Function at 0x180007c20
Capabilities:
Check if file exists
Delete file
Delete registry key
Get file attributes
Set file attributes

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3b0
mov qword [rsp + 0x158], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1800654c0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov qword [r11 - 0x340], 0xf
xor r14d, r14d
mov qword [r11 - 0x348], r14
mov byte [r11 - 0x358], r14b
lea r8d, [r14 + 0xb]
lea rdx, str.auditConfig
lea rcx, [rsp + 0x78]
call fcn.180001d80
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x130]
call fcn.180004fc0
nop
cmp qword [rsp + 0x98], 0x10
jb 0x180007cba
mov rcx, qword [rsp + 0x80]
call fcn.180033b90
mov qword [rsp + 0x98], recvfrom
mov qword [rsp + 0x90], r14
mov byte [rsp + 0x80], 0
mov qword [rsp + 0x68], recvfrom
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
mov r8d, recvfrom
lea rdx, str.localCacheDays
lea rcx, [rsp + 0x48]
call fcn.180001d80
nop
mov r8d, 7
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x130]
call fcn.180004c00
mov r13d, eax
cmp qword [rsp + 0x68], 0x10
jb 0x180007d2e
mov rcx, qword [rsp + 0x50]
call fcn.180033b90
mov qword [rsp + 0x68], recvfrom
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
cmp r13d, 7
je 0x180007d56
mov edx, r13d
lea rcx, str.local_audit_cache_days:__d
call fcn.18002fec4
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, r13d
imul eax, eax, 0xfffeae80
cdqe
imul rax, rax, 0x989680
add qword [rsp + 0x40], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx r11d, word [rsp + 0xa6]
movzx r9d, word [rsp + 0xa2]
movzx r8d, word [rsp + 0xa0]
mov dword [rsp + 0x20], r11d
lea rdx, str._04d__02d__02d
lea rcx, [rsp + 0x160]
call fcn.18002cf08
nop
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_rptcache_rptstore_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xf0]
call fcn.180003e40
nop
mov rbp, qword [rsp + 0x120]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
mov r12, qword [rsp + 0xf0]
mov qword [rsp + 0x30], r12
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
or r15d, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
nop dword [rax]
test rsi, rsi
je 0x180007e3a
cmp rsi, r12
je 0x180007e3f
call fcn.180033b38
cmp rbx, rbp
je 0x18000800b
test rsi, rsi
jne 0x180007e57
call fcn.180033b38
mov r11, r14
jmp 0x180007e5a
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x30]
jne 0x180007e65
call fcn.180033b38
lea r8, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae r8, qword [rsp + 0x168]
mov r9, qword [rbx + 0x30]
cmp r9, r9
cmovb r9, r9
cmp qword [rbx + 0x38], 8
jb 0x180007e97
mov rcx, qword [rbx + 0x20]
jmp 0x180007e9b
lea rcx, [rbx + 0x20]
mov rdx, qword [rsp + 0x178]
cmp r9, rdx
cmovb rdx, r9
test rdx, rdx
je 0x180007ed7
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x180007ec9
add rcx, 2
add r8, 2
sub rdx, 1
jne 0x180007eb0
jmp 0x180007ed7
mov edx, 1
cmp word [rcx], ax
cmovb edx, r15d
jmp 0x180007eda
mov edx, r14d
movsxd rax, edx
test edx, edx
jne 0x180007ef7
mov rdx, qword [rsp + 0x178]
cmp r9, rdx
jb 0x180007eff
mov eax, r14d
cmp r9, rdx
setne al
test eax, eax
jns 0x180007f9b
test rsi, rsi
jne 0x180007f0e
call fcn.180033b38
mov r11, r14
jmp 0x180007f11
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x30]
jne 0x180007f1c
call fcn.180033b38
cmp qword [rbx + 0x38], 8
jb 0x180007f29
mov rdx, qword [rbx + 0x20]
jmp 0x180007f2d
lea rdx, [rbx + 0x20]
lea rcx, [0x180052770]
call fcn.18003005c
test rsi, rsi
jne 0x180007f48
call fcn.180033b38
mov r11, r14
jmp 0x180007f4b
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x30]
jne 0x180007f56
call fcn.180033b38
lea r8, [rbx + 0x18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_rptcache_rptstore_
lea rcx, [rsp + 0x48]
call fcn.18000d2f0
cmp qword [rax + 0x20], 8
jb 0x180007f78
mov rdx, qword [rax + 8]
jmp 0x180007f7c
lea rdx, [rax + 8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp qword [rsp + 0x68], 8
jb 0x180007f9b
mov rcx, qword [rsp + 0x50]
call fcn.180033b90
test rsi, rsi
jne 0x180007fa5
call fcn.180033b38
cmp byte [rbx + 0x41], 0
je 0x180007fb5
call fcn.180033b38
jmp 0x180007e30
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x41], 0
jne 0x180007fe1
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
jne 0x180007e30
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x180007fd0
jmp 0x180007e30
mov rax, qword [rbx + 8]
cmp byte [rax + 0x41], 0
jne 0x180008003
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x180008003
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], 0
je 0x180007ff0
mov rbx, rax
jmp 0x180007e30
mov word [rsp + 0x190], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x192]
call fcn.180035e00
lea rcx, [rsp + 0x190]
call fcn.180031314
test eax, eax
je 0x180008330
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x48]
call fcn.18002bc20
nop
mov rbx, qword [rsp + 0x60]
cmp rbx, qword [rsp + 0x68]
jbe 0x180008068
call fcn.180033b38
mov rdi, qword [rsp + 0x48]
add rbx, 8
movabs r12, 0x346dc5d63886594b
nop dword [rax + rax]
mov rsi, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rsi
jbe 0x180008091
call fcn.180033b38
test rdi, rdi
je 0x18000809d
cmp rdi, qword [rsp + 0x48]
je 0x1800080a2
call fcn.180033b38
lea rbp, [rbx - 8]
cmp rbp, rsi
je 0x1800082c8
mov word [rsp + 0x30], r14w
xor eax, eax
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
test rdi, rdi
jne 0x1800080d4
call fcn.180033b38
mov r11, r14
jmp 0x1800080d7
mov r11, qword [rdi]
cmp rbp, qword [r11 + 0x20]
jb 0x1800080e2
call fcn.180033b38
cmp qword [rbx + 0x18], 8
jb 0x1800080ee
mov rcx, qword [rbx]
jmp 0x1800080f1
mov rcx, rbx
mov dword [rsp + 0x78], r14d
xor eax, eax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x98], eax
lea r8, [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1800082a2
mov rax, qword [rsp + 0x8c]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x1800082a2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xc0], xmm1
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, r13d
imul eax, eax, 0x36ee80
cdqe
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rsp + 0xd0]
sub rcx, qword [rsp + 0xb0]
mov rax, r12
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jle 0x1800082a2
test rdi, rdi
jne 0x180008217
call fcn.180033b38
mov r11, r14
jmp 0x18000821a
mov r11, qword [rdi]
cmp rbp, qword [r11 + 0x20]
jb 0x180008225
call fcn.180033b38
cmp qword [rbx + 0x18], 8
jb 0x180008231
mov rdx, qword [rbx]
jmp 0x180008234
mov rdx, rbx
lea rcx, str.cacheable_attachment_expired__delete_it:__s
call fcn.18002fec4
test rdi, rdi
jne 0x18000824f
call fcn.180033b38
mov r11, r14
jmp 0x180008252
mov r11, qword [rdi]
cmp rbp, qword [r11 + 0x20]
jb 0x18000825d
call fcn.180033b38
cmp qword [rbx + 0x18], 8
jb 0x180008269
mov rsi, qword [rbx]
jmp 0x18000826c
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180008287
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1800082a2
test al, 1
je 0x180008299
and eax, 0xfffffffe
mov edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jne 0x1800082b1
call fcn.180033b38
mov r11, r14
jmp 0x1800082b4
mov r11, qword [rdi]
cmp rbp, qword [r11 + 0x20]
jb 0x1800082bf
call fcn.180033b38
add rbx, 0x28
jmp 0x180008080
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x180008316
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x18000830c
add rbx, 0x20
cmp qword [rbx], 8
jb 0x1800082ef
mov rcx, qword [rbx - 0x18]
call fcn.180033b90
mov qword [rbx], 7
mov qword [rbx - 8], r14
mov word [rbx - 0x18], r14w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rsi
jne 0x1800082e0
mov rcx, qword [rsp + 0x60]
call fcn.180033b90
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x48]
call fcn.180033b90
nop
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xb0], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0xc0], xmm1
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
call fcn.180009a10
mov rcx, qword [rsp + 0x120]
call fcn.180033b90
mov qword [rsp + 0x120], r14
mov qword [rsp + 0x128], r14
mov rcx, qword [rsp + 0xf0]
call fcn.180033b90
nop
cmp qword [rsp + 0x180], 8
jb 0x1800083e1
mov rcx, qword [rsp + 0x168]
call fcn.180033b90
mov qword [rsp + 0x180], 7
mov qword [rsp + 0x178], r14
mov word [rsp + 0x168], r14w
mov eax, dword [rsp + 0x138]
movsx ecx, al
cmp ecx, 4
je 0x180008434
lea eax, [rcx - 6]
cmp eax, 1
ja 0x180008447
mov rbx, qword [rsp + 0x130]
test rbx, rbx
je 0x180008447
mov rcx, rbx
call fcn.180020c94
mov rcx, rbx
call fcn.180033b90
jmp 0x180008447
bt eax, 8
jae 0x180008447
mov rcx, qword [rsp + 0x130]
call fcn.180034b78
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x180008474
lea rbx, [rcx - 8]
lea r9, [0x18001bccc]
mov r8d, dword [rbx]
mov edx, 8
call fcn.180034efc
mov rcx, rbx
call fcn.180034ffc
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1800336d0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret