Function at 0x140002ad0
Capabilities:
Delete file

Disassembly:
sub rsp, 0xd8
xor ecx, ecx
call fcn.140001010
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x78]
imul ecx, eax
mov eax, ecx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8d, 0x64
xor edx, edx
lea rcx, [0x140044570]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
add eax, 0xa
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], 0
jmp 0x140002b3a
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x50], eax
jge 0x140002b76
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
mov ecx, 0x34
div rcx
mov rax, rdx
lea rcx, [0x140015c38]
movsxd rdx, dword [rsp + 0x50]
lea r8, [0x140044570]
movzx eax, byte [rcx + rax]
mov byte [r8 + rdx], al
jmp 0x140002b30
lea rcx, [0x140044570]
call fcn.140004c00
call fcn.1400026d0
movzx eax, al
test eax, eax
je 0x140002b9a
mov rax, 0xffffffffffffffff
jmp 0x140002f36
lea rcx, [rsp + 0x58]
call fcn.140004a20
nop
lea rcx, [rsp + 0x58]
call fcn.14000a500
movzx eax, al
test eax, eax
je 0x140002bd9
mov qword [rsp + 0x80], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x80]
jmp 0x140002f36
lea rcx, [rsp + 0x58]
call fcn.14000a260
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
cmp dword [0x1400445d4], 4
je 0x140002c02
cmp dword [0x1400445d4], 3
jne 0x140002cab
mov dword [rsp + 0x40], 0
jmp 0x140002c16
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
cmp rax, 0xc238
jae 0x140002c68
mov eax, dword [rsp + 0x40]
lea rcx, [0x14002bdb0]
movzx eax, byte [rcx + rax]
xor eax, 0xcd
mov ecx, dword [rsp + 0x40]
lea rdx, [0x14002bdb0]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x40]
lea rcx, [0x14002bdb0]
movzx eax, byte [rcx + rax]
xor eax, 0xd8
mov ecx, dword [rsp + 0x40]
lea rdx, [0x14002bdb0]
mov byte [rdx + rcx], al
jmp 0x140002c0c
mov r8d, 0xc238
lea rdx, [0x14002bdb0]
lea rcx, [rsp + 0x58]
call fcn.140011a70
movzx eax, al
test eax, eax
jne 0x140002ca9
mov qword [rsp + 0x88], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x88]
jmp 0x140002f36
jmp 0x140002cfe
cmp dword [0x1400445d4], 1
je 0x140002cbd
cmp dword [0x1400445d4], 2
jne 0x140002cfe
mov r8d, 0x8708
lea rdx, section..data
lea rcx, [rsp + 0x58]
call fcn.140011a70
movzx eax, al
test eax, eax
jne 0x140002cfe
mov qword [rsp + 0x90], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x90]
jmp 0x140002f36
lea rcx, [rsp + 0x58]
call fcn.140011200
movzx eax, al
test eax, eax
jne 0x140002d45
lea rcx, [rsp + 0x58]
call fcn.14000a260
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov qword [rsp + 0x98], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x98]
jmp 0x140002f36
mov qword [rsp + 0x48], 0
cmp dword [0x1400445d4], 1
je 0x140002d60
cmp dword [0x1400445d4], 2
jne 0x140002d98
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [0x140015730]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
jmp 0x140002dce
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [0x140015740]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140002dde
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140002e0b
mov rcx, qword [rsp + 0x48]
call fcn.1400033e0
mov qword [rsp + 0xa0], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0xa0]
jmp 0x140002f36
lea rdx, [0x140015750]
lea rcx, [rsp + 0xb0]
call fcn.140007dc0
nop
lea rcx, [rsp + 0xb0]
call fcn.140011b50
mov qword [0x1400445d8], rax
lea rcx, [rsp + 0xb0]
call fcn.140008a60
cmp dword [0x1400445d4], 4
jne 0x140002e69
mov rcx, qword [rsp + 0x48]
call fcn.140001030
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
jmp 0x140002f17
cmp dword [0x1400445f0], 0x3d
je 0x140002eb4
cmp dword [0x1400445f0], 0x96c80
je 0x140002eb4
cmp dword [0x1400445f0], 0x96c81
je 0x140002eb4
cmp dword [0x1400445f0], 0x3e
je 0x140002eb4
cmp dword [0x1400445f0], 0x999d0
je 0x140002eb4
cmp dword [0x1400445f0], 0x3f
je 0x140002eb4
cmp dword [0x1400445f0], 0x9c270
jne 0x140002ec3
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
jmp 0x140002f17
cmp dword [0x1400445f0], 0x64
je 0x140002ef0
cmp dword [0x1400445f0], 0x98be80
je 0x140002ef0
cmp dword [0x1400445f0], 0x98bfda
je 0x140002ef0
cmp dword [0x1400445f0], 0x98ceb9
jne 0x140002f17
mov rcx, qword [rsp + 0x48]
call fcn.1400013c0
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.140001fd0
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0xa8]
add rsp, 0xd8
ret