Function at 0x1400f02e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov rax, qword [0x140194040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x30], 0
lea rdx, str.https:__shrinkearn.com_api_apidbe222308a1940540118ff951df167f15d55aca5url
lea rcx, [rsp + 0x170]
call fcn.1400148f0
nop
mov r8, qword [rsp + 0x2c8]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x90]
call fcn.1400f41b0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x170]
call fcn.1400147f0
lea rcx, [rsp + 0x90]
call fcn.1400147c0
lea rcx, [rsp + 0x130]
call fcn.140009970
nop
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rdx, [0x140150cf4]
mov rcx, qword [rsp + 0x48]
call fcn.1400148f0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x60]
call fcn.140014950
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.1400f0740
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x190]
call fcn.1400098e0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x140150cfc]
lea rcx, [rsp + 0x190]
call fcn.1400772c0
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.1400f4650
lea rcx, [rsp + 0x190]
call fcn.1400771b0
lea rcx, [rsp + 0x130]
call fcn.140014630
cmp rax, 2
jae 0x1400f04c3
lea rcx, [0x140150d68]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [0x140150d70]
mov rcx, qword [rsp + 0x2c0]
call fcn.1400148f0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x190]
call fcn.140077170
nop
lea rcx, [rsp + 0x130]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x170]
call fcn.1400147c0
nop
mov rcx, qword [rsp + 0x2c8]
call fcn.1400147c0
mov rax, qword [rsp + 0x2c0]
jmp 0x1400f0635
lea rcx, [rsp + 0x150]
call fcn.140009970
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x140150d60]
lea rcx, [rsp + 0x130]
call fcn.1400776e0
mov dword [rsp + 0x34], eax
mov r8, 0xffffffffffffffff
lea rdx, [0x140150d64]
lea rcx, [rsp + 0x130]
call fcn.1400776e0
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
dec eax
cdqe
mov ecx, dword [rsp + 0x34]
inc ecx
movsxd rcx, ecx
mov r9, rax
mov r8, rcx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x130]
call fcn.140077680
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x150]
call fcn.1400147f0
lea rcx, [rsp + 0xb0]
call fcn.1400147c0
lea r8, [rsp + 0x150]
lea rdx, str.https:__tii.la_
lea rcx, [rsp + 0xd0]
call fcn.140078db0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.1400147f0
lea rcx, [rsp + 0xd0]
call fcn.1400147c0
lea rcx, str.fk.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x2c0]
call fcn.140014870
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x150]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x190]
call fcn.140077170
nop
lea rcx, [rsp + 0x130]
call fcn.1400147c0
nop
lea rcx, [rsp + 0x170]
call fcn.1400147c0
nop
mov rcx, qword [rsp + 0x2c8]
call fcn.1400147c0
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400fad60
add rsp, 0x2b8
ret