Function at 0x18000b490
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r8
call fcn.180005a68
xor r14d, r14d
mov word [rbp - 0x49], r14w
mov qword [rax + 0x10], r14
cmp qword [rax + 0x18], 8
jb 0x18000b4e4
mov rax, qword [rax]
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.180005a6c
mov rcx, r15
call fcn.180005c04
test al, al
jne 0x18000b763
mov rcx, rdi
call fcn.180005c04
test al, al
jne 0x18000b763
cmp byte [rdi + 0x38], r14b
jne 0x18000b5f8
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.18000ef70
nop
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], ax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.180013470
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 1], rax
mov byte [rbp + 7], 0
mov rcx, qword [rbp - 0x39]
test rcx, rcx
jne 0x18000b569
xor bl, bl
jmp 0x18000b585
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18000b57f
xor bl, bl
jmp 0x18000b585
mov byte [rbp - 0x31], 1
mov bl, 1
mov byte [rbp + 7], bl
mov byte [rbp - 0x49], 0
lea r8, [rdi + 0x20]
lea r9, [rbp - 0x49]
mov rdx, rdi
call fcn.18000dff0
test al, al
jne 0x18000b5b7
cmp byte [rbp - 0x49], al
je 0x18000b5b7
mov rcx, rdi
call fcn.1800059dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test bl, bl
je 0x18000b5ce
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18000b5ca
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x31], 0
mov qword [rbp - 1], r14
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18000b5e5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], 0
lea rcx, [rbp - 0x29]
call fcn.1800059ec
mov byte [rdi + 0x38], 1
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x28]
cmp rcx, rax
je 0x18000b763
mov esi, r14d
sub rax, rcx
sar rax, 7
test rax, rax
je 0x18000b77c
mov rbx, r14
nop
shl rbx, 7
add rbx, rcx
mov rcx, rbx
call fcn.1800059dc
mov rdx, rax
mov rcx, r15
call fcn.1800059dc
mov rcx, rax
call fcn.18001d1b8
test eax, eax
je 0x18000b663
inc esi
mov rcx, qword [rdi + 0x20]
mov ebx, esi
mov rax, qword [rdi + 0x28]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jb 0x18000b620
jmp 0x18000b77c
mov rcx, r15
call fcn.180005c04
test al, al
jne 0x18000b763
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
lea r8, [rbp - 0x29]
call fcn.18000a000
test al, al
je 0x18000b763
mov edx, dword [rbp - 0x21]
shl rdx, 0x20
mov eax, dword [rbp - 0x25]
add rdx, rax
mov r8d, dword [rbp - 0x11]
shl r8, 0x20
mov eax, dword [rbp - 0x15]
add r8, rax
mov ecx, dword [rbp - 0xd]
shl rcx, 0x20
mov eax, dword [rbp - 9]
add rcx, rax
cmp qword [rbx + 0x60], rcx
jne 0x18000b763
cmp qword [rbx + 0x68], r8
jne 0x18000b763
cmp qword [rbx + 0x70], rdx
jne 0x18000b763
cmp byte [rdi + 0x39], 0
je 0x18000b76c
lea rcx, [rbx + 0x40]
call fcn.180005c04
test al, al
jne 0x18000b763
lea rcx, [rbp - 1]
call fcn.180005a50
nop
lea r8, [rbp - 1]
mov rdx, r15
call fcn.18000f410
test al, al
jne 0x18000b738
lea rcx, [rbp - 1]
call fcn.180005a68
mov word [rbp - 0x49], r14w
mov qword [rax + 0x10], r14
cmp qword [rax + 0x18], 8
jb 0x18000b72c
mov rax, qword [rax]
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.180005a6c
lea rcx, [rbx + 0x40]
call fcn.1800059dc
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.1800059dc
mov rcx, rax
call fcn.18001d1b8
nop
lea rcx, [rbp - 1]
test eax, eax
je 0x18000b767
call fcn.1800059ec
xor eax, eax
jmp 0x18000b77f
call fcn.1800059ec
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.180005d18
mov r14d, dword [rbx + 0x78]
mov eax, r14d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180016920
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret