Function at 0x1800190d0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
mov r13, rdx
mov rdi, rcx
test rdx, rdx
jne 0x180019107
xor eax, eax
jmp 0x1800198c6
lea rdx, [0x180003738]
mov rcx, r13
call fcn.18000c3b8
cmp qword [0x180029070], 0
lea rsi, [0x18000175a]
mov r15, rax
mov qword [rsp + 0x48], rax
lea r14, [0x1800035b0]
mov rcx, rax
lea rdx, [0x180001b9c]
jne 0x180019291
call fcn.18000c400
mov rcx, rax
mov rsi, rax
call fcn.18000c2c0
lea rcx, [0x180003740]
mov rbx, rax
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001674]
mov rcx, rbx
call fcn.18000bc64
lea r8, [rdi + 0x10a60]
mov rcx, rbx
lea rdx, [0x18000196c]
call fcn.18000c5b0
xor r8d, r8d
lea rdx, [0x180001dc0]
mov rcx, rbx
call fcn.18000c448
mov rax, qword [0x180027080]
call qword [rax + 0xe0]
lea rdx, [0x1800016a8]
mov rcx, rbx
mov r8d, eax
call fcn.18000c448
mov rax, qword [0x180027080]
call qword [rax + 0x1a0]
lea rdx, [0x180001bb0]
mov rcx, rbx
mov r8d, eax
call fcn.18000c448
mov rcx, rsi
call fcn.18000c2c0
lea rcx, [0x180003748]
mov rbx, rax
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001674]
mov rcx, rbx
call fcn.18000bc64
lea r8, [rdi + 0x10a60]
mov rcx, rbx
lea rdx, [0x18000196c]
call fcn.18000c5b0
mov r8d, 1
lea rdx, [0x180001dc0]
mov rcx, rbx
call fcn.18000c448
mov r8d, dword [0x1800272ec]
lea rdx, [0x1800016a8]
mov rcx, rbx
call fcn.18000c448
mov r8d, dword [0x18002752c]
lea rdx, [0x180001bb0]
mov rcx, rbx
call fcn.18000c448
call fcn.18000c174
mov rcx, rsi
mov qword [0x180029070], rax
call fcn.18000ca84
mov rcx, qword [0x180029070]
lea rdx, [0x180001b9c]
mov r8, rax
call fcn.18000bc64
lea rsi, [0x18000175a]
jmp 0x180019576
call fcn.18000c400
mov rcx, qword [0x180029070]
lea rdx, [0x180001b9c]
mov qword [rsp + 0x40], rax
call fcn.18000c674
mov r13, rax
test rax, rax
je 0x18001956f
cmp byte [rax], 8
jne 0x18001956f
mov eax, dword [rax + 0x118]
xor r12d, r12d
mov dword [rsp + 0x30], eax
test eax, eax
je 0x18001956f
xor r15d, r15d
mov eax, r12d
lea rdx, [0x180001674]
or eax, 1
bsr ecx, eax
mov rcx, qword [r13 + rcx*8 + 0x10]
mov rbx, qword [r15 + rcx]
mov rcx, rbx
call fcn.18000c674
test rax, rax
je 0x180019311
cmp byte [rax], 4
jne 0x180019311
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0x38], rdi
jmp 0x180019316
mov qword [rsp + 0x38], rsi
lea rdx, [0x180001dc0]
mov rcx, rbx
call fcn.18000c674
test rax, rax
je 0x180019334
cmp byte [rax], 2
jne 0x180019334
mov edi, dword [rax + 0x10]
jmp 0x180019336
xor edi, edi
lea rdx, [0x18000196c]
mov rcx, rbx
call fcn.18000c674
xor ebx, ebx
test rax, rax
je 0x180019355
cmp byte [rax], 4
jne 0x180019355
mov rsi, qword [rax + 0x10]
mov rax, qword [rsp + 0x38]
cmp byte [rax], bl
je 0x18001954a
cmp byte [rsi], bl
je 0x18001954a
lea r8, [rbp - 0x50]
mov edx, edi
lea rcx, [rbp - 0x50]
call fcn.180004fd8
lea rdx, [0x1800016f8]
mov rcx, rsi
call fcn.180025cc8
test eax, eax
je 0x18001954a
lea rdx, [0x180001e14]
mov rcx, rsi
call fcn.180025cc8
test eax, eax
je 0x18001954a
lea rcx, [rbp - 0x50]
mov dword [rbp + 0x120], ebx
mov dword [rbp + 0x128], ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180019517
mov rax, qword [0x180027080]
lea rcx, [rbp - 0x50]
or r8d, 0xffffffff
movzx edx, di
call qword [rax + pe_nt_image_headers64]
mov r8d, eax
test eax, eax
je 0x180019430
mov rcx, r14
call fcn.180004a90
test rax, rax
je 0x180019400
call fcn.180004a90
inc rax
jmp 0x180019403
mov rax, r14
mov dword [rsp + 0x20], r8d
lea r9, [rbp - 0x50]
lea r8, [0x180001e20]
mov edx, 0x2db
mov rcx, rax
call qword [0x180029278]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x18001954a
lea rax, [rbp + 0x128]
movzx edx, di
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x120]
mov rax, qword [0x180027080]
lea r8, [rsp + 0x34]
lea rcx, [rbp - 0x50]
call qword [rax + 0x2e8]
mov r8d, eax
test eax, eax
je 0x1800194a4
mov rcx, r14
call fcn.180004a90
test rax, rax
je 0x18001947a
call fcn.180004a90
inc rax
jmp 0x18001947d
mov rax, r14
mov dword [rsp + 0x28], r8d
lea r9, [rbp - 0x50]
lea r8, [0x180001e48]
mov dword [rsp + 0x20], edi
mov edx, 0x2e7
mov rcx, rax
call qword [0x180029278]
jmp 0x18001954a
mov rcx, qword [rsp + 0x40]
call fcn.18000c2c0
mov r8, qword [rsp + 0x38]
lea rdx, [0x180001674]
mov rcx, rax
mov rbx, rax
call fcn.18000c5b0
mov r8, rsi
lea rdx, [0x18000196c]
mov rcx, rbx
call fcn.18000c5b0
mov r8d, edi
lea rdx, [0x180001dc0]
mov rcx, rbx
call fcn.18000c448
mov r8d, dword [rbp + 0x120]
lea rdx, [0x1800016a8]
mov rcx, rbx
call fcn.18000c448
mov r8d, dword [rbp + 0x128]
lea rdx, [0x180001bb0]
mov rcx, rbx
call fcn.18000c448
jmp 0x18001954a
mov rcx, r14
call fcn.180004a90
test rax, rax
je 0x18001952e
call fcn.180004a90
inc rax
jmp 0x180019531
mov rax, r14
lea r9, [rbp - 0x50]
mov edx, 0x2ed
lea r8, [0x180001e78]
mov rcx, rax
call qword [0x180029278]
inc r12d
lea rsi, [0x18000175a]
add r15, 8
cmp r12d, dword [rsp + 0x30]
jb 0x1800192db
mov r15, qword [rsp + 0x48]
lea rsi, [0x18000175a]
mov r13, qword [rbp + 0x118]
mov rcx, qword [0x180029078]
lea r12, [0x180001b70]
test rcx, rcx
je 0x1800195af
mov rdx, r12
call fcn.18000c674
test rax, rax
je 0x1800195a1
cmp byte [rax], 4
jne 0x1800195a1
mov r8, qword [rax + 0x10]
jmp 0x1800195a4
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.18000c5b0
cmp qword [0x180029058], 0
je 0x180019704
lea rdx, [0x180001644]
mov rcx, r15
call fcn.18000c3b8
mov rdx, qword [0x180029058]
lea rcx, [rsp + 0x50]
mov rdi, rax
call fcn.18000c9a0
jmp 0x1800196c5
and dword [rsp + 0x30], 0
mov byte [rbp + 0x118], 0
test rax, rax
je 0x180019601
cmp byte [rax], 6
jne 0x180019601
mov rbx, qword [rax + 0x10]
jmp 0x180019603
xor ebx, ebx
lea r8, [rsp + 0x30]
mov rcx, rax
lea rdx, [rbp + 0x118]
call fcn.18000ce90
mov dl, byte [rbx]
mov rsi, rax
mov rcx, rbx
mov byte [rsp + 0x70], 0
jmp 0x180019630
cmp dl, 0x5f
je 0x180019636
inc rcx
mov dl, byte [rcx]
test dl, dl
jne 0x180019626
xor ecx, ecx
test rcx, rcx
je 0x180019674
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp byte [rcx + rax], 0
jne 0x180019642
mov rcx, rbx
sub rcx, rax
mov rax, rdx
inc rax
cmp byte [rbx + rax], 0
jne 0x180019654
lea rdx, [rax + 1]
mov r8d, 0x40
add rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.1800049c4
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18000c3b8
mov rdx, r12
mov rcx, rsi
mov rbx, rax
call fcn.18000c674
test rax, rax
je 0x1800196a6
cmp byte [rax], 4
jne 0x1800196a6
mov r8, qword [rax + 0x10]
lea rsi, [0x18000175a]
jmp 0x1800196b0
lea rsi, [0x18000175a]
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.18000c5b0
lea rcx, [rsp + 0x50]
call fcn.18000c938
test rax, rax
jne 0x1800195e5
mov rcx, r14
call fcn.180004a90
test rax, rax
je 0x1800196e4
call fcn.180004a90
lea r14, [rax + 1]
mov rcx, rdi
call fcn.18000ce10
mov r9, rax
lea r8, [0x180003750]
mov edx, 0x317
mov rcx, r14
call qword [0x180029278]
mov rcx, qword [0x1800271b8]
lea rdx, [0x180001bf8]
call fcn.18000c674
test rax, rax
je 0x180019727
cmp byte [rax], 4
jne 0x180019727
mov r8, qword [rax + 0x10]
jmp 0x18001972a
mov r8, rsi
lea rdx, [0x180001bf8]
mov rcx, r15
call fcn.18000c5b0
call fcn.180009cac
mov r8, rax
lea rdx, [0x180003768]
mov rcx, r15
call fcn.18000bc64
mov rcx, qword [0x180028f50]
lea rdx, [0x180001c08]
call fcn.18000c674
mov rdi, rax
test rax, rax
je 0x1800197e0
cmp byte [rax], 8
jne 0x1800197e0
mov esi, dword [rax + 0x118]
test esi, esi
je 0x1800197e0
call fcn.18000c198
xor ebx, ebx
mov r14, rax
test esi, esi
je 0x1800197e3
xor r12d, r12d
mov eax, ebx
lea rdx, [0x180002240]
or eax, 1
bsr ecx, eax
mov rcx, qword [rdi + rcx*8 + 0x10]
mov rcx, qword [r12 + rcx]
call fcn.18000c674
test rax, rax
je 0x1800197b8
cmp byte [rax], 4
jne 0x1800197b8
mov rcx, qword [rax + 0x10]
jmp 0x1800197bf
lea rcx, [0x18000175a]
cmp byte [rcx], 0
je 0x1800197d4
call fcn.18000bb7c
mov rdx, rax
mov rcx, r14
call fcn.18000bd44
inc ebx
add r12, 8
cmp ebx, esi
jb 0x18001978b
jmp 0x1800197e3
xor r14d, r14d
mov r8, r14
lea rdx, [0x180003770]
mov rcx, r15
call fcn.18000bc64
mov rbx, qword [rbp + 0x110]
lea rdx, [0x1800035e8]
mov rcx, r15
lea r8, [rbx + 0x106f4]
call fcn.18000c5b0
mov r8d, dword [rbx + 0x106e8]
lea rdx, [0x180003620]
mov rcx, r15
call fcn.18000c448
mov eax, dword [0x180028d08]
test eax, eax
jne 0x18001983e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x180028d08], eax
mov r8d, eax
lea rdx, [0x18000201c]
mov rcx, r15
call fcn.18000c448
mov rbx, qword [0x180029060]
lea rdx, [0x180003778]
mov rcx, rbx
call fcn.18000c674
test rax, rax
je 0x180019876
cmp byte [rax], 4
jne 0x180019876
mov r8, qword [rax + 0x10]
jmp 0x180019879
xor r8d, r8d
test r8, r8
je 0x18001988d
lea rdx, [0x180003778]
mov rcx, r15
call fcn.18000c5b0
lea rdx, [0x180003788]
mov rcx, rbx
call fcn.18000c674
test rax, rax
je 0x1800198ac
cmp byte [rax], 4
jne 0x1800198ac
mov r8, qword [rax + 0x10]
jmp 0x1800198af
xor r8d, r8d
test r8, r8
je 0x1800198c3
lea rdx, [0x180003788]
mov rcx, r15
call fcn.18000c5b0
mov rax, r13
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret