Function at 0x140151f40
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0xf0], rax
movdqa xmm6, xmmword [0x14060aee0]
xor r12d, r12d
movdqa xmm7, xmmword [0x14060af20]
mov r15, r8
movdqa xmm8, xmmword [0x14060aef0]
mov r13, rdx
mov qword [rsp + 0x68], r9
mov rdi, rcx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rbp + 0x28], r12
mov qword [rsp + 0x60], r12
mov qword [rbp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rbp + 0x48], r12
test rcx, rcx
je 0x140152877
test rdx, rdx
je 0x140152877
cmp r8, 0x100
ja 0x140152877
movzx eax, byte [rcx + 0x10]
test al, al
jne 0x140151ff9
xor r9d, r9d
call fcn.140152ed0
movzx eax, byte [rdi + 0x10]
mov rcx, qword [rdi + 8]
test al, al
je 0x14015201f
mov r8, rcx
lea rdx, str.The_SafeStore_database_already_exists__dbPath:___s__
mov ecx, 3
call fcn.140157a90
mov eax, 8
jmp 0x1401520b0
mov qword [rsp + 0x248], rbx
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x238], r14
test rcx, rcx
je 0x14015207e
call fcn.140155b50
mov r14, rax
test rax, rax
je 0x14015207e
call fcn.140157fe0
xor r9d, r9d
mov rdx, rdi
mov rcx, r14
lea r8d, [r9 + 2]
call fcn.140235840
mov rcx, qword [rdi]
mov ebx, eax
call fcn.140232e80
mov qword [rdi], r12
mov rcx, r14
test ebx, ebx
jne 0x1401520e2
call fcn.1403683a0
call fcn.140158080
mov r8, qword [rdi + 8]
lea rdx, str.Unable_to_create_SafeStore_database__dbPath:___s__
mov ecx, 3
call fcn.140157a90
mov eax, 8
mov rsi, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x248]
mov r14, qword [rsp + 0x238]
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x250]
movaps xmm6, xmmword [r11 - 0x30]
movaps xmm7, xmmword [r11 - 0x40]
movaps xmm8, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
mov ebx, 6
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call fcn.140235840
mov rcx, r14
mov esi, eax
call fcn.1403683a0
test esi, esi
jne 0x140152161
test r15d, r15d
je 0x140152130
mov rcx, qword [rdi]
mov r8d, r15d
mov rdx, r13
call fcn.140315af0
mov esi, eax
test eax, eax
jne 0x140152161
mov rcx, qword [rdi]
mov r8d, r15d
mov rdx, r13
call fcn.140315620
mov esi, eax
test eax, eax
jne 0x140152161
mov rcx, qword [rdi]
lea rdx, str.PRAGMA_cipher_compatibility__3_
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call fcn.140232ea0
mov esi, eax
test eax, eax
jne 0x140152161
mov rcx, qword [rdi]
lea rdx, str.SELECT_count___FROM_sqlite_master_
call fcn.140158130
mov esi, eax
mov rcx, qword [rdi]
test esi, esi
je 0x14015219b
call fcn.140232e80
call fcn.140158080
mov qword [rdi], r12
cmp esi, 5
jne 0x14015207e
mov r8, qword [rdi + 8]
lea rdx, str.The_SafeStore_database_is_locked__dbPath:___s__
lea ecx, [rsi - 2]
call fcn.140157a90
mov eax, 3
jmp 0x140152098
mov edx, 1
call fcn.140233fe0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140152191
mov edx, 0x64
call fcn.140234890
test eax, eax
jne 0x140152191
mov rcx, qword [rdi]
lea rdx, str.PRAGMA_foreign_keys__ON
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call fcn.140232ea0
mov esi, eax
mov r12, 0xffffffffffffffff
test eax, eax
je 0x1401521ec
lea ebx, [r12 + 4]
jmp 0x14015273d
mov rcx, qword [rdi]
call fcn.140158200
mov esi, eax
test eax, eax
je 0x140152204
mov ebx, 3
jmp 0x14015273d
mov rcx, qword [rdi]
lea r8, str.MetaInfoTable
lea rdx, str.schema_vermajor
call fcn.140158cb0
mov esi, eax
test eax, eax
je 0x14015222a
mov ebx, 7
jmp 0x14015273d
mov ecx, 0x10
call fcn.140368330
mov r14, rax
test rax, rax
je 0x14015273d
mov rcx, rax
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov r12d, 3
mov ecx, 0
test eax, eax
cmovns r12d, ecx
jns 0x14015226c
mov rcx, r14
call fcn.1403683a0
mov ebx, r12d
jmp 0x140152736
mov rax, r14
mov qword [rbp + 0x38], 0x10
mov ecx, 0x20
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x30], rax
call fcn.140368330
mov r12, rax
test rax, rax
je 0x14015272e
test r15d, r15d
je 0x140152729
call fcn.1403a65c0
mov ecx, 0x20
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ecx
mov r8, r14
mov qword [rsp + 0x28], rax
mov edx, r15d
mov dword [rsp + 0x20], 0x20000
lea r9d, [rcx - 0x10]
mov rcx, r13
call fcn.1403a6670
test eax, eax
jne 0x1401522dd
lea ebx, [rax + 3]
jmp 0x14015272e
mov r13d, 0x20
mov qword [rsp + 0x58], r12
mov ecx, r13d
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r13
call fcn.140368330
mov r15, rax
test rax, rax
je 0x140152724
test r12, r12
je 0x14015271f
call fcn.1403a65c0
mov qword [rsp + 0x38], r15
lea r9d, [r13 - 0x10]
mov dword [rsp + 0x30], r13d
mov r8, r14
mov qword [rsp + 0x28], rax
mov edx, r13d
mov rcx, r12
mov dword [rsp + 0x20], 0x20000
call fcn.1403a6670
test eax, eax
jne 0x14015234a
lea ebx, [rax + 3]
mov rcx, r15
jmp 0x140152731
mov ecx, 0x21
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r13
call fcn.140368330
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140152372
lea r12, [rax - 1]
mov r13, rax
jmp 0x140152747
mov rdx, rax
lea r13, str.0123456789ABCDEF
xor eax, eax
mov r8d, eax
movzx ecx, byte [r8 + r14]
lea rdx, [rdx + 2]
mov eax, ecx
inc r8
and eax, 0xf
shr rcx, 4
movzx eax, byte [rax + r13]
mov byte [rdx - 1], al
movzx eax, byte [rcx + r13]
mov byte [rdx - 2], al
cmp r8, 0x10
jb 0x140152381
mov ecx, 0x20
mov byte [rdx], 0
add rcx, rcx
mov r12, 0xffffffffffffffff
inc rcx
call fcn.140368330
mov qword [rsp + 0x50], rax
mov r9, rax
test rax, rax
je 0x140152742
test r15, r15
je 0x140152718
xor ebx, ebx
lea r10d, [r12 + 0x21]
mov r8d, ebx
mov rdx, rax
nop dword [rax]
movzx ecx, byte [r8 + r15]
lea rdx, [rdx + 2]
mov eax, ecx
inc r8
and eax, 0xf
shr rcx, 4
movzx eax, byte [rax + r13]
mov byte [rdx - 1], al
movzx eax, byte [rcx + r13]
mov byte [rdx - 2], al
cmp r8, r10
jb 0x1401523f0
mov r13, qword [rsp + 0x40]
lea rax, [0x1405f6b54]
mov qword [rbp + 0x50], rax
lea rcx, [0x1405f6ab4]
mov qword [rbp + 0x60], rax
lea r8, [rbp + 0x50]
mov qword [rbp + 0x68], rax
lea rax, [0x1405f6c08]
mov qword [rbp + 0x70], rax
lea rax, str.schema_vermajor
mov byte [rdx], bl
lea rdx, str.MetaInfoTable
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x78], rcx
mov rcx, qword [rdi]
mov qword [rbp + 0x88], r9
mov r9d, 8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x80], r13
call fcn.14015a270
mov esi, eax
test eax, eax
je 0x140152496
mov ebx, 7
jmp 0x140152747
mov rcx, qword [rdi]
lea r8, str.ThreatObjectTable
lea rdx, str.objectid
call fcn.140158cb0
mov esi, eax
test eax, eax
je 0x1401524bc
mov ebx, 7
jmp 0x140152747
mov rcx, qword [rdi]
lea r8, str.StringPropertyTable
lea rdx, str.stringpropertyid
call fcn.140158cb0
mov esi, eax
test eax, eax
je 0x1401524e2
mov ebx, 7
jmp 0x140152747
mov rcx, qword [rdi]
lea r8, str.BlobPropertyTable
lea rdx, str.blobpropertyid
call fcn.140158cb0
mov esi, eax
test eax, eax
je 0x140152508
mov ebx, 7
jmp 0x140152747
mov rcx, qword [rdi]
lea r8, str.BlobTable
lea rdx, str.blobid
call fcn.140158cb0
mov esi, eax
test eax, eax
je 0x14015252e
mov ebx, 7
jmp 0x140152747
lea rcx, str.objectid
mov dword [rbp - 0x80], 2
lea rax, str.ThreatObjectTable
mov qword [rbp + 0xb0], rcx
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rax, str.ThreatObjectTable_Index
mov qword [rbp + 0x50], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x78], rax
lea rax, str.datetime
mov qword [rbp + 0x90], rax
lea rax, str.StringPropertyTable
mov qword [rbp - 0x70], rax
lea rax, str.StringPropertyTable_Index
mov qword [rbp - 0x68], rax
lea rax, str.BlobTable
mov qword [rbp - 0x50], rax
lea rax, str.BlobTable_Index
mov qword [rbp - 0x48], rax
lea rax, str.originalchecksum
mov qword [rbp + 0xd0], rax
lea rax, str.BlobPropertyTable
mov qword [rbp - 0x30], rax
lea rax, str.BlobPropertyTable_Index
mov qword [rbp - 0x28], rax
lea rax, str.blobid
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x78], rax
mov dword [rbp + 0x98], 1
mov qword [rbp + 0xa0], rbx
mov dword [rbp + 0xa8], ebx
mov dword [rbp - 0x60], 2
mov dword [rbp + 0xb8], 1
mov qword [rbp + 0xc0], rbx
mov dword [rbp + 0xc8], ebx
mov dword [rbp - 0x40], 2
mov dword [rbp + 0xd8], 1
mov qword [rbp + 0xe0], rbx
mov dword [rbp + 0xe8], ebx
mov dword [rbp - 0x20], 2
mov dword [rbp + 0x58], 1
mov dword [rbp + 0x68], 1
mov qword [rbp + 0x70], rbx
mov dword [rbp + 0x78], ebx
call fcn.140158db0
test eax, eax
jne 0x14015248c
mov rcx, qword [rdi]
lea rax, [rbp + 0xb0]
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x58], rax
call fcn.140158db0
test eax, eax
jne 0x14015248c
mov rcx, qword [rdi]
lea rax, [rbp + 0xd0]
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x38], rax
call fcn.140158db0
test eax, eax
jne 0x14015248c
mov rcx, qword [rdi]
lea rax, [rbp + 0x50]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x18], rax
call fcn.140158db0
test eax, eax
jne 0x14015248c
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1401526e1
movaps xmm0, xmmword [rbp + 0x20]
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm7
movups xmmword [rax + 0x20], xmm8
movups xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [rbp + 0x40]
movups xmmword [rax + 0x40], xmm1
movups xmmword [rax + 0x50], xmm0
jmp 0x1401526fb
mov rcx, qword [rsp + 0x58]
call fcn.1403683a0
mov rcx, r14
call fcn.1403683a0
mov rcx, r15
call fcn.1403683a0
mov rcx, r13
mov byte [rdi + 0x10], 1
call fcn.1403683a0
mov rcx, qword [rsp + 0x50]
call fcn.1403683a0
xor eax, eax
jmp 0x140152098
mov ebx, 1
jmp 0x140152742
mov ebx, 1
mov rcx, r15
jmp 0x140152731
mov ebx, 1
mov rcx, r12
call fcn.1403683a0
mov r12, 0xffffffffffffffff
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov r8, qword [rdi + 8]
lea rdx, str.Unable_to_create_SafeStore_database__dbPath:___s___sqlerr:__d_
mov r9d, esi
mov ecx, 3
call fcn.140157a90
mov rcx, r13
call fcn.1403683a0
mov rcx, qword [rsp + 0x50]
call fcn.1403683a0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140152783
call fcn.140232e80
call fcn.140158080
cmp byte [rdi + 0x10], 0
je 0x1401527a4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401527a0
call fcn.140232e80
call fcn.140158080
xor eax, eax
mov qword [rdi], rax
mov byte [rdi + 0x10], 0
mov r14, qword [rdi + 8]
test r14, r14
je 0x14015283f
xor r13d, r13d
lea rcx, [rsp + 0x50]
mov rdx, r14
mov qword [rsp + 0x50], r13
call fcn.140154f30
mov rsi, qword [rsp + 0x50]
test al, al
je 0x140152828
mov rcx, rsi
call fcn.1401557a0
test al, al
jne 0x1401527ee
mov r8, r14
lea rdx, str.Unable_to_make_removable_file_writable:___s_
lea ecx, [r13 + 2]
call fcn.140157a90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140152800
mov r12d, r13d
jmp 0x140152828
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140152828
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14015281d
mov r12d, r13d
jmp 0x140152828
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, r14
je 0x14015283a
test rsi, rsi
je 0x14015283a
mov rcx, rsi
call fcn.1403683a0
test r12d, r12d
je 0x140152854
mov r8, qword [rdi + 8]
lea rdx, str.Unable_to_remove_SafeStore_database__dbPath:___s__
mov ecx, 3
call fcn.140157a90
mov rcx, qword [rsp + 0x58]
call fcn.1403683a0
mov rcx, qword [rsp + 0x60]
call fcn.1403683a0
mov rcx, r15
call fcn.1403683a0
mov eax, ebx
jmp 0x140152098
mov eax, 1
jmp 0x1401520b0