Function at 0x140009f60
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x14006b680]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov r13, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.140047d20
lea rax, [0x14006ca90]
mov rdi, 0xffffffffffffffff
mov r8, rdi
mov qword [rsp + 0x20], rax
lea r9, str._sCredentialsNew.ini
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.1400022c0
xor r12d, r12d
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, rdi
je 0x14000a4d3
xorps xmm0, xmm0
lea rdx, [rbp - 0x80]
xor eax, eax
mov rcx, r14
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x50], eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14000a4ca
cmp dword ds:[rbp - 0x58], 1
jne 0x14000a4ca
mov eax, dword [rbp - 0x5c]
test eax, eax
je 0x14000a4ca
mov qword [rsp + 0x330], rsi
mov ecx, eax
mov qword [rsp + 0x2e0], r15
mov r15d, eax
call fcn.14001e3b0
mov rsi, rax
test rax, rax
je 0x14000a087
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.140047d20
jmp 0x14000a08a
mov rsi, r12
mov r8d, dword [rbp - 0x5c]
lea r9, [rsp + 0x70]
mov rdx, rsi
mov dword [rsp + 0x70], r12d
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000a4a5
mov eax, dword [rbp - 0x5c]
cmp dword [rsp + 0x70], eax
jne 0x14000a4a5
xorps xmm0, xmm0
mov dword [rsp + 0x60], eax
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x64], r12d
mov rax, rdi
mov qword [rsp + 0x68], rsi
inc rax
cmp byte [rbx + rax], r12b
jne 0x14000a0d7
test rax, rax
je 0x14000a18a
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x58], rbx
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], r12b
jne 0x14000a100
inc edi
mov dword [rsp + 0x50], edi
movabs r10, 0x9c058e8154560970
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
mov rax, qword [0x14006ca00]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], 0x41
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [0x14004a4d0]
test eax, eax
jne 0x14000a1f7
lfence
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
xor eax, eax
lea rdi, [rbp - 0x80]
mov ecx, 0x34
rep stosb byte [rdi], al
jmp 0x14000a276
movabs r10, 0x9c058e8154560970
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
mov rax, qword [0x14006ca00]
xor r8d, r8d
mov dword [rsp + 0x28], 0x41
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [0x14004a4d0]
test eax, eax
jne 0x14000a1f7
lfence
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
xor eax, eax
lea rdi, [rbp - 0x80]
mov ecx, 0x34
rep stosb byte [rdi], al
jmp 0x14000a276
mov qword ss:[rsp + 0x30], r12
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 5
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000a2a6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
lea rdi, [rbp - 0x80]
mov ecx, 0x34
rep stosb byte [rdi], al
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov rsi, qword [rsp + 0x330]
mov r15, qword [rsp + 0x2e0]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14001e390
add rsp, 0x2e8
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x74]
mov rdx, qword [rsp + 0x48]
mov rcx, r14
mov dword [rsp + 0x74], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000a325
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax]
jmp 0x14000a26a
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x20a
call fcn.14001e3fc
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
je 0x14000a38d
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140047d20
lea r8, [rbp - 0x40]
mov byte [rbx + 0x208], r12b
mov edx, 0x104
mov rcx, rbx
call fcn.14002ee10
nop dword [rax]
test eax, eax
jne 0x14000a390
mov byte [rbx + 0x208], 1
jmp 0x14000a390
mov rbx, r12
xor r8d, r8d
lea rdx, str.Steam
mov rcx, rbx
call fcn.14000ab20
mov r15, rax
test rax, rax
je 0x14000a421
lfence
mov r8, rax
mov edx, 0x101
mov rcx, r13
call fcn.14002f0c4
mov r8, r15
lea rdx, str.Steam
mov rcx, rbx
call fcn.14000ab20
mov r12, rax
test rax, rax
je 0x14000a40a
lfence
lea rcx, [r13 + 0x101]
mov r8, rax
mov edx, 0x101
call fcn.14002f0c4
xor eax, eax
mov ecx, 0x100
mov rdi, r12
rep stosb byte [rdi], al
mov rcx, r12
call fcn.14001e3b8
xor eax, eax
mov rdi, r15
mov ecx, 0x100
rep stosb byte [rdi], al
mov rcx, r15
call fcn.14001e3b8
xor r12d, r12d
test rbx, rbx
je 0x14000a43a
mov edx, 0x20a
mov byte [rbx + 0x208], 0
mov rcx, rbx
call fcn.14001e3b8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp - 0x5c]
lea r9, [rsp + 0x78]
mov rdx, rsi
mov dword [rsp + 0x78], r12d
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
lea rdi, [rbp - 0x80]
mov ecx, 0x34
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
test ebx, ebx
je 0x14000a26a
mov al, 1
jmp 0x14000a276
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword ds:[rbp - 0x5c]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14001e3b8
jmp 0x14000a274
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000a286