Function at 0x1400112c1
Capabilities:
Delete file

Disassembly:
jmp 0x140025560
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140043018]
xor rax, rbp
mov qword [rbp + 0x3e0], rax
mov dword [rbp + 0x394], 0
lea rcx, [0x14004e4d7]
call fcn.140011f19
lea rcx, [rbp + 0x1b8]
call fcn.140011b1d
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
lea rcx, [0x140043c68]
call fcn.140011479
lea rcx, [rbp + 0x1b8]
call fcn.14001132a
lea rcx, [rbp + 0x1f8]
call fcn.140011519
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
lea rcx, [0x140043c90]
call fcn.140011479
lea rcx, [rbp + 0x1f8]
call fcn.14001132a
lea rax, [rbp + 0x238]
mov qword [rbp + 0x278], rax
lea rdx, [0x140043c90]
mov rcx, qword [rbp + 0x278]
call fcn.140011244
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
lea rcx, [rbp + 0x298]
call fcn.140011285
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
lea rcx, [0x140043cb8]
call fcn.140011479
lea rcx, [rbp + 0x298]
call fcn.14001132a
cmp qword [0x140043c60], 0
je 0x1400256a6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [0x140043c60]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x1400256a6
movzx eax, byte [0x140043d02]
test eax, eax
je 0x1400256a6
mov rcx, qword [0x140043c60]
call qword [sym.imp.ucrtbased.dll_remove]
movzx eax, byte [0x140043d00]
test eax, eax
je 0x1400256c9
call fcn.140012072
movzx eax, al
test eax, eax
jne 0x1400256c9
call fcn.140011316
mov byte [0x140043c58], 1
movzx eax, byte [0x140043d03]
test eax, eax
je 0x14002581e
call fcn.1400118d9
movzx eax, al
test eax, eax
jne 0x14002581e
movzx eax, byte [0x140043d00]
test eax, eax
je 0x14002573f
lea rdx, [0x140043cb8]
lea rcx, [rbp + 0x2d8]
call fcn.140011dd9
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov eax, dword [rbp + 0x394]
or eax, 1
mov dword [rbp + 0x394], eax
mov rcx, qword [rbp + 0x3b0]
call fcn.140011569
mov qword [rbp + 0x3b8], rax
jmp 0x140025789
lea rdx, [0x140043c68]
lea rcx, [rbp + 0x318]
call fcn.140011dd9
mov qword [rbp + 0x3c0], rax
mov rax, qword [rbp + 0x3c0]
mov qword [rbp + 0x3c8], rax
mov eax, dword [rbp + 0x394]
or eax, 2
mov dword [rbp + 0x394], eax
mov rcx, qword [rbp + 0x3c8]
call fcn.140011569
mov qword [rbp + 0x3b8], rax
lea rdx, [0x140043d30]
lea rcx, [rbp + 0x358]
call fcn.140011dd9
mov qword [rbp + 0x3d0], rax
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3d8], rax
mov rcx, qword [rbp + 0x3d8]
call fcn.140011569
xor r8d, r8d
mov rdx, qword [rbp + 0x3b8]
mov rcx, rax
call fcn.14001190b
nop
lea rcx, [rbp + 0x358]
call fcn.140011d2a
nop
mov eax, dword [rbp + 0x394]
and eax, 2
test eax, eax
je 0x1400257fe
and dword [rbp + 0x394], 0xfffffffd
lea rcx, [rbp + 0x318]
call fcn.140011d2a
nop
mov eax, dword [rbp + 0x394]
and eax, 1
test eax, eax
je 0x14002581e
and dword [rbp + 0x394], 0xfffffffe
lea rcx, [rbp + 0x2d8]
call fcn.140011d2a
call fcn.140011dcf
movzx eax, byte [0x140043d04]
test eax, eax
je 0x140025852
lea rdx, [0x140011663]
lea rcx, [rbp + 8]
call fcn.14001173f
nop
lea rcx, [rbp + 8]
call fcn.140011fe1
nop
lea rcx, [rbp + 8]
call fcn.140011753
movzx eax, byte [0x140043c58]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14003a830]
call fcn.140011cc6
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rbp
call fcn.1400117e4
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret