Function at 0x100440440
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x100499010]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
lea r8d, [r12 + 0x10]
lea rdx, str.WorkingDirectory
lea rcx, [rsp + 0x50]
call fcn.10040da90
nop
call fcn.10044da70
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
call fcn.10040a3c0
nop
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r9, qword [rbp - 0x80]
mov edx, 0x200
mov r8d, edx
lea rcx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
sub r9, rax
nop word [rax + rax]
lea rax, [r8 + 0x7ffffdfe]
test rax, rax
je 0x100440553
movzx eax, word [rcx + r9]
test ax, ax
je 0x100440553
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x100440530
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov word [rax], r12w
mov rcx, rdx
lea rax, [rbp + 0xa0]
nop dword [rax]
cmp word [rax], 0
je 0x100440580
add rax, 2
sub rcx, 1
jne 0x100440570
mov rax, rdx
sub rax, rcx
mov r8, r12
test rcx, rcx
cmovne r8, rax
je 0x1004405e6
sub rdx, r8
lea rcx, [rbp + 0xa0]
lea rcx, [rcx + r8*2]
je 0x1004405d7
lea rax, [rdx + 0x7ffffdfe]
add rax, r8
lea r9, str.TSXCACHE.BIN
sub r9, rcx
test rax, rax
je 0x1004405d7
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x1004405d7
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x1004405b6
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9c08]
mov rax, qword [0x1004a90d0]
call qword [case.0x10044bd0b.0]
test eax, eax
jne 0x100440632
cmp dword [0x1004a8ebc], eax
je 0x100440625
test bl, bl
je 0x100440625
lea rdx, str.FlushMSXOperationCacheToDisk
lea rcx, str.__s_____Waiting_for_CritSec__n
call fcn.10043bdc0
lea rcx, [0x1004a9c08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x100440652
test bl, bl
je 0x100440652
lea rdx, str.FlushMSXOperationCacheToDisk
lea rcx, str.__s_____Enters_CritSec__n
call fcn.10043bdc0
mov eax, dword [0x1004a9c9c]
mov dword [rsp + 0x44], eax
lea rcx, [rbp + 0xa0]
test eax, eax
jne 0x100440672
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100440955
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x100080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x100440955
lea rdi, [0x1004793e8]
mov rbx, r12
movzx ecx, word [0x100472a38]
cmp cx, word [0x100472884]
jne 0x1004406d3
movzx ecx, word [0x100472a3a]
cmp cx, word [0x100472886]
je 0x10044081b
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x10044081b
mov ecx, 0x102
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x10044081b
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x1004407e2
sub rax, rdi
sar rax, 1
cdqe
lea r14, [rax + rax]
mov r9, r14
mov r8, rdi
mov edx, 0x102
mov rcx, rbx
call fcn.10044c240
mov word [r14 + rbx], r12w
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x100440770
lea rdx, [rbp - 0x60]
mov rcx, rsi
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x100440781
add rax, rcx
cmp rax, 0x80
jae 0x1004407dc
mov r8, rbx
mov edx, 0x100
lea rcx, [rbp - 0x60]
call fcn.10042b640
lea r8, [0x100472884]
mov edx, 0x100
lea rcx, [rbp - 0x60]
call fcn.10042b640
add rdi, 2
add rdi, r14
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x100440744
cmp word [rdi], 0
je 0x10044082c
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x1004407e5
lea rcx, [rbp - 0x60]
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x1004407f3
add rax, rsi
cmp rax, 0x80
jae 0x10044082c
mov r8, rdi
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.10040d600
jmp 0x10044082c
mov r8, rdi
mov edx, 0x100
lea rcx, [rbp - 0x60]
call fcn.10040b320
test rbx, rbx
je 0x10044083a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov r10d, eax
mov eax, 0x14f8b589
imul r10d
mov r9d, edx
sar r9d, 0xd
mov ecx, r9d
shr ecx, 0x1f
add r9d, ecx
imul ecx, r9d, 0x186a0
mov r8d, r10d
sub r8d, ecx
mov eax, 0x10624dd3
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, r9d, 0x64
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
mov eax, 0x10624dd3
imul r10d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
imul eax, ecx, 0x3e8
add r10d, eax
mov dword [rsp + 0x48], r10d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x44]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, r12d
cmp dword [rsp + 0x44], r12d
jle 0x10044094c
mov edx, edi
lea rcx, [0x1004a9c90]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
mov rbx, rax
test rax, rax
je 0x100440944
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 0x30
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x28]
test rdx, rdx
je 0x100440944
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, dword [rbx + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, dword [rsp + 0x44]
jl 0x1004408f1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9c08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10044098b
test bl, bl
je 0x10044098b
lea rdx, str.FlushMSXOperationCacheToDisk
lea rcx, str.__s_____Leaves_CritSec__n
call fcn.10043bdc0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1004409ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1004409c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1004409c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.100469388
movdqa xmm0, xmmword [0x100482320]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.100469360
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret