Function at 0x1401e87f0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movzx r15d, dl
mov r12, rcx
lea r8, [0x1402d67b4]
mov rdx, rcx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x1401e8850
cmp qword [rsp + 0x38], 0
je 0x1401e8afa
lea rdx, [r8 + 1]
mov r8, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
lea r8, str..temp
mov edx, 0x104
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor edi, edi
mov esi, edi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
je 0x1401e8902
nop dword [rax]
xor al, r15b
mov byte [rsp + 0x30], al
cmp rbx, rsi
je 0x1401e88d8
mov byte [rbx], al
inc rbx
mov qword [rsp + 0x78], rbx
jmp 0x1401e88f3
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400e28f0
mov rsi, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
cmp eax, 0xffffffff
jne 0x1401e88c0
mov rcx, qword [rsp + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea r8, [0x1402d67fc]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s
mov r15, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401e8979
mov rdi, r15
cmp r15, rbx
je 0x1401e8958
nop dword [rax + rax]
movsx ecx, byte [rdi]
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putc
inc rdi
mov rax, qword [rsp + 0x40]
cmp rdi, rbx
jne 0x1401e8940
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r12
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
jmp 0x1401e8a97
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayLock
mov byte [rbp - 0x70], 0
lea rax, [rbp - 0x30]
inc r14
cmp byte [rax + r14], 0
jne 0x1401e8991
mov r8, r14
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400f8840
nop
lea r8, [rbp - 0x70]
lea rdx, str._Utility__EncryptDecryptFile__Open
lea rcx, [rbp - 0x50]
call fcn.1400e1940
nop
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
mov rcx, rax
call fcn.1400f8490
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.140195010
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1401e8a4b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e8a46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e8ce2
call fcn.14020be84
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayLock
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401e8a97
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e8a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e8ce8
call fcn.14020be84
nop
test r15, r15
je 0x1401e8acf
sub rsi, r15
mov rax, r15
cmp rsi, 0x1000
jb 0x1401e8ac4
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e8cee
mov rdx, rsi
mov rcx, r15
call fcn.14020be84
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14020c3e0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayLock
mov byte [rsp + 0x70], dil
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.1400f8840
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea r15d, [rdi + 0x23]
lea r14, str._Utility__EncryptDecryptFile__Open
cmp rax, r15
jb 0x1401e8bb8
lea rax, [r8 + 0x23]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x70]
lea rax, [0x1402e7743]
cmp rax, rbx
jbe 0x1401e8b7b
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1401e8b7b
cmp rbx, r14
ja 0x1401e8b73
mov esi, edi
jmp 0x1401e8b7e
mov rsi, rbx
sub rsi, r14
jmp 0x1401e8b7e
mov rsi, r15
lea rcx, [rbx + 0x23]
inc r8
mov rdx, rbx
call fcn.140244220
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.140244220
lea rcx, [rbx + rsi]
sub r15, rsi
lea rdx, [r14 + 0x23]
add rdx, rsi
mov r8, r15
call fcn.140244220
lea rax, [rsp + 0x70]
jmp 0x1401e8bd5
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400e31f0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._file_failed
lea rcx, [rbp - 0x70]
call fcn.1400f8490
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], 0
lea rcx, [rsp + 0x48]
call fcn.140195010
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401e8c86
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e8c81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e8cd6
call fcn.14020be84
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], SafeArrayLock
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1401e8acf
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e8aca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e8cdc
jmp 0x1401e8aca
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3