Function at 0x140015bf0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r8
call fcn.140003c20
mov rcx, r15
call fcn.140001cc0
test al, al
jne 0x140015e76
mov rcx, rdi
call fcn.140001cc0
test al, al
jne 0x140015e76
xor r14d, r14d
cmp byte [rdi + 0x38], r14b
jne 0x140015d39
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140018cd0
nop
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], ax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.1400070f0
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 1], rax
mov byte [rbp + 7], r14b
mov rcx, qword [rbp - 0x39]
test rcx, rcx
jne 0x140015caa
xor bl, bl
jmp 0x140015cc6
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x140015cc0
xor bl, bl
jmp 0x140015cc6
mov byte [rbp - 0x31], 1
mov bl, 1
mov byte [rbp + 7], bl
mov byte [rbp - 0x49], 0
lea r8, [rdi + 0x20]
lea r9, [rbp - 0x49]
mov rdx, rdi
call fcn.140017d70
test al, al
jne 0x140015cf8
cmp byte [rbp - 0x49], al
je 0x140015cf8
mov rcx, rdi
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test bl, bl
je 0x140015d0f
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140015d0b
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x31], 0
mov qword [rbp - 1], r14
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140015d26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], 0
lea rcx, [rbp - 0x29]
call fcn.140001dd0
mov byte [rdi + 0x38], 1
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x28]
cmp rcx, rax
je 0x140015e76
mov esi, r14d
sub rax, rcx
sar rax, 7
test rax, rax
je 0x140015e8f
mov rbx, r14
shl rbx, 7
add rbx, rcx
mov rcx, rbx
call fcn.140001ccc
mov rdx, rax
mov rcx, r15
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140015da4
inc esi
mov rcx, qword [rdi + 0x20]
mov ebx, esi
mov rax, qword [rdi + 0x28]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jb 0x140015d60
jmp 0x140015e8f
mov rcx, r15
call fcn.140001cc0
test al, al
jne 0x140015e76
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
lea r8, [rbp - 0x29]
call fcn.140006fb0
test al, al
je 0x140015e76
mov edx, dword [rbp - 0x21]
shl rdx, 0x20
mov eax, dword [rbp - 0x25]
add rdx, rax
mov r8d, dword [rbp - 0x11]
shl r8, 0x20
mov eax, dword [rbp - 0x15]
add r8, rax
mov ecx, dword [rbp - 0xd]
shl rcx, 0x20
mov eax, dword [rbp - 9]
add rcx, rax
cmp qword [rbx + 0x60], rcx
jne 0x140015e76
cmp qword [rbx + 0x68], r8
jne 0x140015e76
cmp qword [rbx + 0x70], rdx
jne 0x140015e76
cmp byte [rdi + 0x39], 0
je 0x140015e7f
lea rcx, [rbx + 0x40]
call fcn.140001cc0
test al, al
jne 0x140015e76
lea rcx, [rbp - 1]
call fcn.140001f6c
nop
lea r8, [rbp - 1]
mov rdx, r15
call fcn.1400190e0
test al, al
jne 0x140015e4a
lea rcx, [rbp - 1]
call fcn.140003c20
lea rcx, [rbx + 0x40]
call fcn.140001ccc
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop
lea rcx, [rbp - 1]
test eax, eax
je 0x140015e7a
call fcn.140001dd0
xor eax, eax
jmp 0x140015e92
call fcn.140001dd0
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.140001d5c
mov r14d, dword [rbx + 0x78]
mov eax, r14d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret