Function at 0x1001048f0
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xad0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0xac0], rax
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
mov dword [rsp + 0x40], ebx
xor r14d, r14d
mov word [rsp + 0x280], r14w
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x282]
call sub.msvcrt.dll_memset
mov word [rsp + 0x70], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov word [rsp + 0x490], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x492]
call sub.msvcrt.dll_memset
mov word [rsp + 0x8b0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x8b2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x6a0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x6a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x50], r14d
cmp ebx, dword [rbp + 0xa8]
jne 0x1001049da
lea edi, [r14 + 1]
mov ebx, edi
jmp 0x1001051ab
cmp dword [rbp + 0xa8], r14d
jne 0x100104a4e
xor r9d, r9d
lea r8, [rbp + 0xa8]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000fc25c
cmp eax, r14d
jne 0x100104a4e
mov r9d, dword [rsp + 0x40]
cmp r9d, dword [rbp + 0xa8]
jne 0x100104a4e
mov edi, 1
mov ebx, edi
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x1001051ab
test byte [rcx + 0x1c], 4
je 0x1001051ab
lea edx, [rdi + 0x6c]
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x1001051ab
mov qword [rsp + 0x20], r12
lea r9, [0x100026d28]
lea r8, [0x100026f80]
mov esi, 0x104
mov rdx, rsi
lea rcx, [rsp + 0x8b0]
call fcn.1000f1884
mov ebx, eax
mov edi, 1
cmp eax, r14d
jge 0x100104abe
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
lea edx, [rdi + 0x6d]
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
lea r9, [rsp + 0x44]
lea r8, [0x100027890]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000f43e4
cmp eax, r14d
jne 0x100104b26
cmp dword [rsp + 0x44], edi
jne 0x100104b26
mov ebx, edi
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x1001051ab
test byte [rcx + 0x1c], 4
je 0x1001051ab
mov edx, 0x6f
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
jmp 0x1001051ab
mov r9, r12
lea r8, [0x100027370]
mov rdx, rsi
lea rcx, [rsp + 0x6a0]
call fcn.1000f1884
mov ebx, eax
cmp eax, r14d
jge 0x100104b85
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x70
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x40]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000fc25c
cmp eax, r14d
je 0x100104bf2
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x71
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x490]
lea r8, [0x1000278c0]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000f4028
cmp eax, r14d
je 0x100104c85
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x1000278e0]
mov rdx, rsi
lea rcx, [rsp + 0x490]
call fcn.1000f1884
mov ebx, eax
cmp eax, r14d
jge 0x100104c85
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x72
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
mov rdx, rsi
lea rcx, [rsp + 0x70]
mov ebx, r14d
lea r8, [rsp + 0x280]
lea rax, [rsp + 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r14
je 0x100104cc3
movzx eax, word [rcx + r8]
cmp ax, r14w
je 0x100104cc3
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x100104ca0
cmp rdx, r14
jne 0x100104cd1
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x100104d18
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x73
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [rsp + rcx*2 + 0x70]
lea rax, [rsp + 0x70]
cmp rdx, rax
jbe 0x100104d5d
sub rdx, 2
cmp word [rdx], 0x5c
je 0x100104d57
cmp word [rdx], 0x2f
je 0x100104d57
cmp word [rdx], 0x3a
je 0x100104d57
lea rax, [rsp + 0x70]
cmp rdx, rax
ja 0x100104d35
jmp 0x100104d5d
mov word [rdx], r14w
jmp 0x100104d61
sub rdx, 2
mov eax, r14d
lea rcx, [rsp + 0x70]
cmp rdx, rcx
setne al
cmp eax, r14d
jne 0x100104db9
mov ebx, 0x80004005
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105168
test byte [rcx + 0x1c], dil
je 0x100105168
mov edx, 0x74
lea r9, [rsp + 0x70]
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034788
jmp 0x100105168
lea rdx, [0x1000270f0]
lea rcx, [rsp + 0x70]
call fcn.1000f5ba8
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x490]
mov rcx, qword [rbp + 0x90]
call fcn.1000f96bc
mov ebx, eax
cmp eax, r14d
jge 0x100104e38
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x75
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
mov rax, qword [rbp + 0x90]
mov r9d, dword [rax + 0x340]
cmp r9d, 0xc8
je 0x100104e87
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100104e7d
test byte [rcx + 0x1c], dil
je 0x100104e7d
mov edx, 0x76
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov ebx, 0x80004005
jmp 0x100105168
mov rcx, qword [rax + 0x348]
mov r8d, dword [rax + 0x350]
cmp rcx, r14
je 0x100105130
cmp r8d, r14d
je 0x100105130
cmp dword [rcx], 0x434d5153
je 0x100104ee7
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100104edd
test byte [rcx + 0x1c], dil
je 0x100104edd
mov edx, 0x78
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov ebx, 0x10000a0b
jmp 0x1001051ab
lea r11d, [r8 - 0x10]
mov r9d, r11d
mov edx, r14d
lea r10, [rcx + 0x10]
cmp r11d, r14d
jbe 0x100104f0e
dec r9d
imul edx, edx, 0x65
movzx eax, byte [r10]
add edx, eax
add r10, rdi
cmp r9d, r14d
ja 0x100104efa
cmp dword [rcx + 8], edx
je 0x100104f4b
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100104f41
test byte [rcx + 0x1c], dil
je 0x100104f41
mov edx, 0x79
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov ebx, 0x10000a0b
jmp 0x1001051ab
cmp dword [rcx + 4], r8d
je 0x100104f89
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100104f7f
test byte [rcx + 0x1c], dil
je 0x100104f7f
mov edx, 0x7a
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov ebx, 0x10000a0b
jmp 0x1001051ab
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r11d
lea r8, [rcx + 0x10]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.1001060fc
mov ebx, eax
cmp eax, r14d
jl 0x100105168
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [0x100027410]
xor r8d, r8d
lea rdx, [rsp + 0x6a0]
call fcn.1000f4588
cmp eax, r14d
je 0x10010503c
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x7b
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
lea rcx, [rbp + 0xb0]
mov ebx, r14d
lea rdx, [rsp + 0x280]
sub rdx, rcx
lea rax, [rsi + 0x7ffffefa]
cmp rax, r14
je 0x100105073
movzx eax, word [rcx + rdx]
cmp ax, r14w
je 0x100105073
mov word [rcx], ax
add rcx, 2
sub rsi, rdi
jne 0x100105051
cmp rsi, r14
jne 0x100105081
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x1001050c8
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105163
test byte [rcx + 0x1c], dil
je 0x100105163
mov edx, 0x7c
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x100105163
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x100105121
test byte [rcx + 0x1c], 4
je 0x100105121
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax + 0x350]
mov edx, 0x7d
mov dword [rsp + 0x30], r8d
lea rax, [rsp + 0x490]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.1000dcd50
mov eax, dword [rsp + 0x40]
mov dword [rbp + 0xa8], eax
mov ebx, r14d
jmp 0x1001051ab
lea rax, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rax
je 0x10010515e
test byte [rcx + 0x1c], dil
je 0x10010515e
mov edx, 0x77
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov ebx, 0x80004005
cmp ebx, r14d
jge 0x1001051ab
cmp word [rsp + 0x6a0], r14w
je 0x10010519c
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
lea r8, [0x100027410]
lea rdx, [rsp + 0x6a0]
call fcn.1000f4a58
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1000f64fc
mov eax, ebx
mov rcx, qword [rsp + 0xac0]
xor rcx, rsp
call fcn.10011b980
add rsp, 0xad0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret