Function at 0x140002f50
Capabilities:
Delete file

Disassembly:
sub rsp, 0xd8
xor ecx, ecx
call fcn.140001010
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x78]
imul ecx, eax
mov eax, ecx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8d, 0x64
xor edx, edx
lea rcx, [0x140044570]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
add eax, 0xa
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], 0
jmp 0x140002fba
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x50], eax
jge 0x140002ff6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
mov ecx, 0x34
div rcx
mov rax, rdx
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
movsxd rdx, dword [rsp + 0x50]
lea r8, [0x140044570]
movzx eax, byte [rcx + rax]
mov byte [r8 + rdx], al
jmp 0x140002fb0
lea rcx, [0x140044570]
call fcn.140004c00
call fcn.1400026d0
movzx eax, al
test eax, eax
je 0x14000301a
mov rax, 0xffffffffffffffff
jmp 0x1400033c3
lea rcx, [rsp + 0x58]
call fcn.140004a20
nop
lea rcx, [rsp + 0x58]
call fcn.14000a500
movzx eax, al
test eax, eax
je 0x140003059
mov qword [rsp + 0x80], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x80]
jmp 0x1400033c3
lea rcx, [rsp + 0x58]
call fcn.14000a260
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
cmp dword [0x1400445d4], 4
je 0x140003082
cmp dword [0x1400445d4], 3
jne 0x14000312b
mov dword [rsp + 0x40], 0
jmp 0x140003096
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
cmp rax, 0x96a0
jae 0x1400030e8
mov eax, dword [rsp + 0x40]
lea rcx, [0x140022710]
movzx eax, byte [rcx + rax]
xor eax, 0xcd
mov ecx, dword [rsp + 0x40]
lea rdx, [0x140022710]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x40]
lea rcx, [0x140022710]
movzx eax, byte [rcx + rax]
xor eax, 0xd8
mov ecx, dword [rsp + 0x40]
lea rdx, [0x140022710]
mov byte [rdx + rcx], al
jmp 0x14000308c
mov r8d, 0x96a0
lea rdx, [0x140022710]
lea rcx, [rsp + 0x58]
call fcn.140011a70
movzx eax, al
test eax, eax
jne 0x140003129
mov qword [rsp + 0x88], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x88]
jmp 0x1400033c3
jmp 0x14000317e
cmp dword [0x1400445d4], 1
je 0x14000313d
cmp dword [0x1400445d4], 2
jne 0x14000317e
mov r8d, 0x8708
lea rdx, section..data
lea rcx, [rsp + 0x58]
call fcn.140011a70
movzx eax, al
test eax, eax
jne 0x14000317e
mov qword [rsp + 0x90], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x90]
jmp 0x1400033c3
lea rcx, [rsp + 0x58]
call fcn.140011200
movzx eax, al
test eax, eax
jne 0x1400031c5
lea rcx, [rsp + 0x58]
call fcn.14000a260
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov qword [rsp + 0x98], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0x98]
jmp 0x1400033c3
mov qword [rsp + 0x48], 0
cmp dword [0x1400445d4], 1
je 0x1400031e0
cmp dword [0x1400445d4], 2
jne 0x140003218
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..Nal
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
jmp 0x14000324e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..Ndd
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000325e
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000328b
mov rcx, qword [rsp + 0x48]
call fcn.1400033e0
mov qword [rsp + 0xa0], 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0xa0]
jmp 0x1400033c3
lea rdx, [0x140015780]
lea rcx, [rsp + 0xb0]
call fcn.140007dc0
nop
lea rcx, [rsp + 0xb0]
call fcn.140011b50
mov qword [0x1400445d8], rax
lea rcx, [rsp + 0xb0]
call fcn.140008a60
cmp dword [0x1400445d4], 4
jne 0x1400032f6
mov rcx, qword [rsp + 0x48]
call fcn.1400013c0
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.140001030
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
jmp 0x1400033a4
cmp dword [0x1400445f0], 0x3d
je 0x140003341
cmp dword [0x1400445f0], 0x96c80
je 0x140003341
cmp dword [0x1400445f0], 0x96c81
je 0x140003341
cmp dword [0x1400445f0], 0x3e
je 0x140003341
cmp dword [0x1400445f0], 0x999d0
je 0x140003341
cmp dword [0x1400445f0], 0x3f
je 0x140003341
cmp dword [0x1400445f0], 0x9c270
jne 0x140003350
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
jmp 0x1400033a4
cmp dword [0x1400445f0], 0x64
je 0x14000337d
cmp dword [0x1400445f0], 0x98be80
je 0x14000337d
cmp dword [0x1400445f0], 0x98bfda
je 0x14000337d
cmp dword [0x1400445f0], 0x98ceb9
jne 0x1400033a4
mov rcx, qword [rsp + 0x48]
call fcn.1400013c0
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.140001fd0
movzx eax, al
mov rcx, qword [rsp + 0x48]
call fcn.1400045b0
movzx eax, al
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x58]
call fcn.140008a90
mov rax, qword [rsp + 0xa8]
add rsp, 0xd8
ret