Function at 0x140101814
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
xor esi, esi
mov byte [rbp - 9], sil
test rcx, rcx
jne 0x140101868
mov ecx, 0x27917a3
mov edi, 0x80004005
mov edx, edi
call fcn.1400ee138
jmp 0x140101abb
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElemsize]
cmp eax, 1
je 0x14010187a
mov ecx, 0x27917c0
jmp 0x140101857
lea rdx, [rbp - 5]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VarR8FromUI1]
mov edi, eax
test eax, eax
jns 0x140101894
mov ecx, 0x27917c1
jmp 0x14010185c
cmp word [rbp - 5], 0xc
je 0x1401018a2
mov ecx, 0x27917c2
jmp 0x140101857
lea r8, [rbp + 3]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov edi, eax
test eax, eax
jns 0x1401018c1
mov ecx, 0x27917c3
jmp 0x14010185c
lea r8, [rbp - 1]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov edi, eax
test eax, eax
jns 0x1401018e3
mov ecx, 0x27917c4
jmp 0x14010185c
mov eax, dword [rbp - 1]
cmp eax, dword [rbp + 3]
jns 0x1401018f5
mov ecx, 0x27917c5
jmp 0x140101857
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.1400f5890
mov r14d, 8
mov rdx, qword [rbp + 0xf]
cmp word [rdx], r14w
je 0x140101927
mov ecx, 0x27917c6
mov edi, 0x80004005
mov edx, edi
call fcn.1400ee138
jmp 0x140101aab
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x140101937
mov ecx, 0x27917c7
jmp 0x140101916
movdqa xmm0, xmmword [0x14017f2c0]
movdqu xmmword [rbp + 0x2f], xmm0
mov word [rbp + 0x1f], si
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x14010194c
lea rcx, [rbp + 0x1f]
call fcn.14001c6b0
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], r14
cmovae rcx, qword [rbp + 0x1f]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
mov r8d, 2
call fcn.14003b1bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401019a3
mov byte [rbp - 9], 1
mov edi, 0x80004005
jmp 0x140101a32
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
cmp edx, 0x80070005
je 0x140101a30
mov edi, 0x80004005
mov edx, edi
mov ecx, 0x27917c8
call fcn.1400ee138
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbp - 9], sil
je 0x1401019f4
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], r14
cmovae rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rax, qword [rbp + 0x37]
cmp rax, r14
jb 0x140101a9a
mov rcx, qword [rbp + 0x1f]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x140101a93
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140101a93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edi, esi
test rbx, rbx
je 0x140101a41
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp byte [rbp - 9], sil
je 0x140101a5b
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], r14
cmovae rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rax, qword [rbp + 0x37]
cmp rax, r14
jb 0x140101a9a
mov rcx, qword [rbp + 0x1f]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x140101a93
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140101a93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
movdqa xmm0, xmmword [0x14017f2c0]
mov word [rbp + 0x1f], si
movdqu xmmword [rbp + 0x2f], xmm0
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140101abb
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
nop
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140118d00
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret