Function at 0x418730
Capabilities:
Delete file
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0x177004]
mov dword [rbp - 8], ebx
mov ebx, 0x1d4c0
sub ebx, dword [rbp - 8]
jb 0x418d98
cmp ebx, dword [rax + 0x177004]
jb 0x418d98
mov rbx, qword [rbp + 0x18]
imul eax, dword [rax + 0x177004], 0xc
mov rsi, qword [rbp + 0x10]
mov esi, dword [rsi + 0x177004]
mov dword [rbp - 0xc], esi
mov esi, 0x1d4c0
sub esi, dword [rbp - 0xc]
jb 0x418d98
mov rsi, qword [rbp + 0x10]
mov edi, dword [rbp - 0xc]
cmp edi, dword [rbp - 8]
jne 0x418d98
imul edi, edi, 0xc
mov r8d, edi
lea rdx, [rsi + 0x177008]
lea rcx, [rbx + rax + 0x177008]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov eax, dword [rax + 0x177004]
mov dword [rbp - 4], eax
jmp 0x4187f3
mov eax, dword [rbp - 4]
cmp eax, 0x1d4c0
jae 0x418d9a
mov rbx, qword [rbp + 0x18]
imul eax, eax, 0xc
mov rsi, qword [rbp + 0x18]
mov esi, dword [rsi]
add dword [rbx + rax + 0x177008], esi
inc dword [rbp - 4]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
mov eax, dword [rax + 0x177004]
add eax, dword [rbx + 0x177004]
cmp eax, dword [rbp - 4]
ja 0x4187ce
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx + 0x177004]
add dword [rax + 0x177004], ebx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
mov ebx, dword [rbx]
mov dword [rbp - 8], ebx
mov ebx, 0xbb80
sub ebx, dword [rbp - 8]
jb 0x418d9c
cmp ebx, dword [rax]
jb 0x418d9c
mov rbx, qword [rbp + 0x18]
mov eax, dword [rax]
shl eax, 5
mov rsi, qword [rbp + 0x10]
mov esi, dword [rsi]
mov dword [rbp - 0xc], esi
mov esi, 0xbb80
sub esi, dword [rbp - 0xc]
jb 0x418d9c
mov rsi, qword [rbp + 0x10]
mov edi, dword [rbp - 0xc]
cmp edi, dword [rbp - 8]
jne 0x418d9c
shl edi, 5
mov r8d, edi
lea rdx, [rsi + 4]
lea rcx, [rbx + rax + 4]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov eax, dword [rax]
add dword [rbx], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov r8d, 0x2ee00
mov edx, 4
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov r8d, 0x2ee00
mov edx, 4
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov r8d, 0x177000
mov edx, 4
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp - 0x18]
mov edx, 0x2ee00
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 4], 0
jmp 0x41894b
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418d9e
mov rbx, qword [rbp - 0x18]
mov esi, dword [rbp - 4]
mov dword [rbx + rax*4], esi
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax]
jl 0x418930
push rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
mov dword [rbp - 0x2c], eax
mov eax, 0xbb80
sub eax, dword [rbp - 0x2c]
jb 0x418da0
mov rax, qword [rbp - 0x18]
push qword [rbp - 0x2c]
push rax
push qword [rbp - 0x10]
call fcn.00456fb1
pop rcx
mov rcx, qword [rbp - 0x20]
mov edx, 0x2ee00
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 4], 0
jmp 0x4189cc
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418da2
mov rbx, qword [rbp - 0x18]
mov eax, dword [rbx + rax*4]
cmp eax, 0xbb80
jae 0x418da2
mov rbx, qword [rbp - 0x20]
mov esi, dword [rbp - 4]
mov dword [rbx + rax*4], esi
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax]
jl 0x41899f
mov rcx, qword [rbp - 0x28]
mov edx, 0x177000
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 4], 0
jmp 0x418a5f
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418da4
mov rbx, qword [rbp - 0x28]
shl eax, 5
mov esi, dword [rbp - 4]
cmp esi, 0xbb80
jae 0x418da4
mov rdi, qword [rbp - 0x18]
mov esi, dword [rdi + rsi*4]
cmp esi, 0xbb80
jae 0x418da4
mov rdi, qword [rbp - 0x10]
shl esi, 5
mov rcx, qword [rdi + rsi + 4]
mov rdx, qword [rdi + rsi + 0xc]
mov r8, qword [rdi + rsi + 0x14]
mov r9, qword [rdi + rsi + 0x1c]
mov qword [rbx + rax], rcx
mov qword [rbx + rax + 8], rdx
mov qword [rbx + rax + 0x10], r8
mov qword [rbx + rax + 0x18], r9
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax]
jl 0x4189f7
mov dword [rbp - 4], 0
jmp 0x418ac2
mov eax, dword [rbp - 4]
cmp eax, 0x1d4c0
jae 0x418da6
mov rbx, qword [rbp - 0x10]
imul eax, eax, 0xc
mov esi, dword [rbp - 4]
cmp esi, 0x1d4c0
jae 0x418da6
mov rdi, qword [rbp - 0x10]
imul esi, esi, 0xc
mov esi, dword [rdi + rsi + 0x177008]
cmp esi, 0xbb80
jae 0x418da6
mov rdi, qword [rbp - 0x20]
mov esi, dword [rdi + rsi*4]
mov dword [rbx + rax + 0x177008], esi
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax + 0x177004]
jl 0x418a73
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
jmp 0x418cc4
cmp dword [rbp - 8], 0
jne 0x418b5c
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418da8
mov rbx, qword [rbp - 0x18]
mov esi, dword [rbp - 8]
mov dword [rbx + rax*4], esi
mov eax, dword [rbp - 8]
inc dword [rbp - 8]
cmp eax, 0xbb80
jae 0x418daa
mov rbx, qword [rbp - 0x10]
shl eax, 5
mov esi, dword [rbp - 4]
cmp esi, 0xbb80
jae 0x418daa
mov rdi, qword [rbp - 0x28]
shl esi, 5
mov rcx, qword [rdi + rsi]
mov rdx, qword [rdi + rsi + 8]
mov r8, qword [rdi + rsi + 0x10]
mov r9, qword [rdi + rsi + 0x18]
mov qword [rbx + rax + 4], rcx
mov qword [rbx + rax + 0xc], rdx
mov qword [rbx + rax + 0x14], r8
mov qword [rbx + rax + 0x1c], r9
jmp 0x418cc1
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418dac
mov rbx, qword [rbp - 0x28]
shl eax, 5
push 0xc
lea rax, [rbx + rax]
push rax
mov eax, dword [rbp - 8]
dec eax
cmp eax, 0xbb80
jae 0x418dac
mov rbx, qword [rbp - 0x10]
shl eax, 5
push 0xc
lea rax, [rbx + rax + 4]
push rax
call fcn.00410e58
cmp eax, 0
je 0x418c13
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418dae
mov rbx, qword [rbp - 0x18]
mov esi, dword [rbp - 8]
mov dword [rbx + rax*4], esi
mov eax, dword [rbp - 8]
inc dword [rbp - 8]
cmp eax, 0xbb80
jae 0x418db0
mov rbx, qword [rbp - 0x10]
shl eax, 5
mov esi, dword [rbp - 4]
cmp esi, 0xbb80
jae 0x418db0
mov rdi, qword [rbp - 0x28]
shl esi, 5
mov rcx, qword [rdi + rsi]
mov rdx, qword [rdi + rsi + 8]
mov r8, qword [rdi + rsi + 0x10]
mov r9, qword [rdi + rsi + 0x18]
mov qword [rbx + rax + 4], rcx
mov qword [rbx + rax + 0xc], rdx
mov qword [rbx + rax + 0x14], r8
mov qword [rbx + rax + 0x1c], r9
jmp 0x418cc1
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418db2
mov rbx, qword [rbp - 0x18]
mov esi, dword [rbp - 8]
dec esi
mov dword [rbx + rax*4], esi
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418db4
mov rbx, qword [rbp - 0x28]
shl eax, 5
push 4
lea rax, [rbx + rax + 0xc]
push rax
mov eax, dword [rbp - 8]
dec eax
cmp eax, 0xbb80
jae 0x418db4
mov rbx, qword [rbp - 0x10]
shl eax, 5
push 4
lea rax, [rbx + rax + 0x10]
push rax
call fcn.00410e58
cmp eax, 0
jne 0x418db6
mov eax, dword [rbp - 4]
cmp eax, 0xbb80
jae 0x418db8
mov rbx, qword [rbp - 0x28]
shl eax, 5
push 0x10
lea rax, [rbx + rax + 0x10]
push rax
mov eax, dword [rbp - 8]
dec eax
cmp eax, 0xbb80
jae 0x418db8
mov rbx, qword [rbp - 0x10]
shl eax, 5
push 0x10
lea rax, [rbx + rax + 0x14]
push rax
call fcn.00410e58
cmp eax, 0
jne 0x418dba
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax]
jl 0x418ae4
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 8]
mov dword [rax], ebx
mov dword [rbp - 4], 0
jmp 0x418d34
mov eax, dword [rbp - 4]
cmp eax, 0x1d4c0
jae 0x418dbc
mov rbx, qword [rbp - 0x10]
imul eax, eax, 0xc
mov esi, dword [rbp - 4]
cmp esi, 0x1d4c0
jae 0x418dbc
mov rdi, qword [rbp - 0x10]
imul esi, esi, 0xc
mov esi, dword [rdi + rsi + 0x177008]
cmp esi, 0xbb80
jae 0x418dbc
mov rdi, qword [rbp - 0x18]
mov esi, dword [rdi + rsi*4]
mov dword [rbx + rax + 0x177008], esi
inc dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax + 0x177004]
jl 0x418ce5
mov r8, qword [rbp - 0x18]
xor edx, edx
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapFree]
add rsp, 0x20
mov r8, qword [rbp - 0x20]
xor edx, edx
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapFree]
add rsp, 0x20
mov r8, qword [rbp - 0x28]
xor edx, edx
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapFree]
add rsp, 0x20
leave
ret 0x10
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5