Function at 0x180002b30
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rbp, qword [rsp + 0x130]
mov rdi, r8
xor r8d, r8d
add edx, 0xfffffefe
mov esi, r9d
mov r12, rcx
cmp edx, 0x25
lea r15d, [r8 + 1]
lea r14, [0x18002cbe4]
ja case.0x180002b88.274
lea rcx, [0x180000000]
mov edx, dword [rcx + rdx*4 + 0x3038]
add rdx, rcx
jmp rdx
mov rdx, rbp
mov rcx, rdi
call fcn.1800028f8
jmp 0x180002ff6
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
and qword [rsp + 0x40], r8
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x8c
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1800072dc
test eax, eax
mov ebx, eax
jne 0x180002ff8
lea r8, [rsp + 0x40]
lea edx, [rax + 0x10]
mov r9d, 0x94
mov rcx, r12
call fcn.18000d4b0
test eax, eax
je 0x180002c04
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.18000d530
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002ff8
mov rdx, qword [0x180029790]
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x180002c53
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x30]
lea rcx, [0x18002c1c5]
call fcn.180003c78
mov ebx, eax
test ebx, ebx
jne 0x180002caf
mov r12, qword [rsp + 0x30]
mov r8d, dword [0x180029788]
mov edx, dword [rsp + 0x118]
mov rcx, r12
xor r9d, r9d
call fcn.18001d7ac
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x180002c95
mov r9d, r15d
mov r8d, esi
mov rdx, rdi
mov rcx, r12
call fcn.180012d2c
jmp 0x180002c9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180029648]
mov r8, r12
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, ebx
jmp 0x180002e2f
xor r9d, r9d
jmp 0x180002cbf
mov r9d, r15d
mov edx, esi
mov rcx, rdi
call fcn.180001a84
jmp 0x180002d1c
mov eax, r15d
lock xadd dword [0x18002966c], eax
add eax, r15d
cmp eax, r15d
jle 0x180002ceb
lock add dword [0x18002966c], 0xffffffff
jmp case.0x180002b88.274
xor r9d, r9d
mov edx, 0x117
mov rcx, rdi
call fcn.18000257c
jmp 0x180002ff6
mov r8d, r15d
mov edx, r9d
mov rcx, rdi
call fcn.180001e20
jmp 0x180002d1c
call fcn.180001928
jmp 0x180002d1c
call fcn.180001970
mov ebx, eax
test eax, eax
jmp 0x180002e26
xor edx, edx
lea rcx, [0x18000124c]
jmp 0x180002fee
xor edx, edx
lea rcx, [0x1800022bc]
jmp 0x180002fee
xor edx, edx
lea rcx, [fcn.1800022e0]
jmp 0x180002fee
xor edx, edx
lea rcx, [0x180002454]
jmp 0x180002fee
mov edx, r9d
mov rcx, rdi
call fcn.18000d108
jmp case.0x180002b88.274
cmp qword [0x180029780], r8
je 0x180002d82
lea rcx, [rsp + 0x20]
call fcn.18000d268
jmp 0x180002d84
xor eax, eax
test eax, eax
mov dword [rsp + 0x118], eax
je 0x180002dd6
test r12, r12
je 0x180002dbd
mov r8, qword [rsp + 0x20]
mov r9d, eax
mov edx, 0x10
mov rcx, r12
call fcn.18000d4b0
test eax, eax
je 0x180002dbd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.18000d530
mov r8, qword [rsp + 0x20]
mov rcx, qword [0x180029648]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x180002b88.274
mov ebx, 0x12
jmp 0x180003009
cmp qword [0x180029658], r8
jne case.0x180002b88.274
cmp r9d, 0x10
jne 0x180002e00
mov rcx, rdi
call fcn.180002394
jmp 0x180002d1c
mov ebx, 0x57
jmp 0x180002ff8
xor ecx, ecx
mov ebx, 0x426
xchg qword [0x180029658], rcx
test rcx, rcx
je 0x180002e24
call fcn.18001795c
xor ebx, ebx
test ebx, ebx
jne 0x180002ff8
xor r8d, r8d
mov rdx, rbp
mov rcx, r14
call fcn.1800017e8
jmp 0x180002ff8
xor edx, edx
lea rcx, [0x180001d10]
jmp 0x180002fee
test rdi, rdi
je case.0x180002b88.274
test rbp, rbp
je case.0x180002b88.274
cmp r9d, 4
jne case.0x180002b88.274
mov r8d, dword [rdi]
mov rdx, rbp
mov rcx, r14
call fcn.1800017e8
jmp case.0x180002b88.274
mov rcx, qword [0x1800296d0]
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x20]
call fcn.180012b90
test eax, eax
mov ebx, eax
jne 0x180002ff8
mov r9d, dword [rsp + 0x118]
mov r8, qword [rsp + 0x20]
lea edx, [rax + 0x10]
mov rcx, r12
call fcn.18000d4b0
test eax, eax
je 0x180002ecb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.18000d530
mov r8, qword [rsp + 0x20]
jmp 0x180002f10
mov rsi, qword [0x1800296d0]
xor ebx, ebx
mov rcx, rsi
call fcn.180012a10
test rax, rax
mov rdi, rax
cmovne rsi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180002f04
mov rcx, rsi
call fcn.180015420
mov ebx, eax
test rdi, rdi
je 0x180002ff8
mov r8, rdi
mov rcx, qword [0x180029648]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180002ff8
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
mov r8d, r15d
mov edx, r9d
mov rcx, rdi
call fcn.1800029f0
jmp 0x180002ff6
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
mov r8d, 7
jmp 0x180002f39
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
mov r8d, 3
jmp 0x180002f39
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
mov r8d, 0xd
jmp 0x180002f39
xor edx, edx
lea rcx, [0x1800029b4]
jmp 0x180002fee
test rdi, rdi
je case.0x180002b88.274
test r9d, r9d
je case.0x180002b88.274
mov edx, r9d
mov rcx, rdi
mov ebx, 0x57
call fcn.180003c0c
test eax, eax
je 0x180002ff8
lea r9d, [rbx - 0x54]
lea rcx, [0x18002c1bc]
mov r8d, esi
mov rdx, rdi
call fcn.180003d44
jmp 0x180002ff6
mov eax, dword [0x180029668]
test eax, eax
jne case.0x180002b88.274
test rdi, rdi
je case.0x180002b88.274
cmp r9d, 4
jne case.0x180002b88.274
mov edx, dword [rdi]
lea rcx, [0x1800024a4]
mov r8, rbp
call fcn.180002818
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x180003005
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x180003017
mov r8d, ebx
mov rdx, rbp
mov rcx, r14
call fcn.1800017e8
lea r11, [rsp + 0xe0]
mov eax, r15d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret