Function at 0x140050084
Capabilities:
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor r14d, r14d
mov qword [rsp + 0x70], rdx
or r12, 0xffffffffffffffff
mov qword [rsp + 0x30], r14
mov r13, rdx
mov dword [rsp + 0x28], 0x2200000
mov rsi, r8
mov qword [rsp + 0x78], r12
mov rbx, rcx
mov dword [rsp + 0x58], r14d
lea eax, [r12 + 4]
mov dword [rsp + 0x40], r14d
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
mov qword [rsp + 0x48], r14
lea r8d, [r12 + 2]
mov rcx, r13
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, r12
jne 0x140050167
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0xa4
movzx edx, ax
lea ecx, [r12 + 2]
or edx, 0x80070000
mov qword [rsp + 0x28], r9
test eax, eax
lea r9, str.CreateFile_failed
mov r8, r13
cmovle edx, eax
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.14002aaa0
xor eax, eax
jmp 0x14005049e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov r8d, 0x4000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
xor eax, eax
test r14, r14
jne 0x1400501cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0xb0
mov qword [rsp + 0x28], r9
mov edi, eax
lea r9, str.MALLOC_failed
movzx eax, ax
mov r8, r13
jmp 0x140050c4e
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x900a8
mov dword [rsp + 0x28], 0x4000
mov rcx, r15
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
xor edx, edx
test eax, eax
je 0x140050c12
mov eax, dword [rsp + 0x58]
lea ecx, [rdx + 8]
cmp eax, ecx
jb 0x140050c12
sub ax, cx
cmp dword [r14], 0x80000008
movzx ecx, ax
mov word [r14 + 4], ax
jne 0x140050601
lea eax, [rdx + 0x24]
cmp ax, cx
jne 0x140050601
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp - 0x50], eax
mov r12d, edx
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
test rbx, rbx
je 0x14005025e
mov r12, qword [rbx + 0x40]
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [rax + rax]
test eax, eax
jne 0x1400502c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0xe0
mov edi, eax
mov qword [rsp + 0x28], r9
movzx eax, ax
lea r9, str.GetFileInformationByHandle_failed
or eax, 0x80070000
mov r8, r13
test edi, edi
mov rdx, rbx
mov ecx, 1
cmovle eax, edi
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov r12, qword [rsp + 0x78]
jmp 0x140050c69
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor ecx, ecx
test r12, r12
je 0x140050546
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], rcx
mov rdx, r14
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.14004fa6c
xor ecx, ecx
test eax, eax
js 0x140050546
mov r15, qword [rsp + 0x60]
test r15, r15
je 0x140050546
mov r8, qword [r15 + 0x18]
test r8, r8
je 0x140050546
mov dword [rsp + 0x28], ecx
add r8, 0x20
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, r12
mov rdx, rbx
call fcn.140026220
mov dword [rsp + 0x40], eax
mov r12d, eax
test eax, eax
je 0x1400504f2
mov rcx, qword [r15 + 0x18]
mov r12d, 0x400
test dword [rcx + 0x1c], r12d
jne 0x14005038a
btr dword [rsi + 0x1c], 0xa
mov rax, qword [r15 + 0x18]
mov ecx, dword [rax + 0x80]
mov dword [rsi + 0x80], ecx
mov rax, qword [r15 + 0x18]
mov ecx, dword [rax + 0x84]
mov dword [rsi + 0x84], ecx
mov rcx, qword [r15 + 0x18]
movups xmm0, xmmword [rcx + 0x20]
mov rdx, qword [rsi + 0x38]
movups xmmword [rsi + 0x20], xmm0
mov eax, dword [rcx + 0x30]
mov rcx, rbx
mov dword [rsi + 0x30], eax
call fcn.140010d80
mov r15, qword [r15 + 0x18]
test dword [r15 + 0x1c], r12d
jne 0x140050426
xor eax, eax
cmp dword [r15 + 0x80], eax
jne 0x1400503c2
cmp dword [r15 + 0x84], eax
je 0x140050426
mov r12d, dword [rbp - 0x50]
mov r13d, dword [rbp - 0x54]
test rbx, rbx
je 0x1400504c9
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x1400504c9
mov r8d, 8
mov dword [rsp + 0x64], r13d
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], r12d
call fcn.140031454
test rax, rax
je 0x1400504c9
add rax, 8
je 0x1400504c9
mov rcx, qword [rbx + 0x48]
mov rax, qword [rsi + 0x38]
test rcx, rcx
cmovne rbx, rcx
add qword [rbx + 0x90], rax
mov rsi, qword [rsp + 0x48]
mov r12d, dword [rsp + 0x40]
test r14, r14
je 0x140050455
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140050489
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test edi, edi
je 0x14005049b
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, r12d
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x758]
add rsp, 0x700
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbx + 0xc0]
mov r9d, r12d
neg rbx
lea rcx, [r15 + 0x20]
mov r8d, r13d
mov qword [rsp + 0x20], rcx
sbb rdx, rdx
and rdx, rax
call fcn.140030edc
jmp 0x140050426
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0x142
mov edi, eax
mov qword [rsp + 0x28], r9
movzx eax, ax
lea r9, str.WimCopyStream_failed
or eax, 0x80070000
mov r8, r13
test edi, edi
mov rdx, rbx
mov ecx, 1
cmovle eax, edi
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov rsi, qword [rsp + 0x48]
jmp 0x140050430
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140050614
xorps xmm0, xmm0
lea rdx, [rbp - 0x80]
xor eax, eax
mov rcx, r15
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x50], eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [rax + rax]
xor ecx, ecx
mov r13d, 0x1126
test eax, eax
je 0x1400505e3
mov r12d, 0x400
test dword [rbp - 0x80], r12d
jne 0x1400505e3
cmp dword [rbp - 0x58], 1
mov edi, r13d
jbe 0x1400505dc
mov eax, dword [rbp - 0x50]
mov dword [rsi + 0x80], eax
mov eax, dword [rbp - 0x54]
mov dword [rsi + 0x84], eax
jmp 0x1400505e3
mov qword [rsi + 0x80], rcx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
cmp edi, r13d
je 0x140050426
jmp 0x140050614
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
xor r13d, r13d
test rbx, rbx
je 0x14005062d
cmp qword [rbx + 0x48], r13
mov rax, rbx
cmovne rax, qword [rbx + 0x48]
mov edx, dword [rax + 0x24]
jmp 0x140050630
mov edx, r13d
bts dword [rsi + 0x84], 0x10
mov rcx, rbx
call fcn.14002e0d0
test rax, rax
je 0x140050a38
test byte [rax + 0x40], 0x80
je 0x140050a38
bt edx, 8
jb 0x140050a38
cmp dword [r14], 0xa0000003
je 0x14005067e
cmp dword [r14], 0xa000000c
jne 0x140050a38
test byte [r14 + 0x10], 1
jne 0x140050a38
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.14002e5e4
mov r12d, 0x104
lea rcx, [rbp - 0x40]
mov edx, r12d
mov r8, qword [rax]
call fcn.1400010f8
test eax, eax
js 0x140050a38
mov r8d, r12d
lea rax, [rbp - 0x40]
mov ecx, 2
cmp word [rax], r13w
je 0x1400506cf
add rax, rcx
sub r8, 1
jne 0x1400506c0
mov rcx, r12
mov rax, r8
sub rcx, r8
neg rax
sbb rdx, rdx
and rdx, rcx
test r8, r8
je 0x140050a38
xor r8d, r8d
mov r13, rdx
test rdx, rdx
je 0x14005071b
cmp word [rbp + rdx*2 - 0x42], 0x5c
jne 0x14005071b
lea r13, [rdx - 1]
lea rax, [r13*2]
cmp rax, 0x208
jae 0x140050c9b
mov word [rbp + rax - 0x40], r8w
cmp dword [r14], 0xa0000003
mov eax, FDICreate
movzx ecx, word [r14 + 0xc]
movzx edx, word [r14 + 0xa]
lea r12d, [rax + 4]
cmove r12d, eax
movzx eax, word [r14 + 8]
shr cx, 1
add r12, r14
mov word [rsp + 0x50], cx
movzx ecx, word [r14 + 0xe]
shr cx, 1
shr ax, 1
shr dx, 1
mov word [rsp + 0x68], ax
mov word [rsp + 0x52], dx
mov word [rsp + 0x54], cx
test dx, dx
je 0x140050a35
movzx ecx, ax
lea r8, [r12 + rcx*2]
cmp word [r8], 0x5c
mov qword [rsp + 0x60], r8
jne 0x140050a35
movzx r8d, ax
cmp word [r12 + r8*2 + 2], 0x3f
jne 0x140050a35
cmp word [r12 + rcx*2 + 4], 0x3f
jne 0x140050a35
cmp word [r12 + rcx*2 + 6], 0x5c
jne 0x140050a35
cmp word [r12 + rcx*2 + 0xa], 0x3a
jne 0x140050a35
movzx edx, dx
mov r9d, r13d
add edx, 0xfffffffc
movzx eax, r13w
cmp eax, edx
mov ecx, 0x409
cmovl edx, eax
lea eax, [r8 + 4]
mov dword [rsp + 0x28], edx
lea rax, [r12 + rax*2]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x10001
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x140050a35
mov eax, 7
cmp word [rsp + 0x52], ax
jbe 0x140050a35
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x60]
lea rcx, [rbp + 0x1d0]
mov r9d, 6
call fcn.14001963c
test eax, eax
js 0x140050a35
movzx eax, word [rsp + 0x68]
lea rcx, [rbp + 0x1d0]
movzx r9d, word [rsp + 0x52]
add rax, 4
add rax, r13
sub r9, r13
sub r9, 4
lea r8, [r12 + rax*2]
call fcn.14001963c
xor r8d, r8d
test eax, eax
js 0x140050a35
mov ecx, 0x104
lea rax, [rbp + 0x1d0]
mov edx, ecx
cmp word [rax], r8w
je 0x1400508ad
add rax, 2
sub rdx, 1
jne 0x14005089d
sub rcx, rdx
mov rax, rdx
neg rax
sbb rax, rax
and rax, rcx
mov qword [rsp + 0x60], rax
test rdx, rdx
je 0x140050a35
movzx edx, word [rsp + 0x54]
mov eax, 3
cmp dx, ax
jbe 0x140050a35
movzx eax, word [rsp + 0x50]
lea r8, [rbp - 0x40]
cmp r13, rdx
mov r9d, r13d
lea rcx, [r12 + rax*2]
mov eax, edx
cmovb eax, r13d
mov edx, 0x10001
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
mov ecx, 2
cmp eax, ecx
jne 0x140050a35
mov r9d, ecx
movzx ecx, word [rsp + 0x50]
lea r8, [r12 + rcx*2]
lea rcx, [rbp + 0x3e0]
call fcn.14001963c
test eax, eax
js 0x140050a35
movzx eax, word [rsp + 0x50]
lea rcx, [rbp + 0x3e0]
movzx r9d, word [rsp + 0x54]
add rax, r13
sub r9, r13
lea r8, [r12 + rax*2]
call fcn.14001963c
xor r13d, r13d
test eax, eax
js 0x140050a38
mov edx, 0x104
lea rax, [rbp + 0x3e0]
mov ecx, edx
lea r8d, [r13 + 2]
cmp word [rax], r13w
je 0x14005098f
add rax, r8
sub rcx, 1
jne 0x140050980
sub rdx, rcx
mov rax, rcx
neg rax
sbb r11, r11
and r11, rdx
test rcx, rcx
je 0x140050a38
mov word [r14 + 8], r13w
mov rcx, r12
mov r13, qword [rsp + 0x60]
movzx eax, r13w
add ax, ax
mov word [r14 + 0xa], ax
add ax, r8w
mov word [r14 + 0xc], ax
lea rdx, [r13 + 1]
movzx eax, r11w
lea r8, [rbp + 0x1d0]
add ax, ax
mov r9, rdx
mov word [r14 + 0xe], ax
call fcn.14000107c
test eax, eax
js 0x140050a94
lea rdx, [r11 + 1]
lea rcx, [r13 + 1]
mov r9, rdx
lea rcx, [r12 + rcx*2]
lea r8, [rbp + 0x3e0]
call fcn.14000107c
test eax, eax
js 0x140050a94
add r11w, r13w
add r11w, r11w
sub r11w, r14w
sub r11w, 4
add r11w, r12w
mov word [r14 + 4], r11w
btr dword [rsi + 0x84], 0x10
xor r13d, r13d
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rbx
call fcn.140034310
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140050ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0x230
mov qword [rsp + 0x28], r9
mov edi, eax
movzx ecx, ax
lea r9, str.CreateFile___failed
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
jmp 0x140050bf3
mov r8, qword [rsp + 0x70]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0x215
mov rdx, rbx
mov qword [rsp + 0x28], r9
mov ecx, 1
lea r9, str.StringCchCopyN_failed
mov dword [rsp + 0x20], 0x800700a1
mov edi, 0xa1
call fcn.14002aaa0
mov r12, qword [rsp + 0x78]
jmp 0x140050c05
movzx r8d, word [r14 + 4]
lea rdx, [r14 + 8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x140050bb9
movzx eax, word [r14 + 4]
cmp dword [rsp + 0x58], eax
jne 0x140050bb9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov dword [rsi + 0x3c], r13d
or r12, 0xffffffffffffffff
movzx eax, word [r14 + 4]
mov dword [rsi + 0x38], eax
add rsi, 0x20
mov rax, qword [rsi]
cmp rax, qword [0x1400bace0]
jne 0x140050b8f
mov rax, qword [rsi + 8]
cmp rax, qword [0x1400bace8]
jne 0x140050b8f
mov eax, dword [rsi + 0x10]
cmp eax, dword [0x1400bacf0]
jne 0x140050b8f
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rsi, qword [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
mov dword [rsp + 0x40], 1
call fcn.140035c30
test eax, eax
jne 0x140050c0a
mov dword [rsp + 0x40], r13d
jmp 0x140050c0a
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0x256
mov qword [rsp + 0x28], r9
mov edi, 0x32
mov dword [rsp + 0x20], 0x80070032
lea r9, str.Found_non_null_hash_in_file_node
jmp 0x140050bf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0x23e
mov edi, eax
mov qword [rsp + 0x28], r9
movzx eax, ax
lea r9, str.WriteFile___failed_or_short_write
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x70]
mov rdx, rbx
mov ecx, 1
call fcn.14002aaa0
mov rsi, qword [rsp + 0x48]
cmp r15, 0xffffffffffffffff
je 0x140050c7d
jmp 0x140050c6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r13d, 0x1126
mov edi, eax
cmp eax, r13d
je 0x140050c69
mov r8, qword [rsp + 0x70]
lea r9, str.AddReparsePointToImage
mov dword [rsp + 0x30], 0xc6
mov qword [rsp + 0x28], r9
lea r9, str.ioctl___failed_or_returned_no_data
movzx eax, di
or eax, 0x80070000
mov rdx, rbx
test edi, edi
mov ecx, 1
cmovle eax, edi
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
mov rsi, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp r12, 0xffffffffffffffff
je 0x14005042b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14005042b
call fcn.140096da8
int3