Function at 0x140001c60
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor edi, edi
lea rdx, str.C:WindowsPrefetch
lea rcx, [rbp + 0xf8]
call fcn.140003f40
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
lea rdx, str.ESCAPEFROMTARKOV.EXE_4D62319B
lea rcx, [rbp - 0x60]
call fcn.140003f40
nop
lea rdx, str.ESCAPEFROMTARKOV.EXE_440FC7A0
lea rcx, [rbp - 0x40]
call fcn.140003f40
nop
lea rdx, str.ESCAPEFROMTARKOV_BE.EXE_71E8DD71
lea rcx, [rbp - 0x20]
call fcn.140003f40
nop
lea rdx, str.ESCAPEFROMTARKOV_BE.EXE_DE19075E
lea rcx, [rbp]
call fcn.140003f40
nop
lea rdx, str.BSGLAUNCHER.EXE_D750154A
lea rcx, [rbp + 0x20]
call fcn.140003f40
nop
lea rdx, str.BSGLAUNCHER.EXE_D7501548
lea rcx, [rbp + 0x40]
call fcn.140003f40
nop
lea rdx, str.BSGLAUNCHER.EXE_D7501549
lea rcx, [rbp + 0x60]
call fcn.140003f40
nop
lea rdx, str.BSGLAUNCHER.EXE_D7501550
lea rcx, [rbp + 0x80]
call fcn.140003f40
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rdi
mov ecx, 0x100
call fcn.1400054f0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
lea rcx, [rax + 0x100]
mov qword [rbp + 0xb0], rcx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x70], rcx
lea r9, [rbp + 0xa0]
mov r8, rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.1400052b0
mov qword [rbp + 0xa8], rax
lea r9, [0x140003ed0]
lea edx, [rdi + 0x20]
lea r8d, [rdi + 8]
lea rcx, [rbp - 0x60]
call fcn.14000552c
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x108]
sub rax, rcx
cmp rax, 2
jb 0x1400023da
lea r9, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae r9, qword [rbp + 0xf8]
mov qword [rsp + 0x30], 2
lea rax, [0x140007770]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x78]
call fcn.140004cd0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x70], rax
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140001e8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400055fc
movdqa xmm0, xmmword [0x1400090c0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], di
cmp rbx, 0xffffffffffffffff
jne 0x140001ed0
lea rdx, str.Error_finding_files_in_the_prefetch_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400041f0
lea rdx, [0x1400043d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400022da
test byte [rbp + 0x120], 0x10
jne 0x1400022b8
lea rdx, [rbp + 0x14c]
lea rcx, [rbp + 0xd8]
call fcn.140003f40
nop
mov rsi, qword [rbp + 0xa0]
mov r9, qword [rbp + 0xa8]
mov qword [rsp + 0x48], r9
mov r13, qword [rbp + 0xf0]
mov r12, qword [rbp + 0xd8]
cmp rsi, r9
je 0x14000227c
mov r14, qword [rbp + 0xe8]
mov r11, qword [rsi + 0x10]
mov rbx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140001f33
mov rbx, qword [rsi]
lea rdi, [rbp + 0xd8]
cmp r13, 8
setae r15b
mov byte [rsp + 0x40], r15b
cmovae rdi, r12
cmp r11, r14
ja 0x140002268
mov rax, r14
sub rax, r11
test r11, r11
je 0x140001ffe
inc rax
lea r15, [rdi + rax*2]
mov rax, rdi
movzx r10d, word [rbx]
nop dword [rax]
nop word [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x140001fac
cmp word [rax], r10w
je 0x140001fa9
cmp rcx, 1
je 0x140001fac
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140001f96
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140002263
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140001fe8
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x1400020b4
add rdx, 2
sub r8, 1
jne 0x140001fd0
sub rax, rdi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140002263
movzx r15d, byte [rsp + 0x40]
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x108]
sub rax, rcx
cmp rax, 1
jb 0x1400023d4
lea r9, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae r9, qword [rbp + 0xf8]
mov qword [rsp + 0x30], 1
lea rax, [0x140007778]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
call fcn.140004cd0
nop
lea r9, [rbp + 0xd8]
test r15b, r15b
cmovne r9, r12
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, rdi
cmp r14, rax
ja 0x1400020bd
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [r14 + r14]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rsp + 0x50]
jmp 0x1400020e6
add rax, 2
jmp 0x140001f80
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1400049a0
mov r13, qword [rbp + 0xf0]
mov r14, qword [rbp + 0xe8]
mov r12, qword [rbp + 0xd8]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd0], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002164
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000215f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000232f
call fcn.1400055fc
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea rcx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 8
cmovae rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test eax, eax
je 0x1400021d3
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 8
cmovae rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc8]
call fcn.140004e30
lea rdx, str._removed_successfully.
mov rcx, rax
call fcn.1400041f0
jmp 0x140002205
lea rdx, str.Failed_to_remove
call fcn.1400041f0
lea rdx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 8
cmovae rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc8]
mov rcx, rax
call fcn.140004e30
lea rdx, [0x1400043d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x14000225c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002336
call fcn.1400055fc
mov r9, qword [rsp + 0x48]
jmp 0x14000226a
mov r9, qword [rsp + 0x48]
xor edi, edi
add rsi, 0x20
cmp rsi, r9
jne 0x140001f22
mov rbx, qword [rsp + 0x70]
cmp r13, 8
jb 0x1400022b8
lea rdx, [r13*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400022b0
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000233d
mov rcx, r12
call fcn.1400055fc
lea rdx, [rbp + 0x120]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001ed0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14000235b
mov rdx, qword [rbp + 0xa8]
call fcn.140004b70
mov rdx, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002344
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400055fc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rdi
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x1400023a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000239f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000239f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400055fc
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400054d0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.1400011b0
int3