Function at 0x1000fcf1c
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rdi, rcx
lea r15, [0x10003b820]
mov qword [rsp + 0x58], r15
lea rbx, [0x10003bc10]
mov qword [rsp + 0x60], rbx
lea rsi, [0x10003b800]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xf8
mov r14d, 4
mov dword [rsp + 0x74], r14d
mov ebp, 0xff
mov dword [rsp + 0x78], ebp
xor r13d, r13d
mov word [r11 - 0x2f0], r13w
mov byte [r11 - 0x2ee], r13b
mov byte [rsp + 0xfb], 1
lea r12d, [r14 + 0x74]
mov r8, r12
xor edx, edx
lea rcx, [r11 - 0x368]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e842c
nop
cmp qword [rdi + 8], r13
jne 0x1000fcfec
mov eax, r13d
jmp 0x1000fcff6
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
bt eax, 0x16
jb 0x1000fd073
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xfd
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], ebp
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r8, [0x10003bc70]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
nop
lea rcx, [rsp + 0x130]
call fcn.1000e8518
jmp 0x1000fd58e
cmp qword [rdi + 8], r13
jne 0x1000fd07e
mov ebx, r13d
jmp 0x1000fd08a
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ebx, eax
shr ebx, 0x18
and ebx, 1
mov ecx, ebx
neg ecx
sbb rsi, rsi
and esi, 0x4e20
add rsi, 0x2710
mov ebp, 0x7530
mov r12d, 0xc350
mov qword [rsp + 0x118], r13
lea rax, [0x10000d460]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r13
mov dword [rsp + 0x104], r13d
mov dword [rsp + 0x100], 0x20019
lea r8, [0x100004790]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x100]
call fcn.100102a1c
cmp al, r13b
je 0x1000fd1c4
mov dword [rsp + 0x30], r13d
cmp ebx, r13d
je 0x1000fd12d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004810]
lea rcx, [rsp + 0x100]
call fcn.100103308
jmp 0x1000fd149
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x1000047f0]
lea rcx, [rsp + 0x100]
call fcn.100103308
mov eax, dword [rsp + 0x30]
cmp eax, r13d
je 0x1000fd15a
imul eax, eax, 0x3e8
mov esi, eax
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004848]
lea rcx, [rsp + 0x100]
call fcn.100103308
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fd18f
imul r11d, r11d, 0x3e8
mov ebp, r11d
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004878]
lea rcx, [rsp + 0x100]
call fcn.100103308
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fd1c4
imul r11d, r11d, 0x3e8
mov r12d, r11d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbp
mov r9b, 1
lea r8, [rsp + 0x38]
mov dl, r9b
mov rcx, rdi
call fcn.1000fd7cc
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [0x1000ffae4]
mov rdx, qword [rsp + 0x48]
call fcn.1001017a0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r12, rax
mov ebp, r13d
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fd53c
add rbx, 0x10
mov eax, 0x66666667
imul ebp
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp ebp, ecx
jne 0x1000fd279
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [r12 + rsi]
cmp rax, rcx
ja 0x1000fd460
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x10000a068]
mov edx, 0x104
lea rcx, [rsp + 0x1a0]
call fcn.100052890
mov edi, eax
mov dword [rsp + 0x138], eax
cmp eax, r13d
jge 0x1000fd32b
mov qword [rsp + 0x58], r15
lea rax, [0x10003bc10]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b800]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x143
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10003bce0]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
jmp 0x1000fd443
mov qword [rsp + 0x58], r15
lea rdi, [0x10003bc10]
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b800]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x148
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x1a0]
lea r8, [0x10003bd28]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000fd443
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b800]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x14a
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x1a0]
lea r8, [0x10003bd50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e9608
add rbx, 0x48
inc ebp
lea rax, [rbx - 0x10]
mov rdi, qword [rsp + 0x48]
cmp rax, rdi
je 0x1000fd537
jmp 0x1000fd24c
mov qword [rsp + 0x58], r15
lea rax, [0x10003bc10]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b800]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x139
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, r14d
lea r8, [rsp + 0x58]
mov edx, 0x201c
lea rcx, [rsp + 0x130]
call fcn.1000eba6c
nop
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fd50b
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fd503
mov rcx, rbx
call fcn.1000fe344
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fd4ed
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1001308b8
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100103928
nop
lea rcx, [rsp + 0x130]
call fcn.1000e8518
jmp 0x1000fd58e
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fd564
cmp rbx, rdi
je 0x1000fd55c
mov rcx, rbx
call fcn.1000fe344
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fd546
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1001308b8
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100103928
nop
lea rcx, [rsp + 0x130]
call fcn.1000e8518
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.100130df0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret