Function at 0x18004cdbc
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movss xmm0, dword [0x1800812d8]
xor r13d, r13d
movss dword [rax + 8], xmm0
mov rbx, r9
mov r15d, r8d
mov ebp, edx
mov r14, rcx
mov r12d, r13d
test rcx, rcx
je 0x18004d227
test rbx, rbx
je 0x18004d227
mov rcx, qword [r9]
test rcx, rcx
je 0x18004ce28
call fcn.180050c0c
test eax, eax
je 0x18004ce28
mov rcx, qword [rbx]
xor edx, edx
call fcn.18004cbc4
mov rax, qword [rbx]
jmp 0x18004ce2e
mov qword [rbx], r13
mov rax, r13
or rdi, 0xffffffffffffffff
lea esi, [rdi + 2]
test rax, rax
jne 0x18004ce99
lea edx, [rdi + 0x71]
lea ecx, [rdi + 0x41]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
jne 0x18004ce5c
lea eax, [rdi + 9]
jmp 0x18004d22c
mov dword [rax], 0xffffff02
mov r12d, esi
mov rax, qword [rbx]
mov qword [rax + 8], rdi
mov rax, qword [rbx]
or dword [rax + 0x10], 0xffffffff
mov rax, qword [rbx]
mov dword [rax + 0x14], r13d
mov rax, qword [rbx]
mov qword [rax + 0x18], rdi
mov rax, qword [rbx]
mov qword [rax + 0x30], rdi
mov rax, qword [rbx]
mov qword [rax + 0x48], rdi
mov rax, qword [rbx]
mov qword [rax + 0x60], rdi
mov rax, qword [rbx]
and dword [rax], 0xffffff0f
mov rdx, qword [rbx]
add rdx, 8
cmp qword [rdx], rdi
jne 0x18004ced5
mov rcx, qword [0x18008ba08]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ESENT.dll_JetBeginSessionA]
nop dword [rax + rax]
mov ecx, eax
call fcn.18004f0d8
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x20], 2
lea r9, [rcx + 0x10]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ESENT.dll_JetCreateDatabaseA]
nop dword [rax + rax]
mov ecx, 0xfffffbf8
cmp eax, 0xfffff8ed
cmove eax, ecx
mov ecx, eax
call fcn.18004f0d8
mov edi, eax
mov rax, qword [rbx]
mov dword [rax + 0x14], esi
cmp edi, 4
jne 0x18004cfd8
sub ebp, esi
je 0x18004cf48
sub ebp, esi
je 0x18004cf44
cmp ebp, esi
jne 0x18004d1e4
mov edx, esi
mov r8d, r15d
mov r9, rbx
mov rcx, r14
call fcn.18004f394
jmp 0x18004d1de
xor edx, edx
jmp 0x18004cf31
mov rcx, qword [rbx]
mov rdx, r14
mov rcx, qword [rcx + 8]
call qword [sym.imp.ESENT.dll_JetDetachDatabaseA]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileA]
nop dword [rax + rax]
test eax, eax
jne 0x18004cf9d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x18004cf9d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x1c97
mov ecx, esi
mov edx, eax
call fcn.180038d90
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x20], 2
lea r9, [rcx + 0x10]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ESENT.dll_JetCreateDatabaseA]
nop dword [rax + rax]
mov ecx, 0xfffffbf8
cmp eax, 0xfffff8ed
cmove eax, ecx
mov ecx, eax
call fcn.18004f0d8
mov edi, eax
test edi, edi
jne 0x18004d1e4
mov rcx, qword [rbx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea ebp, [rdi + 3]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
mov qword [rsp + 0x20], rax
lea rdx, str.SmTblVersion
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ESENT.dll_JetPrepareUpdate]
nop dword [rax + rax]
mov ecx, eax
call fcn.18004f0d8
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
lea r14d, [rbp + 1]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], r13
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ESENT.dll_JetSetColumn]
nop dword [rax + rax]
mov ecx, eax
call fcn.18004f0d8
mov rcx, qword [rbx]
mov edi, eax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
test eax, eax
je 0x18004d0a4
mov r8d, ebp
call qword [sym.imp.ESENT.dll_JetPrepareUpdate]
nop dword [rax + rax]
jmp 0x18004d0c9
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ESENT.dll_JetUpdate]
nop dword [rax + rax]
mov ecx, eax
call fcn.18004f0d8
mov edi, eax
test edi, edi
jne 0x18004d1e4
mov rcx, qword [rbx]
lea rdx, str.SmTblSection
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov r8d, r14d
mov qword [rsp + 0x20], r13
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
call fcn.18004b4d4
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
lea rdx, str.SmTblScp
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
lea r8d, [rdi + 2]
mov eax, r15d
mov qword [rsp + 0x28], r13
not eax
mov qword [rsp + 0x20], r13
and eax, esi
lea rdx, str.SmTblSmp
shl eax, 5
xor r9d, r9d
add eax, 0x10
or dword [rcx], eax
mov rcx, qword [rbx]
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
lea rdx, str.SmTblScp2
mov qword [rsp + 0x28], r13
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], r13
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
mov rcx, qword [rbx]
lea r8d, [rax + 5]
mov qword [rsp + 0x28], r13
lea rdx, str.SmTblGpo
mov r9d, esi
mov qword [rsp + 0x20], r13
call fcn.18004d254
mov edi, eax
test eax, eax
jne 0x18004d1e4
test r15b, 2
je 0x18004d223
mov rcx, qword [rbx]
lea r8d, [rax + 6]
mov qword [rsp + 0x28], r13
lea rdx, str.SmTblTattoo
xor r9d, r9d
mov qword [rsp + 0x20], r13
call fcn.18004d254
mov edi, eax
test eax, eax
je 0x18004d223
mov rcx, qword [rbx]
xor edx, edx
call fcn.18004cbc4
cmp r12d, esi
jne 0x18004d223
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
cmp rax, 0xffffffffffffffff
je 0x18004d214
mov edx, esi
mov rcx, rax
call qword [sym.imp.ESENT.dll_JetEndSession]
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [rbx], r13
mov eax, edi
jmp 0x18004d22c
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret