Function at 0x1000077bc
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e8
mov rax, qword [0x10000e160]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rsi, rcx
mov rcx, qword [rsp + 0x350]
mov rbx, r9
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsp + 0x358]
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0xa0], rcx
mov rcx, r8
mov qword [rsp + 0x88], rbx
mov r14, rdx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
xor edx, edx
cmp eax, edx
je 0x100007d56
cmp r14, rdx
je 0x100007840
mov dword [rsp + 0x3c], 1
cmp qword [r14], rdx
je 0x100007844
mov dword [rsp + 0x3c], edx
mov eax, dword [rsp + 0x44]
mov ecx, edx
cmp rbx, rdx
setne cl
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x44], eax
mov r13, rdx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], 0x4ee08
mov ebp, edx
mov dword [rsp + 0x48], edx
mov r15, rdx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x90], rdx
mov r12d, edx
mov dword [rsp + 0x40], edx
cmp qword [rsi + 0x10], rdx
je 0x10000797f
mov rbp, qword [rsi + 0x20]
mov dword [rsi + 0x28], edx
movzx eax, word [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x50]
sub eax, dword [rsi + 0x28]
mov rdx, rbp
mov dword [rsp + 0x50], eax
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x100007975
mov edi, dword [rsp + 0x50]
mov rcx, qword [rsi + 0x20]
mov dword [rsp + 0x60], edx
add dword [rsi + 0x28], edi
mov r8d, dword [rsi + 0x28]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x70], r8d
mov eax, edx
mov dword [rsp + 0x74], edx
mov dword [rsp + 0x78], edx
cmp r8d, edx
jbe 0x100007904
mov bl, byte [rcx]
lea eax, [rdx + 1]
mov dword [rsp + 0x74], eax
jmp 0x10000790e
mov dword [rsp + 0x78], 0x8007000e
mov bl, dl
inc eax
cmp eax, r8d
jae 0x100007925
lea rcx, [rsp + 0x60]
call fcn.10000a6e8
mov r11w, ax
jmp 0x100007930
mov dword [rsp + 0x78], 0x8007000e
mov r11d, edx
cmp r8d, 3
jb 0x10000793f
movzx eax, r11w
cmp r8d, eax
je 0x100007951
lea rcx, [rsp + 0x60]
add rbp, rdi
call fcn.10000a404
jmp 0x1000078a4
lea rdx, [rsp + 0x48]
mov cl, bl
call fcn.1000097a8
lea rcx, [rsp + 0x60]
mov edi, eax
call fcn.10000a404
mov ebp, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x34]
xor edx, edx
jmp 0x100007984
mov ebp, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x34]
jmp 0x100007984
mov edi, 0x8000ffff
cmp edi, edx
jl 0x100007ccd
sub edi, 0x40002
je 0x100007a8c
sub edi, 1
mov rcx, rsi
je 0x1000079c3
sub edi, 0x7e
je 0x100007cb5
cmp edi, 4
je 0x100007c99
call fcn.100008e04
mov edi, 0x80004001
xor edx, edx
jmp 0x100007ccd
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
call fcn.10000919c
mov rbx, qword [rsp + 0x50]
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x100007a6a
mov rax, qword [rsi + 0x20]
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x74], edx
mov qword [rsp + 0x68], rax
movzx eax, word [rsi + 0x18]
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x70], eax
mov rax, rbx
lea rcx, [rsp + 0x60]
neg rax
sbb dl, dl
add dl, 0x44
or dl, 0x80
call fcn.10000a544
lea rcx, [rsp + 0x60]
mov edx, 3
call fcn.10000a584
mov edx, dword [rsp + 0x44]
mov edi, dword [rsp + 0x78]
xor ecx, ecx
lea rax, [rsp + 0x44]
cmp rax, rcx
cmovne edx, dword [rsp + 0x74]
cmp edi, ecx
mov dword [rsp + 0x44], edx
jl 0x100007a5e
mov rcx, qword [rsi + 0x10]
mov r8d, edx
mov rdx, qword [rsi + 0x20]
mov rax, qword [rcx]
call qword [rax]
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.10000a404
xor edx, edx
cmp rbx, rdx
je 0x100007ca4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100007ca2
mov ebx, dword [rsp + 0x3c]
mov eax, ecx
mov rcx, rsi
neg eax
lea rax, [rsp + 0x30]
sbb r9, r9
and r9, rax
mov eax, ebx
neg eax
sbb rdx, rdx
xor r8d, r8d
and rdx, r14
call fcn.10000919c
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x100007ccd
cmp dword [rsp + 0x34], edx
je 0x100007af6
cmp dword [rsp + 0x58], edx
jne 0x100007af6
cmp dword [rsp + 0x30], edx
jne 0x100007adc
mov dword [rsp + 0x30], 0xa00000
jmp 0x100007ae0
mov dword [rsp + 0x34], edx
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x58], 1
mov dword [rcx], eax
cmp dword [rsp + 0x4c], edx
je 0x100007b57
cmp r13, rdx
jne 0x100007b4f
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
cmp eax, ecx
cmova eax, ecx
mov dword [rsp + 0x38], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [rsp + 0x3c]
xor edx, edx
mov r13, rax
cmp rax, rdx
jne 0x100007b3d
mov edi, 0x8007000e
jmp 0x100007b4f
mov r12d, dword [rsp + 0x38]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x4c], edx
cmp ebx, edx
je 0x100007bbe
cmp edi, edx
jl 0x100007ccd
mov dword [rsp + 0x3c], edx
cmp qword [r14], rdx
jne 0x100007b73
mov edi, 0x8007007b
jmp 0x100007b9a
mov r9, qword [rsp + 0xa8]
lea rdx, [rsp + 0x98]
mov r8, r14
mov rcx, rsi
call fcn.100007d88
mov r15, qword [rsp + 0x98]
xor edx, edx
mov edi, eax
lea rax, [fcn.1000067e8]
cmp rax, rdx
je 0x100007bbe
mov rdx, qword [r14]
mov rcx, qword [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
call fcn.1000067e8
xor edx, edx
cmp edi, edx
jl 0x100007ccd
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.1000094b8
xor edx, edx
cmp eax, edx
mov edi, eax
jl 0x100007ccd
mov eax, r12d
mov r12d, dword [rsp + 0x40]
sub eax, r12d
add dword [rsp + 0x30], eax
movzx eax, word [rsi + 0x18]
cmp r12d, eax
jbe 0x100007c03
cmp ebp, edx
je 0x100007c65
mov ebx, dword [rsp + 0x38]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x80]
sub ebx, r12d
mov rdx, r13
mov rcx, r15
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
cmp eax, edx
jne 0x100007c44
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
movzx edi, ax
or edi, 0x80070000
cmp eax, edx
cmovle edi, eax
jmp 0x100007c53
cmp dword [rsp + 0x80], ebx
mov eax, 0x80070057
cmovne edi, eax
mov r12d, dword [rsp + 0x38]
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x40], r12d
lea rax, [fcn.1000067e8]
cmp rax, rdx
je 0x100007c92
mov rax, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
mov r9d, dword [rax]
xor edx, edx
call fcn.1000067e8
xor edx, edx
cmp edi, edx
jl 0x100007ccd
mov rcx, rsi
mov edx, ebp
call fcn.10000970c
mov edi, eax
xor edx, edx
cmp edi, edx
jl 0x100007ccd
cmp ebp, edx
jne 0x100007ccd
mov ecx, dword [rsp + 0x34]
jmp 0x100007893
call fcn.10000910c
mov r11, qword [rsp + 0xb0]
xor edx, edx
mov dword [r11], 1
mov edi, edx
cmp dword [rsp + 0x34], edx
je 0x100007ce1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
cmp r13, rdx
je 0x100007cfc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
cmp r15, rdx
je 0x100007d5b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp edi, ecx
jge 0x100007d5b
mov word [rsp + 0xc0], cx
lea rcx, [rsp + 0xc2]
xor edx, edx
mov r8d, 0x206
call sub.msvcrt.dll_memset
mov r8, qword [r14]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100007d5b
mov edi, 0x80070057
mov eax, edi
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.10000ad60
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret