Function at 0x1401a8af0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movzx r15d, dl
mov r12, rcx
lea r8, [0x14027d3d4]
mov rdx, rcx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x1401a8b50
cmp qword [rsp + 0x38], 0
je 0x1401a8dfa
lea rdx, [r8 + 1]
mov r8, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str..temp
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor edi, edi
mov esi, edi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
je 0x1401a8c02
nop dword [rax]
xor al, r15b
mov byte [rsp + 0x30], al
cmp rbx, rsi
je 0x1401a8bd8
mov byte [rbx], al
inc rbx
mov qword [rsp + 0x78], rbx
jmp 0x1401a8bf3
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400ba740
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
cmp eax, 0xffffffff
jne 0x1401a8bc0
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea r8, [0x14027d404]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r15, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401a8c79
mov rdi, r15
cmp r15, rbx
je 0x1401a8c58
nop dword [rax + rax]
movsx ecx, byte [rdi]
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putc
inc rdi
mov rax, qword [rsp + 0x40]
cmp rdi, rbx
jne 0x1401a8c40
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r12
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
jmp 0x1401a8d97
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayGetLBound
mov byte [rbp - 0x70], 0
lea rax, [rbp - 0x30]
inc r14
cmp byte [rax + r14], 0
jne 0x1401a8c91
mov r8, r14
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400d0690
nop
lea r8, [rbp - 0x70]
lea rdx, str._Utility__EncryptDecryptFile__Open
lea rcx, [rbp - 0x50]
call fcn.1400b9790
nop
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
mov rcx, rax
call fcn.1400d02e0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.1401630b0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1401a8d4b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a8d46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a8fe2
call fcn.1401c72f8
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayGetLBound
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401a8d97
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a8d91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a8fe8
call fcn.1401c72f8
nop
test r15, r15
je 0x1401a8dcf
sub rsi, r15
mov rax, r15
cmp rsi, 0x1000
jb 0x1401a8dc4
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a8fee
mov rdx, rsi
mov rcx, r15
call fcn.1401c72f8
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1401c7850
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayGetLBound
mov byte [rsp + 0x70], dil
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.1400d0690
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea r15d, [rdi + 0x23]
lea r14, str._Utility__EncryptDecryptFile__Open
cmp rax, r15
jb 0x1401a8eb8
lea rax, [r8 + 0x23]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x70]
lea rax, [0x14028ca83]
cmp rax, rbx
jbe 0x1401a8e7b
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1401a8e7b
cmp rbx, r14
ja 0x1401a8e73
mov esi, edi
jmp 0x1401a8e7e
mov rsi, rbx
sub rsi, r14
jmp 0x1401a8e7e
mov rsi, r15
lea rcx, [rbx + 0x23]
inc r8
mov rdx, rbx
call fcn.1401ff6b0
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.1401ff6b0
lea rcx, [rbx + rsi]
sub r15, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
mov r8, r15
call fcn.1401ff6b0
lea rax, [rsp + 0x70]
jmp 0x1401a8ed5
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400bb040
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
lea rcx, [rbp - 0x70]
call fcn.1400d02e0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.1401630b0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401a8f86
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a8f81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a8fd6
call fcn.1401c72f8
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayGetLBound
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1401a8dcf
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a8dca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a8fdc
jmp 0x1401a8dca
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3