Function at 0x406290
Capabilities:
Delete file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb08
mov r12, rcx
mov rax, r9
cmp edx, 0x4e
je 0x4069b0
jbe 0x406630
cmp edx, 0x110
je 0x406670
cmp edx, 0x111
jne 0x406a4e
cmp r8w, 2
jbe 0x406658
mov r13d, 1
cmp r8w, 0xca
jne 0x406619
lea r13, [rsp + 0x50]
xor eax, eax
mov ecx, 0x13
mov rdi, r13
lea rbp, [rsp + 0xf0]
rep stosq qword [rdi], rax
mov rdx, rbp
lea rax, str.backtrace.txt
nop dword [rax]
movzx ecx, word [rax]
add rax, 2
add rdx, 2
mov word [rdx - 2], cx
test cx, cx
jne 0x406318
xor ecx, ecx
mov rsi, qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rbx, [rsp + 0x300]
call rsi
mov r9d, 0x400
mov r8, rbx
mov edx, 0x13
mov rdi, qword [0x00452030]
mov rcx, rax
call rdi
cmp word [rsp + 0x300], 0
je 0x4069fc
mov rax, rbx
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x406370
sub rax, rbx
sar rax, 1
cdqe
lea rcx, [rax + rax + 2]
add rcx, rbx
lea rax, str..txt
mov rdx, rcx
nop dword [rax]
movzx r8d, word [rax]
add rax, 2
add rdx, 2
mov word [rdx - 2], r8w
test r8w, r8w
jne 0x406398
cmp word [rcx], 0
je 0x406a21
mov rax, rcx
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x4063c0
sub rax, rcx
mov r8, rax
sar r8, 1
add r8d, 1
movsxd r8, r8d
add r8, r8
lea r14, [rcx + r8]
xor ecx, ecx
mov qword [rsp + 0x48], r14
call rsi
mov r9d, 0x400
mov edx, 0x14
mov r8, r14
mov rcx, rax
mov rax, r14
sub rax, rbx
sar rax, 1
sub r9d, eax
call rdi
mov rdx, qword [rsp + 0x48]
cmp word [rdx], 0
je 0x406a36
mov rax, rdx
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x406420
sub rax, rdx
sar rax, 1
add eax, 1
cdqe
add rax, rax
add rax, rdx
lea rdx, [0x004304a2]
mov qword [rsp + 0x48], rax
nop word [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
add rax, 2
mov word [rax - 2], cx
test cx, cx
jne 0x406450
mov rdx, qword [rsp + 0x48]
cmp word [rdx], 0
je 0x406a2c
mov rax, rdx
nop word cs:[rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x406480
sub rax, rdx
sar rax, 1
add eax, 1
cdqe
add rax, rax
add rax, rdx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov word [rax], dx
mov dword [rsp + 0x50], 0x98
mov qword [rsp + 0x58], r12
call rsi
mov qword [rsp + 0x68], rbx
mov rcx, r13
mov qword [rsp + 0x60], rax
lea rax, [0x004304aa]
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x88], 0x104
mov dword [rsp + 0xb0], 0x880806
mov qword [rsp + 0xb8], rax
call qword [0x00451910]
test eax, eax
je 0x406666
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov rcx, qword [rsp + 0x80]
mov r8d, 1
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x406a10
mov r13, qword [0x0044d110]
mov rbp, qword [sym.imp.ucrtbase.dll_strlen]
mov rcx, r13
call rbp
lea r9, [rsp + 0x44]
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x40658a
mov rcx, qword [0x0044d110]
call rbp
mov edx, dword [rsp + 0x44]
cmp rdx, rax
je 0x406a40
mov rcx, r12
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x68]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.kernel32.dll_DeleteFileW]
xor ecx, ecx
mov r13d, 1
call rsi
mov r9d, 0x400
mov r8, rbx
mov edx, 0x15
mov rcx, rax
call rdi
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
xor edx, edx
mov ecx, 0x1100
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x48]
mov r8, rbx
xor ecx, ecx
mov r9d, 0x10
call qword [0x00452040]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_LocalFree]
mov rax, r13
add rsp, 0xb08
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp edx, 5
je 0x406878
cmp edx, 0x24
jne 0x406a4e
mov rdx, qword [0x0044d040]
mov r13d, 1
mov qword [r9 + 0x18], rdx
jmp 0x406619
test r8w, r8w
je 0x406666
xor ecx, ecx
call qword [0x00452058]
mov r13d, 1
jmp 0x406619
xor r9d, r9d
lea rbx, [rsp + 0x300]
mov edx, 0x67
mov rsi, qword [0x00452060]
mov r8d, 0x31
mov r13d, 1
mov qword [rsp + 0x20], 0
call rsi
mov r8, rbx
mov edx, 0x5c
mov rcx, rax
call qword [0x00451a38]
xor ecx, ecx
mov byte [rsp + 0x31b], 1
mov word [rsp + 0x31c], cx
mov rcx, rbx
call qword [0x00451a30]
mov r8d, 0x30
mov edx, 0x67
mov rcx, r12
mov qword [rsp + 0x20], 1
mov r9, rax
call rsi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov r9d, 0x100
mov r8, rbx
mov edx, 0x16
mov rcx, rax
call qword [0x00452030]
mov r8, rbx
mov edx, 0x67
mov rcx, r12
call qword [0x00452070]
mov rsi, qword [0x00451f98]
mov edx, 0x67
mov rcx, r12
call rsi
mov rbx, qword [0x00451f48]
xor edx, edx
mov rcx, rax
call rbx
mov edx, 0xca
mov rcx, r12
call rsi
xor edx, edx
mov rcx, rax
call rbx
lea rbx, [rsp + 0xf0]
mov rcx, r12
mov rdx, rbx
call qword [0x00451f78]
mov rax, qword [rsp + 0xf8]
mov rdx, rbx
mov rcx, r12
mov rdi, qword [0x00452000]
mov qword [0x0044d048], rax
call rdi
mov edx, 1
mov rcx, r12
movq xmm1, qword [rsp + 0xf0]
movq xmm0, qword [rsp + 0xf8]
psubd xmm0, xmm1
movq qword [0x0044d040], xmm0
call rsi
mov rdx, rbx
mov rcx, rax
call rdi
mov rbp, qword [0x00452038]
mov r8, rbx
xor ecx, ecx
mov r9d, 2
mov rdx, r12
call rbp
mov rax, qword [rsp + 0xf0]
mov edx, 0xca
mov rcx, r12
mov qword [0x0044d038], rax
call rsi
mov rdx, rbx
mov rcx, rax
call rdi
mov r9d, 2
mov r8, rbx
xor ecx, ecx
mov rdx, r12
call rbp
mov rax, qword [rsp + 0xf0]
mov edx, 0x66
mov rcx, r12
mov qword [0x0044d030], rax
call rsi
mov rdx, rbx
mov rcx, rax
call rdi
mov r9d, 2
mov r8, rbx
xor ecx, ecx
mov rdx, r12
call rbp
mov rax, qword [rsp + 0xf0]
mov edx, 0x67
mov rcx, r12
mov qword [0x0044d028], rax
call rsi
mov rdx, rbx
mov rcx, rax
call rdi
mov r9d, 2
mov r8, rbx
mov rdx, r12
xor ecx, ecx
call rbp
movq xmm0, qword [rsp + 0xf8]
movq xmm1, qword [rsp + 0xf0]
psubd xmm0, xmm1
movq qword [0x0044d020], xmm0
jmp 0x406619
mov r13d, 1
test r8, 0xfffffffffffffffd
jne 0x406619
mov r14d, dword [0x0044d03c]
movsx esi, r9w
sar r9d, 0x10
mov edi, dword [0x0044d038]
sub esi, dword [0x0044d048]
mov ebx, r9d
sub ebx, dword [0x0044d04c]
mov edx, 1
mov rbp, qword [0x00451f98]
add r14d, ebx
add edi, esi
call rbp
mov r9d, r14d
mov r8d, edi
xor edx, edx
mov rdi, qword [0x00452078]
mov dword [rsp + 0x30], 0x15
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
mov r15d, dword [0x0044d034]
mov rcx, r12
mov edx, 0xca
mov r14d, dword [0x0044d030]
call rbp
add r15d, ebx
xor edx, edx
mov dword [rsp + 0x30], 0x15
add r14d, esi
mov r9d, r15d
mov rcx, rax
mov dword [rsp + 0x28], 0
mov r8d, r14d
mov dword [rsp + 0x20], 0
call rdi
mov r15d, dword [0x0044d02c]
mov rcx, r12
mov edx, 0x66
mov r14d, dword [0x0044d028]
call rbp
add r15d, ebx
xor edx, edx
mov dword [rsp + 0x30], 0x15
mov r9d, r15d
mov r8d, r14d
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
add ebx, dword [0x0044d024]
mov rcx, r12
mov edx, 0x67
add esi, dword [0x0044d020]
call rbp
mov dword [rsp + 0x30], 0x16
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov rcx, rax
xor edx, edx
mov dword [rsp + 0x20], esi
call rdi
jmp 0x406619
mov edx, dword [r9 + 0x10]
xor r13d, r13d
and edx, 0xfffffffd
cmp edx, 0xfffffffc
jne 0x406619
cmp r8, 0x66
jne 0x406619
mov dword [rsp + 0x28], 5
xor r9d, r9d
lea r8, [rax + 0x88]
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.open
call qword [0x00451d88]
jmp 0x406619
mov ecx, 2
jmp 0x406387
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x68]
jmp 0x4065ad
mov r8d, 2
jmp 0x4063dd
mov eax, 2
jmp 0x406498
mov eax, 2
jmp 0x406438
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x406666
xor r13d, r13d
jmp 0x406619