Function at 0x14003c6b0
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x120
mov rax, qword [0x14018f080]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor ecx, ecx
call fcn.140041070
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x58]
imul ecx, eax
mov eax, ecx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.14003c5f0
movzx eax, al
test eax, eax
je 0x14003c707
mov rax, 0xffffffffffffffff
jmp 0x14003cb0d
lea rax, [0x14018f3c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
add eax, 0xa
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], 0
jmp 0x14003c745
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x50], eax
jge 0x14003c780
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
mov ecx, 0x34
div rcx
mov rax, rdx
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
movsxd rdx, dword [rsp + 0x50]
lea rdi, [0x14018f3c0]
movzx eax, byte [rcx + rax]
mov byte [rdi + rdx], al
jmp 0x14003c73b
lea rcx, [rsp + 0xf0]
call fcn.14003bf60
nop
lea rcx, [rsp + 0xf0]
call fcn.14003fac0
movzx eax, al
test eax, eax
je 0x14003c7c2
mov qword [rsp + 0x60], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x60]
jmp 0x14003cb0d
lea rcx, [rsp + 0xf0]
call fcn.14003f1d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov r8d, 0x8708
lea rdx, [0x140168c70]
lea rcx, [rsp + 0xf0]
call fcn.140047d80
movzx eax, al
test eax, eax
jne 0x14003c819
mov qword [rsp + 0x68], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x68]
jmp 0x14003cb0d
lea rcx, [rsp + 0xf0]
call fcn.140046140
movzx eax, al
test eax, eax
jne 0x14003c863
lea rcx, [rsp + 0xf0]
call fcn.14003f1d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov qword [rsp + 0x70], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x70]
jmp 0x14003cb0d
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x40]
movzx r8d, byte [rsp + 0x41]
movzx edx, byte [rsp + 0x42]
lea rcx, [rsp + 0xd0]
call fcn.140033090
mov rcx, rax
call fcn.14003f3b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14003c8fe
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14003c928
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0x78], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x78]
jmp 0x14003cb0d
lea rax, [rsp + 0x43]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x45]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x43]
movzx r8d, byte [rsp + 0x44]
movzx edx, byte [rsp + 0x45]
lea rcx, [rsp + 0xe0]
call fcn.140033650
mov rcx, rax
call fcn.14003f3b0
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14002dc80
nop
lea rcx, [rsp + 0xb0]
call fcn.140048210
mov qword [0x14018f428], rax
lea rcx, [rsp + 0xb0]
call fcn.14002dff0
cmp qword [0x14018f428], 0
jne 0x14003c9ed
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0x80], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x80]
jmp 0x14003cb0d
mov rcx, qword [rsp + 0x48]
call fcn.14003a5d0
movzx eax, al
test eax, eax
jne 0x14003ca2e
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0x88], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x88]
jmp 0x14003cb0d
mov rcx, qword [rsp + 0x48]
call fcn.140039900
movzx eax, al
test eax, eax
jne 0x14003ca6f
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0x90], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x90]
jmp 0x14003cb0d
mov rcx, qword [rsp + 0x48]
call fcn.14003a1f0
movzx eax, al
test eax, eax
jne 0x14003caad
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0x98], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0x98]
jmp 0x14003cb0d
mov rcx, qword [rsp + 0x48]
call fcn.14003ad20
movzx eax, al
test eax, eax
jne 0x14003caeb
mov rcx, qword [rsp + 0x48]
call fcn.14003dff0
mov qword [rsp + 0xa0], 0xffffffffffffffff
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0xa0]
jmp 0x14003cb0d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xf0]
call fcn.1400393f0
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140160680
add rsp, 0x120
pop rdi
ret