Function at 0x1401c4f60
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14039a678]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movzx r15d, dl
mov r12, rcx
lea r8, [0x1402a2984]
mov rdx, rcx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x1401c4fc0
cmp qword [rsp + 0x38], 0
je 0x1401c526a
lea rdx, [r8 + 1]
mov r8, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str..temp
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor edi, edi
mov esi, edi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
je 0x1401c5072
nop dword [rax]
xor al, r15b
mov byte [rsp + 0x30], al
cmp rbx, rsi
je 0x1401c5048
mov byte [rbx], al
inc rbx
mov qword [rsp + 0x78], rbx
jmp 0x1401c5063
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400d2360
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
cmp eax, 0xffffffff
jne 0x1401c5030
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea r8, [0x1402a29b4]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r15, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401c50e9
mov rdi, r15
cmp r15, rbx
je 0x1401c50c8
nop dword [rax + rax]
movsx ecx, byte [rdi]
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putc
inc rdi
mov rax, qword [rsp + 0x40]
cmp rdi, rbx
jne 0x1401c50b0
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r12
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
jmp 0x1401c5207
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayGetLBound
mov byte [rbp - 0x70], 0
lea rax, [rbp - 0x30]
inc r14
cmp byte [rax + r14], 0
jne 0x1401c5101
mov r8, r14
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400e82b0
nop
lea r8, [rbp - 0x70]
lea rdx, str._Utility__EncryptDecryptFile__Open
lea rcx, [rbp - 0x50]
call fcn.1400d13b0
nop
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
mov rcx, rax
call fcn.1400e7f00
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.14017eab0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1401c51bb
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c51b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c5452
call fcn.1401e3784
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayGetLBound
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401c5207
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c5201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c5458
call fcn.1401e3784
nop
test r15, r15
je 0x1401c523f
sub rsi, r15
mov rax, r15
cmp rsi, 0x1000
jb 0x1401c5234
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c545e
mov rdx, rsi
mov rcx, r15
call fcn.1401e3784
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1401e3ce0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayGetLBound
mov byte [rsp + 0x70], dil
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.1400e82b0
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea r15d, [rdi + 0x23]
lea r14, str._Utility__EncryptDecryptFile__Open
cmp rax, r15
jb 0x1401c5328
lea rax, [r8 + 0x23]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x70]
lea rax, [0x1402b2693]
cmp rax, rbx
jbe 0x1401c52eb
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1401c52eb
cmp rbx, r14
ja 0x1401c52e3
mov esi, edi
jmp 0x1401c52ee
mov rsi, rbx
sub rsi, r14
jmp 0x1401c52ee
mov rsi, r15
lea rcx, [rbx + 0x23]
inc r8
mov rdx, rbx
call fcn.14021bb20
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.14021bb20
lea rcx, [rbx + rsi]
sub r15, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
mov r8, r15
call fcn.14021bb20
lea rax, [rsp + 0x70]
jmp 0x1401c5345
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400d2c60
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
lea rcx, [rbp - 0x70]
call fcn.1400e7f00
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayGetLBound
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.14017eab0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401c53f6
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c53f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c5446
call fcn.1401e3784
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayGetLBound
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1401c523f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c523a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401c544c
jmp 0x1401c523a
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3