Function at 0x41049870
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov r13, r9
mov rbp, r8
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x1178], eax
je 0x410498d4
mov dword [rbx + 0x1140], 0x3f3
xor esi, esi
mov dword [rbx + 0x1144], esi
mov dword [rbx + 0x1148], esi
xor eax, eax
jmp 0x41049f1b
cmp qword [rbx + 0x1150], 0
jne 0x410498e5
xor eax, eax
jmp 0x41049f1b
mov qword [rbx + 0x1170], r13
xor esi, esi
mov dword [rbx + 0x1158], esi
mov qword [rbx + 8], rsi
mov rax, qword [rbx + 0x10]
mov word [rax], si
mov rax, qword [rbx + 0x20]
mov word [rax], si
mov dword [rbx + 0x30], esi
mov dword [rbx + 0x34], esi
mov dword [rbx + 0x38], esi
mov dword [rbx + 0x1140], esi
mov dword [rbx + 0x1144], esi
mov dword [rbx + 0x1148], esi
xor eax, eax
mov dword [rbx + 0x1120], eax
mov dword [rbx + 0x1124], eax
mov dword [rbx + 0x1128], eax
mov dword [rbx + 0x84], esi
mov rdx, qword [rbp]
or r15, 0xffffffffffffffff
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, dword [rbp + 8]
jb 0x4104997c
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
mov r8d, ecx
lea rcx, [rbx + 0x98]
call fcn.410459d0
mov rdx, qword [rbx + 0x98]
xor eax, eax
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, dword [rbx + 0xa0]
jb 0x410499d0
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
cmp ecx, 1
jle 0x410499f3
movsxd rax, ecx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x410499f3
lea rdx, [0x4129a2c0]
lea rcx, [rbx + 0x98]
call fcn.41045ae0
lea rdx, str.MEMORY_
mov rcx, qword [rbx + 0x98]
call fcn.41213c60
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x115c], ecx
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov edi, 0x258
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.4120fd60
test rax, rax
jne 0x41049a5e
lea rax, str.Fatal_error:_Out_of_memory_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edi
mov word [rax], si
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.4120fd60
test rax, rax
jne 0x41049ab0
lea rax, str.Fatal_error:_Out_of_memory_
mov qword [rsp + 0x98], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0x98]
call fcn.41211a10
int3
mov word [rax], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edi
mov word [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.410460a0
xor eax, eax
mov rcx, r15
mov rdi, qword [rbx + 0x98]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, dword [rbx + 0xa0]
jb 0x41049b17
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
cmp ecx, 3
jb 0x41049ef2
mov rcx, r15
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, dword [rsp + 0x58]
jb 0x41049b64
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
cmp ecx, 2
jb 0x41049ef2
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r14d, dword [rsp + 0x48]
cmp ecx, r14d
jb 0x41049bab
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
cmp ecx, 2
jb 0x41049ef2
mov rax, qword [rbx + 0xa8]
mov word [rax], 0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
mov edi, 0x258
mov rcx, rdi
call fcn.4120fd60
test rax, rax
je 0x41049ece
mov byte [rax], 0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], edi
mov byte [rax], 0
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
mov rcx, rdi
call fcn.4120fd60
test rax, rax
je 0x41049eaa
mov byte [rax], 0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edi
mov byte [rax], 0
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.410458b0
mov rdi, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.410458b0
mov rdx, rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rsi
lea rax, [0x41048960]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rdi
mov rcx, qword [rbx + 0x1150]
call qword [rbx + 0x1190]
test eax, eax
je 0x41049e30
xor eax, eax
mov rcx, r15
mov rdi, qword [rbx + 0xa8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, dword [rbx + 0xb0]
jae 0x41049e0c
test ecx, ecx
je 0x41049df5
mov rdx, qword [rbx + 0xa8]
mov qword [rsp + 0xf0], rdx
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r13, rcx
cmp ecx, dword [rbx + 0xb0]
jae 0x41049dd1
cmp ecx, r14d
jb 0x41049d52
lea r15d, [rcx + rcx]
mov edx, r15d
mov eax, 2
mul rdx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.4120fd60
mov r12, rax
test rax, rax
je 0x41049dad
test rbp, rbp
je 0x41049d2c
xor eax, eax
mov rcx, rdi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, r14d
jae 0x41049d89
lea r8d, [rcx + 1]
mov rdx, rbp
mov rcx, r12
call fcn.41217490
mov rcx, rbp
call fcn.41212980
jmp 0x41049d31
mov word [rax], 0
mov rbp, r12
mov qword [rsp + 0x40], r12
mov r14d, r15d
mov dword [rsp + 0x48], r15d
mov rdx, qword [rsp + 0xf0]
mov r12, qword [rsp + 0x50]
or r15, 0xffffffffffffffff
mov edi, r13d
mov r8d, r13d
mov rcx, rbp
call fcn.41217490
mov word [rbp + rdi*2], 0
mov rcx, qword [rsp + 0x70]
call fcn.41212980
nop
mov rcx, qword [rsp + 0x60]
call fcn.41212980
mov r13, qword [rsp + 0x108]
jmp 0x41049bb4
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0x90], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0x90]
call fcn.41211a10
int3
lea rax, str.Fatal_error:_Out_of_memory_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
int3
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0x88], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0x88]
call fcn.41211a10
nop
mov rcx, qword [rsp + 0x70]
call fcn.41212980
nop
mov rcx, qword [rsp + 0x60]
call fcn.41212980
jmp 0x41049e45
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0xf0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xf0]
call fcn.41211a10
nop
mov rcx, qword [rsp + 0x70]
call fcn.41212980
nop
mov rcx, qword [rsp + 0x60]
call fcn.41212980
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.41047220
cmp dword [rbx + 0x1158], 0
je 0x41049e6b
cmp qword [rbx + 8], 0
je 0x41049e6b
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx + 0x1128], 0
jne 0x41049e8a
cmp dword [rbx + 0x1144], 0
jne 0x41049e8a
cmp dword [rbx + 0x1140], 0
jne 0x41049e8a
mov eax, esi
jmp 0x41049e8f
mov eax, 1
test eax, eax
sete sil
mov rcx, rbp
call fcn.41212980
nop
mov rcx, r12
call fcn.41212980
mov eax, esi
jmp 0x41049f1b
lea rax, str.Fatal_error:_Out_of_memory_
mov qword [rsp + 0xa0], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0xa0]
call fcn.41211a10
nop
lea rax, str.Fatal_error:_Out_of_memory_
mov qword [rsp + 0x80], rax
lea rdx, [0x4132aaf0]
lea rcx, [rsp + 0x80]
call fcn.41211a10
int3
mov dword [rbx + 0x1140], 0x3ea
mov dword [rbx + 0x1144], esi
mov dword [rbx + 0x1148], esi
mov rcx, rbp
call fcn.41212980
nop
mov rcx, r12
call fcn.41212980
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret