Function at 0x140048730
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov qword [rax - 0xc8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x28], ecx
lea rdx, str.C:Windowsiassist_
lea rcx, [rsp + 0x38]
call fcn.14000c6f0
nop
lea rdx, str.ZIP.txt
lea rcx, [rsp + 0x38]
call fcn.14000c2e0
lea rdx, [0x1400a3cc0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
mov qword [rsp + 0xa8], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x20]
call fcn.14000c6f0
nop
mov r15d, 0xffffffff
test rbx, rbx
je 0x14004894e
xor r13d, r13d
mov r8, rbx
mov edx, 0x64
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14004894e
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x98]
call fcn.14000c6f0
mov qword [rsp + 0x1b8], rax
mov rdi, qword [rax]
movsxd rcx, dword [rdi - 0x10]
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x90], rdi
mov r14, rdi
mov rax, qword [rsp + 0x20]
sub r14, rax
sar r14, 1
mov qword [rsp + 0x178], r14
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140048ce5
test rdi, rdi
jne 0x140048854
mov esi, r13d
mov dword [rsp + 0x50], r13d
jmp 0x14004886c
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x20]
mov ecx, 0x7fffffff
sub ecx, esi
cmp ecx, r12d
jl 0x140048cef
lea ebx, [r12 + rsi]
mov dword [rsp + 0x168], ebx
test ebx, ebx
js 0x140048cf9
lea rcx, [rax - 0x18]
mov qword [rsp + 0x180], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x16c], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x170], ecx
or ecx, edx
jge 0x1400488cb
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14000d100
mov rax, qword [rsp + 0x20]
cmp r14, r12
ja 0x1400488dc
lea rdi, [rax + r14*2]
mov qword [rsp + 0x90], rdi
movsxd rdx, esi
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000da90
mov rax, qword [rsp + 0x20]
cmp ebx, dword [rax - 0xc]
jg 0x140048d03
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], r13w
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xa0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048941
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0xa8]
jmp 0x1400487d0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x20]
mov edi, dword [rcx - 0x10]
mov dword [rsp + 0x80], edi
mov edx, 0x5c
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rbx, rax
mov qword [rsp + 0x188], rax
test rax, rax
jne 0x140048986
mov ebx, r15d
jmp 0x14004898e
sub rbx, qword [rsp + 0x20]
sar rbx, 1
mov dword [rsp + 0x58], ebx
sub edi, ebx
lea r8d, [rdi - 1]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000bb80
nop
mov r8d, ebx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.14000bae0
mov qword [rsp + 0x190], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x198], rcx
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0xb0], rbx
cmp rcx, rbx
je 0x140048a55
cmp dword [rbx + 0x10], 0
jl 0x140048a36
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140048a36
call fcn.14000d070
mov qword [rsp + 0xb8], rax
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140048a23
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0xb8]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140048a55
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x8c], r8d
mov qword [rsp + 0x1a0], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xc8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048a87
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x84], eax
test eax, eax
js 0x140048ac7
lea rdx, [0x1400a4010]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x1a8], rax
test rax, rax
je 0x140048ac7
sub rax, qword [rsp + 0x30]
sar rax, 1
mov dword [rsp + 0x88], eax
test eax, eax
jg 0x140048ad8
lea rdx, str..zip
lea rcx, [rsp + 0x30]
call fcn.14000c2e0
lea rdx, str.__C:Program_FilesWinZipwzzip___yf
lea rcx, [rsp + 0x70]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
call fcn.14000ba30
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000ba30
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048b48
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xe0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048b77
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x40], rcx
call fcn.14000d070
mov qword [rsp + 0x48], rax
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8b, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe8]
call fcn.14005e3e0
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xf0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048bf7
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xf8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048c27
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x100], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048c57
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x108], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048c87
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x38]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x110], rax
lock xadd dword [rax + 0x10], r15d
sub r15d, 1
jg 0x140048cb6
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400691f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
mov ecx, 0x80070057
call fcn.14000dd90
int3