Function at 0x100029d14
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rax - 0x50], r14
xor r12d, r12d
mov qword [rax + 0x20], r12
xor r13d, r13d
mov qword [rax - 0x48], r13
and qword [rax - 0x58], r12
and qword [rax + 0x18], r12
mov byte [rax + 8], r12b
lea rsi, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029d8e
test byte [rcx + 0x1c], 1
je 0x100029d8e
cmp byte [rcx + 0x19], 4
jb 0x100029d8e
mov edx, 0x13d
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
cmp qword [rbx + 0x1d8], r12
jne 0x100029daf
lea r8, [0x100004b40]
mov edx, 0x1898
lea rcx, [0x1000046e0]
call fcn.100099ad8
lea r15, [rbx + 0x28]
xor edx, edx
mov rcx, r15
call fcn.10010ad48
mov edi, eax
test eax, eax
js 0x10002a1d0
lea rcx, [rsp + 0x90]
call fcn.1000a2a08
mov edi, eax
test eax, eax
jns 0x100029e1b
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a1d0
test byte [rcx + 0x1c], 1
je 0x10002a1d0
cmp byte [rcx + 0x19], 2
jb 0x10002a1d0
mov edx, 0x13e
mov r9d, eax
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
jmp 0x10002a1d0
cmp qword [rbx + 0x1d0], r12
jne 0x100029e62
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a1d0
test byte [rcx + 0x1c], 1
je 0x10002a1d0
cmp byte [rcx + 0x19], 4
jb 0x10002a1d0
mov edx, 0x13f
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
jmp 0x10002a1d0
test byte [rbx + 0x150], 4
je 0x100029f77
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.1001208dc
mov edi, eax
test eax, eax
js 0x100029f6d
lea rdx, [rsp + 0xa8]
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.10010bcc8
mov edi, eax
test eax, eax
jns 0x100029f04
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029ef7
test byte [rcx + 0x1c], 1
je 0x100029ef7
cmp byte [rcx + 0x19], 2
jb 0x100029ef7
mov edx, 0x140
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001e360
mov r12, qword [rsp + 0xa8]
jmp 0x10002a1d0
mov r12, qword [rsp + 0xa8]
jmp 0x10002a1d0
mov r12, qword [rsp + 0xa8]
test r12, r12
je 0x100029f77
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100029f77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029f5a
test byte [rcx + 0x1c], 1
je 0x100029f5a
cmp byte [rcx + 0x19], 2
jb 0x100029f5a
mov edx, 0x141
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x10002a1d0
mov r14, qword [rsp + 0x38]
jmp 0x10002a1d0
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.1001208dc
mov edi, eax
test eax, eax
js 0x10002a197
mov r13, qword [rsp + 0x40]
test byte [rbx + 0x150], 1
je 0x100029fc6
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10009b4ec
mov edi, eax
test eax, eax
js 0x10002a18e
jmp 0x100029feb
lea r9, [rsp + 0x30]
mov r8b, 1
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.1001208dc
mov edi, eax
test eax, eax
js 0x10002a18e
cmp byte [rsp + 0x90], 0
jne 0x10002a072
test rbp, rbp
jne 0x10002a012
lea r8, [0x100004b58]
mov edx, 0x18f5
lea rcx, [0x1000046e0]
call fcn.100099ad8
mov rax, qword [rbp]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [rax + 0x60]
mov edi, eax
test eax, eax
jns 0x10002a072
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x10002a1d0
test byte [rcx + 0x1c], 1
je 0x10002a1d0
cmp byte [rcx + 0x19], 2
jb 0x10002a1d0
mov edx, 0x142
mov r9d, eax
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
jmp 0x10002a1d0
mov r9, qword [rsp + 0xa0]
test r9, r9
jne 0x10002a086
mov r9, qword [rbx + 0x1d0]
mov r8d, dword [rbx + 0x14c]
mov rdx, qword [rsp + 0x30]
mov rcx, r13
call fcn.10010b3bc
mov edi, eax
test eax, eax
js 0x10002a1b7
test byte [rbx + 0x150], 0x80
je 0x10002a1c9
cmp byte [rbx + 0x11c], 0
je 0x10002a1c0
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x90], rax
test rax, rax
je 0x10002a0e2
mov rcx, rax
call fcn.100043fcc
mov rbp, rax
jmp 0x10002a0e4
xor ebp, ebp
mov rdx, r13
mov rcx, rbp
call fcn.10001ec50
mov edi, eax
test eax, eax
js 0x10002a1ae
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x10002a10b
mov rdi, rdx
jmp 0x10002a112
mov rdi, qword [rbx + 0x1d0]
test rdx, rdx
jne 0x10002a11e
mov rdx, qword [rbx + 0x1d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, rbp
call fcn.10001ef7c
mov edi, eax
test eax, eax
js 0x10002a1a5
mov rsi, qword [rbx + 0x310]
cmp rsi, qword [rbx + 0x318]
jb 0x10002a16b
lea rdx, [rsi + 1]
lea rcx, [rbx + 0x308]
call fcn.100043a28
test al, al
jne 0x10002a16b
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + rsi*8]
test rcx, rcx
je 0x10002a17e
mov qword [rcx], rbp
inc qword [rbx + 0x310]
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
mov r13, qword [rsp + 0x40]
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
jmp 0x10002a1d0
lea rsi, [0x1001653b8]
mov rcx, r15
call fcn.10010aed8
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x10002a1f4
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10002a204
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x10002a212
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x10002a220
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x10002a22e
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jns 0x10002a26b
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a298
test byte [rcx + 0x1c], 1
je 0x10002a272
cmp byte [rcx + 0x19], 2
jb 0x10002a272
mov edx, 0x143
mov r9d, edi
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
jmp 0x10002a272
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a298
test byte [rcx + 0x1c], 1
je 0x10002a298
cmp byte [rcx + 0x19], 4
jb 0x10002a298
mov edx, 0x144
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret