Function at 0x10002a7ac
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rsi, rcx
xor r15d, r15d
mov r14, r15
mov qword [rax + 0x20], r15
mov rbp, r15
mov qword [rax + 8], r15
mov r13, r15
mov qword [rsp + 0x30], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rsp + 0x40], r15
mov qword [rax - 0x80], r15
mov qword [rax - 0x78], r15
mov dword [rax - 0x70], r15d
mov qword [rax - 0x68], r15
mov qword [rax - 0x60], r15
mov qword [rax - 0x58], r15
mov dword [rax - 0x50], r15d
cmp qword [rcx + 0x1d8], r15
jne 0x10002a831
lea r8, [0x100004b40]
mov edx, 0x1a3a
lea rcx, [0x1000046e0]
call fcn.100099ad8
lea r12, [0x1001653b8]
test byte [rsi + 0x150], 4
je 0x10002a95a
lea r9, [rsp + 0xe8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsi + 0x1d8]
call fcn.100120c78
mov ebx, eax
cmp eax, r15d
jl 0x10002a94d
lea rdx, [rsp + 0xd0]
mov r14, qword [rsp + 0xe8]
mov rcx, r14
call fcn.10010bcc8
mov ebx, eax
cmp eax, r15d
jge 0x10002a8e2
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002a8d5
test byte [rcx + 0x1c], 1
je 0x10002a8d5
cmp byte [rcx + 0x19], 2
jb 0x10002a8d5
mov edx, 0x148
mov dword [rsp + 0x28], eax
mov rax, qword [rsi + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001e360
mov rbp, qword [rsp + 0xd0]
jmp 0x10002ab97
mov rbp, qword [rsp + 0xd0]
jmp 0x10002ab97
mov rbp, qword [rsp + 0xd0]
cmp rbp, r15
je 0x10002a95a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r15d
jne 0x10002a95a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002a939
test byte [rcx + 0x1c], 1
je 0x10002a939
cmp byte [rcx + 0x19], 2
jb 0x10002a939
mov edx, 0x149
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
movzx ebx, di
or ebx, 0x80070000
cmp edi, r15d
cmovle ebx, edi
jmp 0x10002ab97
mov r14, qword [rsp + 0xe8]
jmp 0x10002abb3
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120c78
mov ebx, eax
cmp eax, r15d
jl 0x10002ab92
mov r13, qword [rsp + 0x30]
test byte [rsi + 0x150], 1
je 0x10002a9ae
xor r8d, r8d
lea rdx, [rsp + 0xd8]
mov rcx, r13
call fcn.10009b4ec
mov ebx, eax
cmp eax, r15d
jl 0x10002ab7d
jmp 0x10002a9d7
lea r9, [rsp + 0xd8]
mov r8b, 1
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120c78
mov ebx, eax
cmp eax, r15d
jl 0x10002ab7d
mov rcx, qword [rsi + 0x1c8]
cmp rcx, r15
je 0x10002a9f8
lea rdx, [rsp + 0x40]
call fcn.10012bd94
mov ebx, eax
cmp eax, r15d
jl 0x10002ab7d
lea rcx, [rsi + 0x3c8]
lea rdx, [rsp + 0x60]
call fcn.10012d5a8
mov ebx, eax
cmp eax, r15d
jge 0x10002aa51
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002ab7d
test byte [rcx + 0x1c], 1
je 0x10002ab7d
cmp byte [rcx + 0x19], 2
jb 0x10002ab7d
mov edx, 0x14a
mov r9d, eax
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
jmp 0x10002ab7d
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.10013dc18
mov ebx, eax
cmp eax, r15d
jl 0x10002ab7d
mov r9, qword [rsp + 0xe0]
mov r8d, dword [rsi + 0x14c]
mov rdx, qword [rsp + 0xd8]
mov rcx, r13
call fcn.10010b3bc
mov ebx, eax
cmp eax, r15d
jl 0x10002ab7d
test byte [rsi + 0x150], 0x80
je 0x10002ab7d
cmp byte [rsi + 0x11c], r15b
je 0x10002ab7d
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0xd0], rax
cmp rax, r15
je 0x10002aadb
mov rcx, rax
call fcn.100043fcc
mov r12, rax
jmp 0x10002aade
mov r12, r15
mov rdx, r13
mov rcx, r12
call fcn.10001ec50
mov ebx, eax
cmp eax, r15d
jl 0x10002ab6d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0xe0]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, r12
call fcn.10001ef7c
mov ebx, eax
cmp eax, r15d
jl 0x10002ab76
mov rdi, qword [rsi + 0x310]
cmp rdi, qword [rsi + 0x318]
jb 0x10002ab4a
lea rdx, [rdi + 1]
lea rcx, [rsi + 0x308]
call fcn.100043a28
cmp al, r15b
jne 0x10002ab4a
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rsi + 0x308]
lea rcx, [rax + rdi*8]
cmp rcx, r15
je 0x10002ab5d
mov qword [rcx], r12
inc qword [rsi + 0x310]
lea r12, [0x1001653b8]
jmp 0x10002ab7d
lea r12, [0x1001653b8]
jmp 0x10002ab7d
lea r12, [0x1001653b8]
mov rcx, qword [rsp + 0xd8]
cmp rcx, r15
je 0x10002ab97
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10002ab97
mov r13, qword [rsp + 0x30]
cmp rbp, r15
je 0x10002aba5
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10002abb3
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r15
je 0x10002abc1
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x60]
call fcn.10013f470
mov ebp, r15d
mov rsi, r15
cmp qword [rsp + 0x48], r15
jbe 0x10002ac25
cmp rsi, qword [rsp + 0x48]
jae 0x10002ac02
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rdi + rsi*8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi + rsi*8], r15
inc ebp
inc rsi
mov eax, ebp
cmp rax, qword [rsp + 0x48]
jae 0x10002ac25
jmp 0x10002abd8
lea r8, [0x100005ac8]
mov edx, 0x2cd
lea rcx, [0x100005a08]
call fcn.100099ad8
mov ecx, 0x80070057
call fcn.100019658
int3
mov rdi, qword [rsp + 0x40]
cmp rdi, r15
je 0x10002ac4a
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.10004387c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
cmp ebx, r15d
jge 0x10002ac8a
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002ac8a
test byte [rcx + 0x1c], 1
je 0x10002ac8a
cmp byte [rcx + 0x19], 2
jb 0x10002ac8a
mov edx, 0x14b
mov r9d, ebx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x10002ac9b
call qword [sym.imp.msvcrt.dll_free]
nop
lea rcx, [rsp + 0x40]
call fcn.100043290
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret