Function at 0x1400e9410
Capabilities:
Clear file content
Delete file
Get file size

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov qword [r11 - 0x28], rcx
lea rax, [0x140174b10]
mov qword [rcx], rax
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1400e94f3
mov rcx, qword [rax]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e94f3
mov rbx, qword [rsp + 0x48]
lea rdx, [r11 - 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
test eax, eax
je 0x1400e95fc
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
cmp qword [rsp + 0x30], rcx
jbe 0x1400e94f3
mov rsi, qword [rdi + 0x48]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e94b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
and qword [rdi + 0x48], 0
mov rdx, qword [rdi + 0x40]
cmp qword [rdx], 0
jne 0x1400e94f5
lea rcx, [rdi + 8]
cmp qword [rcx + 0x18], 8
jb 0x1400e94d3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400e94f3
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x43]
call fcn.14008e070
nop
jmp 0x1400e954d
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1400e9503
mov rcx, qword [rax]
jmp 0x1400e9505
xor ecx, ecx
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop
test eax, eax
je 0x1400e960f
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1400e9530
mov rcx, qword [rax]
jmp 0x1400e9532
xor ecx, ecx
mov rbx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
test eax, eax
je 0x1400e9622
jmp 0x1400e94f3
mov rcx, qword [rdi + 0x48]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e9562
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400e9572
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
mov rcx, qword [rdi + 0x38]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e9587
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x1400e95ca
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e95ca
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
nop
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400e95ca
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
nop
lea rcx, [rdi + 8]
call fcn.140006970
nop
lea rax, [0x1401719f0]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010fb20
nop
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x3b]
mov rcx, rbx
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x49]
mov rcx, rbx
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x4a]
mov rcx, rbx
call fcn.1400290d4
nop
int3