Function at 0x1000fc908
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100176150]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rdi, rcx
lea r15, [0x10003b6c0]
mov qword [rsp + 0x58], r15
lea rbx, [0x10003bab0]
mov qword [rsp + 0x60], rbx
lea rsi, [0x10003b6a0]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xf8
mov r14d, 4
mov dword [rsp + 0x74], r14d
mov ebp, 0xff
mov dword [rsp + 0x78], ebp
xor r13d, r13d
mov word [r11 - 0x2f0], r13w
mov byte [r11 - 0x2ee], r13b
mov byte [rsp + 0xfb], 1
lea r12d, [r14 + 0x74]
mov r8, r12
xor edx, edx
lea rcx, [r11 - 0x368]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e8000
nop
cmp qword [rdi + 8], r13
jne 0x1000fc9d8
mov eax, r13d
jmp 0x1000fc9e2
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
bt eax, 0x16
jb 0x1000fca5f
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], 0xfd
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], ebp
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r8, [0x10003bb10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
nop
lea rcx, [rsp + 0x130]
call fcn.1000e80ec
jmp 0x1000fcf7a
cmp qword [rdi + 8], r13
jne 0x1000fca6a
mov ebx, r13d
jmp 0x1000fca76
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ebx, eax
shr ebx, 0x18
and ebx, 1
mov ecx, ebx
neg ecx
sbb rsi, rsi
and esi, 0x4e20
add rsi, 0x2710
mov ebp, 0x7530
mov r12d, 0xc350
mov qword [rsp + 0x118], r13
lea rax, [0x100035878]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r13
mov dword [rsp + 0x104], r13d
mov dword [rsp + 0x100], 0x20019
lea r8, [0x100004790]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x100]
call fcn.100102448
cmp al, r13b
je 0x1000fcbb0
mov dword [rsp + 0x30], r13d
cmp ebx, r13d
je 0x1000fcb19
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004810]
lea rcx, [rsp + 0x100]
call fcn.100102d34
jmp 0x1000fcb35
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x1000047f0]
lea rcx, [rsp + 0x100]
call fcn.100102d34
mov eax, dword [rsp + 0x30]
cmp eax, r13d
je 0x1000fcb46
imul eax, eax, 0x3e8
mov esi, eax
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004848]
lea rcx, [rsp + 0x100]
call fcn.100102d34
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fcb7b
imul r11d, r11d, 0x3e8
mov ebp, r11d
mov dword [rsp + 0x30], r13d
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [0x100004878]
lea rcx, [rsp + 0x100]
call fcn.100102d34
mov r11d, dword [rsp + 0x30]
cmp r11d, r13d
je 0x1000fcbb0
imul r11d, r11d, 0x3e8
mov r12d, r11d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbp
mov r9b, 1
lea r8, [rsp + 0x38]
mov dl, r9b
mov rcx, rdi
call fcn.1000fd1b8
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [0x1000ff510]
mov rdx, qword [rsp + 0x48]
call fcn.1001011cc
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r12, rax
mov ebp, r13d
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fcf28
add rbx, 0x10
mov eax, 0x66666667
imul ebp
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp ebp, ecx
jne 0x1000fcc65
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [r12 + rsi]
cmp rax, rcx
ja 0x1000fce4c
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x10000a068]
mov edx, 0x104
lea rcx, [rsp + 0x1a0]
call fcn.1000526f0
mov edi, eax
mov dword [rsp + 0x138], eax
cmp eax, r13d
jge 0x1000fcd17
mov qword [rsp + 0x58], r15
lea rax, [0x10003bab0]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b6a0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x143
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, edi
lea r8, [0x10003bb80]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
jmp 0x1000fce2f
mov qword [rsp + 0x58], r15
lea rdi, [0x10003bab0]
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b6a0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x148
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x1a0]
lea r8, [0x10003bbc8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000fce2f
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rdi
lea rax, [0x10003b6a0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x14a
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x1a0]
lea r8, [0x10003bbf0]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1000e91dc
add rbx, 0x48
inc ebp
lea rax, [rbx - 0x10]
mov rdi, qword [rsp + 0x48]
cmp rax, rdi
je 0x1000fcf23
jmp 0x1000fcc38
mov qword [rsp + 0x58], r15
lea rax, [0x10003bab0]
mov qword [rsp + 0x60], rax
lea rax, [0x10003b6a0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x139
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x78], 0xff
mov word [rsp + 0xf8], r13w
mov byte [rsp + 0xfa], r13b
mov byte [rsp + 0xfb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x80]
call sub.msvcrt.dll_memset
mov r9d, r14d
lea r8, [rsp + 0x58]
mov edx, 0x201c
lea rcx, [rsp + 0x130]
call fcn.1000eb640
nop
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fcef7
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1000fceef
mov rcx, rbx
call fcn.1000fdd30
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fced9
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1001302fc
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100103354
nop
lea rcx, [rsp + 0x130]
call fcn.1000e80ec
jmp 0x1000fcf7a
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x1000fcf50
cmp rbx, rdi
je 0x1000fcf48
mov rcx, rbx
call fcn.1000fdd30
add rbx, 0x48
cmp rbx, rdi
jne 0x1000fcf32
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1001302fc
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x100]
call fcn.100103354
nop
lea rcx, [rsp + 0x130]
call fcn.1000e80ec
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.100130830
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret