Function at 0x140009d40
Capabilities:
Delete file
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140015010]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r12d, r12d
mov dword [rbp - 0x10], 0x100
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rax, [rbp + 0x60]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140009db0
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x14000a52f
movabs r13, 0x8000000000000000
mov r15d, 0x16
mov qword [rsp + 0x48], 0xf
cmp rbx, 0x10
jae 0x140009e0b
mov qword [rsp + 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r12b
jmp 0x140009e9d
mov rsi, rbx
or rsi, 0xf
cmp rsi, r14
jbe 0x140009e39
mov rsi, r14
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.14000b8d0
test rax, rax
je 0x140009e5c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140009e75
cmp rsi, r15
cmovb rsi, r15
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140009e63
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a51d
jmp 0x140009e1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140009e72
call fcn.14000b8d0
mov r15, rax
jmp 0x140009e75
mov r15, r12
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov r8, rbx
lea rdx, [rbp + 0x60]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], r12b
mov r15d, 0x16
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.14000a7b0
mov rsi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x24
jb 0x140009ef5
lea rax, [rcx + 0x24]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140009ed6
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8d, 0x24
lea rdx, str.AppDataLocalTemp_screenshot_1.jpg
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x24], 0
jmp 0x140009f15
mov qword [rsp + 0x20], 0x24
lea r9, str.AppDataLocalTemp_screenshot_1.jpg
mov edx, 0x24
mov rcx, rsi
call fcn.1400063d0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rsi]
movaps xmmword [rbp], xmm0
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rbp + 0x10], xmm1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140009f80
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009f7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
movdqa xmm0, xmmword [0x14000f9b0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140009fd1
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009fcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x60]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000a000
cmp rbx, r14
ja 0x14000a535
mov qword [rsp + 0x68], 0xf
cmp rbx, 0x10
jae 0x14000a041
mov qword [rsp + 0x60], rbx
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], 0
jmp 0x14000a0cf
mov rsi, rbx
or rsi, 0xf
cmp rsi, r14
jbe 0x14000a06f
mov rsi, r14
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.14000b8d0
test rax, rax
je 0x14000a093
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14000a0ac
cmp rsi, 0x16
cmovb rsi, r15
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000a09a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a523
jmp 0x14000a054
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000a0a9
call fcn.14000b8d0
mov r15, rax
jmp 0x14000a0ac
mov r15, r12
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r8, rbx
lea rdx, [rbp + 0x60]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], 0
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.14000a7b0
mov rsi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x24
jb 0x14000a127
lea rax, [rcx + 0x24]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x14000a108
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8d, 0x24
lea rdx, str.AppDataLocalTemp_screenshot_0.jpg
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x24], 0
jmp 0x14000a147
mov qword [rsp + 0x20], 0x24
lea r9, str.AppDataLocalTemp_screenshot_0.jpg
mov edx, 0x24
mov rcx, rsi
call fcn.1400063d0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rbp + 0x30], xmm1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000a1b2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a1ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
movdqa xmm0, xmmword [0x14000f9b0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000a203
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a1fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lea rax, [rbp + 0x60]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000a230
cmp rdi, r14
ja 0x14000a517
mov qword [rbp - 0x78], 0xf
cmp rdi, 0x10
jae 0x14000a26f
mov qword [rbp - 0x80], rdi
mov r8, rdi
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x70], 0
jmp 0x14000a2fc
mov rax, rdi
or rax, 0xf
cmp rax, r14
jbe 0x14000a29e
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.14000b8d0
test rax, rax
je 0x14000a423
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000a2dc
mov r14, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14000a2ca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a529
jmp 0x14000a27f
test rcx, rcx
je 0x14000a2d9
call fcn.14000b8d0
mov rbx, rax
jmp 0x14000a2dc
mov rbx, r12
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r14
mov r8, rdi
lea rdx, [rbp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.14000a7b0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x24
jb 0x14000a354
lea rax, [rcx + 0x24]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000a335
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0x24
lea rdx, str.AppDataLocalTemp_screenshot_2.jpg
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x24], 0
jmp 0x14000a374
mov qword [rsp + 0x20], 0x24
lea r9, str.AppDataLocalTemp_screenshot_2.jpg
mov edx, 0x24
mov rcx, rdi
call fcn.1400063d0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rbp + 0x50], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a3df
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a3da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a3da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
movdqa xmm0, xmmword [0x14000f9b0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000a430
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a42a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a42a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b914
nop
lea rbx, [rbp]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000a441
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x14000a488
lea rdx, str.Datei
call fcn.140001eb0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000a46b
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140002370
lea rdx, str._erfolgreich_gel
mov rcx, rax
call fcn.140001eb0
jmp 0x14000a4ad
lea rdx, str.Fehler_beim_L
call fcn.140001eb0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000a4a1
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140002370
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rbx, 0x20
lea rax, [rbp + 0x60]
cmp rbx, rax
jne 0x14000a434
lea r9, [fcn.140001ba0]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp]
call fcn.14000b948
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000b8b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
nop
call fcn.140001120
nop
call fcn.140001120
nop
call fcn.1400011c0
nop
call fcn.1400011c0
int3