Function at 0x140028d60
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x230], 0xfffffffffffffffe
lea rsi, [rbp - 0x60]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x220], xmm0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
movabs r15, 0x7fffffffffffffff
cmp rax, r15
jae 0x1400291c6
mov rsi, rax
cmp rax, 7
ja 0x140028df9
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], 7
add rsi, rsi
lea rcx, [rbp + 0x210]
lea rdx, [rbp - 0x60]
mov r8, rsi
call fcn.14002b030
jmp 0x140028e9b
mov qword [rbp + 0x228], 7
mov rax, rsi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x1400291d0
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx + rbx]
cmp rbx, 0x7ff
jb 0x140028e62
movabs rax, 0x7fffffffffffffec
cmp rbx, rax
jae 0x1400291d0
add rcx, 0x29
call fcn.140029c54
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140028e6e
add rcx, 2
call fcn.140029c54
mov rdi, rax
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], rbx
mov r8, rsi
add r8, rsi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14002b030
mov word [rdi + rsi*2], 0
mov rsi, qword [rbp + 0x220]
cmp qword [rbp + 0x228], 8
jb 0x140028eb5
mov r14, qword [rbp + 0x210]
jmp 0x140028ebc
lea r14, [rbp + 0x210]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x50], xmm0
cmp rsi, r15
jae 0x1400291cb
cmp rsi, 7
ja 0x140028ef9
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
add rsi, rsi
lea rcx, [rbp - 0x60]
mov rdx, r14
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
jmp 0x140028f8f
mov qword [rbp - 0x48], 7
mov rax, rsi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x1400291d5
cmp rax, 0xb
mov edi, 0xa
cmovae rdi, rax
lea rcx, [rdi + rdi]
cmp rdi, 0x7ff
jb 0x140028f62
movabs rax, 0x7fffffffffffffec
cmp rdi, rax
jae 0x1400291d5
add rcx, 0x29
call fcn.140029c54
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140028f6e
add rcx, 2
call fcn.140029c54
mov rbx, rax
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rdi
lea r8, [rsi + rsi]
mov rcx, rbx
mov rdx, r14
call fcn.14002b030
mov word [rbx + rsi*2], 0
lea rcx, [rbp - 0x60]
call fcn.140029290
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 7
mov ecx, 0x20
call fcn.140029c54
mov qword [rbp + 0x1f0], rax
movaps xmm0, xmmword [0x140031360]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [str._old.exe]
movups xmmword [rax], xmm0
mov word [rax + 0x10], 0
movaps xmm0, xmmword [0x140031370]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [str..exe]
movaps xmmword [rbp + 0x1d0], xmm0
lea rsi, [rbp + 0x1b0]
lea rdx, [rbp + 0x210]
lea r8, [rbp + 0x1d0]
lea r9, [rbp + 0x1f0]
mov rcx, rsi
call fcn.140029490
mov rax, qword [rbp + 0x1e8]
cmp rax, 8
jb 0x140029073
mov rcx, qword [rbp + 0x1d0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14002906e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400291c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
mov rax, qword [rbp + 0x208]
cmp rax, 8
jb 0x1400290bf
mov rcx, qword [rbp + 0x1f0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400290ba
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400291c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
cmp qword [rbp + 0x1c8], 8
jb 0x1400290d0
mov rsi, qword [rbp + 0x1b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rax, qword [rbp + 0x1c8]
cmp rax, 8
jb 0x140029125
mov rcx, qword [rbp + 0x1b0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029120
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400291c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x140029167
mov rcx, qword [rbp - 0x60]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029162
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400291c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
mov rax, qword [rbp + 0x228]
cmp rax, 8
jb 0x1400291af
mov rcx, qword [rbp + 0x210]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400291aa
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400291c0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
nop
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.140001590
call fcn.140001590
call fcn.1400015b0
call fcn.1400015b0
int3