Function at 0x180027810
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1800a11a0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, r8
mov rdi, rdx
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], rbx
call fcn.180029930
test al, al
jne 0x1800278df
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18002788d
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x180027888
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027c76
mov rcx, r8
call fcn.180032af0
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800278d8
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800278d3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027c7c
mov rcx, r8
call fcn.180032af0
xor al, al
jmp 0x180027c43
cmp qword [rdi + 0x10], 0
je 0x180027853
lea rdx, [rbp + 0x17]
call fcn.180028ee0
nop
mov r8d, 1
lea rdx, [0x18008d2f8]
lea rcx, [rbp + 0x17]
call fcn.180015970
mov rdx, rdi
lea rcx, [rbp - 0x59]
call fcn.18002c340
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180027924
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp + 0x17]
call fcn.180015970
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x18002796d
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c82
call fcn.180032af0
cmp qword [rbx + 0x10], 0
jne 0x180027a39
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.data_is_empty
mov ecx, pe_nt_image_headers64
call fcn.18001f390
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x1800279d9
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800279d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c9a
call fcn.180032af0
xor esi, esi
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180027a25
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180027a20
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027c76
mov rcx, r8
call fcn.180032af0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x18002789e
lea rdx, [rbp - 0x19]
call fcn.180029020
nop
mov r8, rax
lea rdx, [rbp - 0x59]
call fcn.1800276f0
mov rsi, rax
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x39]
call fcn.1800276f0
cmp qword [rsi + 0x18], 8
jb 0x180027a69
mov rsi, qword [rsi]
cmp qword [rax + 0x18], 8
jb 0x180027a73
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180027a80
mov rcx, qword [rbx]
movzx r9d, byte [0x1800a20b0]
mov r8, rsi
mov rdx, rax
call fcn.18002e380
movzx r14d, al
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x180027ad7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027ad2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c88
call fcn.180032af0
xor esi, esi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], si
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x180027b29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c8e
call fcn.180032af0
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], 7
mov word [rbp - 0x59], si
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180027b75
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027b6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c94
call fcn.180032af0
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x180027bb0
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027c9a
call fcn.180032af0
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180027bfa
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180027bf5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027c76
mov rcx, r8
call fcn.180032af0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180027c3f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180027c3a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027c7c
mov rcx, r8
call fcn.180032af0
movzx eax, r14b
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180032aa0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
nop
call fcn.180056698
int3