Function at 0x14000a33c
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov rax, qword [0x140015128]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rcx
mov qword [rbp - 0x78], r9
mov rcx, qword [rbp + 0x240]
mov rdi, r9
mov qword [rbp - 0x58], rcx
mov r13, rdx
mov rcx, qword [rbp + 0x248]
mov qword [rbp - 0x68], rcx
mov rcx, r8
mov qword [rbp - 0x60], r8
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000a87c
mov eax, 1
test r13, r13
je 0x14000a3be
cmp qword [r13], 0
jne 0x14000a3be
mov dword [rsp + 0x3c], eax
jmp 0x14000a3c3
and dword [rsp + 0x3c], 0
xor ebx, ebx
mov dword [rsp + 0x54], eax
test rdi, rdi
mov dword [rsp + 0x34], 0x4ee08
setne bl
xor eax, eax
and dword [rsp + 0x30], eax
xor r14d, r14d
and qword [rbp - 0x70], rax
xor r12d, r12d
and qword [rbp - 0x80], rax
xor r15d, r15d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x44], r14d
cmp qword [rsi + 0x10], 0
je 0x14000a4ef
mov r14, qword [rsi + 0x20]
and dword [rsi + 0x28], 0
movzx eax, word [rsi + 0x18]
lea r8, [rsp + 0x48]
sub eax, dword [rsi + 0x28]
mov rdx, r14
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140010a28]
mov edi, eax
test eax, eax
js 0x14000a4e4
mov r8d, dword [rsi + 0x28]
xor eax, eax
mov edi, dword [rsp + 0x48]
and dword [rsp + 0x70], eax
add r8d, edi
and dword [rsp + 0x58], 0
mov rcx, qword [rsi + 0x20]
mov dword [rsi + 0x28], r8d
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x6c], eax
test r8d, r8d
je 0x14000a47f
mov bl, byte [rcx]
mov eax, 1
mov dword [rsp + 0x6c], eax
jmp 0x14000a489
mov dword [rsp + 0x70], 0x8007000e
xor bl, bl
inc eax
cmp eax, r8d
jae 0x14000a4a0
lea rcx, [rsp + 0x58]
call fcn.14000d318
movzx r10d, ax
jmp 0x14000a4ab
mov dword [rsp + 0x70], 0x8007000e
xor r10d, r10d
cmp r8d, 3
jb 0x14000a4ba
movzx eax, r10w
cmp r8d, eax
je 0x14000a4cc
add r14, rdi
lea rcx, [rsp + 0x58]
call fcn.14000cfac
jmp 0x14000a413
lea rdx, [rsp + 0x44]
mov cl, bl
call fcn.14000d5b8
lea rcx, [rsp + 0x58]
mov edi, eax
call fcn.14000cfac
mov r14d, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x38]
jmp 0x14000a4f4
mov edi, 0x8000ffff
test edi, edi
js 0x14000a7ef
mov rcx, rsi
sub edi, 0x40002
je 0x14000a5ee
sub edi, 1
je 0x14000a531
sub edi, 0x7e
je 0x14000a7de
cmp edi, 4
je 0x14000a7c2
call fcn.14000ba04
mov edi, 0x80004001
jmp 0x14000a7ef
and qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
xor r8d, r8d
call fcn.14000bdb0
mov rbx, qword [rsp + 0x48]
mov edi, eax
test eax, eax
js 0x14000a5c0
mov rax, qword [rsi + 0x20]
lea rcx, [rsp + 0x58]
and dword [rsp + 0x58], 0
and dword [rsp + 0x6c], 0
and dword [rsp + 0x70], 0
mov qword [rsp + 0x60], rax
movzx eax, word [rsi + 0x18]
mov dword [rsp + 0x68], eax
mov rax, rbx
neg rax
sbb dl, dl
add dl, 0xc4
call fcn.14000d13c
mov edx, 3
lea rcx, [rsp + 0x58]
call fcn.14000d17c
mov edi, dword [rsp + 0x70]
test edi, edi
js 0x14000a5b6
mov rcx, qword [rsi + 0x10]
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsi + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140010a28]
mov edi, eax
lea rcx, [rsp + 0x58]
call fcn.14000cfac
test rbx, rbx
je 0x14000a7cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14000a7cc
mov eax, ebx
neg eax
lea rax, [rsp + 0x30]
sbb r8, r8
and r8, rax
mov eax, dword [rsp + 0x3c]
neg eax
sbb rdx, rdx
and rdx, r13
call fcn.14000bdb0
mov edi, eax
test eax, eax
js 0x14000a7ef
test ebx, ebx
je 0x14000a64b
cmp dword [rsp + 0x50], 0
jne 0x14000a64b
cmp dword [rsp + 0x30], 0
jne 0x14000a634
mov dword [rsp + 0x30], 0xa00000
jmp 0x14000a639
and dword [rsp + 0x38], 0
mov rcx, qword [rbp - 0x78]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x50], 1
mov dword [rcx], eax
cmp dword [rsp + 0x54], 0
je 0x14000a6b2
test r12, r12
jne 0x14000a6a7
mov eax, dword [rsp + 0x30]
cmp eax, dword [rsp + 0x34]
cmova eax, dword [rsp + 0x34]
mov dword [rsp + 0x34], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x14000a699
mov edi, 0x8007000e
jmp 0x14000a6a7
mov r15d, dword [rsp + 0x34]
mov dword [rsp + 0x40], r15d
mov qword [rbp - 0x80], rax
and dword [rsp + 0x30], 0
xor eax, eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x3c], 0
je 0x14000a6f9
test edi, edi
js 0x14000a7ef
and dword [rsp + 0x3c], 0
cmp qword [r13], 0
jne 0x14000a6d4
mov edi, 0x8007007b
jmp 0x14000a6e6
mov r9, qword [rbp - 0x60]
lea rdx, [rbp - 0x70]
mov r8, r13
call fcn.14000a8b0
mov edi, eax
mov rdx, qword [r13]
xor r9d, r9d
mov rcx, qword [rbp - 0x68]
xor r8d, r8d
call fcn.140008fd8
test edi, edi
js 0x14000a7ef
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rbp - 0x80]
call fcn.14000c098
mov edi, eax
test eax, eax
js 0x14000a7ef
mov r8d, dword [rsp + 0x30]
mov eax, r15d
mov r15d, dword [rsp + 0x40]
sub eax, r15d
add r8d, eax
movzx eax, word [rsi + 0x18]
mov dword [rsp + 0x30], r8d
cmp r15d, eax
jbe 0x14000a742
test r14d, r14d
je 0x14000a7a9
mov ebx, dword [rsp + 0x34]
lea r9, [rsp + 0x78]
mov rcx, qword [rbp - 0x70]
sub ebx, r15d
and qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000a78a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14000a796
cmp dword [rsp + 0x78], ebx
mov eax, 0x80070057
cmovne edi, eax
mov r15d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov dword [rsp + 0x40], r15d
mov qword [rbp - 0x80], r12
mov rax, qword [rbp - 0x78]
xor edx, edx
mov rcx, qword [rbp - 0x68]
mov r9d, dword [rax]
call fcn.140008fd8
test edi, edi
js 0x14000a7ef
mov rcx, rsi
mov edx, r14d
call fcn.14000c2d0
mov edi, eax
test edi, edi
js 0x14000a7ef
test r14d, r14d
jne 0x14000a7ef
mov ebx, dword [rsp + 0x38]
jmp 0x14000a400
call fcn.14000bd24
mov rax, qword [rbp - 0x58]
xor edi, edi
mov dword [rax], 1
cmp dword [rsp + 0x38], 0
je 0x14000a800
mov rcx, qword [rbp - 0x78]
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
test r12, r12
je 0x14000a825
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x14000a881
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
jns 0x14000a881
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8, qword [r13]
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
nop dword [rax + rax]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
jmp 0x14000a881
mov edi, 0x80070057
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000e7b0
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret