Function at 0x100033d64
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r14d, r14d
or qword [r11 - 0x60], 0xffffffffffffffff
mov r13, rcx
mov rbx, r14
mov qword [r11 - 0x50], r14
mov rsi, r14
mov qword [r11 - 0x68], rbx
mov qword [r11 - 0x58], r14
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100033ddb
test byte [rcx + 0x1c], 1
je 0x100033ddb
cmp byte [rcx + 0x19], 4
jb 0x100033ddb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x208
call fcn.10001c7b8
mov rcx, qword [r13 + 0x1d8]
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call fcn.100120b70
cmp eax, r14d
mov edi, eax
jl 0x100034470
mov rax, qword [r13 + 0x1d8]
mov r12, r14
cmp rax, r14
je 0x100033e33
mov r12d, 0x7fffffff
mov edi, r14d
mov rcx, r12
cmp word [rax], r14w
je 0x100033e27
add rax, 2
sub rcx, 1
jne 0x100033e17
cmp rcx, r14
jne 0x100033ebe
mov r12, r14
mov edi, 0x80070057
cmp edi, r14d
cmovl r12, r14
cmp edi, r14d
jl 0x100034470
mov rbp, qword [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbp
xor r9d, r9d
call fcn.10010b8b4
cmp eax, r14d
mov edi, eax
jge 0x1000341aa
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034469
test byte [rcx + 0x1c], 1
je 0x100034469
cmp byte [rcx + 0x19], 2
jb 0x100034469
mov edx, 0x209
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov rbx, qword [rsp + 0x30]
jmp 0x10003447c
sub r12, rcx
jmp 0x100033e38
cmp rsi, r14
je 0x100033ed9
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], r14
lea rcx, [rbx + r12*2 + 2]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call fcn.10009b4ec
mov rsi, qword [rsp + 0x40]
cmp eax, r14d
mov edi, eax
jl 0x100034475
lea rdx, [0x100004b00]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x100033fc3
mov edx, dword [r13 + 0x170]
mov ecx, r14d
cmp edx, r14d
jbe 0x100033f45
mov rax, qword [r13 + 0xd8]
add rax, 0x54
test byte [rax], 1
jne 0x100033f45
inc ecx
add rax, 0x160
cmp ecx, edx
jb 0x100033f34
cmp ecx, edx
jne 0x10003417c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x10003417c
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x10003417c
test byte [rax + 0x1c], 1
je 0x10003417c
cmp byte [rax + 0x19], 2
jb 0x10003417c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
mov edx, 0x20a
or r9d, 0x80070000
cmp eax, r14d
cmovle r9d, eax
call fcn.10001c7dc
jmp 0x10003417c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jb 0x100034145
mov word [rsi + 0x48], r14w
movdqu xmm0, xmmword [0x100001fe0]
lea rdx, [rsp + 0x50]
mov rcx, rsi
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r14d
jne 0x10003411f
lea rax, [rsp + 0x50]
lea rcx, [0x100001fe0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10003402c
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10003402c
mov eax, r14d
jmp 0x100034031
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
jne 0x10003404e
lea r8, [0x100005198]
lea rcx, [0x1000046e0]
mov edx, 0x30ad
call fcn.100099ad8
mov r8d, dword [r13 + 0x170]
mov ecx, r14d
cmp r8d, r14d
jbe 0x10003409f
mov r9, qword [r13 + 0xd8]
mov eax, ecx
imul rax, rax, 0x160
lea rdx, [rax + r9 + 0x44]
lea rax, [rsp + 0x50]
mov rdi, qword [rdx]
cmp rdi, qword [rax]
jne 0x10003408e
mov rdi, qword [rdx + 8]
cmp rdi, qword [rax + 8]
jne 0x10003408e
mov eax, r14d
jmp 0x100034093
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
je 0x10003409f
inc ecx
cmp ecx, r8d
jb 0x100034064
cmp ecx, r8d
jne 0x10003417c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x10003417c
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x10003417c
test byte [rax + 0x1c], 1
je 0x10003417c
cmp byte [rax + 0x19], 2
jb 0x10003417c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003d08]
mov edx, 0x20b
movzx ecx, ax
mov r9, rbx
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
jmp 0x10003417c
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003417c
test byte [rcx + 0x1c], 1
je 0x10003417c
cmp byte [rcx + 0x19], 3
jb 0x10003417c
mov edx, 0x20c
jmp 0x100034169
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003417c
test byte [rcx + 0x1c], 1
je 0x10003417c
cmp byte [rcx + 0x19], 3
jb 0x10003417c
mov edx, 0x20d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov r9, rbx
call fcn.10001da24
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x30], r14
call fcn.10010bad8
cmp eax, r14d
mov edi, eax
jl 0x10003427c
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x100033ec6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rsp + 0x38], 0xffffffffffffffff
cmp rbp, r14
je 0x1000341dc
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x48], r14
mov rcx, qword [r13 + 0x1d8]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.100120a08
cmp eax, r14d
mov edi, eax
jl 0x100034470
cmp rbx, r14
je 0x100034222
lea r8, [0x1000051b8]
lea rcx, [0x1000046e0]
mov edx, 0x30e4
call fcn.100099ad8
mov rbp, qword [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbp
xor r9d, r9d
call fcn.10010b8b4
cmp eax, r14d
mov edi, eax
jge 0x100034430
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034469
test byte [rcx + 0x1c], 1
je 0x100034469
cmp byte [rcx + 0x19], 3
jb 0x100034469
mov edx, 0x20e
jmp 0x100033e9d
mov rbx, qword [rsp + 0x30]
jmp 0x100034475
cmp rsi, r14
je 0x100034299
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], r14
lea rcx, [rbx + r12*2 + 2]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call fcn.10009b4ec
mov rsi, qword [rsp + 0x40]
cmp eax, r14d
mov edi, eax
jl 0x100034475
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jb 0x1000343cf
mov word [rsi + 0x48], r14w
movdqu xmm0, xmmword [0x100001fe0]
lea rdx, [rsp + 0x50]
mov rcx, rsi
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r14d
jne 0x1000343a9
lea rcx, [rsp + 0x50]
mov rdx, qword [rcx]
cmp rdx, qword [r13 + 0x130]
jne 0x100034324
mov rdx, qword [rcx + 8]
cmp rdx, qword [r13 + 0x138]
jne 0x100034324
mov eax, r14d
jmp 0x100034329
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
je 0x100034406
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x100034406
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x100034406
test byte [rax + 0x1c], 1
je 0x100034406
cmp byte [rax + 0x19], 3
jb 0x100034406
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003d08]
mov edx, 0x20f
movzx ecx, ax
mov r9, rbx
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
jmp 0x100034406
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100034406
test byte [rcx + 0x1c], 1
je 0x100034406
cmp byte [rcx + 0x19], 3
jb 0x100034406
mov edx, 0x210
jmp 0x1000343f3
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100034406
test byte [rcx + 0x1c], 1
je 0x100034406
cmp byte [rcx + 0x19], 3
jb 0x100034406
mov edx, 0x211
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov r9, rbx
call fcn.10001da24
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x30], r14
call fcn.10010bad8
cmp eax, r14d
mov edi, eax
jl 0x100034440
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x100034286
jmp 0x100034475
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034469
test byte [rcx + 0x1c], 1
je 0x100034469
cmp byte [rcx + 0x19], 2
jb 0x100034469
mov edx, 0x212
jmp 0x100033e9d
mov rbx, qword [rsp + 0x30]
jmp 0x100034483
mov rbp, qword [rsp + 0x48]
lea r12, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rbp, r14
je 0x100034498
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rbx, r14
je 0x1000344ad
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rsi, r14
je 0x1000344c2
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x1000344dc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100034502
test byte [rcx + 0x1c], 1
je 0x100034502
cmp byte [rcx + 0x19], 4
jb 0x100034502
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x213
call fcn.10001c7b8
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret