Function at 0x140003e20
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x1401973d0]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov rax, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
mov r8d, 3
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14000afb0
nop
mov rbx, qword [r15]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
xor r12d, r12d
test rbx, rbx
jne 0x140003e9d
mov eax, r12d
mov qword [rbp - 0x20], rax
jmp 0x140003f01
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r12w
jne 0x140003ea4
add eax, 1
js 0x1400041a6
movsxd rdi, eax
cmp eax, 0x80
jle 0x140003ee0
mov edx, 2
mov rcx, rdi
call fcn.14012fff0
mov qword [rbp - 0x20], rax
mov rcx, rax
test rax, rax
je 0x1400041b1
jmp 0x140003eec
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x18]
lea r8, [rdi + rdi]
test r8, r8
je 0x140003f01
mov rdx, rbx
call fcn.1401203d0
mov rax, qword [rbp - 0x20]
mov r9, qword [rsp + 0x50]
mov rcx, rax
call fcn.14001cd80
mov rbx, rax
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
cmp rcx, rax
je 0x140003f24
call fcn.14012d07c
nop
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140003f38
call fcn.14012d07c
test rbx, rbx
jne 0x140003f60
mov r14d, r12d
mov dword [rbp + 0xf0], r12d
mov word [rbp + 0xf4], r12w
mov dword [rbp + 0x31c], r12d
mov eax, 0x10000
jmp 0x140004008
cmp dword [rbx], 1
je 0x140003f6c
mov eax, 0x80000
jmp 0x140003fc1
mov rsi, qword [rbx + 8]
mov r8d, 0x103
mov rdx, qword [r14]
lea rcx, [rsi + 0x250]
call fcn.140136154
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rsi + rax*2 + 0x250], 0
jne 0x140003f90
movzx ecx, word [rsi + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x140003fbe
cmp cx, 0x2f
je 0x140003fbe
mov dword [rsi + rax*2 + 0x250], 0x2f
mov eax, r12d
mov dword [rbp + 0x31c], r12d
mov word [rbp + 0xf4], r12w
mov dword [rbp + 0xf0], r12d
mov r14d, r12d
mov dword [0x1401a2bbc], eax
cmp dword [rbx], 1
je 0x140003fec
mov eax, 0x80000
jmp 0x140004008
lea r8, [rbp + 0xf0]
mov edx, 0xffffffff
mov rcx, qword [rbx + 8]
call fcn.14001c050
mov r14d, dword [rbp + 0xf0]
mov dword [0x1401a2bbc], eax
mov esi, r12d
test r14d, r14d
jle 0x14000409b
nop word [rax + rax]
mov dword [rbp + 0x320], r12d
mov word [rbp + 0x324], r12w
mov dword [rbp + 0x54c], r12d
lea rdi, [rbx + 8]
test rbx, rbx
jne 0x140004046
mov eax, 0x10000
jmp 0x14000408c
mov eax, dword [rbx]
cmp eax, 1
je 0x140004054
mov ecx, 0x80000
jmp 0x140004069
lea r8, [rbp + 0x320]
mov edx, esi
mov rcx, qword [rdi]
call fcn.14001c050
mov ecx, eax
mov eax, dword [rbx]
mov dword [0x1401a2bbc], ecx
cmp eax, 1
je 0x14000407b
mov eax, 0x80000
jmp 0x14000408c
lea r8, [rbp + 0x324]
mov edx, esi
mov rcx, qword [rdi]
call fcn.14001c970
mov dword [0x1401a2bbc], eax
inc esi
cmp esi, r14d
jl 0x140004020
jmp 0x14000409f
lea rdi, [rbx + 8]
test rbx, rbx
jne 0x1400040b3
mov dword [0x1401a2bbc], 0x10000
jmp 0x14000417b
cmp dword [rbx], 1
je 0x1400040c7
mov dword [0x1401a2bbc], 0x80000
jmp 0x14000417b
mov rdi, qword [rdi]
cmp dword [rdi + 8], 0xffffffff
je 0x1400040d8
mov rcx, qword [rdi]
call fcn.14001bfb0
mov dword [rdi + 8], 0xffffffff
mov rsi, qword [rdi]
test rsi, rsi
je 0x140004127
cmp qword [rsi + 0x80], 0
je 0x1400040f9
mov rcx, rsi
call fcn.14001bfb0
mov r14, qword [rsi]
test r14, r14
je 0x14000411f
cmp byte [r14 + 0x18], 0
je 0x140004112
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x30
mov rcx, r14
call fcn.14011e050
mov rcx, rsi
call fcn.14012d07c
mov qword [rdi], r12
mov dword [0x1401a2bbc], r12d
mov rcx, qword [rdi + 0x240]
test rcx, rcx
je 0x140004142
call fcn.14011e050
mov qword [rdi + 0x240], r12
mov rcx, qword [rdi + 0x248]
test rcx, rcx
je 0x14000415a
call fcn.14011e050
mov qword [rdi + 0x248], r12
mov edx, 0x458
mov rcx, rdi
call fcn.14011e050
mov edx, 0x10
mov rcx, rbx
call fcn.14011e050
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.14011e030
add rsp, 0x660
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000fc90
int3
mov ecx, 0x8007000e
call fcn.14000fc90
int3