Function at 0x18009f1e0
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
cmp byte [rcx + 0x30], 0
jne 0x18009f22a
xor al, al
jmp 0x18009f51d
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18009f51b
cmp qword [rcx + 0x38], 0
jne 0x18009f51b
lea rdx, [rsp + 0x280]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r13d, r13d
test eax, eax
jne 0x18009f266
call fcn.180085d60
jmp 0x18009f332
cmp eax, 0x100
ja 0x18009f223
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, [0x1801e58d0]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x18009f298
call fcn.180085d60
jmp 0x18009f332
mov word [rsp + 0x276], r13w
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x70]
mov edx, 0x101
lea rcx, [rsi + 0x48]
call fcn.1801893fc
test eax, eax
je 0x18009f2e3
cmp eax, 0xc
je 0x18009f54e
cmp eax, 0x16
je 0x18009f564
cmp eax, 0x22
je 0x18009f564
cmp eax, 0x50
jne 0x18009f559
mov dword [rsp + 0x48], 0x18
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], 1
mov dword [rsi + 0x24c], 0xc0000000
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 0xc0000000
lea rdx, [rsi + 0x48]
lea rcx, [rsi + 0x38]
call fcn.18009dd20
test eax, eax
js 0x18009f223
mov rax, qword [rsi]
mov rbx, qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
mov edi, eax
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x48]
imul edi, eax
shl edi, 2
mov r15d, edi
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 4
imul rax, r15
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea r8, [rsp + 0x64]
mov edx, eax
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18009f393
call fcn.180085d60
test eax, eax
js 0x18009f3a6
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18009f3a6
call fcn.180085d60
mov qword [rsp + 0x60], r13
mov rdx, qword [rsi + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1800e34e0
nop
mov rbp, r13
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 4
mov rbx, qword [rsp + 0x60]
test rax, rax
je 0x18009f4a9
mov r14, r13
nop dword [rax]
mov rcx, qword [rdx + r14]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rdi, rax
test rax, rax
je 0x18009f4f5
test r15, r15
je 0x18009f476
mov rdx, qword [rbx + 0x38]
add rdx, r15
cmp rdx, qword [rbx + 0x30]
jbe 0x18009f40d
xor dil, dil
jmp 0x18009f479
mov rcx, rbx
call fcn.18009dfa0
xor edx, edx
mov rax, qword [rbx + 0x38]
div qword [0x1802713b8]
mov r13, rdx
imul rax, qword [0x1802713b8]
lea r8, [r15 + rdx]
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
mov r9, rax
mov rdx, qword [rbx + 0x28]
mov rcx, rbx
call fcn.18009de90
test eax, eax
jns 0x18009f459
xor dil, dil
jmp 0x18009f479
mov rcx, qword [rbx]
add rcx, r13
mov r8, r15
mov rdx, rdi
call fcn.180180990
add qword [rbx + 0x38], r15
mov rcx, rbx
call fcn.18009dfa0
mov dil, 1
mov rax, qword [rsi]
mov rcx, qword [r14 + rax]
mov rax, qword [rcx]
call qword [rax + 0x60]
test dil, dil
je 0x18009f4f5
inc rbp
add r14, 0x10
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 4
cmp rbp, rax
jb 0x18009f3e0
lea rcx, [rsi + 0x250]
call fcn.180035e10
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
call fcn.18009c5c0
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov dil, 1
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x18009f4ef
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call fcn.18009dfa0
mov edx, 0x48
mov rcx, rbx
call fcn.18017ebfc
movzx eax, dil
jmp 0x18009f51d
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x18009f50c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x38], 0
lea rcx, [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor dil, dil
jmp 0x18009f4cb
mov al, 1
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1800845a0
int3
mov ecx, 0x80004005
call fcn.1800845a0
int3
mov ecx, 0x80070057
call fcn.1800845a0
int3