Function at 0x140047adc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15d, edx
mov rdi, rcx
mov r12d, 1
mov rcx, qword [str.P5_n_]
lea rbx, str.P5_n_
cmp rcx, rbx
je 0x140047b38
test byte [rcx + 0x1c], 4
je 0x140047b38
cmp byte [rcx + 0x19], 5
jb 0x140047b38
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x72]
lea r8, [0x140008f68]
call fcn.14000ffa8
mov rcx, qword [rdi + 0x198]
xor r14d, r14d
cmp rcx, r14
je 0x140047b8c
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
cmp eax, r14d
jne 0x140047b8c
mov rcx, qword [str.P5_n_]
cmp rcx, rbx
je 0x140047b85
test byte [rcx + 0x1c], 4
je 0x140047b85
lea esi, [r14 + 2]
cmp byte [rcx + 0x19], sil
jb 0x140047b85
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x72]
lea r8, [0x140008f68]
call fcn.1400100e0
xor eax, eax
jmp 0x140048299
mov rcx, rdi
call fcn.1400478c8
mov esi, 0x678
lea r13d, [rsi + rax]
mov ecx, r13d
mov ebx, r13d
call fcn.140076a54
mov rbp, rax
cmp rax, r14
je 0x140047b85
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp], esi
mov rax, qword [rdi + 0x10]
mov qword [rbp + 8], rax
mov rax, qword [rdi + 0x18]
lea r9, [rdi + 0x498]
mov qword [rbp + 0x10], rax
mov rax, qword [rdi + 0x1a0]
lea rcx, [rbp + 0x470]
mov qword [rbp + 0x180], rax
mov rax, qword [rdi + 0x1a8]
mov r8d, 0x100
mov qword [rbp + 0x188], rax
mov eax, dword [rdi + 0x24]
mov qword [rsp + 0x70], rsi
mov dword [rbp + 0x18], eax
mov eax, dword [rdi + 0x734]
mov rdx, r8
mov dword [rbp + 0x28], eax
mov eax, dword [rdi + 0x698]
mov ebx, r14d
sub r9, rcx
mov esi, 2
mov dword [rbp + 0x670], eax
lea rax, [rdx + 0x7ffffefe]
cmp rax, r14
je 0x140047c50
movzx eax, word [r9 + rcx]
cmp ax, r14w
je 0x140047c50
mov word [rcx], ax
add rcx, rsi
sub rdx, r12
jne 0x140047c2e
mov r9d, 0x8007007a
cmp rdx, r14
jne 0x140047c61
sub rcx, rsi
mov ebx, r9d
cmp ebx, r14d
mov word [rcx], r14w
jge 0x140047cbd
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x140047ca1
test byte [rcx + 0x1c], 4
je 0x140047ca1
cmp byte [rcx + 0x19], sil
jb 0x140047ca1
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
mov r9d, ebx
call fcn.1400100e0
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
mov r12d, ebx
jmp 0x14004828e
lea rdx, [rdi + 0x288]
lea rcx, [rbp + 0x22c]
mov ebx, r14d
sub rdx, rcx
lea rax, [r8 + 0x7ffffefe]
cmp rax, r14
je 0x140047cf2
movzx eax, word [rdx + rcx]
cmp ax, r14w
je 0x140047cf2
mov word [rcx], ax
add rcx, rsi
sub r8, r12
jne 0x140047cd1
cmp r8, r14
jne 0x140047cfd
sub rcx, rsi
mov ebx, r9d
cmp ebx, r14d
mov word [rcx], r14w
jge 0x140047d33
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x140047ca1
test byte [rcx + 0x1c], 4
je 0x140047ca1
cmp byte [rcx + 0x19], sil
jb 0x140047ca1
mov edx, 0x76
jmp 0x140047c8e
mov eax, dword [rdi + 0x40]
mov dword [rbp + 0x2c], eax
mov eax, dword [rdi + 0xe8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rdi + 0x17c]
mov dword [rbp + 0x154], eax
mov eax, dword [rdi + 0x178]
mov dword [rbp + 0x150], eax
mov eax, dword [rdi + 0x184]
mov dword [rbp + 0x158], eax
cmp dword [rdi + 0x24], esi
jne 0x140047d80
mov rax, qword [rdi + 0x248]
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x220], rcx
mov eax, dword [rdi + 0x250]
mov dword [rbp + 0x228], eax
mov rax, qword [rdi + 0x488]
mov qword [rbp + 0x460], rax
mov rax, qword [rdi + 0x490]
mov qword [rbp + 0x468], rax
mov rcx, qword [rdi + 0x198]
cmp rcx, r14
je 0x140047de9
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov qword [rbp + 0x178], 0x678
mov rdx, qword [rdi + 0x198]
lea rcx, [rbp + 0x678]
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea r11, [rbx + 0x678]
mov qword [rsp + 0x70], r11
mov rcx, qword [rdi + 0x1b8]
lea rdx, [rbp + 0x190]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.14007845c
xor eax, eax
lea r9, [rsp + 0x70]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x458], rax
mov rcx, qword [rdi + 0x38]
lea rdx, [rbp + 0x20]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.14007845c
cmp dword [rdi + 0x24], 0x20
je 0x140047e3f
cmp dword [rdi + 0x24], 8
jne 0x140047e59
mov rcx, qword [rdi + 0x48]
lea rdx, [rbp + 0x30]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.14007845c
lea rdx, [rbp + 0x38]
lea rcx, [rdi + 0x50]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.1400472bc
test eax, eax
jne 0x140047ec2
lea r12d, [rax + 0x7a]
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14004828e
test byte [rcx + 0x1c], 4
je 0x14004828e
cmp byte [rcx + 0x19], sil
jb 0x14004828e
lea edx, [rax + 0x77]
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
call fcn.1400100e0
jmp 0x14004828e
lea rdx, [rbp + 0x98]
lea rcx, [rdi + 0xb0]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.140047350
test eax, eax
jne 0x140047f1a
lea r12d, [rax + 0x7a]
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14004828e
test byte [rcx + 0x1c], 4
je 0x14004828e
cmp byte [rcx + 0x19], sil
jb 0x14004828e
lea edx, [rax + 0x78]
jmp 0x140047ea9
lea rdx, [rbp + 0xc8]
lea rcx, [rdi + 0xf0]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.1400473fc
test eax, eax
jne 0x140047f75
lea r12d, [rax + 0x7a]
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14004828e
test byte [rcx + 0x1c], 4
je 0x14004828e
cmp byte [rcx + 0x19], sil
jb 0x14004828e
lea edx, [rax + 0x79]
jmp 0x140047ea9
mov rcx, qword [rdi + 0x190]
lea rdx, [rbp + 0x170]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.14007845c
lea rdx, [rbp + 0x198]
lea rcx, [rdi + 0x1c0]
lea r9, [rsp + 0x70]
mov r8, rbp
mov dword [rsp + 0x20], r13d
call fcn.1400473fc
test eax, eax
jne 0x140047ff0
lea r12d, [rax + 0x7a]
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14004828e
test byte [rcx + 0x1c], 4
je 0x14004828e
cmp byte [rcx + 0x19], sil
jb 0x14004828e
mov edx, r12d
jmp 0x140047ea9
cmp dword [rdi + 0x24], 8
jne 0x14004806a
lea r8, [rsp + 0x70]
mov r9d, r13d
mov rdx, rbp
mov rcx, rdi
call fcn.1400475d8
mov r12d, eax
test eax, eax
jne 0x14004806a
mov rax, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rax, r13
je 0x14004828e
test byte [rax + 0x1c], 4
je 0x14004828e
cmp byte [rax + 0x19], sil
jb 0x14004828e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x7b]
lea r8, [0x140008f68]
mov dword [rsp + 0x20], eax
call fcn.14001d4a0
jmp 0x14004828e
mov rcx, qword [rdi + 0x38]
mov dword [rsp + 0x38], esi
and qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], esi
call fcn.140079cec
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400480e3
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x1400480db
test byte [rcx + 0x1c], 4
je 0x1400480db
cmp byte [rcx + 0x19], sil
jb 0x1400480db
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x7d]
mov rax, qword [rdi + 0x38]
lea r8, [0x140008f68]
mov qword [rsp + 0x20], rax
call fcn.140058098
xor r12d, r12d
jmp 0x14004827f
mov r8d, r13d
mov rdx, rbp
mov rcx, rax
call fcn.14004d558
test eax, eax
je 0x14004823e
test r15d, r15d
je 0x1400481e8
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x140048147
test byte [rcx + 0x1c], 4
je 0x140048147
cmp byte [rcx + 0x19], sil
jb 0x140048147
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
lea r8, [0x140008f68]
mov edx, 0x7d
mov qword [rsp + 0x20], rax
call fcn.14003b8f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14004819a
mov rax, qword [str.P5_n_]
cmp rax, r13
je 0x14004819a
test byte [rax + 0x1c], 4
je 0x14004819a
cmp byte [rax + 0x19], sil
jb 0x14004819a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov r9, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x140008f68]
mov edx, 0x7e
mov dword [rsp + 0x20], ebx
call fcn.14004446c
mov rcx, qword [rdi + 0x38]
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400480db
mov rax, qword [str.P5_n_]
cmp rax, r13
je 0x1400480db
test byte [rax + 0x1c], 4
je 0x1400480db
cmp byte [rax + 0x19], sil
jb 0x1400480db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov edx, 0x7f
jmp 0x140048218
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x1400480db
test byte [rcx + 0x1c], 4
je 0x1400480db
cmp byte [rcx + 0x19], sil
jb 0x1400480db
mov edx, 0x80
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
lea r8, [0x140008f68]
mov qword [rsp + 0x20], rax
call fcn.14003b8f4
jmp 0x1400480db
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14004827f
test byte [rcx + 0x1c], 4
je 0x14004827f
cmp byte [rcx + 0x19], 5
jb 0x14004827f
mov rax, qword [rdi + 0x38]
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
mov edx, 0x81
mov qword [rsp + 0x20], rax
call fcn.140058098
cmp rbx, 0xffffffffffffffff
je 0x14004828e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.140076afc
mov eax, r12d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret