Function at 0x180068e20
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0x90]
lea r12d, [rcx + 0x13]
mov r15, r9
mov ebp, ecx
cmp ecx, r12d
jae case.0x180068e90.6
mov rdi, qword [rsp + 0x48]
lea r9, [0x180000000]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x48]
nop dword [rax]
lea eax, [rbp - 3]
cmp eax, 0x40
ja case.0x180068e90.15
movzx eax, byte [r9 + rax + 0x6933c]
mov ecx, dword [r9 + rax*4 + 0x692ec]
add rcx, r9
jmp rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
jmp case.0x180068e90.15
cmp dword [rsp + 0x30], 1
jge case.0x180068e90.15
mov esi, 0xa5
cmp esi, 0xa5
je 0x180068f08
cmp esi, 0x24bd
je 0x180068f04
cmp esi, 0x48d5
jne 0x180068f19
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
jmp 0x180068f19
xor r9d, r9d
mov rdx, r15
xor ecx, ecx
lea r8d, [r9 + 0x44]
call fcn.18009fdb0
add esi, 0x2418
cmp esi, 0x6c48
jbe 0x180068ed2
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
jmp case.0x180068e90.15
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xe0
call fcn.1800a3a80
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
mov rdi, rax
jmp case.0x180068e90.15
mov rdx, r15
mov ecx, 0xf
call fcn.1800d0d90
mov qword [rsp + 0x48], rax
cmp rax, 0
jne 0x180068ea6
mov eax, 0xffffffff
jmp 0x180068eec
mov dword [r15 + 0x280], 0
jmp case.0x180068e90.15
movsxd rbp, dword [rsp + 0x30]
add rbp, rdi
nop word [rax + rax]
mov esi, 0x121
nop word [rax + rax]
cmp esi, 0x164bc
ja 0x1800690e0
je 0x1800690d8
cmp esi, 0x121
je 0x1800690a1
cmp esi, 0x4840
je 0x1800690f8
cmp esi, 0x8f5f
je 0x180069077
cmp esi, 0xd67e
je 0x180069068
cmp esi, 0x11d9d
jne 0x180069162
mov ecx, dword [rsp + 0x90]
cmp ecx, 0x80
jge 0x180069053
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x180069053
mov ecx, dword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x38], 1
lea r9, [rsp + 0x90]
jmp 0x180069109
movsx eax, byte [rdi]
mov dword [rsp + 0x90], eax
jmp 0x180069162
cmp rdi, rbp
jb 0x180069162
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
mov ebp, 0x42
jmp case.0x180068e90.15
mov r14, rdi
cmp rdi, rbp
jae 0x180069162
nop dword [rax]
movsx eax, byte [rdi]
cmp al, 0x80
jae 0x180069162
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180069162
inc rdi
cmp rdi, rbp
jb 0x1800690b0
jmp 0x180069162
inc rdi
jmp 0x180069162
cmp esi, 0x1abdb
je 0x18006915f
cmp esi, 0x1f2fa
je 0x18006911d
cmp esi, 0x28138
jne 0x180069162
cmp r14, rdi
jae 0x180069162
mov eax, edi
mov r9, r14
sub eax, r14d
mov dword [rsp + 0x38], eax
mov r8, r15
lea rdx, [rsp + 0x38]
mov ecx, 0xcd
call fcn.1800612d0
jmp 0x180069162
cmp rdi, rbp
jae 0x180069158
movsx eax, byte [rdi]
cmp al, 0xc0
jb 0x180069144
inc rdi
cmp rdi, rbp
jae 0x180069158
movzx eax, byte [rdi]
and al, 0xc0
cmp al, 0x80
jne 0x180069153
inc rdi
cmp rdi, rbp
jb 0x180069131
jmp 0x180069153
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x180069158
inc rdi
cmp rdi, rbp
jb 0x180069122
mov esi, 0x1f2fa
jmp 0x180069162
mov r14, rdi
add esi, 0x471f
cmp esi, 0x2c736
jbe 0x180068fe0
jmp 0x180068fd0
mov r13, r15
jmp case.0x180068e90.15
mov rcx, qword [r15 + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
jmp case.0x180068e90.15
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
jmp 0x180068e9b
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x48]
jmp case.0x180068e90.15
cmp dword [rdx], 1
jge case.0x180068e90.15
mov esi, 0xd5
mov eax, esi
sub eax, 0xd5
je 0x180069203
sub eax, 1
je 0x1800691ff
cmp eax, 1
je case.0x180068e90.6
jmp 0x180069214
xor ebx, ebx
jmp 0x180069214
xor r9d, r9d
mov rdx, r15
xor ecx, ecx
lea r8d, [r9 + 0x44]
call fcn.18009fdb0
inc esi
cmp esi, 0xd8
jb 0x1800691e6
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
jmp case.0x180068e90.15
mov rcx, qword [r15 + 0x278]
call fcn.1801060fc
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
jmp case.0x180068e90.15
mov rcx, qword [r13]
cmp rcx, 0xffffffffffffffff
je 0x18006926f
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [r13 + 8]
jmp 0x180068e9b
mov rcx, qword [r15 + 0x268]
call fcn.1801060fc
mov rdx, qword [rsp + 0x98]
lea r9, [0x180000000]
mov r8, qword [rsp + 0xa0]
mov dword [r15 + 0x270], 0
jmp case.0x180068e90.15
mov eax, dword [rsp + 0x40]
neg eax
sbb ebx, ebx
neg ebx
dec ebx
jmp case.0x180068e90.15
mov eax, 0xda
cmp eax, 0xda
je 0x1800692e4
add eax, 0x919e
cmp eax, 0x919e
jbe 0x1800692c1
inc ebp
cmp ebp, r12d
jb 0x180068e70
jmp case.0x180068e90.6
xor eax, eax
jmp 0x180068eec