Function at 0x140005de0
Capabilities:
Delete file

Disassembly:
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
lea rdx, str.C:Windowscheat.sys
lea rcx, [rbp + 0x170]
call fcn.140006cc0
nop
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x170]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140005e71
mov r8d, 0x3110
lea rdx, [0x1400e6b00]
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x178]
call fcn.1400080c0
test rax, rax
jne 0x140005e71
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x170]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str.C:Windowsmapper.exe
lea rcx, [rbp + 0x60]
call fcn.140006cc0
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140005edc
mov r8d, 0x46a00
lea rdx, [0x14008a100]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x68]
call fcn.1400080c0
test rax, rax
jne 0x140005edc
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov ecx, Ordinal_50
call fcn.14006be24
mov rdx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], Ordinal_46
mov qword [rsp + 0x48], Ordinal_50
movups xmm0, xmmword [str.C:Windowsmapper.exe__C:Windowscheat.sys]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14007d868]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14007d878]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x14007d880]
mov word [rdx + 0x28], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdx + 0x2a], al
mov byte [rdx + 0x2b], 0
lea rcx, [rsp + 0x30]
call fcn.140005bd0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Windowsmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Windowscheat.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [0x14007d888]
lea rcx, [rsp + 0x50]
call fcn.140006cc0
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140005ff7
mov r8d, 0x16000
lea rdx, [0x1400d0b00]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x58]
call fcn.1400080c0
test rax, rax
jne 0x140005ff7
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400058b0
nop
lea rcx, [rbp + 0x60]
call fcn.1400058b0
nop
lea rcx, [rbp + 0x170]
call fcn.1400058b0
add rsp, 0x380
pop rbp
ret