Function at 0x14000c748
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140052b88]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
xor edi, edi
mov dword [rsp + 0x60], edi
lea r15d, [rdi + 1]
cmp byte [0x140057663], dil
jne 0x14000c7ba
lea rcx, str.SeRestorePrivilege
call fcn.14000e25c
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.14000e25c
mov byte [0x140057663], r15b
lea r14, [r12 + 0x130]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x40], rax
lea edx, [rax*4 + 0x1c]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x70]
call fcn.14000c1e4
nop
lea rcx, str.___
call fcn.14002da58
mov rcx, r14
mov edx, 8
cmp qword [r14 + 0x18], rdx
jb 0x14000c807
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
mov qword [rsp + 0x20], rax
lea r9, str.___
xor r8d, r8d
mov rdx, rbx
call fcn.14000c3a8
mov r13, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
je 0x14000c87a
mov qword [rbp - 0x18], rdi
movdqu xmmword [rbp - 8], xmm0
cmp rbx, 4
jb 0x14000d2ed
lea rax, [rbx - 4]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c862
mov rdx, qword [r14]
add rdx, 8
lea rcx, [rbp - 0x18]
call fcn.140002ac0
lea rbx, [rbp - 0x18]
mov edi, 5
jmp 0x14000c8a5
mov qword [rbp - 0x38], rdi
movdqu xmmword [rbp - 0x28], xmm0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c890
mov rdx, qword [r14]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.140007c54
lea rbx, [rbp - 0x38]
mov edi, 2
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea r8d, [rax + 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140029880
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea ebx, [rax + 8]
test dil, 2
je 0x14000c932
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x20]
cmp rdx, rbx
jb 0x14000c921
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c91a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2f3
call fcn.140028644
xor eax, eax
movdqa xmm0, xmmword [0x14003f9a0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], ax
test r15b, dil
je 0x14000c98b
mov rdx, qword [rbp]
cmp rdx, rbx
jb 0x14000c976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2f9
call fcn.140028644
movdqa xmm0, xmmword [0x14003f9a0]
movdqu xmmword [rbp - 8], xmm0
xor edi, edi
mov word [rbp - 0x18], di
jmp 0x14000c98d
xor edi, edi
cmp r13, 0xffffffffffffffff
je 0x14000cabb
lea rcx, str.UNC_
call fcn.14002da58
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, str.UNC_
xor r8d, r8d
mov r13, qword [rbp - 0x48]
mov rdx, r13
call fcn.14000c3a8
cmp rax, 0xffffffffffffffff
je 0x14000cabf
mov qword [rbp - 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
cmp r13, 3
jb 0x14000d2ff
lea rax, [r13 - 3]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rdx, qword [rbp - 0x58]
add rdx, 6
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea r8, [rbp - 0x78]
lea rdx, [0x14003fa7c]
lea rcx, [rbp + 0x80]
call fcn.140002a44
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x14000caa5
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14000ca78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d305
call fcn.140028644
mov qword [rbp - 0x48], rdi
mov r13d, 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x58], di
lea r8d, [r13 + 0x19]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140029880
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], r13
mov word [rbx], di
lea rcx, [rbp + 0x80]
call fcn.1400028f8
nop
lea rcx, [rbp - 0x78]
call fcn.1400028f8
mov r13, qword [rbp - 0x48]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
cmp byte [rbx + 0x93], 0
jne 0x14000cb3a
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000cb23
mov rcx, r14
call fcn.1400190e8
xor ecx, ecx
test al, al
jne 0x14000cb23
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
lea rdx, [r12 + 0x28]
mov r9, r14
lea r8, [rbp - 0x78]
mov rcx, rbx
call fcn.14000ddc4
test al, al
jne 0x14000cb3a
lea rdx, [r12 + 0x28]
mov r8, r14
mov ecx, 0x67
call fcn.140003390
jmp 0x14000cf08
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
mov r8b, byte [rbx + 0x5b]
mov dl, r15b
lea rcx, [rbp - 0x78]
call fcn.140013774
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000cbb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cbab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d30b
call fcn.140028644
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rcx, [rbp - 0x78]
call fcn.140013b18
mov bl, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000cc20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d311
call fcn.140028644
xor eax, eax
test bl, bl
je 0x14000cd45
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rcx, [rbp - 0x78]
call fcn.140013b2c
mov ecx, eax
call fcn.140013c10
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.1400028f8
xorps xmm0, xmm0
mov rcx, rsi
movdqu xmmword [rbp - 0x68], xmm0
test bl, bl
je 0x14000cce3
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rcx, [rbp - 0x78]
call fcn.140013940
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000cd47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d317
call fcn.140028644
jmp 0x14000cd47
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rcx, [rbp - 0x78]
call fcn.140013a2c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000cd47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2e7
jmp 0x14000ccdc
xor ebx, ebx
cmp byte [r12 + 0x111], bl
jne 0x14000ceac
cmp byte [r12 + 0x150], bl
jne 0x14000ceac
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000ce17
xor r14d, r14d
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x140057700]
call fcn.14000b948
nop
mov rdx, qword [rbp - 0x60]
lea r13d, [r14 + 8]
cmp rdx, r13
jb 0x14000cf20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d31d
call fcn.140028644
jmp 0x14000cf20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r12 + 0x128]
cmp eax, 3
jne 0x14000cfd9
mov dword [rdi], 0xa0000003
mov rcx, qword [rsp + 0x40]
lea eax, [r13 + 6]
add ax, cx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], 8
jb 0x14000ce62
mov r14, qword [r14]
lea rcx, [rdi + 0x10]
mov rdx, r14
call fcn.140030a50
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 9
lea rcx, [rdi + rax*2]
call fcn.140030a50
xor r14d, r14d
jmp 0x14000d06d
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rcx, [rbp - 0x78]
call fcn.14001375c
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.1400028f8
test bl, bl
jne 0x14000ce20
lea r8, [rsp + 0x50]
lea rdx, [0x14003fa94]
mov ecx, 0x14
call fcn.14000c438
mov r15d, 9
mov edx, r15d
lea rcx, [0x140057700]
call fcn.14000be10
mov r13d, 8
xor r14d, r14d
mov r15b, r14b
mov rdx, qword [rbp - 0x40]
cmp rdx, r13
jb 0x14000cf62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d323
call fcn.140028644
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r14w
test rdi, rdi
je 0x14000cfac
mov rdx, qword [rbp - 0x80]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000cfa4
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2e1
mov rcx, rdi
call fcn.140028644
mov al, r15b
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140028760
mov rbx, qword [rsp + 0x208]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
dec eax
cmp eax, r15d
ja 0x14000cf17
mov dword [rdi], 0xa000000c
mov rcx, qword [rsp + 0x40]
lea eax, [rcx + r13]
mov edx, 8
add ax, dx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], rdx
jb 0x14000d019
mov r14, qword [r14]
lea rcx, [rdi + 0x14]
mov rdx, r14
call fcn.140030a50
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 0xb
lea rcx, [rdi + rax*2]
call fcn.140030a50
xor r14d, r14d
mov eax, r14d
cmp qword [rsp + 0x48], 0xffffffffffffffff
sete al
mov dword [rdi + 0x10], eax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d12d
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x140057700]
call fcn.14000b948
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000d117
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d329
call fcn.140028644
mov edx, 9
lea rcx, [0x140057700]
call fcn.14000be10
jmp 0x14000cf20
movzx r9d, word [rdi + 4]
add r9d, r13d
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r8, rdi
mov edx, 0x900a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000d1eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, [0x14003fab4]
mov ecx, 0x15
call fcn.14000c438
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000d198
cmp eax, 0x522
jne 0x14000d1ab
call fcn.14001f80c
test al, al
jne 0x14000d1ab
mov ecx, 0x18
call fcn.140003304
lea rcx, [0x140057700]
call fcn.14000be80
mov edx, 9
lea rcx, [0x140057700]
call fcn.14000be10
mov rcx, rsi
cmp byte [r12 + 0x111], r14b
je 0x14000d1e0
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000cf20
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000cf20
lea rcx, [rbp + 0x10]
call fcn.14001278c
nop
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
mov rax, qword [rax + 0x10]
call qword [0x14003f440]
mov qword [rbp + 0x18], rbx
mov rbx, qword [rsp + 0x58]
mov eax, dword [rbx + 0x1d8]
lea rcx, [r12 + 0x70]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [rbx + 0x1d4]
lea rcx, [r12 + 0x68]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rbx + 0x1d0]
lea rcx, [r12 + 0x60]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x10]
call fcn.140013270
lea rcx, [rbp + 0x10]
call fcn.140012870
cmp byte [rbx + 0xa8], r14b
jne 0x14000d2d3
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14002da58
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.140002ac0
nop
mov edx, dword [r12 + 0x24]
lea rcx, [rbp - 0x78]
call fcn.140014664
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000d2d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d2cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d32f
call fcn.140028644
nop
lea rcx, [rbp + 0x10]
call fcn.1400127e4
jmp 0x14000cf23
call fcn.14002d924
nop
call fcn.14002d924
nop
call fcn.140005f1c
nop
call fcn.14002d924
nop
call fcn.14002d924
int3
call fcn.140005f1c
nop
call fcn.14002d924
nop
call fcn.14002d924
int3
call fcn.14002d924
int3
call fcn.14002d924
int3
call fcn.14002d924
nop
call fcn.14002d924
nop
call fcn.14002d924
nop
call fcn.14002d924
int3