Function at 0x140271db0
Capabilities:
Delete file
Get session user name
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x938
movaps xmmword [rsp + 0x920], xmm6
mov ebx, edx
mov rdi, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140271de0
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
mov byte [rdi + 0x218], 1
mov r13d, dword [rdi]
cmp r13d, 0x1000000
jb 0x140271f88
mov byte [rsp + 0x5b], bl
shr r13d, 0x18
lea rbx, [rdi + 0x10]
xor r14d, r14d
lea rbp, [rsp + 0x720]
xorps xmm6, xmm6
lea rsi, [rsp + 0x70]
jmp 0x140271e48
mov rcx, rsi
call fcn.14025f970
lea rcx, [rsp + 0x520]
mov rdx, rbp
call sub.msvcrt.dll_strcpy
lea eax, [r13 + 1]
add r14d, 1
test eax, eax
jle 0x140271f84
mov r12d, r13d
sub r13d, 1
jae 0x140271e60
mov rcx, rbp
mov rdx, rbx
call sub.msvcrt.dll_strcpy
jmp 0x140271e98
test dword [rdi], 0x800
lea rcx, str._s._d
mov r8, rcx
lea rax, str._s._d.gz
cmovne r8, rax
cmp r12d, 1
cmove r8, rcx
mov dword [rsp + 0x20], r12d
mov edx, 0x200
mov rcx, rbp
mov r9, rbx
call fcn.1402ea1b0
lea rax, [rsp + 0x2c8]
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rsp + 0x2c0], 0xffffffffffffffff
mov rcx, rsi
mov rdx, rbp
call fcn.14025fac0
cmp qword [rsp + 0x2c0], 0xffffffffffffffff
je 0x140271e20
movzx r15d, byte [rsp + 0x70]
mov rcx, rsi
call fcn.14025f970
test r15b, 0x10
jne 0x140271e28
test r14d, r14d
je 0x140271f41
test byte [rdi + 1], 8
je 0x140271f6f
cmp r12d, 1
jne 0x140271f6f
cmp byte [0x1405df380], 0
jne 0x140271f6f
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x520]
mov rdx, rbp
lea r8, [rsp + 0x60]
call fcn.1403284a0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140271e28
lock sub dword [rcx + 8], 1
jne 0x140271e28
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140271e28
mov rcx, rsi
mov rdx, rbp
call fcn.14025fe60
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140271e28
call fcn.140309590
jmp 0x140271e28
mov rcx, rbp
lea rdx, [rsp + 0x520]
call fcn.1402607e0
jmp 0x140271e28
mov bl, byte [rsp + 0x5b]
mov dword [rdi + 0x210], 0
lea rcx, [rdi + 0x10]
movzx esi, bl
lea eax, [rsi + rsi]
add eax, 2
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov qword [rdi + 8], rax
test sil, sil
je 0x140271feb
mov rcx, rax
xor edx, edx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [rdi + 0x210], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movsx r13d, word [rsp + 0x70]
movzx r15d, byte [rsp + 0x72]
movzx r12d, byte [rsp + 0x76]
movzx esi, byte [rsp + 0x78]
movzx ebx, byte [rsp + 0x7a]
movzx r14d, byte [rsp + 0x7c]
mov byte [rsp + 0x720], 0
mov rcx, qword [0x1405ff868]
test rcx, rcx
jne 0x14027203e
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov rcx, rax
mov qword [0x1405ff868], rax
lea rdx, [rsp + 0x520]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov dword [rsp + 0x6c], 0x800
lea rbp, [rsp + 0x720]
lea rdx, [rsp + 0x6c]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
lea r8, str.__s__02d._02d._04d__02d:_02d:_02d__user:__s_n
lea rbx, [rsp + 0x70]
mov edx, 0x4b0
mov rcx, rbx
lea r9, [rsp + 0x520]
call fcn.1402ea1b0
mov rsi, qword [rdi + 8]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov r8d, dword [rdi + 0x214]
test r8d, r8d
je 0x140272124
lea rdx, [0x1403d4eb5]
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1402ea1d0
mov rbx, qword [rdi + 8]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov rcx, rbx
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], 0
lea rdx, [0x1403d4ebb]
lea r9, [rsp + 0x5c]
mov r8d, 2
call qword [sym.imp.KERNEL32.DLL_WriteFile]
movaps xmm6, xmmword [rsp + 0x920]
add rsp, 0x938
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret