Function at 0x10001df80
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x500
mov rax, qword [0x10003d110]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
xor r15d, r15d
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x30], rdi
lea rax, [rsp + 0xc0]
mov r9d, 0x104
mov r11, r8
mov qword [rsp + 0x58], r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
mov rdi, rcx
sub r8, rax
mov r12, r15
mov rbp, r15
mov rsi, r15
mov qword [rsp + 0x48], r15
mov r14, r15
mov rdx, r9
lea rcx, [rsp + 0xc0]
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x10001e015
movzx eax, word [r8 + rcx]
test ax, ax
je 0x10001e015
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001dff0
jmp 0x10001e01a
test rdx, rdx
jne 0x10001e01e
sub rcx, 2
mov word [rcx], r15w
lea rax, [rsp + 0xc0]
mov rcx, r9
nop dword [rax]
cmp word [rax], si
je 0x10001e041
add rax, 2
sub rcx, 1
jne 0x10001e030
jmp 0x10001e0a0
test rcx, rcx
je 0x10001e0a0
mov rdx, r9
sub rdx, rcx
mov rcx, r9
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0xc0]
je 0x10001e098
lea r10, [0x10000b0d0]
lea rdx, [rcx + rdx + 0x7ffffefb]
sub r10, rax
nop
test rdx, rdx
je 0x10001e093
movzx r8d, word [r10 + rax]
test r8w, r8w
je 0x10001e093
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x10001e070
jmp 0x10001e098
test rcx, rcx
jne 0x10001e09c
sub rax, 2
mov word [rax], r15w
lea rax, [rsp + 0x2d0]
mov r8, r11
mov rdx, r9
sub r8, rax
lea rcx, [rsp + 0x2d0]
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x10001e0e5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x10001e0e5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001e0c0
jmp 0x10001e0ea
test rdx, rdx
jne 0x10001e0ee
sub rcx, 2
mov word [rcx], r15w
lea rax, [rsp + 0x2d0]
mov rcx, r9
nop dword [rax]
cmp word [rax], si
je 0x10001e111
add rax, 2
sub rcx, 1
jne 0x10001e100
jmp 0x10001e16e
test rcx, rcx
je 0x10001e16e
mov rdx, r9
sub rdx, rcx
sub r9, rdx
lea rax, [rsp + rdx*2 + 0x2d0]
je 0x10001e166
lea r8, [0x10000b0e8]
lea rcx, [r9 + rdx + 0x7ffffefb]
sub r8, rax
nop dword [rax + rax]
test rcx, rcx
je 0x10001e161
movzx edx, word [r8 + rax]
test dx, dx
je 0x10001e161
mov word [rax], dx
add rax, 2
dec rcx
sub r9, 1
jne 0x10001e140
jmp 0x10001e166
test r9, r9
jne 0x10001e16a
sub rax, 2
mov word [rax], r15w
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.10001dd40
test eax, eax
je 0x10001e1a3
or ebx, 0xffffffff
lea r9, [rsp + 0xc0]
lea rcx, [0x10000b100]
mov edx, ebx
mov r8, rdi
call sub.msvcrt.dll_wprintf
jmp 0x10001e782
lea rdx, [0x10000b0a0]
mov rcx, rbx
mov qword [rsp + 0x40], r15
call sub.msvcrt.dll__wfopen
mov rbx, rax
test rax, rax
je 0x10001e229
mov rcx, rax
call sub.msvcrt.dll__fileno
mov ecx, eax
call sub.msvcrt.dll__filelength
movsxd rbp, eax
test eax, eax
je 0x10001e221
mov rcx, rbp
call sub.msvcrt.dll_malloc
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x10001e221
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rbp, rax
je 0x10001e221
lea rcx, [0x10000b0b0]
mov rdx, rbp
call sub.msvcrt.dll_printf
mov rcx, r12
call sub.msvcrt.dll_free
mov r12, r15
mov qword [rsp + 0x40], r15
mov rcx, rbx
call sub.msvcrt.dll_fclose
test r12, r12
jne 0x10001e238
lea ebx, [r12 - 2]
jmp 0x10001e782
lea rdx, [0x10000b0a0]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x4f0], r13
mov qword [rsp + 0x30], r15
call sub.msvcrt.dll__wfopen
mov rbx, rax
test rax, rax
je 0x10001e2d0
mov rcx, rax
call sub.msvcrt.dll__fileno
mov ecx, eax
call sub.msvcrt.dll__filelength
movsxd r13, eax
mov qword [rsp + 0x48], r13
test eax, eax
je 0x10001e2c8
mov rcx, r13
call sub.msvcrt.dll_malloc
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x10001e2c8
mov r9, rbx
mov r8, r13
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
cmp r13, rax
je 0x10001e2c8
lea rcx, [0x10000b0b0]
mov rdx, r13
call sub.msvcrt.dll_printf
mov rcx, rsi
call sub.msvcrt.dll_free
mov rsi, r15
mov qword [rsp + 0x30], r15
mov rcx, rbx
call sub.msvcrt.dll_fclose
test rsi, rsi
jne 0x10001e2dd
lea ebx, [rsi - 3]
jmp 0x10001e77a
cmp rbp, 0x10
jae 0x10001e2ed
mov ebx, 0xfffffff9
jmp 0x10001e77a
cmp dword [r12], 0x5053504d
je 0x10001e301
mov ebx, 0xfffffff8
jmp 0x10001e77a
mov eax, dword [r12 + 4]
lea rbx, [rbp - 0x10]
cmp rax, rbx
je 0x10001e32a
lea rcx, [0x10000b180]
mov r8, rbx
mov edx, eax
call sub.msvcrt.dll_printf
mov ebx, 0xfffffff7
jmp 0x10001e77a
mov edi, dword [r12 + 0xc]
lea rsi, [r12 + 0x10]
mov rdx, rbx
mov rcx, rsi
call fcn.10002e840
cmp edi, eax
je 0x10001e36e
mov rdx, rbx
mov rcx, rsi
call fcn.10002e840
lea rcx, [0x10000b1b8]
mov edx, edi
mov r8d, eax
call sub.msvcrt.dll_printf
mov rsi, qword [rsp + 0x30]
mov ebx, 0xfffffff6
jmp 0x10001e77a
mov r13d, dword [r12 + 8]
test r13, r13
je 0x10001e770
mov eax, 0x80000000
cmp r13, rax
jae 0x10001e770
mov rcx, r13
call sub.msvcrt.dll_malloc
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x10001e3ac
mov rsi, qword [rsp + 0x30]
lea ebx, [rax - 0xc]
jmp 0x10001e77a
lea eax, [rbp - 0x10]
mov edx, 1
xor ecx, ecx
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x38]
lea r8d, [rdx + 0x1f]
mov qword [rsp + 0x70], rax
lea rax, [fcn.10002b464]
mov r14d, r13d
mov qword [rsp + 0x90], rax
lea rax, [0x10002b494]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x80], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0x98], rax
call fcn.10002b464
mov qword [rsp + 0x88], rax
test rax, rax
je 0x10001e461
mov qword [rax + 0x18], r15
mov dword [rax + 0xc], r15d
mov dword [rax + 0x10], 0xf
cmp dword [rax + 0xc], r15d
lea rdx, [fcn.10002b310]
lea rcx, [rsp + 0x60]
cmovne rdx, r15
mov r8d, 0x8000
call fcn.10002b540
mov r11, rax
mov rax, qword [rsp + 0x88]
mov qword [rax + 0x18], r11
test r11, r11
jne 0x10001e475
lea rcx, [rsp + 0x60]
call fcn.100029968
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov ebx, 0xfffffff3
jmp 0x10001e77a
lea rcx, [rsp + 0x60]
call fcn.100029918
lea rcx, [rsp + 0x60]
call fcn.100029aac
mov ecx, 0xfffffffb
mov ebx, eax
cmp eax, 1
je 0x10001e552
mov r12, qword [rsp + 0x88]
test r12, r12
je 0x10001e543
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x10001e543
mov rdi, qword [r12 + 0x18]
mov rbp, qword [rsp + 0xa0]
test rdi, rdi
je 0x10001e536
mov eax, dword [rdi]
cmp eax, 4
je 0x10001e4d9
cmp eax, 5
jne 0x10001e4e2
mov rdx, qword [rdi + 0x10]
mov rcx, rbp
call rsi
cmp dword [rdi], 6
jne 0x10001e4f0
mov rdx, qword [rdi + 8]
mov rcx, rbp
call rsi
mov rax, qword [rdi + 0x40]
mov dword [rdi], r15d
mov dword [rdi + 0x2c], r15d
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x50], rax
mov rax, qword [rdi + 0x60]
mov dword [rdi + 0x30], r15d
test rax, rax
je 0x10001e51c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov dword [rdi + 0x68], eax
mov rdx, qword [rdi + 0x40]
mov rcx, rbp
call rsi
mov rdx, qword [rdi + 0x38]
mov rcx, rbp
call rsi
mov rdx, rdi
mov rcx, rbp
call rsi
mov rdx, r12
mov rcx, rbp
call rsi
mov ecx, 0xfffffffb
mov r12, qword [rsp + 0x40]
test ebx, ebx
cmove ebx, ecx
jmp 0x10001e60a
mov rbp, qword [rsp + 0x88]
mov r14d, dword [rsp + 0x7c]
test rbp, rbp
je 0x10001e605
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x10001e605
mov rbx, qword [rbp + 0x18]
mov rsi, qword [rsp + 0xa0]
test rbx, rbx
je 0x10001e5f3
mov eax, dword [rbx]
cmp eax, 4
je 0x10001e596
cmp eax, 5
jne 0x10001e59f
mov rdx, qword [rbx + 0x10]
mov rcx, rsi
call rdi
cmp dword [rbx], 6
jne 0x10001e5ad
mov rdx, qword [rbx + 8]
mov rcx, rsi
call rdi
mov rax, qword [rbx + 0x40]
mov dword [rbx], r15d
mov dword [rbx + 0x2c], r15d
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x50], rax
mov rax, qword [rbx + 0x60]
mov dword [rbx + 0x30], r15d
test rax, rax
je 0x10001e5d9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov dword [rbx + 0x68], eax
mov rdx, qword [rbx + 0x40]
mov rcx, rsi
call rdi
mov rdx, qword [rbx + 0x38]
mov rcx, rsi
call rdi
mov rdx, rbx
mov rcx, rsi
call rdi
mov rdx, rbp
mov rcx, rsi
call rdi
mov ebx, r15d
mov ecx, 0xfffffffb
jmp 0x10001e60a
mov ebx, 0xfffffffe
test ebx, ebx
jne 0x10001e461
mov eax, r14d
cmp rax, r13
je 0x10001e62e
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov ebx, 0xfffffff2
jmp 0x10001e77a
cmp r13, 8
ja 0x10001e648
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov ebx, 0xfffffffc
jmp 0x10001e77a
mov r14, qword [rsp + 0x38]
mov ebx, dword [r14]
test rbx, rbx
je 0x10001e767
mov eax, 0x80000000
cmp rbx, rax
jae 0x10001e767
mov rcx, rbx
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
jne 0x10001e684
mov rsi, qword [rsp + 0x30]
lea ebx, [rax - 6]
jmp 0x10001e77a
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0xc0]
lea rcx, [0x10000b1f0]
call sub.msvcrt.dll_wprintf
mov rsi, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
mov r9, r13
mov r8, r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call fcn.10001e840
cmp rax, 0xffffffffffffffff
je 0x10001e760
cmp rax, rbx
jne 0x10001e760
lea rdx, [0x10000b0a8]
lea rcx, [rsp + 0x2d0]
call sub.msvcrt.dll__wfopen
mov rdi, rax
test rax, rax
je 0x10001e716
mov r9, rax
mov r8, rbx
mov edx, 1
mov rcx, r15
call sub.msvcrt.dll_fwrite
cmp rbx, rax
je 0x10001e71d
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov ebx, 0xfffffff0
jmp 0x10001e77a
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rdi, qword [rsp + 0x58]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.10001d9c0
mov ebx, eax
test eax, eax
je 0x10001e77a
lea r8, [rsp + 0x2d0]
lea rcx, [0x10000b230]
mov r9, rdi
mov edx, eax
call sub.msvcrt.dll_wprintf
mov ebx, 0xffffffef
jmp 0x10001e77a
mov ebx, 0xfffffff1
jmp 0x10001e77a
mov rsi, qword [rsp + 0x30]
mov ebx, ecx
jmp 0x10001e77a
mov rsi, qword [rsp + 0x30]
mov ebx, 0xfffffff5
mov r13, qword [rsp + 0x4f0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, qword [rsp + 0x4f8]
mov rbp, qword [rsp + 0x548]
test eax, eax
jne 0x10001e7c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xc0]
lea rcx, [0x10000b148]
mov r8d, eax
call sub.msvcrt.dll_wprintf
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10001e7f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x2d0]
lea rcx, [0x10000b148]
mov r8d, eax
call sub.msvcrt.dll_wprintf
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r15
call sub.msvcrt.dll_free
mov eax, ebx
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.10002eee0
add rsp, 0x500
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret