Function at 0x140013a00
Capabilities:
Delete file
Resolve path using msvcrt
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
mov rax, qword [0x140085db8]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor edi, edi
cmp word [0x1400a21c4], 1
jae 0x140013a52
cmp byte [0x140091983], dil
jne 0x140013a52
cmp byte [0x140091a6b], dil
jne 0x140013a52
call fcn.14001364c
mov rcx, qword [0x1400a20a8]
test rcx, rcx
je 0x140013a6a
call fcn.140023d50
mov qword [0x1400a20a8], rdi
mov rcx, qword [0x140091ac8]
test rcx, rcx
je 0x140013a82
call fcn.140023d50
mov qword [0x140091ac8], rdi
mov rcx, qword [0x1400a21e8]
test rcx, rcx
je 0x140013a9a
call fcn.140023d50
mov qword [0x1400a21e8], rdi
mov rcx, qword [0x1400a46c8]
test rcx, rcx
je 0x140013ab6
mov rbx, qword [rcx]
call fcn.140023d50
mov rcx, rbx
test rbx, rbx
jne 0x140013aa6
lea rdx, [0x140080f22]
xor ecx, ecx
call fcn.140023b20
mov rdx, qword [0x140091a18]
mov rcx, qword [0x1400919c8]
add rcx, 8
mov qword [0x1400919d8], rax
test rdx, rdx
cmovne rcx, rdx
call fcn.140013834
lea rsi, str..exe
mov rdx, rax
mov r8, rsi
lea rcx, [0x140091998]
call fcn.1400122f4
lea rcx, [0x140080e94]
mov qword [0x140091998], rax
call fcn.1400138fc
cmp byte [0x1400902b6], dil
je 0x140013b2a
lea rcx, str._DEBUG_r_n
call fcn.1400138fc
mov rdx, qword [0x140091a10]
test rdx, rdx
je 0x140013b42
lea rcx, str._DEF:
call fcn.140013960
cmp qword [0x140091a28], rdi
setne al
or byte [0x140091a85], al
je 0x140013b85
mov rcx, qword [0x140091998]
call fcn.140013834
mov rdx, rax
lea r8, str..map
lea rcx, [0x140091a28]
call fcn.1400122f4
mov rdx, rax
lea rcx, str._MAP:
call fcn.140013960
mov rdx, qword [0x140091998]
lea rcx, str._OUT:
call fcn.140013960
cmp qword [0x140091a08], rdi
je 0x140013bc5
lea rcx, str._STACK:0x
call fcn.1400138fc
mov rcx, qword [0x140091a08]
call fcn.1400138fc
lea rcx, [0x140080e80]
call fcn.1400138fc
mov rbx, qword [0x1400919c8]
jmp 0x140013be1
lea rdx, [rbx + 8]
lea rcx, [0x140080c10]
call fcn.140013960
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140013bce
mov rbx, qword [0x1400919b8]
jmp 0x140013c02
lea rdx, [rbx + 8]
lea rcx, [0x140080c10]
call fcn.140013960
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140013bef
mov rcx, qword [0x1400919d8]
call fcn.140023d50
mov rdx, qword [0x140091a00]
lea rbx, str.link
mov qword [0x1400919d8], rdi
lea rax, str._mllink_.lnk
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
test rdx, rdx
jne 0x140013ccf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
mov qword [rsp + 0x40], rdi
lea r9, [rbp + 0x180]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
mov r8d, 3
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov r9, rbx
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
int3
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnvp]
mov rbx, rax
test rax, rax
je 0x140013d06
cmp rax, 0xffffffffffffffff
jne 0x140013cf9
xor r8d, r8d
xor edx, edx
mov ecx, 0x3fc
call fcn.14001b0f0
lea rcx, [0x140080f22]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3