Function at 0x10000f5bc
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1000400a0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
xor r13d, r13d
mov word [rsp + 0x30], r13w
mov r12d, r13d
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea r9d, [r13 + 1]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.10000c5c8
cmp eax, r13d
je 0x10000f6d1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
movabs r14, 0x4000000000010000
cmp eax, r13d
je 0x1000152d3
mov rcx, qword [rsi + 0x70]
add rcx, 0x130
call fcn.10000ecc4
cmp eax, r13d
jne 0x100015101
mov rcx, qword [rsi + 0x70]
call fcn.10000d638
mov edi, eax
cmp eax, 1
je 0x100015056
cmp eax, 2
je 0x100015056
cmp edi, r13d
jl 0x1000150ef
mov rcx, qword [rsi + 0x70]
call fcn.10000f720
cmp eax, r13d
jne 0x100015069
mov r12d, 1
jmp 0x10000f6b1
xor r9d, r9d
lea r8d, [r9 + 8]
mov rdx, rsi
lea rcx, [0x10000a210]
call qword [sym.imp.SHLWAPI.dll_SHCreateThread]
cmp eax, r13d
je 0x1000152ec
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r13d
jle 0x100015348
mov eax, r12d
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000012f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov edx, 0x1ff
mov rcx, rsi
call fcn.10001df38
nop
jmp 0x10000f68e
xor r8d, r8d
mov edx, 0x200
mov rcx, rsi
call fcn.10001d408
mov ebp, eax
cmp eax, r13d
jge 0x1000150e1
cmp dword [0x1000408f4], r13d
je 0x1000150d4
mov cl, byte [0x1000408f8]
cmp cl, 2
jae 0x100015099
cmp cl, r13b
jne 0x1000150d4
movabs rdi, 0x2000000000010000
test qword [0x1000408e0], rdi
je 0x1000150d4
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x1000150d4
mov r8d, ebp
lea rdx, [0x1000330b0]
mov rcx, qword [0x1000400f0]
call fcn.100019be4
mov edx, 0x202
mov rcx, rsi
call fcn.10001df38
cmp ebp, r13d
je 0x10000f6a9
jmp 0x10000f6d1
mov edx, 0x202
mov rcx, rsi
call fcn.10001df38
jmp 0x10000f6d1
cmp eax, 0x8000000b
je 0x10001513d
cmp eax, 0x80030050
je 0x10001513d
cmp eax, 0x80030103
jle 0x10001512b
cmp eax, 0x80030105
jle 0x10001513d
cmp eax, 0x80030109
je 0x10001513d
cmp eax, 0x80030112
je 0x10001513d
mov edx, 0x1fb
mov rcx, rsi
call fcn.10001df38
jmp 0x10000f6d1
movabs rdi, 0x2000000000010000
cmp dword [0x1000408f4], r13d
je 0x10001518d
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x10001515f
cmp al, r13b
jne 0x10001518d
test qword [0x1000408e0], rdi
je 0x10001518d
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x10001518d
lea rdx, [0x100032fc0]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
mov ebx, 0x1fa
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.100007bb0
cmp eax, r13d
jne 0x1000151ec
cmp dword [0x1000408f4], r13d
je 0x1000151ec
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x1000151bb
cmp al, r13b
jne 0x1000151ec
test qword [0x1000408e0], r14
je 0x1000151ec
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x1000151ec
mov r8d, ebx
lea rdx, [0x1000331a0]
mov rcx, qword [0x1000400f0]
call fcn.1000180bc
mov r9d, 0x111
mov r8, qword [0x1000400d8]
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x10000f6d1
mov rcx, qword [rsi + 0x60]
call fcn.100022f40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
je 0x10001527e
cmp dword [0x1000408f4], r13d
je 0x100015271
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x100015243
cmp al, r13b
jne 0x100015271
test qword [0x1000408e0], rdi
je 0x100015271
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x100015271
lea rdx, [0x100033000]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
mov rcx, rsi
call fcn.10001d318
mov r12d, eax
jmp 0x1000152de
cmp dword [0x1000408f4], r13d
je 0x1000152c4
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x100015296
cmp al, r13b
jne 0x1000152c4
test qword [0x1000408e0], rdi
je 0x1000152c4
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x1000152c4
lea rdx, [0x100032fd0]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
mov edx, 0x1fc
mov rcx, rsi
call fcn.10001df38
jmp 0x1000152de
mov rcx, rsi
call fcn.10001d318
mov r12d, eax
cmp r12d, r13d
jne 0x10000f6b1
jmp 0x10000f6d1
cmp dword [0x1000408f4], r13d
je 0x10000f6d1
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x10001530c
cmp al, r13b
jne 0x10000f6d1
test qword [0x1000408e0], r14
je 0x10000f6d1
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, r14
cmp rax, rcx
jne 0x10000f6d1
lea rdx, [0x100033260]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
nop
jmp 0x10000f6d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x10000f6e8