Function at 0x140009750
Capabilities:
Delete file
Get file attributes
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140033670]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r14, rcx
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x50], r15
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x80]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov r8d, 0x104
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameW]
test eax, eax
je 0x1400097ee
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140009807
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140009a32
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000a99c
lea rdx, [0x140021ea0]
lea rcx, [rsp + 0x58]
call fcn.140008c6c
lea rdx, str.Logs
lea rcx, [rsp + 0x58]
call fcn.140008c6c
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
or r12d, 0xffffffff
cmp eax, r12d
je 0x140009861
shr ebx, 4
and ebx, 1
jmp 0x140009864
mov ebx, r15d
xor ecx, ecx
call fcn.140008b64
xor ecx, ecx
call fcn.140008b64
test ebx, ebx
jne 0x140009896
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call fcn.14000a414
mov edi, eax
test eax, eax
js 0x140009a23
mov esi, r15d
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400098c7
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140008b64
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
inc esi
mov dword [rsp + 0x20], esi
lea r9, str.ServiceRemediation
lea rdx, str._s_s._03d.etl
lea rcx, [rsp + 0x30]
call fcn.14000630c
mov edi, eax
test eax, eax
js 0x140009a23
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140008a00
mov edi, eax
test eax, eax
js 0x140009a23
cmp esi, 0xa
jb 0x140009899
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, r12d
je 0x140009942
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140009945
mov ebx, r15d
xor ecx, ecx
call fcn.140008b64
xor ecx, ecx
call fcn.140008b64
test ebx, ebx
je 0x14000998b
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x14000998b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140009976
mov edi, 0x80004005
jmp 0x140009984
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x140009a25
mov edi, 0x40
mov rcx, qword [rsi + rdi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, r12d
je 0x1400099ab
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400099ae
mov ebx, r15d
xor ecx, ecx
call fcn.140008b64
xor ecx, ecx
call fcn.140008b64
test ebx, ebx
je 0x1400099d3
mov rdx, qword [rdi + rsi + 8]
mov rcx, qword [rsi + rdi]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
test eax, eax
je 0x140009965
sub rdi, 8
cmp rdi, 0xfffffffffffffff8
jne 0x140009990
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, r12d
je 0x1400099f7
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400099fa
mov ebx, r15d
xor ecx, ecx
call fcn.140008b64
xor ecx, ecx
call fcn.140008b64
mov edi, r15d
test ebx, ebx
je 0x140009a18
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rax, qword [rsi]
mov qword [rsi], r15
mov qword [r14], rax
jmp 0x140009a2a
mov ecx, eax
call fcn.140008b48
mov ecx, edi
call fcn.140008b64
nop
lea rcx, [rsp + 0x58]
call fcn.140009ee8
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140009a67
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140008b64
nop
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000a808
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140009a91
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, edi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14001c1f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret