Function at 0x1400e97d0
Capabilities:
Clear file content
Delete file
Get file size

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov qword [r11 - 0x28], rcx
lea rax, [0x140174b60]
mov qword [rcx], rax
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1400e98b3
mov rcx, qword [rax]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e98b3
mov rbx, qword [rsp + 0x48]
lea rdx, [r11 - 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
test eax, eax
je 0x1400e99bc
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
cmp qword [rsp + 0x30], rcx
jbe 0x1400e98b3
mov rsi, qword [rdi + 0x48]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e9876
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
and qword [rdi + 0x48], 0
mov rdx, qword [rdi + 0x40]
cmp qword [rdx], 0
jne 0x1400e98b5
lea rcx, [rdi + 8]
cmp qword [rcx + 0x18], 8
jb 0x1400e9893
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400e98b3
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x43]
call fcn.14008e070
nop
jmp 0x1400e990d
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1400e98c3
mov rcx, qword [rax]
jmp 0x1400e98c5
xor ecx, ecx
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop
test eax, eax
je 0x1400e99cf
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1400e98f0
mov rcx, qword [rax]
jmp 0x1400e98f2
xor ecx, ecx
mov rbx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
test eax, eax
je 0x1400e99e2
jmp 0x1400e98b3
mov rcx, qword [rdi + 0x48]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e9922
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400e9932
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
mov rcx, qword [rdi + 0x38]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400e9947
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x1400e998a
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e998a
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
nop
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400e998a
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
nop
lea rcx, [rdi + 8]
call fcn.140006970
nop
lea rax, [0x1401719f0]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010fb20
nop
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x3b]
mov rcx, rbx
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x49]
mov rcx, rbx
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
lea edx, [rax + 0x4a]
mov rcx, rbx
call fcn.1400290d4
nop
int3