Function at 0x140072ce0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1402bf200]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r15, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
mov edx, 3
lea ecx, [rdx + 3]
call fcn.140039f40
test al, al
jne 0x14006a978
mov eax, 9
jmp 0x14006ac02
lea rbx, [r15 + 0xf0]
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor r14d, r14d
cmp qword [r15 + 0xb0], r14
jne 0x14006a9db
mov dword [rbp - 0x30], 0x35383744
mov dword [rbp - 0x2c], 0x46353539
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x48], eax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], 0x22b
lea rcx, [rsp + 0x40]
call fcn.14006bb90
cmp byte [rbp + 0x2a0], r14b
jne 0x14006aa7b
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x10]
call fcn.1401d80e0
xor edx, edx
mov r8d, 0x20a
lea rcx, [r15 + 0x1c0]
call fcn.1401d80e0
lea r8, [r15 + 0xa0]
cmp qword [r8 + 0x18], 7
jbe 0x14006aa1e
mov r8, qword [r8]
mov edx, 0x104
lea rcx, [r15 + 0x1c0]
call fcn.1401b5104
lea rdx, str._kernel_manual.
test rdi, rdi
cmovne rdx, rdi
lea rcx, [r15 + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp - 0x10]
lea rcx, [r15 + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14006aa7b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x14006ac02
lea rsi, [r15 + 0xa0]
mov r13, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14006aa8f
mov r13, qword [rsi]
lea r12, [r15 + 0x1c0]
xor edx, edx
mov r8d, 0x20a
mov rcx, r12
call fcn.1401d80e0
mov rcx, r12
test rdi, rdi
je 0x14006aac0
mov r8, r13
mov edx, 0x104
call fcn.1401b5104
mov rdx, rdi
jmp 0x14006ab11
mov rdx, r13
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x20a
lea rcx, [r15 + 0x3ca]
call fcn.1401d80e0
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x1c]
lea r8, str.unp_u_ux_kernel_manual.dmp
mov edx, 0x104
lea rcx, [r15 + 0x3ca]
call fcn.140024550
lea rdx, [r15 + 0x3ca]
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsi + 0x18], 7
jbe 0x14006ab24
mov rsi, qword [rsi]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xa0000000
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rbp - 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x14006ac2c
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x48], rax
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.140039f40
test al, al
je 0x14006ab9b
or dword [rbp - 0x38], 1
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rbp - 0x70]
lea ecx, [r9 + 0x25]
call qword [sym.imp.ntdll.dll_NtSystemDebugControl]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], 0xffffffffffffffff
test esi, esi
jns 0x14006abe6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r14d, 6
jmp 0x14006abf6
mov rcx, qword [r15]
mov rcx, qword [rcx + 0x2008]
call fcn.1400733a0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14019acb0
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp - 0x20], eax
lea rax, str.Dump_file__could_not_be_created__error_code:_
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x33
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14006bcd0
lea rdx, [0x1402b9f88]
lea rcx, [rsp + 0x68]
call fcn.14019cd80
int3
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
movzx r8d, byte [rsp + 0x40]
add rcx, 0x10
mov rdx, qword [rsp + 0x38]
add rsp, 0x28
jmp 0x14006a910