Function at 0x14006c620
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140099040]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, ebx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [rbp + 0x70], 0x238e2d80
mov dword [rbp + 0x74], 0x278a2152
mov dword [rbp + 0x78], 0x3b9b2576
mov dword [rbp + 0x7c], 0x3f3e3984
xor eax, eax
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], eax
mov word [rbp + 0x8c], ax
mov byte [rbp + 0x8e], al
xor esi, esi
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movabs r9, 0x7c88966cb7a7d486
nop
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rbp + rax + 0x70]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x56
mov rax, qword [rsp + 0x40]
mov byte [rbp + rax + 0x70], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1f
jb 0x14006c6c0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14006c74e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
jmp 0x14006cbe5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140963a10], xmm0
movups xmmword [0x140963a20], xmm0
movups xmmword [0x140963a30], xmm0
movups xmmword [0x140963a40], xmm0
movups xmmword [0x140963a50], xmm0
movups xmmword [0x140963a60], xmm0
mov dword [0x140963a70], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
add r8d, 0xa
movsxd rdi, r8d
test r8d, r8d
jle 0x14006c7fa
mov rbx, rsi
movabs r15, 0x4ec4ec4ec4ec4ec5
lea r14, [0x140000000]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r15
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + r14 + 0x8ae18]
mov byte [rbx + r14 + 0x963a10], al
inc rbx
cmp rbx, rdi
jl 0x14006c7c7
lea rcx, [rbp + 0xb0]
call fcn.14006c400
nop
cmp qword [rbp + 0xc0], 0
je 0x14006cbcf
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rdx, qword [rbp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.14006fac0
nop
mov r8d, 0x8708
lea rdx, [0x1400804e0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rsp + 0x58]
test al, al
je 0x14006c8fa
call fcn.14005add0
test rax, rax
jne 0x14006c8ae
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.1400597b0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14006cbcf
call fcn.14005add0
test rax, rax
jne 0x14006c923
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.1400597b0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xb0]
call fcn.140073dd0
test al, al
jne 0x14006c99c
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
jmp 0x14006cbcf
mov dword [rbp + 0x90], 0xebb8d5ba
mov dword [rbp + 0x94], 0xef84e9d8
mov dword [rbp + 0x98], 0xe38bedbc
mov dword [rbp + 0x9c], 0xe7e0e19e
xor eax, eax
mov qword [rbp + 0xa0], rax
mov dword [rbp + 0xa8], eax
mov word [rbp + 0xac], ax
mov byte [rbp + 0xae], al
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movabs r9, 0x15a5fc3d4e5d63dd
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rbp + rax + 0x90]
add r8, r9
mov eax, edx
and rax, r8
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r8
sub cl, 0xb
mov rax, qword [rsp + 0x40]
mov byte [rbp + rax + 0x90], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x1f
jb 0x14006c9f4
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14006cbc7
mov dword [rbp + 0x60], 0x6461191e
mov dword [rbp + 0x64], 0x5b64675f
mov dword [rbp + 0x68], 0x5e6250a6
mov byte [rbp + 0x6c], pe_nt_image_headers64
xor eax, eax
mov word [rbp + 0x6d], ax
mov byte [rbp + 0x6f], al
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
movabs r9, 0xd0edaa2aaaf6c23e
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rbp + rax + 0x60]
add r8, r9
mov eax, edx
and rax, r8
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r8
add cl, 0x4e
mov rax, qword [rsp + 0x40]
mov byte [rbp + rax + 0x60], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x14006cac0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14006cb25
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xd0]
call fcn.14005fa20
nop
lea rcx, [rbp + 0xd0]
call fcn.140074c30
mov qword [0x140963a78], rax
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14006cb9e
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006cb92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006cb92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400763dc
mov rax, qword [0x140963a78]
mov rcx, rbx
test rax, rax
je 0x14006cbca
call fcn.14006e760
mov rcx, rbx
test al, al
je 0x14006cbca
call fcn.14006f290
mov rcx, rbx
test al, al
je 0x14006cbca
call fcn.14006dce0
test al, al
jne 0x14006cbd6
mov rcx, rbx
call fcn.14006cc20
mov rbx, 0xffffffffffffffff
lea rcx, [rbp + 0xb0]
call fcn.140059f80
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140075d20
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret