Function at 0x140046dc4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov esi, r9d
mov r13, r8
mov rdi, rdx
mov r12, rcx
lea rcx, [rsp + 0x40]
call fcn.140063500
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x4c], ebx
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140071240
nop
mov r15, qword [rsp + 0x60]
mov eax, esi
and eax, 0xfffffff7
mov dword [rsp + 0x70], eax
and esi, 8
mov dword [rsp + 0x118], esi
lea rdx, [0x140140490]
lea rcx, [rsp + 0x58]
call fcn.140071240
nop
call fcn.14002d394
mov dword [rsp + 0x74], eax
movzx esi, ax
mov ecx, 0xff
and si, cx
movzx ecx, ax
shl cx, 8
or si, cx
movzx eax, si
shl eax, 0x10
mov dword [rsp + 0x88], eax
mov ebp, eax
mov dword [rsp + 0x68], eax
mov r14d, ebx
lea eax, [rbx + 1]
cmp r13, rax
setne r14b
mov dword [rsp + 0x6c], ebx
mov rdi, r12
mov qword [rsp + 0xa0], rbx
mov r13d, ebx
cmp r14d, ebx
je 0x140046ee2
mov ecx, 0xd0
call fcn.1400cf938
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, rbx
je 0x140046ed2
mov rdx, r12
mov rcx, rax
call fcn.14002a68c
mov rdx, r12
mov rcx, rdi
call fcn.14002af60
mov qword [rdi + 0x40], rbx
jmp 0x140046ed5
mov rdi, rbx
mov rdx, r12
mov rcx, rdi
call fcn.14002af60
jmp 0x140046eea
mov dword [rsp + 0x6c], 0x100000
mov r12, qword [rsp + 0x108]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140071240
nop
mov qword [rsp + 0x90], rbx
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.14006f2b0
mov r11, qword [rsp + 0x90]
cmp r11, rbx
je 0x140046f2f
mov word [r11 - 2], bx
mov r8, qword [rsp + 0x50]
lea rdx, [0x140149770]
mov rcx, rdi
call fcn.140061330
mov word [rdi + 0xc], si
movzx edx, si
mov rcx, rdi
call fcn.1400602b0
mov r11, qword [rsp + 0x40]
xor word [r11], si
mov eax, 0x23
cmp ax, word [r15]
jne 0x140046fea
lea rcx, [rsp + 0x78]
call fcn.140063230
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x84], ebx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, str.SCRIPT
mov rdx, r15
mov rcx, qword [0x14019c040]
call fcn.140030854
mov ebp, dword [rsp + 0x68]
or ebp, dword [rsp + 0x88]
cmp dword [rsp + 0x80], ebx
jle 0x140046fde
mov edx, ebp
or edx, 1
lea rcx, [rsp + 0x78]
call fcn.140081dc0
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x78], r11
lea rcx, [rsp + 0x78]
call fcn.14005b520
jmp 0x140047045
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14004394c
cmp eax, 0xffffffff
jne 0x14004703a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
jmp 0x140047361
and eax, 2
or ebp, eax
mov r13d, 1
cmp r14d, ebx
jne 0x140047060
lea r8, str.PeExe
mov edx, r13d
lea rcx, [0x14019c170]
call fcn.140065f20
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140071360
mov r11, qword [rsp + 0x40]
mov r13, r11
cmp r11, rbx
jne 0x1400470a9
cmp r14d, ebx
je 0x1400470c1
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
mov ebx, 2
jmp 0x140047361
movzx edx, si
mov rcx, r11
call fcn.14002d37c
cmp eax, ebx
jg 0x140047142
cmp r14d, ebx
jne 0x1400470f2
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400635c0
movzx r11d, si
xor r11w, 0x20
mov rax, qword [rsp + 0x40]
mov word [rax], r11w
mov rax, qword [rsp + 0x40]
mov word [rax + 2], si
mov r11, qword [rsp + 0x40]
jmp 0x1400470a9
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
cmp rbx, rbx
je 0x140047127
mov qword [rsp + 0x110], rbx
xor edx, edx
mov rcx, rbx
call fcn.140045e0c
nop
lea rcx, [rbx + 0x58]
call fcn.14005b520
mov rcx, rbx
call fcn.1400cf984
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
jmp 0x140047361
movzx r12d, word [rsp + 0x74]
lea r8d, [rax + 2]
movzx edx, si
xor edx, r12d
mov rcx, r11
call fcn.14002d430
mov esi, r12d
shl esi, 0x10
movzx eax, bp
or esi, eax
mov qword [rdi + 0x60], rbx
mov r8, qword [rsp + 0x50]
lea rdx, [0x140149770]
mov rcx, rdi
call fcn.140061330
cmp dword [rsp + 0x118], ebx
je 0x140047194
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp r13, rbx
jne 0x1400471ee
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
cmp rbx, rbx
je 0x1400471ce
mov qword [rsp + 0x110], rbx
xor edx, edx
mov rcx, rbx
call fcn.140045e0c
nop
lea rcx, [rbx + 0x58]
call fcn.14005b520
mov rcx, rbx
call fcn.1400cf984
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
mov ebx, 1
jmp 0x140047361
mov rbp, qword [rsp + 0x40]
mov r13, rbp
movzx eax, byte [0x1401958a8]
mov ecx, eax
cmp al, bl
mov edx, 1
cmovl ecx, edx
mov byte [0x1401958a8], cl
cmp r14d, ebx
je 0x14004726d
mov r9, qword [rsp + 0x110]
mov r8, qword [rsp + 0x120]
lea rdx, [rsp + 0x40]
mov ecx, r12d
call fcn.140043ed8
sub rax, qword [rsp + 0x40]
sar rax, 1
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x70]
mov r8, qword [rsp + 0x128]
lea rdx, [rsp + 0x40]
mov ecx, r12d
call fcn.14002d488
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rbp, qword [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x40], rbx
cmp r14d, ebx
je 0x1400472a6
or esi, dword [rsp + 0x70]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
mov r9, r15
mov r8, qword [rsp + 0x110]
mov rdx, rbp
mov rcx, qword [rsp + 0x100]
call fcn.1400c0c10
jmp 0x140047316
mov eax, dword [0x14019c2a0]
test dl, al
jne 0x1400472cb
or eax, edx
mov dword [0x14019c2a0], eax
mov qword [0x14019c298], rbx
lea rcx, [0x14013b22c]
call fcn.14010c694
mov rdx, rbp
lea rsi, [0x14019c298]
mov rcx, rsi
call fcn.1400a4890
mov qword [rdi + 0x60], rsi
mov rax, qword [0x14019c298]
mov r8, qword [rax]
mov qword [rdi + 0x68], r8
mov eax, dword [rsp + 0x74]
mov word [rdi + 0xc], ax
or r12d, dword [rsp + 0x6c]
mov edx, r12d
mov rcx, rdi
call fcn.1400602b0
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call fcn.140036614
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
cmp rbx, rbx
je 0x14004734b
mov qword [rsp + 0x110], rbx
xor edx, edx
mov rcx, rbx
call fcn.140045e0c
nop
lea rcx, [rbx + 0x58]
call fcn.14005b520
mov rcx, rbx
call fcn.1400cf984
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x40]
call fcn.14005b520
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret