Function at 0x1401a3db0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140351248]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movzx r15d, dl
mov r12, rcx
lea r8, [0x140274194]
mov rdx, rcx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x1401a3e10
cmp qword [rsp + 0x38], 0
je 0x1401a40ba
lea rdx, [r8 + 1]
mov r8, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str..temp
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor edi, edi
mov esi, edi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
je 0x1401a3ec2
nop dword [rax]
xor al, r15b
mov byte [rsp + 0x30], al
cmp rbx, rsi
je 0x1401a3e98
mov byte [rbx], al
inc rbx
mov qword [rsp + 0x78], rbx
jmp 0x1401a3eb3
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400b96c0
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
cmp eax, 0xffffffff
jne 0x1401a3e80
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea r8, [0x1402741c4]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r15, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401a3f39
mov rdi, r15
cmp r15, rbx
je 0x1401a3f18
nop dword [rax + rax]
movsx ecx, byte [rdi]
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putc
inc rdi
mov rax, qword [rsp + 0x40]
cmp rdi, rbx
jne 0x1401a3f00
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r12
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
jmp 0x1401a4057
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayLock
mov byte [rbp - 0x70], 0
lea rax, [rbp - 0x30]
inc r14
cmp byte [rax + r14], 0
jne 0x1401a3f51
mov r8, r14
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400cf610
nop
lea r8, [rbp - 0x70]
lea rdx, str._Utility__EncryptDecryptFile__Open
lea rcx, [rbp - 0x50]
call fcn.1400b8710
nop
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
mov rcx, rax
call fcn.1400cf260
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.140162100
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1401a400b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a4006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a42a2
call fcn.1401bfb10
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayLock
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401a4057
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a4051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a42a8
call fcn.1401bfb10
nop
test r15, r15
je 0x1401a408f
sub rsi, r15
mov rax, r15
cmp rsi, 0x1000
jb 0x1401a4084
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a42ae
mov rdx, rsi
mov rcx, r15
call fcn.1401bfb10
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1401c0070
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayLock
mov byte [rsp + 0x70], dil
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.1400cf610
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea r15d, [rdi + 0x23]
lea r14, str._Utility__EncryptDecryptFile__Open
cmp rax, r15
jb 0x1401a4178
lea rax, [r8 + 0x23]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x70]
lea rax, [0x140282fb3]
cmp rax, rbx
jbe 0x1401a413b
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1401a413b
cmp rbx, r14
ja 0x1401a4133
mov esi, edi
jmp 0x1401a413e
mov rsi, rbx
sub rsi, r14
jmp 0x1401a413e
mov rsi, r15
lea rcx, [rbx + 0x23]
inc r8
mov rdx, rbx
call fcn.1401f7750
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.1401f7750
lea rcx, [rbx + rsi]
sub r15, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
mov r8, r15
call fcn.1401f7750
lea rax, [rsp + 0x70]
jmp 0x1401a4195
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400b9fc0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
lea rcx, [rbp - 0x70]
call fcn.1400cf260
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.140162100
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401a4246
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a4241
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a4296
call fcn.1401bfb10
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayLock
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1401a408f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a408a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a429c
jmp 0x1401a408a
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3