Function at 0x140002ce0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
mov r13, rcx
mov rax, qword [0x140017800]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x88], rcx
mov rax, qword [rsp + 0x88]
xor edi, edi
mov qword [rcx], rdi
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x90], rcx
mov rax, qword [rsp + 0x90]
mov qword [rcx], rdi
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x98], rax
mov eax, 0x2845e265
lea rsi, [rsp + 0xe0]
lea rbx, [rsp + 0xc0]
mov r14d, 0x5bf43057
cmp eax, 0x2845e264
jg 0x140002dac
cmp eax, 0x9cce3046
jle 0x140002def
cmp eax, 0xc8e47c0a
jg 0x140002e78
cmp eax, 0x9cce3047
je 0x140002ed0
cmp eax, 0xa0d18a6a
jne 0x140002d6b
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov qword [rsp + 0xa8], rax
mov eax, 0x18bac7bb
jmp 0x140002d6b
cmp eax, 0x4e1d59bd
jle 0x140002e3a
cmp eax, 0x6b0cb5ae
jle 0x140002eab
cmp eax, 0x6b0cb5af
je 0x140002ef1
cmp eax, 0x70658ef6
jne 0x140002d6b
cmp byte [rsp + 0x7f], 0
mov eax, 0x305ebff6
cmovne eax, r14d
mov r15d, dword [rsp + 0x80]
jmp 0x140002d6b
cmp eax, 0x8341e051
je 0x140002efb
cmp eax, 0x8ad1bd7f
je 0x140002fa1
cmp eax, 0x9ae2cf96
jne 0x140002d6b
mov rax, qword [rsp + 0x100]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], 0
mov rax, qword [rax + 0x28]
mov qword [rsp + 0xb8], rax
mov eax, 0x9cce3047
jmp 0x140002d6b
cmp eax, 0x2845e265
je 0x140002fb3
cmp eax, 0x305ebff6
je 0x140002fd5
cmp eax, 0x40862304
jne 0x140002d6b
mov rcx, qword [rsp + 0x108]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, 0x4e1d59be
mov r12d, ebp
jmp 0x140002d6b
cmp eax, 0xc8e47c0b
je 0x140002ff0
cmp eax, 0x18bac7bb
jne 0x140002d6b
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0xb0], rax
mov eax, 0xc8e47c0b
jmp 0x140002d6b
cmp eax, 0x5bf43057
jne 0x140003054
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x84], eax
mov eax, 0x6b0cb5af
jmp 0x140002d6b
mov rcx, qword [rsp + 0xb8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
test al, al
setne byte [rsp + 0x7f]
mov eax, 0x70658ef6
jmp 0x140002d6b
mov eax, 0x8ad1bd7f
jmp 0x140002d6b
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], rdi
mov dword [rsp + 0xd8], 0x240
mov qword [rsp + 0xd0], r13
mov qword [rsi + 8], rdi
mov qword [rsi], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], 0x100
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x108]
mov edx, 0x110000
mov r8, rbx
lea r9, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
mov r12d, eax
test eax, eax
mov eax, 0x4e1d59be
mov ecx, 0xa0d18a6a
cmovns eax, ecx
jmp 0x140002d6b
mov eax, 0x305ebff6
mov r15d, dword [rsp + 0x84]
jmp 0x140002d6b
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rbx
mov rax, qword [rsp + 0xa0]
mov eax, 0x8341e051
jmp 0x140002d6b
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0x40862304
mov ebp, r15d
jmp 0x140002d6b
mov rcx, qword [rsp + 0x108]
mov r8, qword [rsp + 0xb0]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x454c4946
mov edx, 0x110000
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
mov eax, 0x40862304
mov ecx, 0x9ae2cf96
cmovns eax, ecx
mov ebp, dword [rsp + 0x80]
jmp 0x140002d6b
cmp eax, 0x4e1d59be
jne 0x140002d6b
mov rax, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400094e0
mov eax, r12d
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret