Function at 0x140001610
Capabilities:
Delete file
Move file

Disassembly:
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x408
lea rdi, [rsp + 0x20]
mov ecx, 0xfa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x420]
mov rax, qword [0x140009020]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400056a0]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x298]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000169a
lea rcx, str.Error_fetching_USERPROFILE._n
call fcn.140002a60
lea rcx, [0x1400056d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, dword [rsp + 0x20]
jmp 0x1400019ec
lea rax, [rsp + 0x2d8]
lea rcx, str..accessibility.properties
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x318]
lea rcx, str..acce__ibility.properties
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x2b8]
dec rax
cmp rax, 0xe9
ja 0x1400016f8
mov rax, qword [rsp + 0x2b8]
dec rax
cmp rax, 0xe9
jbe 0x14000171a
lea rcx, str.The_USERPROFILE_environment_variable_is_too_long._n
call fcn.140002a60
lea rcx, str.It_must_be_no_longer_than_233_characters._n
call fcn.140002a60
mov eax, 0x7b
jmp 0x1400019ec
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x3e0], rax
cmp qword [rsp + 0x3e0], 0x104
jae 0x14000173b
jmp 0x140001740
call fcn.140002c54
mov rax, qword [rsp + 0x3e0]
mov byte [rsp + rax + 0x40], 0
mov r8, qword [rsp + 0x298]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x40]
call fcn.1400027b0
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x3e8], rax
cmp qword [rsp + 0x3e8], 0x104
jae 0x140001798
jmp 0x14000179d
call fcn.140002c54
mov rax, qword [rsp + 0x3e8]
mov byte [rsp + rax + 0x170], 0
mov r8, qword [rsp + 0x298]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x170]
call fcn.1400027b0
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x298], 0
lea r8, [0x14000569c]
lea rdx, [rsp + 0x40]
lea rcx, [0x140009120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400018e7
movzx eax, byte [rsp + 0x420]
test eax, eax
je 0x1400018da
lea r8, [0x1400056ac]
lea rdx, [rsp + 0x40]
lea rcx, [0x140009120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001873
lea rdx, [rsp + 0x40]
lea rcx, str.Couldnt_create_file:__s_n
call fcn.140002a60
lea rcx, [0x14000579c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1400018d8
lea rax, [rsp + 0x360]
lea rcx, str.assistive_technologiescom.sun.java.accessibility.AccessBridge_n
mov rdi, rax
mov rsi, rcx
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x3a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rdx, str.screen_magnifier_presenttrue_n
lea rcx, [rsp + 0x360]
call fcn.140002810
lea rdx, [rsp + 0x360]
mov rcx, qword [0x140009120]
call fcn.1400029e0
mov rcx, qword [0x140009120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400018e2
mov dword [rsp + 0x20], 0
jmp 0x1400019e8
lea r8, [0x1400056f4]
lea rdx, [rsp + 0x170]
lea rcx, [0x140009128]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001938
lea rdx, [rsp + 0x170]
lea rcx, str.Couldnt_open_temp_file:__s_n
call fcn.140002a60
lea rcx, [0x1400057c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, dword [rsp + 0x20]
jmp 0x1400019ec
movzx eax, byte [rsp + 0x420]
test eax, eax
je 0x14000194b
call fcn.1400010a0
jmp 0x140001950
call fcn.140001420
mov rcx, qword [0x140009120]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x140009128]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x1400019a1
lea rdx, [rsp + 0x40]
lea rcx, str.Couldnt_remove_file:__s_n
call fcn.140002a60
lea rcx, [0x14000584c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x1400019ec
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x170]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
test eax, eax
je 0x1400019e8
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x170]
lea rcx, str.Couldnt_rename__s_to__s._n
call fcn.140002a60
lea rcx, str.Error
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x1400019ec
mov eax, dword [rsp + 0x20]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400062b0]
call fcn.140002de8
mov rax, rdi
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140002ef0
add rsp, 0x408
pop rdi
pop rsi
ret