Function at 0x1400532a0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
mov eax, 0x1318
call fcn.1400637c0
sub rsp, rax
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x1300], rax
mov rbx, qword [rsp + 0x1330]
add rbx, 0x17a
mov rdi, qword [rsp + 0x1330]
add rdi, 0x384
mov rcx, qword [rsp + 0x1330]
add rcx, 0x148
call fcn.140001b90
mov r8, rax
mov rax, qword [rsp + 0x1330]
mov eax, dword [rax + 0x37c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea rdx, str._UnLoadNTDSFile__size:_d__ntds:_s__windir:_s__currentset:_d._n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rcx, qword [rsp + 0x1330]
add rcx, 0x148
call fcn.140001b90
test rax, rax
jbe 0x1400538d5
mov byte [rsp + 0x170], 0
lea rdi, [rsp + 0x171]
xor eax, eax
mov ecx, 0x63
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1330]
movsx r8d, byte [rax + 0x17a]
lea rdx, [0x14007f7d0]
lea rcx, [rsp + 0x170]
call fcn.140025b64
lea r9, [rsp + 0x170]
lea r8, [0x14007f7e0]
mov edx, 0x98
mov rcx, qword [rsp + 0x1330]
call fcn.140050e80
mov byte [rsp + 0x250], al
movzx eax, byte [rsp + 0x250]
test eax, eax
je 0x1400533c7
lea rax, [0x14007f7e8]
mov qword [rsp + 0x12e8], rax
jmp 0x1400533d6
lea rax, [0x14007f7f0]
mov qword [rsp + 0x12e8], rax
mov r8, qword [rsp + 0x12e8]
lea rdx, str.ExtractFile1_return__s_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x170]
call fcn.1400258a0
mov rdx, qword [rsp + 0x1330]
movsx r8d, byte [rdx + 0x17a]
lea rdx, str._c:PassRec.exe
lea rcx, [rsp + 0x170]
call fcn.140025b64
lea r9, [rsp + 0x170]
lea r8, [0x14007f820]
mov edx, 0x96
mov rcx, qword [rsp + 0x1330]
call fcn.140050e80
mov byte [rsp + 0x250], al
movzx eax, byte [rsp + 0x250]
test eax, eax
je 0x14005346f
lea rax, [0x14007f828]
mov qword [rsp + 0x12f0], rax
jmp 0x14005347e
lea rax, [0x14007f830]
mov qword [rsp + 0x12f0], rax
mov r8, qword [rsp + 0x12f0]
lea rdx, str.ExtractFile2_return__s_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x170]
call fcn.1400258a0
mov rdx, qword [rsp + 0x1330]
movsx r8d, byte [rdx + 0x17a]
lea rdx, [0x14007f850]
lea rcx, [rsp + 0x170]
call fcn.140025b64
lea r9, [rsp + 0x170]
lea r8, [0x14007f85c]
mov edx, 0xa2
mov rcx, qword [rsp + 0x1330]
call fcn.140050e80
mov byte [rsp + 0x250], al
movzx eax, byte [rsp + 0x250]
test eax, eax
je 0x140053517
lea rax, [0x14007f864]
mov qword [rsp + 0x12f8], rax
jmp 0x140053526
lea rax, [0x14007f86c]
mov qword [rsp + 0x12f8], rax
mov rax, qword [rsp + 0x1330]
mov r9d, dword [rax + 0x37c]
mov r8, qword [rsp + 0x12f8]
lea rdx, str.ExtractFile3_return__s__m_nCurrentControlSet_03d__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rax, qword [rsp + 0x1330]
cmp dword [rax + 0x37c], 0
jne 0x140053573
mov rax, qword [rsp + 0x1330]
mov dword [rax + 0x37c], 1
mov byte [rsp + 0x1e0], 0
lea rdi, [rsp + 0x1e1]
xor eax, eax
mov ecx, 0x63
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1330]
movsx r8d, byte [rax + 0x17a]
lea rdx, [0x14007f8b0]
lea rcx, [rsp + 0x1e0]
call fcn.140025b64
mov byte [rsp + 0x60], 0
lea rdi, [rsp + 0x61]
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1330]
movsx r8d, byte [rax + 0x17a]
lea rdx, str._c:createsvc.bat
lea rcx, [rsp + 0x60]
call fcn.140025b64
lea rdx, [0x1400761fc]
lea rcx, [rsp + 0x60]
call fcn.140026708
mov qword [rsp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rsp + 0x160]
lea rdx, str._UnLoadNTDSFile__fopen_return__p__err:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
cmp qword [rsp + 0x160], 0
je 0x1400538d5
mov rax, qword [rsp + 0x1330]
movsx edx, byte [rax + 0x178]
mov rax, qword [rsp + 0x1330]
movsx ecx, byte [rax + 0x17a]
mov r8, qword [rsp + 0x1330]
add r8, 0x17a
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x1e0]
lea rdx, str.reg_load_HKLMAddUser_SYSTEM__s_system32configSYSTEM______s_2_1__n_c:_sc_create_PassRecovery_Type_own_Start_auto_depend_SamSs_Binpath__c:_srvany.exe_Obj_LocalSystem_displayname_PassRecovery__group_MS_WindowsLocalValidation_____s_2_1__n
mov rcx, qword [rsp + 0x160]
call fcn.140026714
mov byte [rsp + 0x2e0], 0
lea rdi, [rsp + 0x2e1]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x12e0], 0
jmp 0x1400536c5
mov eax, dword [rsp + 0x12e0]
add eax, 1
mov dword [rsp + 0x12e0], eax
movsxd rdi, dword [rsp + 0x12e0]
mov rcx, qword [rsp + 0x1330]
add rcx, 0x148
call fcn.140001b90
cmp rdi, rax
jae 0x140053765
cmp dword [rsp + 0x12e0], 0
jle 0x140053704
lea rdx, [0x1400766bc]
lea rcx, [rsp + 0x2e0]
call fcn.140025f90
lea rdx, [0x14007672c]
lea rcx, [rsp + 0x2e0]
call fcn.140025f90
movsxd rdx, dword [rsp + 0x12e0]
mov rcx, qword [rsp + 0x1330]
add rcx, 0x148
call fcn.140001bc0
mov rcx, rax
call fcn.1400015a0
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.140025f90
lea rdx, [0x140076764]
lea rcx, [rsp + 0x2e0]
call fcn.140025f90
jmp 0x1400536b4
lea r8, [rsp + 0x2e0]
lea rdx, str._szAccList___s__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov byte [rsp + 0x260], 0
lea rdi, [rsp + 0x261]
xor eax, eax
mov ecx, 0x63
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1330]
movsx r8d, byte [rax + 0x17a]
lea rdx, [0x14007fa20]
lea rcx, [rsp + 0x260]
call fcn.140025b64
lea rdx, [0x140076cdc]
lea rcx, [rsp + 0x260]
call fcn.140026708
mov qword [rsp + 0x2d0], rax
mov rcx, qword [rsp + 0x2d0]
call fcn.140026f24
mov rdx, qword [rsp + 0x1330]
movsx r8d, byte [rdx + 0x178]
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e0]
lea rdx, str.reg_add_HKLMSYSTEMCurrentControlSet_servicesPassRecoveryParameters__v_Application__t_REG_SZ__d___c:PassRec.exe__s____f______s_2_1__n
mov rcx, qword [rsp + 0x160]
call fcn.140026714
lea rdx, [rsp + 0x1e0]
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x260]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rax, qword [rsp + 0x1330]
mov r8d, dword [rax + 0x37c]
lea rdx, str.reg_copy_HKLMSYSTEMCurrentControlSet_servicesPassRecovery_HKLMAddUser_SYSTEMControlSet_03d_servicesPassRecovery__s__f______s_2_1__nreg_unload_HKLMAddUser_SYSTEM______s_2_1__ndel__s_______s_2_1
mov rcx, qword [rsp + 0x160]
call fcn.140026714
mov rcx, qword [rsp + 0x160]
call fcn.140026f24
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x1330]
call fcn.140050fe0
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400538ca
lea r8, [rsp + 0x260]
lea rdx, str._PathFileExists__s__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140053890
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsp + 0x1330]
mov rax, qword [rax + 0x590]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1330]
mov rax, qword [rax + 0x598]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x1330]
mov r9d, dword [rax + 0x5a8]
mov r8, qword [rsp + 0x1330]
mov r8, qword [r8 + 0x5a0]
lea rdx, str.UnLoadNTDSFile_m_TableID:_d__m_DatabaseID:_d__m_SessionID:_d__m_hInstance:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rax, qword [rsp + 0x1330]
add rax, 0x384
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1330]
cmp qword [rax + 0x5a0], 0
je 0x140053996
mov rdx, qword [rsp + 0x1330]
mov rdx, qword [rdx + 0x5a0]
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x1330]
call qword [rax + 0x608]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1330]
mov qword [rax + 0x5a0], 0
mov rax, qword [rsp + 0x1330]
cmp dword [rax + 0x5a8], 0
je 0x140053a11
xor r8d, r8d
mov rax, qword [rsp + 0x1330]
mov edx, dword [rax + 0x5a8]
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x1330]
call qword [rax + 0x610]
mov dword [rsp + 0x40], eax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x1330]
call qword [rax + 0x618]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1330]
mov dword [rax + 0x5a8], 0
mov rax, qword [rsp + 0x1330]
cmp qword [rax + 0x598], 0
je 0x140053a59
xor edx, edx
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x598]
mov rax, qword [rsp + 0x1330]
call qword [rax + 0x620]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1330]
mov qword [rax + 0x598], 0
mov rax, qword [rsp + 0x1330]
cmp qword [rax + 0x590], 0
je 0x140053aa1
xor edx, edx
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x590]
mov rax, qword [rsp + 0x1330]
call qword [rax + 0x628]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1330]
mov qword [rax + 0x590], 0
mov rax, qword [rsp + 0x1330]
cmp qword [rax + 0x5b0], 0
je 0x140053b4c
mov dword [rsp + 0x12e4], 0
jmp 0x140053ad5
mov eax, dword [rsp + 0x12e4]
add eax, 1
mov dword [rsp + 0x12e4], eax
mov rax, qword [rsp + 0x1330]
mov eax, dword [rax + 0x5b8]
cmp dword [rsp + 0x12e4], eax
jge 0x140053b13
movsxd rax, dword [rsp + 0x12e4]
imul rax, rax, 0x30
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x5b0]
mov rcx, qword [rcx + rax + 8]
call fcn.140025614
jmp 0x140053ac4
mov rcx, qword [rsp + 0x1330]
mov rcx, qword [rcx + 0x5b0]
call fcn.140025614
mov rdx, qword [rsp + 0x1330]
mov qword [rdx + 0x5b0], 0
mov rax, qword [rsp + 0x1330]
mov dword [rax + 0x5b8], 0
mov rcx, qword [rsp + 0x1330]
call fcn.1400513c0
mov rcx, qword [rsp + 0x1330]
call fcn.140053140
mov rcx, qword [rsp + 0x1300]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x1318
pop rdi
pop rbx
ret