Function at 0x1400040b1
Capabilities:
Delete file
Write file on windows

Disassembly:
jmp 0x14012aa10
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x900
mov rdi, rsp
mov ecx, 0x240
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x910]
mov qword [rsp + 0x858], 0xfffffffffffffffe
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0x8f0], rax
mov rcx, qword [rsp + 0x918]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14012aa89
mov rcx, qword [rsp + 0x920]
call fcn.140006938
movzx eax, al
test eax, eax
je 0x14012aa90
xor al, al
jmp 0x14012b9ca
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
jmp 0x14012aaad
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x920]
call fcn.140006df2
cmp qword [rsp + 0x48], rax
jae 0x14012aaf1
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x920]
call fcn.1400061b8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x94]
test eax, eax
je 0x14012aaef
mov byte [rsp + 0x40], 1
jmp 0x14012aaf1
jmp 0x14012aaa0
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14012ab01
xor al, al
jmp 0x14012b9ca
mov r8, qword [rsp + 0x918]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x910]
call fcn.140006cf3
nop
mov edx, 0x10
lea rcx, [rsp + 0xa8]
call fcn.14000451b
lea rcx, [rsp + 0xa8]
call fcn.1400061bd
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.140002b26
mov edx, 0x10
lea rcx, [rsp + 0xd8]
call fcn.140004b10
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xd8]
call fcn.1400047b9
nop
mov edx, 0x20
lea rcx, [rsp + 0x108]
call fcn.140005f7e
lea rcx, [rsp + 0x108]
call fcn.1400054ca
nop
mov byte [rsp + 0x144], 0
lea r9, [rsp + 0x144]
lea r8, [rsp + 0x108]
mov rdx, qword [rsp + 0x918]
mov rcx, qword [rsp + 0x910]
call fcn.1400071c1
mov byte [rsp + 0x154], al
movzx eax, byte [rsp + 0x154]
test eax, eax
jne 0x14012abf8
movzx eax, byte [rsp + 0x144]
test eax, eax
je 0x14012abf8
mov rcx, qword [rsp + 0x918]
call fcn.140004fac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x158], 0
jmp 0x14012ac1e
mov rax, qword [rsp + 0x158]
inc rax
mov qword [rsp + 0x158], rax
mov rcx, qword [rsp + 0x920]
call fcn.140006df2
cmp qword [rsp + 0x158], rax
jae 0x14012aec0
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x920]
call fcn.1400061b8
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
movzx eax, byte [rax + 0x94]
test eax, eax
je 0x14012aebb
mov qword [rsp + 0x168], 0
mov dword [rsp + 0x170], 0
jmp 0x14012ac96
mov eax, dword [rsp + 0x170]
inc eax
mov dword [rsp + 0x170], eax
mov eax, dword [rsp + 0x170]
mov qword [rsp + 0x860], rax
lea rcx, [rsp + 0x108]
call fcn.140006df2
mov rcx, qword [rsp + 0x860]
cmp rcx, rax
jae 0x14012ad30
mov eax, dword [rsp + 0x170]
mov edx, eax
lea rcx, [rsp + 0x108]
call fcn.140001690
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x160]
mov rcx, rax
call fcn.140004fac
mov qword [rsp + 0x868], rax
mov rcx, qword [rsp + 0x178]
call fcn.140004fac
mov rcx, qword [rsp + 0x868]
mov rdx, rcx
mov rcx, rax
call fcn.140003ed1
test eax, eax
jne 0x14012ad2b
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x168], rax
jmp 0x14012ad30
jmp 0x14012ac86
cmp qword [rsp + 0x168], 0
jne 0x14012ad93
lea rcx, [rsp + 0x190]
call fcn.140007725
nop
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x108]
call fcn.1400017a8
lea rcx, [rsp + 0x108]
call fcn.140006df2
dec rax
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.140001690
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x190]
call fcn.140004ca0
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x238], rax
mov rdx, qword [rsp + 0x238]
lea rcx, [rsp + 0x250]
call fcn.140003ad5
nop
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x238]
call fcn.1400046b5
mov rax, qword [rsp + 0x238]
lea rdx, [rsp + 0x250]
mov rcx, rax
call fcn.140001753
movzx eax, al
test eax, eax
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
add rax, 0x28
lea rdx, [rsp + 0x278]
mov rcx, rax
call fcn.140001753
movzx eax, al
test eax, eax
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x2c8]
cmp qword [rax + 0x78], rcx
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x2d0]
cmp qword [rax + 0x80], rcx
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x2d8]
cmp qword [rax + 0x88], rcx
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
add rax, 0x50
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call fcn.140001753
movzx eax, al
test eax, eax
jne 0x14012ae9a
mov rax, qword [rsp + 0x238]
mov ecx, dword [rsp + 0x2e0]
cmp dword [rax + 0x90], ecx
je 0x14012aeae
mov byte [rsp + 0x40], 1
mov rax, qword [rsp + 0x238]
mov byte [rax + 0x94], 1
lea rcx, [rsp + 0x250]
call fcn.140004ca0
jmp 0x14012ac0b
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x14012aedd
lea rcx, [rsp + 0x108]
call fcn.140006938
movzx eax, al
test eax, eax
je 0x14012af26
mov byte [rsp + 0x850], 0
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x850]
jmp 0x14012b9ca
mov edx, 0x20
lea rcx, [rsp + 0x308]
call fcn.140006dca
lea rcx, [rsp + 0x308]
call fcn.140008e31
nop
lea rcx, [rsp + 0x108]
call fcn.140006df2
mov rdx, rax
lea rcx, [rsp + 0x308]
call fcn.140001645
mov qword [rsp + 0x338], 0
jmp 0x14012af84
mov rax, qword [rsp + 0x338]
inc rax
mov qword [rsp + 0x338], rax
lea rcx, [rsp + 0x108]
call fcn.140006df2
cmp qword [rsp + 0x338], rax
jae 0x14012b3bd
mov rdx, qword [rsp + 0x338]
lea rcx, [rsp + 0x108]
call fcn.140001690
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
cmp dword [rax + 0x90], 1
je 0x14012aff1
mov rax, qword [rsp + 0x340]
cmp dword [rax + 0x90], 2
je 0x14012aff1
mov rax, qword [rsp + 0x340]
cmp dword [rax + 0x90], 3
je 0x14012aff1
jmp 0x14012af71
lea rcx, [rsp + 0x350]
call fcn.1400082e2
mov rdx, rax
lea rcx, [rsp + 0x308]
call fcn.140007fc2
lea rcx, [rsp + 0x308]
call fcn.1400074af
dec rax
mov rdx, rax
lea rcx, [rsp + 0x308]
call fcn.140001a23
mov qword [rsp + 0x740], rax
mov rax, qword [rsp + 0x740]
mov dword [rax], 0x23ab45db
mov rax, qword [rsp + 0x740]
add rax, 4
mov rdi, rax
xor eax, eax
mov ecx, 0x280
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x740]
add rax, 0x284
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x740]
add rax, 0x384
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x340]
mov rcx, rax
call fcn.14000281a
cmp rax, 0x13f
ja 0x14012b143
mov rax, qword [rsp + 0x340]
mov rcx, rax
call fcn.140004fac
mov qword [rsp + 0x870], rax
mov rax, qword [rsp + 0x740]
add rax, 4
mov qword [rsp + 0x878], rax
mov rax, qword [rsp + 0x878]
mov qword [rsp + 0x880], rax
mov rax, qword [rsp + 0x870]
movzx eax, word [rax]
mov word [rsp + 0x888], ax
mov rax, qword [rsp + 0x878]
movzx ecx, word [rsp + 0x888]
mov word [rax], cx
mov rax, qword [rsp + 0x870]
add rax, 2
mov qword [rsp + 0x870], rax
mov rax, qword [rsp + 0x878]
add rax, 2
mov qword [rsp + 0x878], rax
cmp word [rsp + 0x888], 0
jne 0x14012b0e8
jmp 0x14012b16d
mov rax, qword [rsp + 0x340]
mov rcx, rax
call fcn.140004fac
mov rcx, qword [rsp + 0x740]
add rcx, 4
mov r8d, 0x13e
mov rdx, rax
call fcn.140006b90
mov rax, qword [rsp + 0x340]
add rax, 0x28
mov rcx, rax
call fcn.14000281a
cmp rax, 0x7f
ja 0x14012b228
mov rax, qword [rsp + 0x340]
add rax, 0x28
mov rcx, rax
call fcn.140004fac
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x740]
add rax, 0x284
mov qword [rsp + 0x898], rax
mov rax, qword [rsp + 0x898]
mov qword [rsp + 0x8a0], rax
mov rax, qword [rsp + 0x890]
movzx eax, word [rax]
mov word [rsp + 0x8a8], ax
mov rax, qword [rsp + 0x898]
movzx ecx, word [rsp + 0x8a8]
mov word [rax], cx
mov rax, qword [rsp + 0x890]
add rax, 2
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x898]
add rax, 2
mov qword [rsp + 0x898], rax
cmp word [rsp + 0x8a8], 0
jne 0x14012b1cd
jmp 0x14012b259
mov rax, qword [rsp + 0x340]
add rax, 0x28
mov rcx, rax
call fcn.140004fac
mov rcx, qword [rsp + 0x740]
add rcx, 0x284
mov r8d, 0x7e
mov rdx, rax
call fcn.140006b90
mov rax, qword [rsp + 0x340]
add rax, 0x50
mov rcx, rax
call fcn.14000281a
cmp rax, 0x23
ja 0x14012b314
mov rax, qword [rsp + 0x340]
add rax, 0x50
mov rcx, rax
call fcn.140004fac
mov qword [rsp + 0x8b0], rax
mov rax, qword [rsp + 0x740]
add rax, 0x384
mov qword [rsp + 0x8b8], rax
mov rax, qword [rsp + 0x8b8]
mov qword [rsp + 0x8c0], rax
mov rax, qword [rsp + 0x8b0]
movzx eax, word [rax]
mov word [rsp + 0x8c8], ax
mov rax, qword [rsp + 0x8b8]
movzx ecx, word [rsp + 0x8c8]
mov word [rax], cx
mov rax, qword [rsp + 0x8b0]
add rax, 2
mov qword [rsp + 0x8b0], rax
mov rax, qword [rsp + 0x8b8]
add rax, 2
mov qword [rsp + 0x8b8], rax
cmp word [rsp + 0x8c8], 0
jne 0x14012b2b9
jmp 0x14012b345
mov rax, qword [rsp + 0x340]
add rax, 0x50
mov rcx, rax
call fcn.140004fac
mov rcx, qword [rsp + 0x740]
add rcx, 0x384
mov r8d, 0x23
mov rdx, rax
call fcn.140006b90
mov rax, qword [rsp + 0x740]
mov rcx, qword [rsp + 0x340]
mov rcx, qword [rcx + 0x78]
mov qword [rax + 0x3cc], rcx
mov rax, qword [rsp + 0x740]
mov rcx, qword [rsp + 0x340]
mov rcx, qword [rcx + 0x80]
mov qword [rax + 0x3d4], rcx
mov rax, qword [rsp + 0x740]
mov rcx, qword [rsp + 0x340]
mov rcx, qword [rcx + 0x88]
mov qword [rax + 0x3dc], rcx
mov rax, qword [rsp + 0x740]
mov rcx, qword [rsp + 0x340]
mov ecx, dword [rcx + 0x90]
mov dword [rax + 0x3e4], ecx
jmp 0x14012af71
lea rcx, [rsp + 0x308]
call fcn.1400082ce
movzx eax, al
test eax, eax
je 0x14012b428
mov byte [rsp + 0x851], 0
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x851]
jmp 0x14012b9ca
mov edx, 0x20
lea rcx, [rsp + 0x758]
call fcn.140006f41
lea rcx, [rsp + 0x758]
call fcn.140003684
nop
lea rcx, [rsp + 0x798]
call fcn.140008d6e
nop
lea rcx, [rsp + 0x308]
call fcn.1400074af
mov eax, eax
imul rax, rax, 0x3e8
mov qword [rsp + 0x8d0], rax
xor edx, edx
lea rcx, [rsp + 0x308]
call fcn.140001a23
lea r9, [rsp + 0x758]
mov rcx, qword [rsp + 0x8d0]
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x798]
call fcn.140002b80
movzx eax, al
test eax, eax
jne 0x14012b520
mov byte [rsp + 0x852], 0
lea rcx, [rsp + 0x798]
call fcn.140005abf
nop
lea rcx, [rsp + 0x758]
call fcn.140003599
nop
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x852]
jmp 0x14012b9ca
lea rcx, [rsp + 0x758]
call fcn.14000535d
movzx eax, al
test eax, eax
je 0x14012b5a7
mov byte [rsp + 0x853], 0
lea rcx, [rsp + 0x798]
call fcn.140005abf
nop
lea rcx, [rsp + 0x758]
call fcn.140003599
nop
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x853]
jmp 0x14012b9ca
mov rcx, qword [rsp + 0x918]
call fcn.140004fac
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call fcn.140007d4c
mov qword [rsp + 0x7c8], rax
cmp qword [rsp + 0x7c8], 0xffffffffffffffff
je 0x14012b602
cmp qword [rsp + 0x7c8], 0
jne 0x14012b6ac
mov r8, 0xffffffffffffffff
lea rdx, [0x1402260f4]
mov rcx, qword [rsp + 0x918]
call fcn.140006ded
mov qword [rsp + 0x7d0], rax
cmp qword [rsp + 0x7d0], 0xffffffffffffffff
je 0x14012b6ac
mov r9, qword [rsp + 0x7d0]
xor r8d, r8d
lea rdx, [rsp + 0x7e8]
mov rcx, qword [rsp + 0x918]
call fcn.140004c0a
nop
lea rcx, [rsp + 0x7e8]
call fcn.140006578
mov rcx, qword [rsp + 0x918]
call fcn.140004fac
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call fcn.140007d4c
mov qword [rsp + 0x7c8], rax
lea rcx, [rsp + 0x7e8]
call fcn.1400073ce
cmp qword [rsp + 0x7c8], 0xffffffffffffffff
jne 0x14012b6dd
cmp qword [rsp + 0x7c8], 0
jne 0x14012b6dd
mov r8d, 0x1a2
lea rdx, [0x140226280]
lea rcx, str._hFile_____HANDLE__LONG_PTR__1_____hFile___0_
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x7c8], 0xffffffffffffffff
je 0x14012b6f3
cmp qword [rsp + 0x7c8], 0
jne 0x14012b766
mov byte [rsp + 0x854], 0
lea rcx, [rsp + 0x798]
call fcn.140005abf
nop
lea rcx, [rsp + 0x758]
call fcn.140003599
nop
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x854]
jmp 0x14012b9ca
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x824], 0
lea rcx, [rsp + 0x758]
call fcn.140007bcb
mov qword [rsp + 0x8d8], rax
xor edx, edx
lea rcx, [rsp + 0x758]
call fcn.1400057c7
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x824]
mov rcx, qword [rsp + 0x8d8]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x824]
mov qword [rsp + 0x8e0], rax
lea rcx, [rsp + 0x758]
call fcn.140007bcb
mov rcx, qword [rsp + 0x8e0]
cmp rcx, rax
je 0x14012b81c
mov r8d, 0x1ab
lea rdx, [0x140226380]
lea rcx, str.dwWriteLen__writeData.size__
call fcn.1400070db
xor eax, eax
mov rcx, qword [rsp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x7c8], 0
mov eax, dword [rsp + 0x824]
mov qword [rsp + 0x8e8], rax
lea rcx, [rsp + 0x758]
call fcn.140007bcb
mov rcx, qword [rsp + 0x8e8]
cmp rcx, rax
jne 0x14012b95c
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x928]
call fcn.140005bc3
mov qword [rsp + 0x838], 0
jmp 0x14012b8a7
mov rax, qword [rsp + 0x838]
inc rax
mov qword [rsp + 0x838], rax
mov rcx, qword [rsp + 0x928]
call fcn.140006df2
cmp qword [rsp + 0x838], rax
jae 0x14012b8ec
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rsp + 0x928]
call fcn.140001690
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x840]
mov byte [rax + 0x94], 0
jmp 0x14012b894
mov byte [rsp + 0x855], 1
lea rcx, [rsp + 0x798]
call fcn.140005abf
nop
lea rcx, [rsp + 0x758]
call fcn.140003599
nop
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x855]
jmp 0x14012b9ca
mov byte [rsp + 0x856], 0
lea rcx, [rsp + 0x798]
call fcn.140005abf
nop
lea rcx, [rsp + 0x758]
call fcn.140003599
nop
lea rcx, [rsp + 0x308]
call fcn.1400061c7
nop
lea rcx, [rsp + 0x108]
call fcn.14000501f
nop
lea rcx, [rsp + 0xd8]
call fcn.140001028
nop
lea rcx, [rsp + 0xa8]
call fcn.1400024a0
nop
lea rcx, [rsp + 0x68]
call fcn.1400073ce
movzx eax, byte [rsp + 0x856]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140226eb0]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0x8f0]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0x900
pop rdi
ret