Function at 0x140048920
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov qword [rax - 0xc8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x28], ecx
lea rdx, str.C:Windowsiassist_
lea rcx, [rsp + 0x38]
call fcn.14000c8e0
nop
lea rdx, str.ZIP.txt
lea rcx, [rsp + 0x38]
call fcn.14000c4d0
lea rdx, [0x1400a3cc0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
mov qword [rsp + 0xa8], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x20]
call fcn.14000c8e0
nop
mov r15d, 0xffffffff
test rbx, rbx
je 0x140048b3e
xor r13d, r13d
mov r8, rbx
mov edx, 0x64
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x140048b3e
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x98]
call fcn.14000c8e0
mov qword [rsp + 0x1b8], rax
mov rdi, qword [rax]
movsxd rcx, dword [rdi - 0x10]
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x90], rdi
mov r14, rdi
mov rax, qword [rsp + 0x20]
sub r14, rax
sar r14, 1
mov qword [rsp + 0x178], r14
mov r12d, dword [rax - 0x10]
test ecx, ecx
js 0x140048ed5
test rdi, rdi
jne 0x140048a44
mov esi, r13d
mov dword [rsp + 0x50], r13d
jmp 0x140048a5c
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x20]
mov ecx, 0x7fffffff
sub ecx, esi
cmp ecx, r12d
jl 0x140048edf
lea ebx, [r12 + rsi]
mov dword [rsp + 0x168], ebx
test ebx, ebx
js 0x140048ee9
lea rcx, [rax - 0x18]
mov qword [rsp + 0x180], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x16c], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x170], ecx
or ecx, edx
jge 0x140048abb
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14000d2f0
mov rax, qword [rsp + 0x20]
cmp r14, r12
ja 0x140048acc
lea rdi, [rax + r14*2]
mov qword [rsp + 0x90], rdi
movsxd rdx, esi
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rdi
call fcn.14000dc80
mov rax, qword [rsp + 0x20]
cmp ebx, dword [rax - 0xc]
jg 0x140048ef3
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], r13w
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xa0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048b31
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0xa8]
jmp 0x1400489c0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x20]
mov edi, dword [rcx - 0x10]
mov dword [rsp + 0x80], edi
mov edx, 0x5c
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rbx, rax
mov qword [rsp + 0x188], rax
test rax, rax
jne 0x140048b76
mov ebx, r15d
jmp 0x140048b7e
sub rbx, qword [rsp + 0x20]
sar rbx, 1
mov dword [rsp + 0x58], ebx
sub edi, ebx
lea r8d, [rdi - 1]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14000bd70
nop
mov r8d, ebx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.14000bcd0
mov qword [rsp + 0x190], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x198], rcx
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0xb0], rbx
cmp rcx, rbx
je 0x140048c45
cmp dword [rbx + 0x10], 0
jl 0x140048c26
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140048c26
call fcn.14000d260
mov qword [rsp + 0xb8], rax
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140048c13
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0xb8]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140048c45
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x8c], r8d
mov qword [rsp + 0x1a0], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d350
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xc8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048c77
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x84], eax
test eax, eax
js 0x140048cb7
lea rdx, [0x1400a4010]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov qword [rsp + 0x1a8], rax
test rax, rax
je 0x140048cb7
sub rax, qword [rsp + 0x30]
sar rax, 1
mov dword [rsp + 0x88], eax
test eax, eax
jg 0x140048cc8
lea rdx, str..zip
lea rcx, [rsp + 0x30]
call fcn.14000c4d0
lea rdx, str.__C:Program_FilesWinZipwzzip___yf
lea rcx, [rsp + 0x70]
call fcn.14000c8e0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
call fcn.14000bc20
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000bc20
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048d38
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xe0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048d67
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x40], rcx
call fcn.14000d260
mov qword [rsp + 0x48], rax
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8b, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xe8]
call fcn.14005e5d0
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xf0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048de7
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xf8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048e17
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x100], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048e47
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x108], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140048e77
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x38]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x110], rax
lock xadd dword [rax + 0x10], r15d
sub r15d, 1
jg 0x140048ea6
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
int3