Function at 0x1400eff70
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov rax, qword [0x140194040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x30], 0
lea rdx, str.https:__shrinkme.io_api_apic0a63df2a6a06aa42210b2aee72c514f06697b62url
lea rcx, [rsp + 0x170]
call fcn.1400148f0
nop
mov r8, qword [rsp + 0x2c8]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x90]
call fcn.1400f41b0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x170]
call fcn.1400147f0
lea rcx, [rsp + 0x90]
call fcn.1400147c0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rdx, [0x140150ccc]
mov rcx, qword [rsp + 0x48]
call fcn.1400148f0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x60]
call fcn.140014950
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.1400f0740
lea rcx, [rsp + 0x130]
call fcn.140009970
nop
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x190]
call fcn.1400098e0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x140150c64]
lea rcx, [rsp + 0x190]
call fcn.1400772c0
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.1400f4650
lea rcx, [rsp + 0x190]
call fcn.1400771b0
lea rcx, [rsp + 0x130]
call fcn.140014630
cmp rax, 2
jae 0x1400f0153
lea rcx, [0x140150c6c]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [0x140150cec]
mov rcx, qword [rsp + 0x2c0]
call fcn.1400148f0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x190]
call fcn.140077170
nop
lea rcx, [rsp + 0x130]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x170]
call fcn.1400147c0
nop
mov rcx, qword [rsp + 0x2c8]
call fcn.1400147c0
mov rax, qword [rsp + 0x2c0]
jmp 0x1400f02c5
lea rcx, [rsp + 0x150]
call fcn.140009970
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x140150cf0]
lea rcx, [rsp + 0x130]
call fcn.1400776e0
mov dword [rsp + 0x34], eax
mov r8, 0xffffffffffffffff
lea rdx, [0x140150cd4]
lea rcx, [rsp + 0x130]
call fcn.1400776e0
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
dec eax
cdqe
mov ecx, dword [rsp + 0x34]
inc ecx
movsxd rcx, ecx
mov r9, rax
mov r8, rcx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x130]
call fcn.140077680
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x150]
call fcn.1400147f0
lea rcx, [rsp + 0xb0]
call fcn.1400147c0
lea r8, [rsp + 0x150]
lea rdx, str.https:__shrinke.me_
lea rcx, [rsp + 0xd0]
call fcn.140078db0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.1400147f0
lea rcx, [rsp + 0xd0]
call fcn.1400147c0
lea rcx, [0x140150d04]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x2c0]
call fcn.140014870
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x150]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x190]
call fcn.140077170
nop
lea rcx, [rsp + 0x130]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x170]
call fcn.1400147c0
nop
mov rcx, qword [rsp + 0x2c8]
call fcn.1400147c0
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400fad60
add rsp, 0x2b8
ret