Function at 0x14001e488
Capabilities:
Delete file
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r13, rcx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x68], rcx
mov eax, r9d
mov dword [rsp + 0x78], eax
mov r12d, 1
mov qword [rbp - 0x80], rcx
mov r14, r8
mov qword [rsp + 0x58], rcx
mov esi, r12d
mov dword [rsp + 0x50], ecx
mov r15d, ecx
mov dword [rsp + 0x60], ecx
mov edi, ecx
mov qword [rsp + 0x70], rcx
mov ebx, ecx
mov qword [rbp - 0x60], rcx
mov dword [rbp - 0x48], FDICopy
mov byte [rbp - 0x44], cl
mov dword [rbp - 0x40], FDICopy
mov byte [rbp - 0x3c], cl
mov dword [rbp - 0x38], 8
mov byte [rbp - 0x34], cl
mov dword [rsp + 0x64], ecx
test r13, r13
je 0x14001f11f
test r8, r8
je 0x14001f11f
cmp word [r8], cx
je 0x14001f11f
cmp dword [r13], 0xfeedf001
jne 0x14001f11f
test rdx, rdx
je 0x14001e55a
cmp dword [rdx], 0xfeedf002
jne 0x14001f11f
test eax, 0xf9cd5ecd
jne 0x14001f11f
mov rcx, r14
call fcn.14000c064
test eax, eax
je 0x14001f130
mov rcx, r13
call fcn.14002e3e8
test r12b, al
je 0x14001e58c
mov ecx, 5
jmp 0x14001f124
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14002f2f8
xor ecx, ecx
mov qword [rbp - 0x78], rax
test rax, rax
je 0x14001f130
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14002f99c
mov r12, qword [rsp + 0x48]
mov r14d, eax
xor eax, eax
test r14d, r14d
jns 0x14001e7f8
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8d, 0x93b
lea rdx, str.onecore_base_ntsetupopktoolsosimagewimgapilibcapture.c
lea rcx, str.WIMCaptureImageInternal
call fcn.140046874
mov ecx, r14d
bt r14d, 0x1c
jae 0x14001e623
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
jne 0x14001e610
mov edi, r14d
jmp 0x14001e639
mov ecx, r14d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14001e639
and ecx, 0x1fff0000
movzx eax, r14w
cmp ecx, 0x70000
mov edi, r14d
cmove edi, eax
xor r9d, r9d
mov esi, r9d
test r12, r12
je 0x14001e667
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor r9d, r9d
test esi, esi
je 0x14001eff5
mov rcx, r13
mov qword [rsp + 0x48], r9
call fcn.14002e168
xor edx, edx
lea r8, [rsp + 0x48]
mov rcx, rax
call fcn.14002f2f8
xor ecx, ecx
mov qword [rbp - 0x68], rax
mov r12, rax
test rax, rax
je 0x14001efd4
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14001efd4
cmp word [rax], cx
je 0x14001efd4
mov word [rax], cx
xor edx, edx
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x48], 0x208
mov r8d, 0x410
mov r14d, esi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x48]
mov rcx, r13
lea rdx, [rbp - 0x30]
call fcn.140010c20
xor esi, esi
test eax, eax
jne 0x14001e70e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x660
jne 0x14001e70e
cmp dword [rsp + 0x48], esi
jne 0x14001e70e
mov rdx, r12
mov rcx, r13
call fcn.140010378
xor edx, edx
mov dword [rsp + 0x48], 0x208
mov r8d, 0x410
lea rcx, [rbp - 0x30]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x48]
mov rcx, r13
lea rdx, [rbp - 0x30]
call fcn.140010c20
test eax, eax
je 0x14001efc1
cmp si, word [rbp - 0x30]
je 0x14001efc1
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14002e860
mov rbx, rax
test rax, rax
je 0x14001efc1
mov r12, qword [rbp - 0x78]
lea rdx, [rbp - 0x60]
mov rcx, r12
mov dword [rsp + 0x48], edi
mov esi, r14d
call fcn.14002fcbc
xor r9d, r9d
test eax, eax
js 0x14001e7c1
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
mov dword [rsp + 0x48], edi
cmovne rax, rcx
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x70], rax
mov rax, rbx
je 0x14001e7b1
mov dword [rsp + 0x48], edi
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e7a5
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x50], 1
mov qword [rax + 0x28], rcx
mov rcx, qword [rbx + 0x48]
mov rax, rbx
mov r8d, dword [rsp + 0x78]
test rcx, rcx
cmovne rax, rcx
mov r14d, dword [rax + 0x24]
mov dword [rsp + 0x40], r14d
test r8b, 2
je 0x14001e837
test rcx, rcx
mov rax, rbx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, 2
jmp 0x14001e82f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
nop dword [rax + rax]
xor r9d, r9d
test eax, 0xfffffffa
jne 0x14001e63f
cmp eax, 5
je 0x14001e63f
mov edi, 0xa1
jmp 0x14001e63c
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e828
mov dword [rax + 0x24], edx
test r8b, 0x10
jne 0x14001e845
mov rax, qword [rbp - 0x60]
test al, 8
jne 0x14001e871
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, 0x10
jmp 0x14001e865
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e85e
mov dword [rax + 0x24], edx
mov rax, qword [rbp - 0x60]
test r8b, 0x20
jne 0x14001e87b
test al, 8
jne 0x14001e8a3
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, 0x20
jmp 0x14001e89b
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e894
mov dword [rax + 0x24], edx
mov r10d, 0x2000000
test r10d, r8d
je 0x14001e8d6
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e8ce
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e8c7
mov dword [rax + 0x24], edx
mov r10d, 0x4000000
test r10d, r8d
je 0x14001e909
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e901
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e8fa
mov dword [rax + 0x24], edx
mov r10d, 0x200000
test r10d, r8d
je 0x14001e93c
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e934
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e92d
mov dword [rax + 0x24], edx
mov r10d, 0x8000
test r10d, r8d
je 0x14001e96f
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e967
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e960
mov dword [rax + 0x24], edx
mov r10d, 0x100
test r10d, r8d
je 0x14001e9a4
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e99a
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e993
mov dword [rax + 0x24], edx
jmp 0x14001e9aa
bts dword [r13 + 0x40], 7
mov rcx, qword [rbx + 0x48]
mov r10d, 0x20000
mov rax, rbx
test r10d, r8d
je 0x14001e9dc
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, r10d
jmp 0x14001e9d5
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e9ce
jmp 0x14001e9fb
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
bts edx, 0x10
jmp 0x14001e9f6
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001e9ef
mov edi, 0x2000
mov dword [rax + 0x24], edx
test edi, r8d
je 0x14001eb9c
bt r8d, 0x14
jb 0x14001ea2d
mov rdx, r12
mov rcx, r13
call fcn.14001b608
xor r9d, r9d
test eax, eax
jne 0x14001ea2d
mov esi, r9d
jmp 0x14001eba9
mov rcx, qword [rbx + 0x48]
mov rax, rbx
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rbx
or edx, edi
jmp 0x14001ea4c
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001ea45
mov dword [rax + 0x24], edx
lea r13, str.WindowsSystem32WimBootCompress.ini
or rdi, 0xffffffffffffffff
inc rdi
cmp word [r12 + rdi*2], r9w
jne 0x14001ea5f
mov r14d, 0x25
test edi, edi
je 0x14001ea8c
lea ecx, [rdi - 1]
lea eax, [r14 + 0x37]
cmp ax, word [r12 + rcx*2]
jne 0x14001ea8c
lea r14d, [rax - 0x38]
lea r13, [0x1400a03a2]
mov rcx, qword gs:[0x60]
lea eax, [rdi + 1]
add eax, r14d
mov edx, 8
mov r12d, eax
mov rcx, qword [rcx + 0x30]
lea r8, [rax + rax]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r9d, r9d
mov r15, rax
test rax, rax
jne 0x14001ead7
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], 8
jmp 0x14001eb94
mov r8, qword [rbp - 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rdx, r12
lea rax, [rbp - 0x70]
mov r9d, edi
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14000c208
xor r11d, r11d
mov edi, eax
test eax, eax
js 0x14001eb64
mov rdx, qword [rsp + 0x68]
mov r8, r13
mov rcx, qword [rbp - 0x70]
mov r9d, r14d
call fcn.14000107c
mov edi, eax
test eax, eax
js 0x14001eb64
mov rax, qword gs:[0x30]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
mov r8, r15
mov qword [rsp + 0x58], r11
mov dword [rax + 0x68], r11d
call fcn.1400394c8
xor r9d, r9d
test eax, eax
je 0x14001eb97
cmp dword [rbx], 0xfeedf002
mov r14d, dword [rsp + 0x40]
jne 0x14001eb9c
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x140], rax
jmp 0x14001eb9c
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword gs:[0x30]
xor r9d, r9d
movzx ecx, di
mov dword [rax + 0x68], ecx
mov r15, r9
mov r14d, dword [rsp + 0x40]
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x14001eba9
mov qword [rbx + 0x40], rax
mov edi, dword [rsp + 0x48]
mov r13, r15
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r15
mov r15d, dword [rsp + 0x50]
test esi, esi
je 0x14001ef32
test dword [rsp + 0x78], 0x20000
jne 0x14001ec88
cmp qword [rbx + 0x48], r9
lea rdx, [rbp - 0x48]
mov rax, rbx
mov r8d, 3
cmovne rax, qword [rbx + 0x48]
mov esi, dword [rax + 0x24]
mov ecx, esi
mov dword [rsp + 0x60], esi
call fcn.14004d620
xor r9d, r9d
mov edi, eax
test eax, eax
jns 0x14001ec7c
mov qword [rsp + 0x20], r9
lea rdx, str.onecore_base_ntsetupopktoolsosimagewimgapilibcapture.c
mov r9d, eax
lea rcx, str.WIMCaptureImageInternal
mov r8d, 0xa3e
call fcn.140046874
mov ecx, edi
bt edi, 0x1c
jae 0x14001ec55
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
je 0x14001ec67
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14001ec67
and ecx, 0x1fff0000
movzx eax, di
cmp ecx, 0x70000
cmove edi, eax
mov r14d, dword [rsp + 0x40]
xor r9d, r9d
mov esi, r9d
mov qword [rsp + 0x58], r13
jmp 0x14001ef32
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x60], esi
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], r9
call fcn.140036cd8
mov edi, dword [rsp + 0x48]
xor r9d, r9d
mov r14d, dword [rsp + 0x40]
mov esi, eax
mov qword [rsp + 0x58], r13
test eax, eax
je 0x14001ef32
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14001eccc
cmp dword [rbx], 0xfeedf002
jne 0x14001eccc
mov qword [rbx + 0x150], rcx
mov r14, qword [rbp - 0x78]
xor r8d, r8d
mov dword [rsp + 0x30], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], r9
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.140037764
xor r15d, r15d
mov r13, rax
test rax, rax
je 0x14001ed42
mov ecx, dword [rax + 0x1c]
bt ecx, 0xa
jae 0x14001ed29
mov edx, dword [rax + 0x80]
cmp edx, 0xa0000003
je 0x14001ed1b
cmp edx, 0xa000000c
jne 0x14001ed29
btr ecx, 0xa
mov qword [rax + 0x80], r15
mov dword [rax + 0x1c], ecx
mov r8, r13
mov qword [rbx + 0xb8], r13
mov rdx, r14
mov rcx, rbx
call fcn.14001d6a8
test eax, eax
jne 0x14001ed53
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov esi, r15d
mov rcx, qword [rbx + 0x48]
mov rax, rbx
mov rdx, qword [rsp + 0x68]
test rcx, rcx
mov r11d, dword [rsp + 0x50]
mov r8, rbx
mov r10d, dword [rsp + 0x40]
cmovne rax, rcx
mov qword [rsp + 0x58], rdx
mov r15d, r11d
mov r14d, r10d
mov r9d, dword [rax + 0x24]
mov rax, rdx
btr r9d, 0x10
test rcx, rcx
je 0x14001eda0
mov qword [rsp + 0x58], rdx
mov r8, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14001ed94
mov dword [r8 + 0x24], r9d
xor r9d, r9d
mov qword [rbp - 0x70], rax
test esi, esi
je 0x14001ef32
mov rcx, qword [rbp - 0x50]
call fcn.140034134
xor ecx, ecx
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x14001edea
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
xor r9d, r9d
mov rax, qword [rsp + 0x58]
mov esi, r9d
mov qword [rsp + 0x58], rax
jmp 0x14001ef32
cmp qword [rbx + 0x48], rcx
mov rdx, rbx
mov rax, qword [rbp - 0x70]
mov rcx, rbx
cmovne rdx, qword [rbx + 0x48]
mov qword [rsp + 0x58], rax
mov rax, rbx
cmovne rax, qword [rbx + 0x48]
mov rdx, qword [rdx + 0x78]
mov r9, qword [rax + 0x98]
mov rax, rbx
cmovne rax, qword [rbx + 0x48]
mov r8, qword [rax + 0x90]
call fcn.140010d0c
mov r8, qword [rbp - 0x80]
xor ecx, ecx
cmp qword [rbx + 0x48], rcx
mov rax, rbx
mov rdx, r13
mov rcx, rbx
cmovne rax, qword [rbx + 0x48]
mov dword [rax + 0x70], 1
call fcn.14001d1b0
xor r13d, r13d
test eax, eax
jne 0x14001ee71
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
mov edi, eax
mov rax, qword [rbp - 0x70]
mov esi, r9d
jmp 0x14001eef8
mov rcx, qword [rbp - 0x78]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x68], r13
call fcn.14001e06c
test eax, eax
je 0x14001eee2
mov r13, qword [rsp + 0x68]
mov ecx, esi
mov eax, edi
test r13, r13
je 0x14001eee2
mov rdx, r13
mov rcx, rbx
call fcn.14002d850
xor ecx, ecx
test eax, eax
jne 0x14001eebb
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor r9d, r9d
test esi, esi
je 0x14001eefd
mov rcx, qword [rbp - 0x50]
mov edx, FDICreate
call fcn.14002e500
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x58], rax
cmp qword [rbx + 0x48], r9
mov rcx, rbx
mov r13d, dword [rsp + 0x60]
mov eax, 1
cmovne rcx, qword [rbx + 0x48]
mov dword [rsp + 0x60], r13d
mov r13d, dword [rsp + 0x64]
mov dword [rsp + 0x64], r13d
mov dword [rcx + 0x70], r9d
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x80], rcx
test eax, eax
je 0x14001ef4b
mov rax, qword [rbx + 0x48]
mov rcx, rbx
jmp 0x14001ef42
mov rcx, rax
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x14001ef3b
mov dword [rcx + 0x24], r14d
test r15d, r15d
je 0x14001ef69
mov rax, qword [rbx + 0x48]
mov rcx, rbx
jmp 0x14001ef60
mov rcx, rax
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x14001ef59
mov qword [rcx + 0x28], r12
test esi, esi
je 0x14001efea
mov r8, qword [rbp - 0x58]
test r8, r8
je 0x14001f02b
test dword [rsp + 0x78], 0x4000000
je 0x14001f027
cmp qword [r8 + 0x48], r9
mov rax, r8
mov rcx, rbx
cmovne rax, qword [r8 + 0x48]
mov edx, dword [rax + 0x24]
mov rax, qword [rbx + 0x48]
jmp 0x14001efa7
mov rcx, rax
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x14001efa0
mov dword [rcx + 0x24], edx
mov rdx, rbx
mov rcx, r8
call fcn.140010b60
mov esi, eax
xor r9d, r9d
jmp 0x14001f027
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
xor r9d, r9d
jmp 0x14001eff8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r9d, r9d
mov edi, eax
mov esi, r9d
jmp 0x14001eff8
mov r15, qword [rsp + 0x58]
mov r12, qword [rbp - 0x68]
jmp 0x14001eff8
mov r12, rbx
mov rax, rbx
cmp qword [rbp - 0x58], r9
je 0x14001f02b
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x80], rcx
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x64], ecx
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x58], r15
test rax, rax
je 0x14001f02b
mov qword [rbx + 0x40], r9
cmp dword [rsp + 0x64], r9d
je 0x14001f045
mov ecx, dword [rsp + 0x60]
lea rdx, [rbp - 0x48]
mov r8d, 3
call fcn.14004d78c
test esi, esi
jne 0x14001f05c
test rbx, rbx
je 0x14001f05c
mov rcx, rbx
call fcn.1400102c0
xor r9d, r9d
mov ebx, r9d
mov rsi, qword [rbp - 0x80]
test rsi, rsi
je 0x14001f094
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r15, qword [rbp - 0x68]
test r15, r15
je 0x14001f0bd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x14001f108
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test edi, edi
je 0x14001f11a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rbx
jmp 0x14001f132
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140096bd0
mov rbx, qword [rsp + 0x548]
add rsp, 0x4f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret