Function at 0x140012bec
Capabilities:
Delete file
Resolve path using msvcrt
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
mov rax, qword [0x14007cb88]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor edi, edi
cmp word [0x1400981c0], 1
jae 0x140012c3e
cmp byte [0x140086a62], dil
jne 0x140012c3e
cmp byte [0x140086a5b], dil
jne 0x140012c3e
call fcn.140012838
mov rcx, qword [0x1400980a8]
test rcx, rcx
je 0x140012c56
call fcn.14001c8bc
mov qword [0x1400980a8], rdi
mov rcx, qword [0x140087b80]
test rcx, rcx
je 0x140012c6e
call fcn.14001c8bc
mov qword [0x140087b80], rdi
mov rcx, qword [0x1400981e0]
test rcx, rcx
je 0x140012c86
call fcn.14001c8bc
mov qword [0x1400981e0], rdi
mov rcx, qword [0x14009a5e0]
test rcx, rcx
je 0x140012ca2
mov rbx, qword [rcx]
call fcn.14001c8bc
mov rcx, rbx
test rbx, rbx
jne 0x140012c92
lea rdx, [0x140078492]
xor ecx, ecx
call fcn.14001c68c
mov rdx, qword [0x140087ad8]
mov rcx, qword [0x140086aa8]
add rcx, 8
mov qword [0x140086a40], rax
test rdx, rdx
cmovne rcx, rdx
call fcn.140012a20
lea rsi, str..exe
mov rdx, rax
mov r8, rsi
lea rcx, [0x140086a78]
call fcn.140011588
lea rcx, [0x140078404]
mov qword [0x140086a78], rax
call fcn.140012ae8
cmp byte [0x140086342], dil
je 0x140012d16
lea rcx, str._DEBUG_r_n
call fcn.140012ae8
mov rdx, qword [0x140087ad0]
test rdx, rdx
je 0x140012d2e
lea rcx, str._DEF:
call fcn.140012b4c
cmp qword [0x140087ae8], rdi
setne al
or byte [0x140087b3c], al
je 0x140012d71
mov rcx, qword [0x140086a78]
call fcn.140012a20
mov rdx, rax
lea r8, str..map
lea rcx, [0x140087ae8]
call fcn.140011588
mov rdx, rax
lea rcx, str._MAP:
call fcn.140012b4c
mov rdx, qword [0x140086a78]
lea rcx, str._OUT:
call fcn.140012b4c
cmp qword [0x140087ac8], rdi
je 0x140012db1
lea rcx, str._STACK:0x
call fcn.140012ae8
mov rcx, qword [0x140087ac8]
call fcn.140012ae8
lea rcx, [0x1400783ec]
call fcn.140012ae8
mov rbx, qword [0x140086aa8]
jmp 0x140012dcd
lea rdx, [rbx + 8]
lea rcx, [0x140078170]
call fcn.140012b4c
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140012dba
mov rbx, qword [0x140086a98]
jmp 0x140012dee
lea rdx, [rbx + 8]
lea rcx, [0x140078170]
call fcn.140012b4c
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140012ddb
mov rcx, qword [0x140086a40]
call fcn.14001c8bc
mov rdx, qword [0x140087ac0]
lea rbx, str.link
mov qword [0x140086a40], rdi
lea rax, str._mllink_.lnk
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
test rdx, rdx
jne 0x140012ebb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
mov qword [rsp + 0x40], rdi
lea r9, [rbp + 0x180]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
mov r8d, 3
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov r9, rbx
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140012f98
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x140012eb4
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnv]
jmp 0x140012ec8
lea rdx, str.link.exe
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnvp]
mov rbx, rax
test rax, rax
je 0x140012ef2
cmp rax, 0xffffffffffffffff
jne 0x140012ee5
xor r8d, r8d
xor edx, edx
mov ecx, 0x3fc
call fcn.140016748
lea rcx, [0x140078492]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3