Function at 0x1401f3e64
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12, r8
mov rbp, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + 0x30]
xor r14d, r14d
test al, al
jne 0x1401f3eae
lea rcx, [rbx - 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp 0x1401f40e9
mov sil, 1
or r15, 0xffffffffffffffff
cmp byte [rbx + 0x70], r14b
je 0x1401f3efc
xor eax, eax
mov rcx, r15
lea rdi, [r12 + 0x2c]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 7
jbe 0x1401f3efc
lea rdx, [0x1403370e0]
lea rcx, [r12 + 0x2c]
call fcn.1400bee84
test rax, rax
je 0x1401f3efc
sub rax, r12
sub rax, 0x2c
sar rax, 1
inc eax
je 0x1401f40e9
mov rdx, rbp
lea rcx, [rbx - 8]
call fcn.14020efc0
test al, al
jne 0x1401f40e9
cmp dword [rbx + 0x84], 8
jl 0x1401f3f3a
lea rcx, [r12 + 0x2c]
lea rdx, str.SuggestedSites.dat
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1401f3f3a
call fcn.1401ef6b4
cmp al, 1
setne sil
cmp dword [rbx + 0x84], 0xa
jl 0x1401f3f5f
lea rcx, [r12 + 0x2c]
lea rdx, str.container.dat
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
movzx esi, sil
test eax, eax
cmovne esi, r14d
test sil, sil
je 0x1401f40e9
lea rcx, [r12 + 0x2c]
lea rdx, str.index.dat
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1401f3fa0
mov sil, r14b
mov rax, qword [rbx + 0x18]
cmp byte [rax + 1], r14b
jne 0x1401f40e9
mov rcx, rbp
call fcn.1401bd3b4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test sil, sil
je 0x1401f40e9
mov ecx, 0x88
call fcn.1400be454
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401f3fcb
mov rdx, qword [rbx + 8]
mov rcx, rax
call fcn.14006de38
jmp 0x1401f3fce
mov rax, r14
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400186f8
nop
mov r9, qword [rsp + 0x28]
test rbp, rbp
jne 0x1401f3feb
mov ecx, r14d
jmp 0x1401f3ffc
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbp
lea rcx, [r9 + 0x20]
call fcn.14000c9f8
mov edx, dword [r12 + 0x1c]
shl rdx, 0x20
mov eax, dword [r12 + 0x20]
or rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x28], rdx
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x30], 1
mov rax, qword [rbx]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x68]
mov rdx, qword [rsp + 0x28]
cmp byte [rdx + 0x70], r14b
jne 0x1401f4054
mov rax, qword [rbx + 0x18]
cmp byte [rax + 1], r14b
je 0x1401f40b3
mov dl, 1
mov rcx, rbp
call fcn.14020ec00
test al, al
jne 0x1401f40b3
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x1401f40a0
cmp qword [rax + 0x80], r14
je 0x1401f40a0
mov rax, qword [rax + 0x80]
cmp byte [rax + 0x20], r14b
je 0x1401f40a0
mov rax, qword [rbx + 0x18]
mov rcx, rbx
lea rdx, [rsp + 0x28]
cmp byte [rax + 1], r14b
mov rax, qword [rbx]
je 0x1401f409b
call qword [rax + 0x60]
jmp 0x1401f40b3
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
jmp 0x1401f40b3
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x28]
add qword [rbx + 0x78], rcx
inc dword [rbx + 0x80]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1401f40e9
mov eax, r15d
lock xadd dword [rdi + 8], eax
add eax, r15d
jne 0x1401f40e9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r15d
lock xadd dword [rdi + 0xc], eax
add eax, r15d
jne 0x1401f40e9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret