Function at 0x14002a078
Capabilities:
Clear file content
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [0x1400390f8]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov r12d, 0x104
mov qword [rsp + 0x60], rdx
mov r15, rdx
mov qword [rbp + 0x188], r12
mov rdi, rcx
xor r14d, r14d
or esi, 0xffffffff
mov qword [rsp + 0x50], r14
mov r8d, r12d
mov qword [rbp + 0x178], r14
xor edx, edx
lea rcx, [rsp + 0x70]
lea ebx, [rsi + 2]
mov byte [rbp + 0x180], bl
call sub.msvcrt.dll_memset
mov r8d, r12d
mov qword [rbp + 0x5b8], r14
xor edx, edx
mov byte [rbp + 0x5c0], bl
lea rcx, [rbp + 0x3b0]
mov qword [rbp + 0x5c8], r12
call sub.msvcrt.dll_memset
mov r8d, r12d
mov qword [rbp + 0x398], r14
xor edx, edx
mov byte [rbp + 0x3a0], bl
lea rcx, [rbp + 0x190]
mov qword [rbp + 0x3a8], r12
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x180]
lea rcx, [rsp + 0x70]
neg al
mov r13d, 0x7ee3
sbb rdx, rdx
and rdx, r13
add rdx, r12
call fcn.1400104d0
test eax, eax
js 0x14002a913
mov al, byte [rbp + 0x5c0]
lea rcx, [rbp + 0x3b0]
neg al
sbb rdx, rdx
and rdx, r13
add rdx, r12
call fcn.1400104d0
test eax, eax
js 0x14002a913
mov al, byte [rbp + 0x3a0]
lea rcx, [rbp + 0x190]
neg al
sbb rdx, rdx
and rdx, r13
add rdx, r12
call fcn.1400104d0
test eax, eax
js 0x14002a913
xor r9d, r9d
lea r8, [rsp + 0x48]
mov ecx, 0xfe00
call fcn.1400063d0
mov qword [rsp + 0x58], rax
mov r13, rax
test rax, rax
je 0x14002a913
cmp dword [0x140039858], r14d
mov r12d, dword [rsp + 0x48]
je 0x14002a201
mov r9d, ebx
lea r8, [rsp + 0x40]
mov ecx, r12d
call fcn.1400063d0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002a913
cmp r12d, dword [rsp + 0x40]
cmovae r12d, dword [rsp + 0x40]
mov rdi, qword [rdi + 0x40]
mov rcx, qword [rdi]
call fcn.140008c6c
test eax, eax
jne 0x14002a222
mov rdi, qword [rdi + 0x40]
test rdi, rdi
jne 0x14002a205
mov ebx, r14d
jmp 0x14002a913
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rcx, [fcn.140016cc0]
mov rax, qword [rdi + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x21]
call fcn.140016b14
mov r14, qword [rsp + 0x48]
xor ecx, ecx
and dword [rdi + 0x38], 0xffff3fff
mov eax, dword [rdi + 0x38]
test al, 4
je 0x14002a269
and eax, 0xfffffffb
or eax, 2
mov dword [rdi + 0x38], eax
cmp dword [0x140039834], ecx
jne 0x14002a90b
mov rax, qword [rbp + 0x5b8]
lea rdx, [rbp + 0x3b0]
mov r8d, dword [rbp + 0x5c8]
test rax, rax
mov rcx, rdi
cmovne rdx, rax
call fcn.1400062fc
cmp eax, ebx
je 0x14002a90b
mov rdx, qword [rdi + 8]
lea rcx, [0x1400303c8]
call fcn.14001242c
mov rax, qword [rbp + 0x178]
lea r8, [rsp + 0x70]
mov r9d, dword [rbp + 0x188]
xor ecx, ecx
test rax, rax
mov dword [rsp + 0x20], ecx
mov rdx, r15
mov rcx, rdi
cmovne r8, rax
call fcn.140005cdc
cmp eax, ebx
je 0x14002a90b
mov rcx, qword [rbp + 0x178]
lea rax, [rsp + 0x70]
xor r8d, r8d
test rcx, rcx
cmovne rax, rcx
cmp word [rax], r8w
je 0x14002a7c2
test rcx, rcx
lea rdx, [rsp + 0x70]
cmovne rdx, rcx
mov rcx, qword [rdi + 8]
call fcn.14002aab4
mov rcx, qword [rdi + 8]
test eax, eax
je 0x14002a33a
mov r9d, r12d
mov r8, r13
mov rdx, rdi
call fcn.14002a968
mov esi, eax
mov dword [rsp + 0x40], eax
jmp 0x14002a590
mov edx, dword [rdi + 0x38]
and edx, 0x800
shl edx, 0xa
call fcn.14000244c
mov r15d, eax
cmp eax, 0xffffffff
je 0x14002a8ef
mov ecx, eax
call fcn.14000f518
mov rcx, qword [rbp + 0x178]
lea rdx, [rsp + 0x70]
test eax, eax
lea r9, [rsp + 0x44]
mov eax, 0x80
cmovne r12d, eax
test rcx, rcx
mov r8d, r12d
cmovne rdx, rcx
mov ecx, r15d
mov qword [rsp + 0x30], rdx
mov rdx, r13
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.140006248
xor esi, esi
mov dword [rsp + 0x48], eax
cmp dword [0x1400502f8], esi
jne 0x14002a8cb
mov rdx, qword [rbp + 0x178]
lea rcx, [rsp + 0x70]
test rdx, rdx
cmovne rcx, rdx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
test al, 2
lea rcx, [rsp + 0x70]
mov rax, qword [rbp + 0x178]
jne 0x14002a406
test rax, rax
cmovne rcx, rax
call fcn.14000655c
mov dword [rsp + 0x40], eax
mov esi, eax
cmp eax, 0xffffffff
je 0x14002a8a7
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
jmp 0x14002a41a
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.14000244c
mov esi, eax
mov dword [rsp + 0x40], eax
cmp esi, 0xffffffff
je 0x14002a8a7
xor ecx, ecx
cmp dword [0x1400398e4], ecx
je 0x14002a4bd
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x14002a4b1
mov rax, qword [rbp + 0x178]
lea r9, [rsp + 0x70]
test rax, rax
mov dword [rsp + 0x20], r15d
mov rdx, r13
mov ecx, esi
cmovne r9, rax
call fcn.14002ad34
xor ecx, ecx
cmp dword [0x140039858], ecx
je 0x14002a4b1
mov ecx, esi
call fcn.14000f518
xor ecx, ecx
test eax, eax
jne 0x14002a4b1
mov rax, qword [rbp + 0x178]
lea rdx, [rsp + 0x70]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, r13
cmovne rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
cmp eax, ebx
je 0x14002a81b
mov esi, dword [rsp + 0x40]
xor ecx, ecx
cmp dword [0x1400398e4], ecx
jne 0x14002a582
mov eax, dword [rsp + 0x48]
cmp eax, ebx
jne 0x14002a582
mov rax, qword [rbp + 0x178]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x44]
test rax, rax
mov rdx, r13
mov dword [rsp + 0x20], r15d
cmovne r9, rax
mov ecx, esi
call fcn.14002ad34
xor edx, edx
cmp dword [0x140039858], edx
je 0x14002a540
mov ecx, esi
call fcn.14000f518
test eax, eax
jne 0x14002a540
mov rax, qword [rbp + 0x178]
lea rdx, [rsp + 0x70]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, r13
cmovne rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
cmp eax, ebx
je 0x14002a83e
mov esi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x178]
lea rcx, [rsp + 0x70]
test rax, rax
lea r9, [rsp + 0x44]
mov r8d, r12d
mov rdx, r13
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r15d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.140006248
xor ecx, ecx
cmp dword [0x1400398e4], ecx
je 0x14002a4c1
mov dword [0x1400398e4], ecx
mov ecx, r15d
call fcn.14000d778
mov r15, qword [rdi + 0x40]
xor eax, eax
mov dword [0x14003985c], eax
test r15, r15
je 0x14002a7ac
xor r13d, r13d
mov eax, dword [r15 + 0x38]
test al, 4
je 0x14002a5ba
and eax, 0xfffffffb
or eax, 2
mov dword [r15 + 0x38], eax
mov rax, qword [rbp + 0x398]
lea rcx, [rbp + 0x190]
mov r9, qword [rdi + 8]
test rax, rax
mov r8, qword [r15]
mov edx, dword [rbp + 0x3a8]
cmovne rcx, rax
call fcn.140005e9c
test eax, eax
je 0x14002a5f0
xor edx, edx
mov ecx, eax
call fcn.140015a74
jmp 0x14002a611
mov rax, qword [rbp + 0x398]
lea rdx, [rbp + 0x190]
test rax, rax
lea rcx, [0x1400303c8]
cmovne rdx, rax
call fcn.14001242c
mov rax, qword [rbp + 0x398]
lea rcx, [rbp + 0x190]
test rax, rax
cmovne rcx, rax
call fcn.140008c6c
test eax, eax
je 0x14002a79a
mov rax, qword [rbp + 0x178]
lea rdx, [rsp + 0x70]
test rax, rax
lea rcx, [rbp + 0x190]
cmovne rdx, rax
mov rax, qword [rbp + 0x398]
test rax, rax
cmovne rcx, rax
call fcn.14002aab4
test eax, eax
je 0x14002a675
xor edx, edx
mov ecx, 0x2340
call fcn.140015a74
jmp 0x14002a79a
mov rax, qword [rbp + 0x398]
lea rcx, [rbp + 0x190]
test rax, rax
cmovne rcx, rax
xor edx, edx
call fcn.14000244c
mov r13d, eax
cmp eax, 0xffffffff
je 0x14002a884
mov ecx, eax
call fcn.14000f518
xor r8d, r8d
test eax, eax
mov eax, 0x80
cmovne r12d, eax
jmp 0x14002a77b
mov rax, qword [rbp + 0x178]
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x44]
test rax, rax
mov r8d, r12d
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r13d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
call fcn.140006248
xor r8d, r8d
test eax, eax
je 0x14002a788
mov rax, qword [rbp + 0x178]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x44]
test rax, rax
mov rdx, qword [rsp + 0x58]
mov ecx, esi
cmovne r9, rax
mov dword [rsp + 0x20], r13d
call fcn.14002ad34
xor r8d, r8d
cmp dword [0x140039858], r8d
je 0x14002a77b
mov ecx, esi
call fcn.14000f518
xor r8d, r8d
test eax, eax
jne 0x14002a77b
mov rax, qword [rbp + 0x178]
lea rdx, [rsp + 0x70]
mov r9, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
test rax, rax
cmovne rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
cmp eax, ebx
je 0x14002a861
mov esi, dword [rsp + 0x40]
xor r8d, r8d
cmp dword [0x1400398e4], r8d
je 0x14002a6b7
mov ecx, r13d
mov dword [0x1400398e4], r8d
call fcn.14000d778
xor r13d, r13d
mov r15, qword [r15 + 0x40]
test r15, r15
jne 0x14002a5a8
mov r13, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
xor r9d, r9d
mov rdx, r15
mov r8d, esi
mov rcx, rdi
call fcn.1400061b8
mov rdx, qword [rdi + 0x30]
lea rcx, [fcn.140016cc0]
mov r9, r14
mov r8d, 0x21
call fcn.140016cd0
xor ecx, ecx
test al, al
jne 0x14002a252
mov rcx, r14
call fcn.140013ddc
mov rcx, qword [rbp + 0x398]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor eax, eax
jmp 0x14002a93c
mov rcx, r14
call fcn.140013ddc
mov ecx, r15d
call fcn.14000d778
mov ecx, dword [rsp + 0x40]
call fcn.14000d778
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, r15d
call fcn.14000d778
mov ecx, dword [rsp + 0x40]
call fcn.14000d778
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, r13d
call fcn.14000d778
mov ecx, dword [rsp + 0x40]
call fcn.14000d778
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, esi
call fcn.14000d778
mov ecx, 0x6e
call fcn.14002b61c
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, r15d
call fcn.14000d778
mov ecx, 0x6e
call fcn.14002b61c
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, r15d
call fcn.14000d778
mov ecx, 0x6e
call fcn.14002b61c
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov ecx, 0x6e
call fcn.14002b61c
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r14
call fcn.140013ddc
mov rcx, qword [rbp + 0x398]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.1400173b0
mov rbx, qword [rsp + 0x730]
add rsp, 0x6e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret