Function at 0x1400115d8
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r12, r8
mov r15, rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
lea r14d, [rbx + 1]
cmp byte [0x14006fe6e], bl
jne 0x14001164f
lea rcx, str.SeRestorePrivilege
call fcn.140013a4c
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.140013a4c
mov byte [0x14006fe6e], r14b
lea rsi, [r12 + 0x130]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x40], rax
lea edx, [rax*4 + 0x1c]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
lea rcx, [rsp + 0x70]
call fcn.1400011cc
nop
mov rcx, rsi
mov eax, 8
cmp qword [rsi + 0x18], rax
jb 0x140011690
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x20], 4
lea r9, [0x140058268]
xor r8d, r8d
mov rdx, rbx
call fcn.140011384
mov r13, rax
mov qword [rsp + 0x48], rax
or rdi, 0xffffffffffffffff
xor ecx, ecx
xorps xmm0, xmm0
cmp rax, rdi
je 0x14001170b
mov qword [rbp - 0x78], rcx
movdqu xmmword [rbp - 0x68], xmm0
cmp rbx, 4
jb 0x140012131
lea rax, [rbx - 4]
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400116f3
mov rdx, qword [rsi]
add rdx, 8
lea rcx, [rbp - 0x78]
call fcn.140003394
lea rax, [rbp - 0x78]
mov ebx, 5
jmp 0x140011736
mov qword [rbp - 0x38], rcx
movdqu xmmword [rbp - 0x28], xmm0
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140011721
mov rdx, qword [rsi]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.140008de0
lea rax, [rbp - 0x38]
mov ebx, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
lea eax, [rcx + 8]
test bl, 2
je 0x1400117a5
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x20]
cmp rdx, rax
jb 0x1400117a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001179b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012137
call fcn.1400409c4
mov eax, 8
test r14b, bl
je 0x1400117e9
mov rdx, qword [rbp - 0x60]
cmp rdx, rax
jb 0x1400117e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400117e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001213d
call fcn.1400409c4
cmp r13, rdi
mov r13, qword [rbp - 0x48]
je 0x1400118ea
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], 4
lea r9, str.UNC_
xor r8d, r8d
mov rdx, r13
call fcn.140011384
cmp rax, rdi
je 0x1400118ea
xor ebx, ebx
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
cmp r13, 3
jb 0x140012143
lea rax, [r13 - 3]
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
add rdx, 6
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
mov r9, r14
lea r8, [0x140057fb4]
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140007174
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400118d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400118d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012149
call fcn.1400409c4
movups xmmword [rbp - 0x58], xmm6
movups xmmword [rbp - 0x48], xmm7
lea rcx, [rbp - 0x78]
call fcn.14000323c
mov r13, qword [rbp - 0x48]
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
xor eax, eax
cmp byte [rbx + 0x9b], al
jne 0x14001195e
cmp qword [rsp + 0x48], rdi
jne 0x140011c84
mov rcx, rsi
call fcn.1400228dc
xor ecx, ecx
test al, al
jne 0x140011c84
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov r8, rdi
inc r8
cmp word [r15 + r8*2], cx
jne 0x14001192a
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
lea rdx, [r12 + 0x28]
mov r9, rsi
lea r8, [rbp - 0x78]
mov rcx, rbx
call fcn.140013544
test al, al
je 0x140011c84
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8, rdi
inc r8
cmp word [r15 + r8*2], ax
jne 0x14001196d
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
mov r8b, byte [rbx + 0x5f]
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.14001ac30
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400119d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400119cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001214f
call fcn.1400409c4
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8, rdi
inc r8
cmp word [r15 + r8*2], ax
jne 0x1400119e5
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rcx, [rbp - 0x78]
call fcn.14001afd4
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.14000323c
xor eax, eax
test bl, bl
je 0x140011b3b
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8, rdi
inc r8
cmp word [r15 + r8*2], ax
jne 0x140011a29
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rcx, [rbp - 0x78]
call fcn.14001afe8
mov ecx, eax
call fcn.14001b1a8
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.14000323c
xorps xmm0, xmm0
mov r8, rdi
movdqu xmmword [rbp - 0x68], xmm0
test bl, bl
je 0x140011ad7
xor ebx, ebx
mov qword [rbp - 0x78], rbx
inc r8
cmp word [r15 + r8*2], bx
jne 0x140011a70
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rcx, [rbp - 0x78]
call fcn.14001adfc
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140011b3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012155
call fcn.1400409c4
jmp 0x140011b3d
xor ebx, ebx
mov qword [rbp - 0x78], rbx
inc r8
cmp word [r15 + r8*2], bx
jne 0x140011add
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rcx, [rbp - 0x78]
call fcn.14001aee8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140011b3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001212b
jmp 0x140011ad0
xor ebx, ebx
cmp byte [r12 + 0x111], bl
jne 0x140011c1b
cmp byte [r12 + 0x150], bl
jne 0x140011c1b
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
jne 0x140011c0d
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
inc rdi
cmp word [r15 + rdi*2], bx
jne 0x140011b97
mov r8, rdi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x14006ff10]
call fcn.1400109a4
nop
mov rdx, qword [rbp - 0x60]
mov r13d, 8
cmp rdx, r13
jb 0x140011c8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001215b
call fcn.1400409c4
jmp 0x140011c8a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011d4c
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8, rdi
inc r8
cmp word [r15 + r8*2], bx
jne 0x140011c2a
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rcx, [rbp - 0x78]
call fcn.14001ac18
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.14000323c
test bl, bl
jne 0x140011d4a
lea r8, [rsp + 0x50]
lea rdx, [0x140057fd4]
mov ecx, 0x14
call fcn.140011414
mov edx, 9
lea rcx, [0x14006ff10]
call fcn.140010e50
mov r13d, 8
xor esi, esi
mov bl, sil
mov rdx, qword [rbp - 0x40]
cmp rdx, r13
jb 0x140011cce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011cc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012161
call fcn.1400409c4
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], si
test r14, r14
je 0x140011d17
mov rdx, qword [rbp - 0x80]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x140011d0f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012125
mov rcx, r14
call fcn.1400409c4
mov al, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140040b40
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
mov eax, dword [r12 + 0x128]
cmp eax, 3
jne 0x140011df7
mov dword [r14], 0xa0000003
mov r8, qword [rsp + 0x40]
lea eax, [r13 + 6]
add ax, r8w
add ax, ax
mov word [r14 + 4], ax
and dword [r14 + 6], 0
movzx ecx, r8w
add cx, cx
mov word [r14 + 0xa], cx
cmp qword [rsi + 0x18], 8
jb 0x140011d94
mov rsi, qword [rsi]
mov rdx, r14
sub rdx, rsi
mov r9d, 2
movzx eax, word [rsi]
mov word [rdx + rsi + 0x10], ax
add rsi, r9
test ax, ax
jne 0x140011da0
add cx, r9w
mov word [r14 + 0xc], cx
add r13w, r13w
mov word [r14 + 0xe], r13w
lea rcx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rcx, qword [rbp - 0x58]
lea rdx, [r8*2 + 0x12]
sub rdx, rcx
add rdx, r14
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r9
test ax, ax
jne 0x140011de3
jmp 0x140011ea8
dec eax
cmp eax, 1
ja 0x140011c84
mov dword [r14], 0xa000000c
mov r8, qword [rsp + 0x40]
lea eax, [r8 + r13]
mov edx, 8
add ax, dx
add ax, ax
mov word [r14 + 4], ax
and dword [r14 + 6], 0
movzx ecx, r8w
add cx, cx
mov word [r14 + 0xa], cx
cmp qword [rsi + 0x18], rdx
jb 0x140011e3c
mov rsi, qword [rsi]
mov rdx, r14
sub rdx, rsi
mov r9d, 2
movzx eax, word [rsi]
mov word [rdx + rsi + 0x14], ax
add rsi, r9
test ax, ax
jne 0x140011e48
add cx, r9w
mov word [r14 + 0xc], cx
add r13w, r13w
mov word [r14 + 0xe], r13w
lea rcx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rcx, qword [rbp - 0x58]
lea rdx, [r8*2 + 0x16]
sub rdx, rcx
add rdx, r14
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r9
test ax, ax
jne 0x140011e8b
mov eax, ebx
cmp qword [rsp + 0x48], rdi
sete al
mov dword [r14 + 0x10], eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor esi, esi
cmp rax, rdi
jne 0x140011f6b
mov qword [rbp - 0x78], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
inc rdi
cmp word [r15 + rdi*2], si
jne 0x140011eeb
mov r8, rdi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x14006ff10]
call fcn.1400109a4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x140011f55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012167
call fcn.1400409c4
mov edx, 9
lea rcx, [0x14006ff10]
call fcn.140010e50
jmp 0x140011c8c
movzx r9d, word [r14 + 4]
add r9d, r13d
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r8, r14
mov edx, 0x900a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140012028
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, [0x140057ffc]
mov ecx, 0x15
call fcn.140011414
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140011fd5
cmp eax, 0x522
jne 0x140011fe8
call fcn.140031ed8
test al, al
jne 0x140011fe8
mov ecx, 0x18
call fcn.140003c40
lea rcx, [0x14006ff10]
call fcn.140010ec0
mov edx, 9
lea rcx, [0x14006ff10]
call fcn.140010e50
mov rcx, r15
cmp byte [r12 + 0x111], sil
je 0x14001201d
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140011c8c
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140011c8c
lea rcx, [rbp - 0x10]
call fcn.1400199a8
nop
mov rax, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
mov rax, qword [rax + 0x10]
call qword [0x140057518]
mov qword [rbp - 8], rbx
mov rbx, qword [rsp + 0x58]
mov eax, dword [rbx + 0x3e0]
lea rcx, [r12 + 0x70]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [rbx + 0x3dc]
lea rcx, [r12 + 0x68]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rbx + 0x3d8]
lea rcx, [r12 + 0x60]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14001a4a0
lea rcx, [rbp - 0x10]
call fcn.140019a80
cmp byte [rbx + 0x2b2], sil
jne 0x140012112
mov qword [rbp - 0x78], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
inc rdi
cmp word [r15 + rdi*2], si
jne 0x1400120ad
mov r8, rdi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140003394
nop
mov edx, dword [r12 + 0x24]
lea rcx, [rbp - 0x78]
call fcn.14001befc
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x140012112
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001210c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001216d
call fcn.1400409c4
nop
lea rcx, [rbp - 0x10]
call fcn.140019a00
mov ebx, 1
jmp 0x140011c8f
call fcn.140045ef4
nop
call fcn.140045ef4
nop
call fcn.140006fbc
nop
call fcn.140045ef4
nop
call fcn.140045ef4
int3
call fcn.140006fbc
nop
call fcn.140045ef4
nop
call fcn.140045ef4
int3
call fcn.140045ef4
int3
call fcn.140045ef4
nop
call fcn.140045ef4
nop
call fcn.140045ef4
nop
call fcn.140045ef4
int3