcx, [rsp + 0xb8]
call fcn.0100ddd8
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100dd70
mov rdx, qword [rax]
mov r8, rdx
mov rdx, qword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.0100de4c
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
cmp dword [rdi + 0x48], 5
jne 0x1013aa6
lea r8, [rdi + 0x40]
lea rdx, [0x01006c08]
lea rcx, [rsp + 0xb8]
call fcn.0100ddd8
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100dd70
mov rdx, qword [rax]
mov r8, rdx
mov rdx, qword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.0100de4c
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
mov rax, qword [rdi + 0x28]
cmp qword [rax - 0x10], rsi
je 0x1013b09
lea r8, [rdi + 0x28]
lea rdx, [0x01006c18]
lea rcx, [rsp + 0xb8]
call fcn.0100ddd8
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100dd70
mov rdx, qword [rax]
mov r8, rdx
mov rdx, qword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.0100de4c
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
mov rax, qword [rdi + 0x30]
cmp qword [rax - 0x10], rsi
je 0x1013b6c
lea r8, [rdi + 0x30]
lea rdx, [0x01006c28]
lea rcx, [rsp + 0xb8]
call fcn.0100ddd8
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100dd70
mov rdx, qword [rax]
mov r8, rdx
mov rdx, qword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.0100de4c
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
mov rax, qword [rdi + 0x50]
cmp qword [rax - 0x10], rsi
je 0x1013bcf
lea r8, [rdi + 0x50]
lea rdx, [0x01006c38]
lea rcx, [rsp + 0xb8]
call fcn.0100ddd8
mov r8, r15
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100dd70
mov rdx, qword [rax]
mov r8, rdx
mov rdx, qword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.0100de4c
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
cmp dword [rdi + 0x5c], r14d
jne 0x1013be6
lea rdx, [0x01006c48]
lea rcx, [rsp + 0x48]
call fcn.0100deec
cmp dword [rdi + 0x60], r14d
jne 0x1013bfd
lea rdx, [0x01006c58]
lea rcx, [rsp + 0x48]
call fcn.0100deec
cmp dword [rdi + 0x64], r14d
jne 0x1013c14
lea rdx, [0x01006c68]
lea rcx, [rsp + 0x48]
call fcn.0100deec
cmp dword [rdi + 0x70], esi
je 0x1013c2a
lea rdx, [0x01006c78]
lea rcx, [rsp + 0x48]
call fcn.0100deec
mov rdx, qword [rsp + 0x48]
lea rcx, [0x010033f4]
call fcn.0100fdd0
lea rcx, [0x0100b520]
call fcn.0100fdd0
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb8]
call fcn.0101f100
mov r15d, 2
cmp dword [rsp + 0xb8], r14d
jne 0x1013c99
cmp dword [rsp + 0xa0], esi
jne 0x1013c88
lea rcx, [0x0100b538]
call fcn.0100fdd0
jmp 0x1013c94
lea rcx, [0x0100b570]
call fcn.0100fdd0
mov eax, r14d
jmp 0x1013d01
mov eax, dword [rsp + 0x40]
cmp eax, 4
jne 0x1013cb3
lea rcx, [0x0100b5b8]
call fcn.0100fdd0
mov eax, r15d
jmp 0x1013d01
cmp eax, 3
jne 0x1013cc6
lea rcx, [0x0100b5f8]
call fcn.0100fdd0
jmp 0x1013cfc
cmp eax, 5
jne 0x1013cf0
cmp dword [rsp + 0xa0], esi
jne 0x1013ce2
lea rcx, [0x0100b638]
call fcn.0100fdd0
jmp 0x1013cfc
lea rcx, [0x0100b680]
call fcn.0100fdd0
jmp 0x1013cfc
lea rcx, [0x0100b6d0]
call fcn.0100fdd0
mov eax, 3
mov dword [rdi + 0xf4], eax
cmp eax, esi
jne 0x1013d32
mov dword [0x01044b80], 7
mov dword [0x01044b84], esi
mov dword [0x01044db4], esi
lea rcx, [rsp + 0x48]
call fcn.0100d9e0
xor eax, eax
jmp 0x1013eda
cmp eax, r15d
je 0x1013d45
cmp eax, 3
je 0x1013d45
mov dword [rdi + 0xf8], r14d
jmp 0x1013d50
call fcn.0101f190
mov dword [rdi + 0xf8], eax
mov edx, dword [rdi + 0xf8]
lea rcx, [0x01006c90]
call fcn.0100fdd0
mov dword [rdi + 0x158], r14d
mov rax, qword [rdi + 0x28]
cmp qword [rax - 0x10], rsi
je 0x1013ddd
mov rax, qword [0x01043880]
mov qword [rsp + 0xa0], rax
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x40]
call fcn.0100d7ec
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.0101f73c
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.0100db8c
lea rcx, [rsp + 0xb8]
call fcn.0100d9e0
mov rdx, qword [rsp + 0xa0]
mov ecx, r14d
call fcn.0100ff04
nop
lea rcx, [rsp + 0xa0]
call fcn.0100d9e0
jmp 0x1013e05
mov rdx, qword [rdi + 0x50]
cmp qword [rdx - 0x10], rsi
je 0x1013df3
mov ecx, 3
call fcn.0100ff04
jmp 0x1013e05
mov rdx, qword [rdi + 0x30]
cmp qword [rdx - 0x10], rsi
je 0x1013e05
mov ecx, r15d
call fcn.0100ff04
cmp dword [rdi + 0x20], 4
jne 0x1013e1f
mov edx, r13d
mov rcx, rdi
call fcn.01013ef8
cmp eax, esi
jne 0x1013e30
jmp 0x1013ece
cmp dword [rdi + 0x48], 5
jne 0x1013e30
mov edx, r13d
mov rcx, rdi
call fcn.01014244
cmp dword [rdi + 0x5c], r14d
jne 0x1013e41
mov edx, r14d
mov rcx, rdi
call fcn.010168e4
cmp dword [rdi + 0x60], r14d
jne 0x1013e51
xor edx, edx
mov rcx, rdi
call fcn.010168e4
cmp dword [rdi + 0x64], r14d
jne 0x1013e72
mov edx, 4
mov rcx, rdi
call fcn.010168e4
mov edx, eax
lea rcx, [0x01006ce0]
call fcn.0100fdd0
cmp dword [rdi + 0x70], esi
je 0x1013eb8
lea rdx, [rdi + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.0100d7ec
mov rbx, rax
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0xb8]
call fcn.0100d7ec
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.01016984
mov edx, eax
lea rcx, [0x01006d60]
call fcn.0100fdd0
cmp dword [rdi + 0x74], esi
je 0x1013ecb
cmp r13d, esi
jne 0x1013ecb
mov rcx, rdi
call fcn.010184b4
nop
mov esi, r14d
lea rcx, [rsp + 0x48]
call fcn.0100d9e0
mov eax, esi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret