Function at 0x140035ef0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov rbx, rcx
xor r13d, r13d
mov r12d, r13d
mov qword [rbp + 0x7f], r13
mov esi, r13d
mov qword [rbp + 0x67], r13
mov r14d, r13d
mov qword [rbp - 0x39], r13
mov qword [rbp + 0x6f], r13
mov qword [rbp + 0x77], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x11], r13d
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov qword [rbp + 7], r13
mov dword [rbp + 0xf], r13d
cmp qword [rcx + 0x1d8], r13
jne 0x140035f75
lea r8, [0x140004208]
mov edx, 0x1dfb
lea rcx, [0x140003c50]
call fcn.1400a8be8
lea r15, [0x14017d3a8]
test byte [rbx + 0x154], 4
je 0x14003606c
lea r9, [rbp + 0x7f]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.140131a00
mov edi, eax
mov r12, qword [rbp + 0x7f]
test eax, eax
js 0x14003627e
lea rdx, [rbp + 0x67]
mov rcx, r12
call fcn.14011f17c
mov edi, eax
test eax, eax
jns 0x140036007
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x140035ffe
test byte [rcx + 0x1c], 1
je 0x140035ffe
cmp byte [rcx + 0x19], 2
jb 0x140035ffe
mov edx, 0x16a
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028ec8
mov rsi, qword [rbp + 0x67]
jmp 0x140036262
mov rsi, qword [rbp + 0x67]
test rsi, rsi
je 0x14003606c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14003606c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x140036059
test byte [rcx + 0x1c], 1
je 0x140036059
cmp byte [rcx + 0x19], 2
jb 0x140036059
mov edx, 0x16b
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x140036262
lea r15, [rbx + 0x128]
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbx + 0x1d8]
call fcn.140131a00
mov edi, eax
mov r14, qword [rbp - 0x39]
test eax, eax
js 0x14003625b
test byte [rbx + 0x154], 1
je 0x1400360b1
xor r8d, r8d
lea rdx, [rbp + 0x6f]
mov rcx, r14
call fcn.1400a99e4
jmp 0x1400360c7
lea r9, [rbp + 0x6f]
mov r8b, 1
mov rdx, r15
mov rcx, qword [rbx + 0x1d8]
call fcn.140131a00
test eax, eax
mov edi, eax
js 0x140036243
mov rcx, qword [rbx + 0x1c8]
test rcx, rcx
je 0x1400360f0
lea rdx, [rbp - 0x29]
call fcn.140149d74
mov edi, eax
test eax, eax
js 0x140036243
lea rcx, [rbx + 0x3e8]
lea rdx, [rbp - 9]
call fcn.1401236d8
mov edi, eax
test eax, eax
jns 0x14003614e
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x14003624a
test byte [rcx + 0x1c], 1
je 0x14003624a
cmp byte [rcx + 0x19], 2
jb 0x14003624a
mov edx, 0x16c
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
jmp 0x14003624a
lea r8, [rbp + 0x77]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.14015b11c
mov edi, eax
test eax, eax
js 0x140036243
mov r9, qword [rbp + 0x77]
mov r8d, dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
mov rdx, qword [rbp + 0x6f]
mov rcx, r14
call fcn.14011e870
mov edi, eax
test eax, eax
js 0x140036243
test byte [rbx + 0x154], 0x80
je 0x140036243
cmp byte [rbx + 0x114], r13b
je 0x140036243
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400361c5
mov rcx, rax
call fcn.140052668
mov r15, rax
jmp 0x1400361c8
mov r15, r13
mov rdx, r14
mov rcx, r15
call fcn.140029a6c
mov edi, eax
test eax, eax
js 0x140036243
mov rdx, qword [rbp + 0x77]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r13w
jne 0x1400361e1
lea r8, [r8*2 + 2]
mov rcx, r15
call fcn.140029d98
mov edi, eax
test eax, eax
js 0x140036243
add rbx, 0x308
mov r13, qword [rbx + 8]
cmp r13, qword [rbx + 0x10]
jb 0x14003622d
lea rdx, [r13 + 1]
mov rcx, rbx
call fcn.14008b270
test al, al
jne 0x14003622d
mov ecx, 0x8007000e
call fcn.14001ad98
int3
mov rax, qword [rbx]
lea rcx, [rax + r13*8]
xor r13d, r13d
test rcx, rcx
je 0x14003623f
mov qword [rcx], r15
inc qword [rbx + 8]
lea r15, [0x14017d3a8]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140036262
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140036262
lea r15, [0x14017d3a8]
test rsi, rsi
je 0x140036270
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x14003627e
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x14003628c
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp - 9]
call fcn.140151940
mov r14d, r13d
mov rsi, r13
cmp qword [rbp - 0x21], r13
jbe 0x1400362ed
cmp rsi, qword [rbp - 0x21]
jae 0x1400362ca
mov rbx, qword [rbp - 0x29]
mov rcx, qword [rbx + rsi*8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx + rsi*8], r13
inc r14d
inc rsi
mov eax, r14d
cmp rax, qword [rbp - 0x21]
jae 0x1400362ed
jmp 0x1400362a1
lea r8, [0x140003a50]
mov edx, 0x2cd
lea rcx, [0x140003bf0]
call fcn.1400a8be8
mov ecx, 0x80070057
call fcn.14001ad98
int3
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x14003630f
mov rdx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.140052038
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
test edi, edi
jns 0x14003634c
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x14003634c
test byte [rcx + 0x1c], 1
je 0x14003634c
cmp byte [rcx + 0x19], 2
jb 0x14003634c
mov edx, 0x16d
mov r9d, edi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14003635c
call qword [sym.imp.msvcrt.dll_free]
nop
lea rcx, [rbp - 0x29]
call fcn.140051cd4
nop
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret