Function at 0x100015298
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x170
xor edi, edi
mov rbp, r8
lea rax, [r11 - 0x70]
mov r8, rcx
lea r10, [r11 - 0xd8]
mov rbx, rdx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], edi
lea ecx, [rdi + 4]
mov byte [rsp + 0x68], dil
lea r11, [0x10002f460]
mov qword [rax - 0x98], r11
mov dword [r10 - 0x10], edi
mov dword [r10], edi
mov qword [rax], rdi
mov qword [rax - 0x48], rdi
add r11, 0x10000
add rax, 8
add r10, 4
sub rcx, 1
jne 0x1000152e1
mov r8, qword [r8 + 0x68]
lea rcx, [rsp + 0x30]
mov edx, r9d
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xe8], edi
mov dword [rsp + 0xec], edi
mov dword [rsp + 0xf0], edi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x130], edi
mov dword [rsp + 0x134], edi
mov dword [rsp + 0x138], edi
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x150], edi
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov dword [rsp + 0x168], 1
call fcn.100016810
lea rcx, [rsp + 0x30]
cmp al, dil
jne 0x1000153c4
call fcn.100016a40
xor eax, eax
jmp 0x100015534
mov r8, rbp
mov rdx, rbx
call fcn.100016ac4
cmp al, dil
jne 0x1000153db
lea rcx, [rsp + 0x30]
jmp 0x1000153b8
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x30]
lea rcx, [0x100016c20]
call qword [sym.imp.ADVAPI32.dll_ReadEncryptedFileRaw]
mov esi, eax
cmp dword [0x100080328], edi
je 0x10001540e
lea rcx, [0x100002d00]
mov edx, eax
call qword [sym.imp.msvcrt.dll_wprintf]
cmp esi, edi
je 0x100015427
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0xe8], esi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + 0x30]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x100015457
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002d60]
mov edx, eax
mov ebx, eax
call qword [sym.imp.msvcrt.dll_wprintf]
cmp esi, edi
cmove esi, ebx
cmp dword [0x100080328], edi
je 0x10001546c
lea rcx, [0x100002db8]
call qword [sym.imp.msvcrt.dll_wprintf]
lea rcx, [rsp + 0x30]
call fcn.10001691c
mov r11d, dword [0x100080328]
cmp r11d, edi
je 0x1000154cd
lea rcx, [0x100002de0]
call qword [sym.imp.msvcrt.dll_wprintf]
mov r11d, dword [0x100080328]
cmp r11d, edi
je 0x1000154cd
cmp esi, edi
je 0x1000154d1
mov eax, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x130]
mov r8d, dword [rsp + 0xe8]
lea rcx, [0x100002e10]
mov edx, esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_wprintf]
mov r11d, dword [0x100080328]
cmp esi, edi
jne 0x1000154f1
mov eax, dword [rsp + 0x38]
mov esi, eax
cmp eax, edi
jne 0x1000154f1
mov esi, dword [rsp + 0xe8]
cmp esi, edi
jne 0x1000154f1
mov esi, dword [rsp + 0x130]
cmp esi, edi
je 0x100015510
cmp r11d, edi
je 0x100015503
lea rcx, [0x100002e98]
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rsp + 0x38]
cmp esi, 0x1d
jne 0x10001551a
cmp eax, edi
cmovne esi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x30]
call fcn.100016a40
cmp esi, edi
sete dil
mov eax, edi
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret