Function at 0x10002c698
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
sub rsp, 0x940
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov rdi, rcx
xor ebp, ebp
mov qword [r11 - 0x860], rbp
lea rsi, [rcx + 0x212]
mov r13d, 0x80004005
mov ebx, r13d
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp rax, rbp
je 0x10002c7d1
mov dword [rsp + 0x28], 7
lea rcx, str..Gadget
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
mov r8, rax
lea edx, [rbp + 1]
lea ecx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x10002c72d
mov ebx, ebp
jmp 0x10002c7d1
mov edx, 0x104
lea rcx, [rsp + 0x720]
mov ebx, ebp
lea rax, [rsp + 0x720]
mov r8, rsi
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x10002c76d
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x10002c76d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10002c74a
cmp rdx, rbp
jne 0x10002c77b
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], bp
cmp ebx, ebp
jl 0x10002c7d1
lea rcx, [rsp + 0x720]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea rcx, [rsp + 0x720]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp rax, rbp
je 0x10002c7d1
mov dword [rsp + 0x28], 7
lea rcx, str..Gadget
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
mov r8, rax
lea edx, [r9 + 2]
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove ebx, ebp
cmp ebx, ebp
jl 0x10002cb0a
add rdi, 0xa
mov rcx, rdi
call fcn.100036e0c
cmp al, bpl
je 0x10002c84c
lea rax, fcn.100036a30
mov qword [rsp + 0x100], rax
mov word [rsp + 0x518], bp
mov word [rsp + 0x310], bp
mov word [rsp + 0x108], bp
mov rdx, rdi
lea rcx, [rsp + 0x100]
call fcn.100036a30
mov ebx, eax
cmp eax, ebp
jge 0x10002c82c
jmp 0x10002cb0a
mov rdx, rsi
lea rcx, [rsp + 0x100]
call fcn.100036a94
mov ebx, eax
cmp eax, ebp
jge 0x10002c847
jmp 0x10002cb0a
jmp 0x10002cb00
lea rcx, [rsp + 0x30]
call fcn.100034fe4
nop
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.10003514c
cmp eax, ebp
jge 0x10002c97c
xor edx, edx
mov r8d, 0x7a512
mov ecx, r13d
call fcn.10000b498
mov qword [rsp + 0x28], 0x1772
mov qword [rsp + 0x20], 0x1771
mov r9d, 0x1770
mov r8, qword [0x1000da200]
xor edx, edx
mov ecx, r13d
call fcn.10003fcfc
mov ebx, eax
cmp eax, ebp
jge 0x10002c912
lea rax, fcn.10003514c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x10002c8c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rbp
je 0x10002c8ea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x58]
call fcn.10003623c
nop
lea rcx, [rsp + 0xa0]
call fcn.100036390
nop
lea rcx, [rsp + 0x58]
call fcn.10003623c
jmp 0x10002cb0a
mov ebx, r13d
lea rax, fcn.10003514c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x10002c932
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rbp
je 0x10002c954
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x58]
call fcn.10003623c
nop
lea rcx, [rsp + 0xa0]
call fcn.100036390
nop
lea rcx, [rsp + 0x58]
call fcn.10003623c
jmp 0x10002cb0a
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.100035b5c
cmp eax, ebp
jge 0x10002ca9e
xor edx, edx
mov r8d, 0x7a512
mov ecx, r13d
call fcn.10000b498
mov qword [rsp + 0x28], 0x1772
mov qword [rsp + 0x20], 0x1771
mov r9d, 0x1770
mov r8, qword [0x1000da200]
xor edx, edx
mov ecx, r13d
call fcn.10003fcfc
mov ebx, eax
cmp eax, ebp
jge 0x10002ca37
lea rax, fcn.10003514c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x10002c9ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rbp
je 0x10002ca0f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x58]
call fcn.10003623c
nop
lea rcx, [rsp + 0xa0]
call fcn.100036390
nop
lea rcx, [rsp + 0x58]
call fcn.10003623c
jmp 0x10002cb0a
mov ebx, r13d
lea rax, fcn.10003514c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x10002ca57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rbp
je 0x10002ca79
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x58]
call fcn.10003623c
nop
lea rcx, [rsp + 0xa0]
call fcn.100036390
nop
lea rcx, [rsp + 0x58]
call fcn.10003623c
jmp 0x10002cb0a
lea rax, fcn.10003514c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x10002cabb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], rbp
je 0x10002cadd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x58]
call fcn.10003623c
nop
lea rcx, [rsp + 0xa0]
call fcn.100036390
nop
lea rcx, [rsp + 0x58]
call fcn.10003623c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret