Function at 0x180002620
Capabilities:
Delete file
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x18002d010]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpnam]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rsi + r8], 0
jne 0x180002690
mov rdx, rsi
lea rcx, [rbp + 0xa0]
call fcn.1800030e0
nop
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
mov r15, qword [rbp + 0xb0]
sub rax, r15
cmp rax, 4
jb 0x180002acb
lea rax, [rbp + 0xa0]
mov r13, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0xb8]
mov qword [rsp + 0x60], rcx
cmp rcx, 0x10
cmovae rax, r13
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r12, [r15 + 4]
mov r14d, 0xf
lea rsi, [rsp + 0x40]
cmp r12, r14
jbe 0x18000279b
mov r14, r12
or r14, 0xf
cmp r14, rdx
jbe 0x18000272c
mov r14, rdx
jmp 0x180002738
mov ecx, 0x16
cmp r14, rcx
cmovb r14, rcx
mov rcx, r14
add rcx, 1
cmovb rcx, rdi
cmp rcx, 0x1000
jb 0x180002780
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180002ac5
mov rcx, rax
call fcn.180020320
test rax, rax
je 0x180002779
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0x38]
jmp 0x180002796
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x180002794
call fcn.180020320
mov rsi, rax
mov rax, qword [rsp + 0x38]
jmp 0x180002796
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov r8, r15
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + rsi], 0x203e3e20
mov byte [rsi + r12], 0
mov esi, 2
mov dword [rsp + 0x30], esi
lea rax, [rbp + 0xc0]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800027d0
mov r8, rdi
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18000cf50
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
or esi, 4
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000286f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000286a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000286a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800207b4
movdqa xmm0, xmmword [0x180027480]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x21
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x70]
call fcn.18000c670
nop
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1800029ab
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::eof_void_const___ptr64]
test al, al
jne 0x18000297f
nop
call fcn.180001c50
int3
call fcn.180001cf0
int3