Function at 0x12578
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x330], rax
xor r15d, r15d
xor eax, eax
mov r13, rcx
mov r14, rdx
mov dword [r11 - 0x2d8], r15d
mov dword [rsp + 0x7c], eax
lea r8d, [r15 + 0x24]
lea rcx, [r11 - 0x2a4]
xor edx, edx
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x94], eax
mov dword [r11 - 0x2a8], r15d
mov qword [r11 - 0x2e8], rax
call fcn.000407c0
lea r8d, [r15 + 0x14]
lea rcx, [rsp + 0xac]
xor edx, edx
mov dword [rsp + 0xa8], r15d
call fcn.000407c0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x88], r15
cmp r13, r15
je 0x12ab5
cmp r14, r15
je 0x12ab5
mov rax, qword [0x0006a6a8]
mov ebx, 0x100
lea edi, [r15 + 1]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
lea esi, [rbx - 0x80]
mov ebp, 0x80100000
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], r15
mov r8, r13
lea rcx, [rsp + 0x70]
mov edx, ebp
cmp rax, r15
je 0x1267e
call rax
jmp 0x12684
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, r15d
jge 0x127b6
cmp eax, 0xc000003b
jne 0x12aba
mov rax, qword [0x00040db0]
lea rcx, [rsp + 0x120]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [0x00040db8]
mov r8d, 0x1ee
mov qword [rcx + 8], rax
mov rax, qword [0x00040dc0]
mov qword [rcx + 0x10], rax
movzx eax, word [0x00040dc8]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x13a]
call fcn.000407c0
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [r13 + 0x10]
mov r11d, 0x208
lea rcx, [rsp + 0x98]
mov word [rsp + 0x9a], r11w
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x98]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0xf8], rax
mov rax, qword [0x0006a6a8]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0xe8], 0x30
mov qword [rsp + 0xf0], r15
mov dword [rsp + 0x100], 0x240
mov qword [rsp + 0x108], r15
mov qword [rsp + 0x110], r15
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xe8]
mov edx, ebp
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], r15
cmp rax, r15
je 0x127a7
call rax
jmp 0x127ad
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, r15d
jl 0x12aba
mov rax, qword [0x0006a6a8]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 8
mov ebp, 5
lea r9, [rsp + 0x78]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r8, r14
mov edx, 0x40000000
lea rcx, [rsp + 0x88]
cmp rax, r15
je 0x12815
call rax
jmp 0x1281b
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, r15d
mov ebx, eax
jl 0x12a37
mov rax, qword [0x0006a6c8]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebp
mov r9d, 0x18
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x78]
cmp rax, r15
je 0x12852
call rax
jmp 0x12858
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r15d
mov ebx, eax
jl 0x129fb
mov ebp, dword [rsp + 0xb0]
mov ebx, 0x20
mov r8d, 0x6e65654b
mov rdx, rbp
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r15
jne 0x12892
add ebx, 0xffffffff
jne 0x1286f
mov rsi, r15
jmp 0x1289f
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp rsi, r15
jne 0x128ae
mov ebx, 0xc000009a
jmp 0x129fb
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.00015964
cmp eax, r15d
jl 0x12932
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.00015a50
mov rax, qword [0x0006a6c8]
mov rcx, qword [rsp + 0x70]
mov ebp, 4
lea r9d, [rbp + 0x24]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x20], ebp
cmp rax, r15
je 0x12961
call rax
jmp 0x12967
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r15d
mov ebx, eax
jl 0x129ed
mov rax, qword [0x0006a6d0]
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x20], ebp
mov r9d, 0x28
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x78]
cmp rax, r15
je 0x1299d
call rax
jmp 0x129a3
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
mov eax, dword [rsp + 0xe0]
test dil, al
je 0x129ed
mov rcx, qword [rsp + 0x70]
and eax, 0xfffffffe
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0xe0], eax
mov rax, qword [0x0006a6d0]
mov r9d, 0x28
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x78]
cmp rax, r15
je 0x129e7
call rax
jmp 0x129ed
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edx, 0x6e65654b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x00062988]
cmp rax, r15
je 0x12a19
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x98]
call rax
mov rax, qword [0x0006a6e0]
mov rcx, qword [rsp + 0x88]
cmp rax, r15
je 0x12a31
call rax
jmp 0x12a37
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [0x0006a6e0]
mov rcx, qword [rsp + 0x70]
cmp rax, r15
je 0x12a4c
call rax
jmp 0x12a52
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, r15d
jl 0x12a8b
lea rdx, [0x00040dd0]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [r13 + 0x10]
lea rdx, [rsp + 0x98]
call fcn.0001f6e0
mov rdx, qword [r13 + 0x10]
cmp ax, word [rdx]
jae 0x12ab1
mov rcx, r13
jmp 0x12a9b
cmp ebx, 0xc0000043
jne 0x12a98
mov ebx, r15d
jmp 0x12ab1
mov rcx, r14
mov rax, qword [0x0006a6d8]
cmp rax, r15
je 0x12aab
call rax
jmp 0x12ab1
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov eax, ebx
jmp 0x12aba
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret