Function at 0x14004da84
Capabilities:
Delete file
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
cmp dword [rcx + 0x20], 0
mov rbx, rcx
movsxd rdi, r9d
jne 0x14004dc63
mov byte [rcx + 0x50], r8b
mov dword [rcx + 0x58], edi
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x68]
mov dl, byte [rbx + 0x50]
shr ecx, 0xb
test dl, dl
je 0x14004dad8
mov rax, rdi
shr rax, 0xb
imul eax, ecx
shl eax, 6
jmp 0x14004dadd
shl ecx, 0xc
mov eax, ecx
mov dword [rbx + 0x40], eax
mov dword [rbx + 0x2c], eax
test dl, dl
jne 0x14004dbb5
call qword [sym.imp.MFC42u.dll_Ordinal_1463]
nop dword [rax + rax]
lea rdx, [0x14008a8c0]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx + 0x168]
call qword [sym.imp.msvcrt.dll__wtempnam]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14004dc63
lea rsi, [rbx + 0x18]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.MFC42u.dll_AfxDeleteObject]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rsi]
xor r8d, r8d
mov dword [rsp + 0x28], 0x10000100
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
mov qword [rbx], rax
cmp rax, rdi
je 0x14004dc63
mov edx, dword [rbx + 0x2c]
mov rcx, rax
shl rdx, 0xb
call fcn.14004e49c
mov rcx, qword [rbx]
test eax, eax
je 0x14004dbb0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsi]
jmp 0x14004dc54
mov eax, dword [rbx + 0x2c]
jmp 0x14004dbbf
or rdi, 0xffffffffffffffff
mov qword [rbx], rdi
mov rcx, rdi
and qword [rsp + 0x28], 0
xor edx, edx
mov dword [rbx + 0x28], eax
mov r8d, 0x8000004
shl rax, 0xb
mov qword [rbx + 0x38], rax
mov r9d, dword [rbx + 0x3c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov qword [rbx + 8], rax
mov rcx, rax
test rax, rax
jne 0x14004dbff
cmp byte [rbx + 0x50], al
jne 0x14004dc60
jmp 0x14004dc41
mov eax, dword [rbx + 0x2c]
xor r9d, r9d
shl rax, 0xb
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x14004dc78
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp byte [rbx + 0x50], 0
jne 0x14004dc63
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov qword [rbx], rdi
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor r8d, r8d
xor ecx, ecx
lea esi, [r8 + 1]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14004dcf3
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14004dcb2
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop dword [rax + rax]
and qword [rbx + 0x48], 0
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp byte [rbx + 0x50], 0
jne 0x14004dce7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
jmp 0x14004dc63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
mov eax, esi
mov dword [rbx + 0x20], esi
jmp 0x14004dc65