Function at 0x14001cac0
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x528
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140092690]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov edi, r9d
mov rsi, r8
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x50], 0xffffffffffffffff
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], r12d
test rdx, rdx
je 0x14001ce01
test r8, r8
je 0x14001ce01
mov byte [rsp + 0x2d8], r12b
xor edx, edx
mov r8d, 0x224
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
nop
lea edx, [r12 + 0x14]
lea rcx, [rsp + 0x2e0]
call fcn.14000a6cc
lea r9d, [r12 + 0x29]
lea r8d, [r12 + 0x14]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x2e0]
call fcn.1400396c0
lea r9, [rsp + 0x80]
lea r8d, [r12 + 0x29]
lea rdx, [rsp + 0x2b0]
mov rcx, r14
call fcn.14001b870
mov dword [rsp + 0x284], edi
mov dword [rsp + 0x80], 0x5a
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14001cbec
mov eax, 0x800432a8
jmp 0x14001ce06
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001cdf3
cmp dword [rsp + 0x40], edi
jne 0x14001cdf3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0xffffffffffffffff
lea rdx, str.temp.txt
mov rcx, r14
call fcn.140019130
mov dword [rsp + 0x2a0], eax
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x58]
call fcn.140008d08
nop
lea r8, str.temp.enc
lea rdx, str.temp.txt
lea rcx, [rsp + 0x58]
call fcn.14000a05c
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14001ccb5
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001ce06
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14001cd0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001ce06
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 0x224
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001cde2
cmp dword [rsp + 0x40], 0x224
jne 0x14001cde2
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x44]
mov r8d, 0x200
lea rdx, [rsp + 0x300]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cda3
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x300]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001cda3
cmp dword [rsp + 0x44], 0x200
je 0x14001cd50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
nop
mov eax, 0x43297
jmp 0x14001ce06
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001ce06
mov eax, 0x800432aa
jmp 0x14001ce06
mov eax, 0x800432b1
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140059ef0
add rsp, 0x528
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret