Function at 0x14000c300
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
xor edi, edi
mov dword [rsp + 0x60], edi
lea r15d, [rdi + 1]
cmp byte [0x140060943], dil
jne 0x14000c372
lea rcx, str.SeRestorePrivilege
call fcn.14000de14
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.14000de14
mov byte [0x140060943], r15b
lea r14, [r12 + 0x130]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x40], rax
lea edx, [rax*4 + 0x1c]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x70]
call fcn.14000bd9c
nop
lea rcx, [0x140048e68]
call fcn.14003790c
mov rcx, r14
mov edx, 8
cmp qword [r14 + 0x18], rdx
jb 0x14000c3bf
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x140048e68]
xor r8d, r8d
mov rdx, rbx
call fcn.14000bf60
mov r13, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
je 0x14000c432
mov qword [rbp - 0x18], rdi
movdqu xmmword [rbp - 8], xmm0
cmp rbx, 4
jb 0x14000cea5
lea rax, [rbx - 4]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c41a
mov rdx, qword [r14]
add rdx, 8
lea rcx, [rbp - 0x18]
call fcn.14000129c
lea rbx, [rbp - 0x18]
mov edi, 5
jmp 0x14000c45d
mov qword [rbp - 0x38], rdi
movdqu xmmword [rbp - 0x28], xmm0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c448
mov rdx, qword [r14]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.140008d04
lea rbx, [rbp - 0x38]
mov edi, 2
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea r8d, [rax + 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.1400335d0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea ebx, [rax + 8]
test dil, 2
je 0x14000c4ea
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x20]
cmp rdx, rbx
jb 0x14000c4d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ceab
call fcn.14003219c
xor eax, eax
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], ax
test r15b, dil
je 0x14000c543
mov rdx, qword [rbp]
cmp rdx, rbx
jb 0x14000c52e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c529
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ceb1
call fcn.14003219c
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 8], xmm0
xor edi, edi
mov word [rbp - 0x18], di
jmp 0x14000c545
xor edi, edi
cmp r13, 0xffffffffffffffff
je 0x14000c673
lea rcx, str.UNC_
call fcn.14003790c
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, str.UNC_
xor r8d, r8d
mov r13, qword [rbp - 0x48]
mov rdx, r13
call fcn.14000bf60
cmp rax, 0xffffffffffffffff
je 0x14000c677
mov qword [rbp - 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
cmp r13, 3
jb 0x14000ceb7
lea rax, [r13 - 3]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rdx, qword [rbp - 0x58]
add rdx, 6
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea r8, [rbp - 0x78]
lea rdx, [0x140048e84]
lea rcx, [rbp + 0x80]
call fcn.140003c84
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x14000c65d
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14000c630
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c62b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cebd
call fcn.14003219c
mov qword [rbp - 0x48], rdi
mov r13d, 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x58], di
lea r8d, [r13 + 0x19]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.1400335d0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], r13
mov word [rbx], di
lea rcx, [rbp + 0x80]
call fcn.140001fa0
nop
lea rcx, [rbp - 0x78]
call fcn.140001fa0
mov r13, qword [rbp - 0x48]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
cmp byte [rbx + 0x93], 0
jne 0x14000c6f2
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000c6db
mov rcx, r14
call fcn.1400170f8
xor ecx, ecx
test al, al
jne 0x14000c6db
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
lea rdx, [r12 + 0x28]
mov r9, r14
lea r8, [rbp - 0x78]
mov rcx, rbx
call fcn.14000d97c
test al, al
jne 0x14000c6f2
lea rdx, [r12 + 0x28]
mov r8, r14
mov ecx, 0x67
call fcn.14000433c
jmp 0x14000cac0
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
mov r8b, byte [rbx + 0x5b]
mov dl, r15b
lea rcx, [rbp - 0x78]
call fcn.140012f18
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c768
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c763
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cec3
call fcn.14003219c
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.140013268
mov bl, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c7d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cec9
call fcn.14003219c
xor eax, eax
test bl, bl
je 0x14000c8fd
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.14001327c
mov ecx, eax
call fcn.140013360
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.140001fa0
xorps xmm0, xmm0
mov rcx, rsi
movdqu xmmword [rbp - 0x68], xmm0
test bl, bl
je 0x14000c89b
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.140013090
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c8ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c894
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cecf
call fcn.14003219c
jmp 0x14000c8ff
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.14001317c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c8ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c894
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce9f
jmp 0x14000c894
xor ebx, ebx
cmp byte [r12 + 0x111], bl
jne 0x14000ca64
cmp byte [r12 + 0x150], bl
jne 0x14000ca64
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c9cf
xor r14d, r14d
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x1400609e0]
call fcn.14000b5b8
nop
mov rdx, qword [rbp - 0x60]
lea r13d, [r14 + 8]
cmp rdx, r13
jb 0x14000cad8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ced5
call fcn.14003219c
jmp 0x14000cad8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r12 + 0x128]
cmp eax, 3
jne 0x14000cb91
mov dword [rdi], 0xa0000003
mov rcx, qword [rsp + 0x40]
lea eax, [r13 + 6]
add ax, cx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], 8
jb 0x14000ca1a
mov r14, qword [r14]
lea rcx, [rdi + 0x10]
mov rdx, r14
call fcn.140037a44
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 9
lea rcx, [rdi + rax*2]
call fcn.140037a44
xor r14d, r14d
jmp 0x14000cc25
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.140012f00
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.140001fa0
test bl, bl
jne 0x14000c9d8
lea r8, [rsp + 0x50]
lea rdx, [0x1400489d4]
mov ecx, 0x14
call fcn.14000bff0
mov r15d, 9
mov edx, r15d
lea rcx, [0x1400609e0]
call fcn.14000ba1c
mov r13d, 8
xor r14d, r14d
mov r15b, r14b
mov rdx, qword [rbp - 0x40]
cmp rdx, r13
jb 0x14000cb1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cedb
call fcn.14003219c
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r14w
test rdi, rdi
je 0x14000cb64
mov rdx, qword [rbp - 0x80]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000cb5c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce99
mov rcx, rdi
call fcn.14003219c
mov al, r15b
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400322b0
mov rbx, qword [rsp + 0x208]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
dec eax
cmp eax, r15d
ja 0x14000cacf
mov dword [rdi], 0xa000000c
mov rcx, qword [rsp + 0x40]
lea eax, [rcx + r13]
mov edx, 8
add ax, dx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], rdx
jb 0x14000cbd1
mov r14, qword [r14]
lea rcx, [rdi + 0x14]
mov rdx, r14
call fcn.140037a44
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 0xb
lea rcx, [rdi + rax*2]
call fcn.140037a44
xor r14d, r14d
mov eax, r14d
cmp qword [rsp + 0x48], 0xffffffffffffffff
sete al
mov dword [rdi + 0x10], eax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cce5
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x1400609e0]
call fcn.14000b5b8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000cccf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cee1
call fcn.14003219c
mov edx, 9
lea rcx, [0x1400609e0]
call fcn.14000ba1c
jmp 0x14000cad8
movzx r9d, word [rdi + 4]
add r9d, r13d
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r8, rdi
mov edx, 0x900a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000cda3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, [0x1400489d4]
mov ecx, 0x15
call fcn.14000bff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000cd50
cmp eax, 0x522
jne 0x14000cd63
call fcn.14001dc5c
test al, al
jne 0x14000cd63
mov ecx, 0x18
call fcn.1400042b0
lea rcx, [0x1400609e0]
call fcn.14000ba60
mov edx, 9
lea rcx, [0x1400609e0]
call fcn.14000ba1c
mov rcx, rsi
cmp byte [r12 + 0x111], r14b
je 0x14000cd98
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000cad8
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000cad8
lea rcx, [rbp + 0x10]
call fcn.140011fac
nop
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
mov rax, qword [rax + 0x10]
call qword [0x140048518]
mov qword [rbp + 0x18], rbx
mov rbx, qword [rsp + 0x58]
mov eax, dword [rbx + 0x1d8]
lea rcx, [r12 + 0x70]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [rbx + 0x1d4]
lea rcx, [r12 + 0x68]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rbx + 0x1d0]
lea rcx, [r12 + 0x60]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x10]
call fcn.140012a90
lea rcx, [rbp + 0x10]
call fcn.140012090
cmp byte [rbx + 0xa8], r14b
jne 0x14000ce8b
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003790c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
mov edx, dword [r12 + 0x24]
lea rcx, [rbp - 0x78]
call fcn.140013cf4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000ce8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cee7
call fcn.14003219c
nop
lea rcx, [rbp + 0x10]
call fcn.140012004
jmp 0x14000cadb
call fcn.140037894
nop
call fcn.140037894
nop
call fcn.14000704c
nop
call fcn.140037894
nop
call fcn.140037894
int3
call fcn.14000704c
nop
call fcn.140037894
nop
call fcn.140037894
int3
call fcn.140037894
int3
call fcn.140037894
int3
call fcn.140037894
nop
call fcn.140037894
nop
call fcn.140037894
nop
call fcn.140037894
int3