Function at 0x1000fc4ec
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rdi, rcx
lea r15, [0x10003b560]
mov qword [rsp + 0x58], r15
lea rbx, [0x10003b950]
mov qword [rsp + 0x60], rbx
lea rsi, [0x10003b540]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xf8
mov r14d, 4
mov dword [rsp + 0x74], r14d
mov ebp, 0xff
mov dword [rsp + 0x78], ebp
xor r13d, r13d
mov word [r11 - 0x2f0], r13w
mov byte [r11 - 0x2ee], r13b
mov byte [rsp + 0xfb], 1
lea r12d, [r14 + 0x74]
mov r8, r12
xor edx, edx
lea rcx, [r11 - 0x368]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e7c38
nop
cmp qword [rdi + 8], r13
jne 0x1000fc5bc
mov eax, r13d
jmp 0x1000fc5c6
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
bt eax, 0x16
jb 0x1000fc643
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xfd
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], ebp
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r8, [0x10003b9b0]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0x130]
call fcn.1000e7d24
jmp 0x1000fcb5e
cmp qword [rdi + 8], r13
jne 0x1000fc64e
mov ebx, r13d
jmp 0x1000fc65a
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ebx, eax
shr ebx, 0x18
and ebx, 1
mov ecx, ebx
neg ecx
sbb rsi, rsi
and esi, 0x4e20
add rsi, 0x2710
mov ebp, 0x7530
mov r12d, 0xc350
mov qword [rsp + 0x118], r13
lea rax, [0x10000d468]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r13
mov dword [rsp + 0x104], r13d
mov dword [rsp + 0x100], 0x20019
lea r8, [0x100004790]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x100]
call fcn.100101fec
cmp al, r13b
je 0x1000fc794
mov dword [rsp + 0x30], r13d
cmp ebx, r13d
je 0x1000fc6fd
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004810]
lea rcx, [rsp + 0x100]
call fcn.1001028d8
jmp 0x1000fc719
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x1000047f0]
lea rcx, [rsp + 0x100]
call fcn.1001028d8
mov eax, dword [rsp + 0x30]
cmp eax, r13d
je 0x1000fc72a
imul eax, eax, 0x3e8
mov esi, eax
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004848]
lea rcx, [rsp + 0x100]
call fcn.1001028d8
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fc75f
imul r11d, r11d, 0x3e8
mov ebp, r11d
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004878]
lea rcx, [rsp + 0x100]
call fcn.1001028d8
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fc794
imul r11d, r11d, 0x3e8
mov r12d, r11d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbp
mov r9b, 1
lea r8, [rsp + 0x38]
mov dl, r9b
mov rcx, rdi
call fcn.1000fcd9c
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [0x1000ff0b4]
mov rdx, qword [rsp + 0x48]
call fcn.100100d70
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r12, rax
mov ebp, r13d
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fcb0c
add rbx, 0x10
mov eax, 0x66666667
imul ebp
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp ebp, ecx
jne 0x1000fc849
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [r12 + rsi]
cmp rax, rcx
ja 0x1000fca30
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x10000a068]
mov edx, 0x104
lea rcx, [rsp + 0x1a0]
call fcn.100052590
mov edi, eax
mov dword [rsp + 0x138], eax
cmp eax, r13d
jge 0x1000fc8fb
mov qword [rsp + 0x58], r15
lea rax, [0x10003b950]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b540]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x143
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10003ba20]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
jmp 0x1000fca13
mov qword [rsp + 0x58], r15
lea rdi, [0x10003b950]
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b540]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x148
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x1a0]
lea r8, [0x10003ba68]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000fca13
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b540]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x14a
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x1a0]
lea r8, [0x10003ba90]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e8e14
add rbx, 0x48
inc ebp
lea rax, [rbx - 0x10]
mov rdi, qword [rsp + 0x48]
cmp rax, rdi
je 0x1000fcb07
jmp 0x1000fc81c
mov qword [rsp + 0x58], r15
lea rax, [0x10003b950]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b540]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x139
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, r14d
lea r8, [rsp + 0x58]
mov edx, 0x201c
lea rcx, [rsp + 0x130]
call fcn.1000eb278
nop
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fcadb
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fcad3
mov rcx, rbx
call fcn.1000fd914
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fcabd
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.10012fe88
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100102ef8
nop
lea rcx, [rsp + 0x130]
call fcn.1000e7d24
jmp 0x1000fcb5e
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fcb34
cmp rbx, rdi
je 0x1000fcb2c
mov rcx, rbx
call fcn.1000fd914
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fcb16
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.10012fe88
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100102ef8
nop
lea rcx, [rsp + 0x130]
call fcn.1000e7d24
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1001303c0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret