Function at 0x14000b8e0
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x14005bec0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r13, r8
mov rdi, rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
lea r14d, [rbx + 1]
cmp byte [0x1400609e3], bl
jne 0x14000b956
lea rcx, str.SeRestorePrivilege
call fcn.14001e0a8
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.14001e0a8
mov byte [0x1400609e3], r14b
lea rsi, [r13 + 0x130]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x40], rax
lea edx, [rax*4 + 0x1c]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
lea rcx, [rsp + 0x70]
call fcn.14000b538
nop
lea rcx, [0x140048c88]
call fcn.14003686c
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000b99e
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x140048c88]
xor r8d, r8d
mov rdx, rbx
call fcn.14000b654
mov r12, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
cmp rax, 0xffffffffffffffff
je 0x14000ba14
movups xmmword [rbp - 0x18], xmm0
movdqu xmmword [rbp - 8], xmm1
cmp rbx, 4
jb 0x14000c4f7
lea rax, [rbx - 4]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000b9fc
mov rdx, qword [rsi]
add rdx, 8
lea rcx, [rbp - 0x18]
call fcn.1400012c0
lea r15, [rbp - 0x18]
mov ebx, 5
jmp 0x14000ba3f
movups xmmword [rbp - 0x38], xmm0
movdqu xmmword [rbp - 0x28], xmm1
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000ba2a
mov rdx, qword [rsi]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.140008a84
lea r15, [rbp - 0x38]
mov ebx, 2
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea r8d, [rax + 0x20]
mov rdx, r15
lea rcx, [rbp - 0x58]
call fcn.140045070
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
movdqa xmm6, xmmword [0x1400489f0]
test bl, 2
je 0x14000bad1
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x14000bac2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000babd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c4fd
call fcn.140031c1c
movdqu xmmword [rbp - 0x28], xmm6
xor r15d, r15d
mov word [rbp - 0x38], r15w
jmp 0x14000bad4
xor r15d, r15d
test r14b, bl
je 0x14000bb2b
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x14000bb21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c503
call fcn.140031c1c
movdqa xmm6, xmmword [0x1400489f0]
movdqu xmmword [rbp - 8], xmm6
mov word [rbp - 0x18], r15w
cmp r12, 0xffffffffffffffff
je 0x14000bc97
lea rcx, str.UNC_
call fcn.14003686c
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, str.UNC_
xor r8d, r8d
mov r12, qword [rbp - 0x48]
mov rdx, r12
call fcn.14000b654
cmp rax, 0xffffffffffffffff
je 0x14000bc9b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
cmp r12, 3
jb 0x14000c509
lea rax, [r12 - 3]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x58]
mov r12d, 7
cmp qword [rbp - 0x40], r12
cmova rdx, qword [rbp - 0x58]
add rdx, 6
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea r8, [rbp - 0x78]
lea rdx, [0x140048ca4]
lea rcx, [rbp + 0x80]
call fcn.1400046b0
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x14000bc4b
mov rdx, qword [rbp - 0x40]
cmp rdx, r12
jbe 0x14000bc20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c50f
call fcn.140031c1c
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r12
mov word [rbp - 0x58], r15w
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140045070
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r12
mov word [rbx], r15w
lea rcx, [rbp + 0x80]
call fcn.140001fa8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r12
jbe 0x14000bc97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c515
call fcn.140031c1c
mov r12, qword [rbp - 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x58]
cmp byte [r15 + 0x93], 0
jne 0x14000bd24
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000bd0a
lea rcx, [r13 + 0x130]
call fcn.140016438
xor ecx, ecx
test al, al
jne 0x14000bd0a
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
lea r9, [r13 + 0x130]
lea rdx, [r13 + 0x28]
lea r8, [rbp - 0x78]
mov rcx, r15
call fcn.14000ce74
test al, al
jne 0x14000bd24
lea r8, [r13 + 0x130]
lea rdx, [r13 + 0x28]
mov ecx, 0x68
call fcn.140004df4
jmp 0x14000c1d5
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
mov r8b, byte [r15 + 0x5b]
mov dl, r14b
lea rcx, [rbp - 0x78]
call fcn.140012304
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000bd9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c51b
call fcn.140031c1c
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea rcx, [rbp - 0x78]
call fcn.14001265c
mov r15b, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000be0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c521
call fcn.140031c1c
test r15b, r15b
je 0x14000bf1c
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea rcx, [rbp - 0x78]
call fcn.140012670
mov ecx, eax
call fcn.140012758
mov r15b, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000be92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c527
call fcn.140031c1c
xorps xmm0, xmm0
xorps xmm1, xmm1
mov rcx, rdi
movups xmmword [rbp - 0x78], xmm0
movdqu xmmword [rbp - 0x68], xmm1
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
test r15b, r15b
je 0x14000bf09
lea rcx, [rbp - 0x78]
call fcn.14001247c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000bf1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c52d
call fcn.140031c1c
jmp 0x14000bf1c
lea rcx, [rbp - 0x78]
call fcn.14001256c
nop
lea rcx, [rbp - 0x78]
call fcn.140001fa8
xor r15d, r15d
cmp byte [r13 + 0x111], r15b
jne 0x14000c13d
cmp byte [r13 + 0x150], r15b
jne 0x14000c13d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c0a3
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x140060a80]
call fcn.14000acf8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000bfe1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c533
call fcn.140031c1c
xor r15d, r15d
mov r14b, r15b
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x14000c027
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c022
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c539
call fcn.140031c1c
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r15w
test rbx, rbx
je 0x14000c071
mov rdx, qword [rbp - 0x80]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c069
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c4f1
mov rcx, rbx
call fcn.140031c1c
mov al, r14b
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140031d30
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r13 + 0x128]
mov edx, 8
cmp eax, 3
jne 0x14000c1e9
mov dword [rbx], 0xa0000003
mov rcx, qword [rsp + 0x40]
lea eax, [r12 + 6]
add ax, cx
add ax, ax
mov word [rbx + 4], ax
and dword [rbx + 6], 0
movzx r15d, cx
add r15w, r15w
mov word [rbx + 0xa], r15w
cmp qword [rsi + 0x18], 7
jbe 0x14000c0f6
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
mov rdx, rsi
call fcn.1400369a4
add r15w, 2
mov word [rbx + 0xc], r15w
add r12w, r12w
mov word [rbx + 0xe], r12w
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 9
lea rcx, [rbx + rax*2]
call fcn.1400369a4
xor r15d, r15d
jmp 0x14000c279
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea rcx, [rbp - 0x78]
call fcn.1400122ec
mov r15b, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000c1b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c1ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c53f
call fcn.140031c1c
test r15b, r15b
jne 0x14000c0ac
lea r8, [rsp + 0x50]
lea rdx, [0x140048a04]
mov ecx, 0x14
call fcn.14000b6e4
mov r14d, 9
mov edx, r14d
lea rcx, [0x140060a80]
call fcn.14000b150
jmp 0x14000bfe1
dec eax
cmp eax, r14d
ja 0x14000bfe1
mov dword [rbx], 0xa000000c
mov rcx, qword [rsp + 0x40]
lea eax, [rcx + r12]
add ax, dx
add ax, ax
mov word [rbx + 4], ax
and dword [rbx + 6], 0
movzx r15d, cx
add r15w, r15w
mov word [rbx + 0xa], r15w
cmp qword [rsi + 0x18], 7
jbe 0x14000c228
mov rsi, qword [rsi]
lea rcx, [rbx + 0x14]
mov rdx, rsi
call fcn.1400369a4
add r15w, 2
mov word [rbx + 0xc], r15w
add r12w, r12w
mov word [rbx + 0xe], r12w
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 0xb
lea rcx, [rbx + rax*2]
call fcn.1400369a4
xor r15d, r15d
mov eax, r15d
cmp qword [rsp + 0x48], 0xffffffffffffffff
sete al
mov dword [rbx + 0x10], eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c33d
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x140060a80]
call fcn.14000acf8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000c327
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c322
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c545
call fcn.140031c1c
mov edx, 9
lea rcx, [0x140060a80]
call fcn.14000b150
jmp 0x14000bfe4
movzx r9d, word [rbx + 4]
add r9d, 8
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r8, rbx
mov edx, 0x900a4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000c3fb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, [0x140048a04]
mov ecx, 0x15
call fcn.14000b6e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000c3a9
cmp eax, 0x522
jne 0x14000c3bc
call fcn.14001d4e4
test al, al
jne 0x14000c3bc
mov ecx, 0x18
call fcn.140004d68
lea rcx, [0x140060a80]
call fcn.14000b194
mov edx, 9
lea rcx, [0x140060a80]
call fcn.14000b150
mov rcx, rdi
cmp byte [r13 + 0x111], r15b
je 0x14000c3f0
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000bfe4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000bfe4
lea rcx, [rbp + 0x10]
call fcn.1400113dc
nop
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
mov rax, qword [rax + 0x10]
call qword [0x140048528]
mov qword [rbp + 0x18], rsi
mov rsi, qword [rsp + 0x58]
mov eax, dword [rsi + 0x1d8]
lea rcx, [r13 + 0x70]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [rsi + 0x1d4]
lea rcx, [r13 + 0x68]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rsi + 0x1d0]
lea rcx, [r13 + 0x60]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x10]
call fcn.140011e70
lea rcx, [rbp + 0x10]
call fcn.1400114c0
cmp byte [rsi + 0xaa], r15b
jne 0x14000c4e3
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov rcx, rdi
call fcn.14003686c
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.1400012c0
nop
mov edx, dword [r13 + 0x24]
lea rcx, [rbp - 0x78]
call fcn.1400130f8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14000c4e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c54b
call fcn.140031c1c
nop
lea rcx, [rbp + 0x10]
call fcn.140011434
jmp 0x14000bfe7
call fcn.1400367f4
nop
call fcn.140006dd0
nop
call fcn.1400367f4
nop
call fcn.1400367f4
int3
call fcn.140006dd0
nop
call fcn.1400367f4
nop
call fcn.1400367f4
int3
call fcn.1400367f4
int3
call fcn.1400367f4
int3
call fcn.1400367f4
int3
call fcn.1400367f4
int3
call fcn.1400367f4
nop
call fcn.1400367f4
nop
call fcn.1400367f4
int3
call fcn.1400367f4
nop
call fcn.1400367f4
int3