Function at 0x140053c30
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov word [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
call sub.msvcrt.dll_rand
movsxd r9, eax
imul rax, r9, 0xffffffff810e35c1
shr rax, 0x20
add eax, r9d
mov ecx, eax
shr ecx, 0x1f
sar eax, 0xf
add eax, ecx
imul eax, eax, 0xfde8
sub r9d, eax
lea r8, [0x140261713]
lea rsi, [rsp + 0x48]
mov edx, 6
mov rcx, rsi
call qword [fcn.14009e2c0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rsi
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
inc rax
cmp rax, 1
ja 0x140053cd8
lea rcx, [0x140261716]
mov dl, 1
call fcn.140011c60
jmp 0x140053ee9
mov dword [rsp + 0x44], 0x30d401
mov ecx, 0x30d400
call sub.msvcrt.dll_malloc
mov rdi, rax
mov ebp, 0x30d400
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, 0x30d400
call qword [0x1402da3e8]
cmp eax, 0x80000005
je 0x140053d24
cmp eax, 0xc0000023
je 0x140053d24
cmp eax, 0xc0000004
jne 0x140053e5f
mov eax, dword [rsp + 0x44]
lea ebx, [rax + rax]
test eax, eax
cmove ebx, ebp
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll_realloc
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, ebx
call qword [0x1402da3e8]
cmp eax, 0x80000005
je 0x140053d6d
cmp eax, 0xc0000023
je 0x140053d6d
cmp eax, 0xc0000004
jne 0x140053e5f
mov eax, dword [rsp + 0x44]
lea r14d, [rax + rax]
test eax, eax
cmove r14d, ebx
mov rcx, rdi
mov rdx, r14
call sub.msvcrt.dll_realloc
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r14d
call qword [0x1402da3e8]
cmp eax, 0x80000005
je 0x140053db8
cmp eax, 0xc0000023
je 0x140053db8
cmp eax, 0xc0000004
jne 0x140053e5f
mov eax, dword [rsp + 0x44]
lea ebx, [rax + rax]
test eax, eax
cmove ebx, r14d
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll_realloc
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, ebx
call qword [0x1402da3e8]
cmp eax, 0x80000005
je 0x140053dfe
cmp eax, 0xc0000023
je 0x140053dfe
cmp eax, 0xc0000004
jne 0x140053e5f
mov eax, dword [rsp + 0x44]
lea r14d, [rax + rax]
test eax, eax
cmove r14d, ebx
mov rcx, rdi
mov rdx, r14
call sub.msvcrt.dll_realloc
mov rdi, rax
lea r9, [rsp + 0x44]
mov ecx, 0x10
mov rdx, rax
mov r8d, r14d
call qword [0x1402da3e8]
cmp eax, 0x80000005
je 0x140053e45
cmp eax, 0xc0000023
je 0x140053e45
cmp eax, 0xc0000004
jne 0x140053e5f
mov eax, dword [rsp + 0x44]
lea edx, [rax + rax]
test eax, eax
cmove edx, r14d
mov rcx, rdi
call sub.msvcrt.dll_realloc
mov rdi, rax
jmp 0x140053ebf
test rdi, rdi
je 0x140053ebf
mov ecx, dword [rdi]
test rcx, rcx
je 0x140053ea1
mov eax, dword [0x1402d7220]
shl rcx, 3
lea rdx, [rcx + rcx*2]
xor ecx, ecx
jmp 0x140053e89
add rcx, 0x18
cmp rdx, rcx
je 0x140053ea1
cmp dword [rdi + rcx + 8], eax
jne 0x140053e80
cmp word [rdi + rcx + 0xe], si
jne 0x140053e80
movzx eax, byte [rdi + rcx + 0xc]
mov dword [0x1402d7368], eax
mov rcx, rdi
call fcn.140257dd0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x140053ee9
lea rcx, str.excpetion_at_sepcifing_fh_index_1
mov dl, 1
call fcn.140011c60
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov rcx, rdi
call fcn.140257dd0
nop
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret