Function at 0x100029da0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbp, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rax - 0x50], r14
xor r12d, r12d
mov qword [rax + 0x20], r12
xor r13d, r13d
mov qword [rax - 0x48], r13
and qword [rax - 0x58], r12
and qword [rax + 0x18], r12
mov byte [rax + 8], r12b
lea rsi, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029e1a
test byte [rcx + 0x1c], 1
je 0x100029e1a
cmp byte [rcx + 0x19], 4
jb 0x100029e1a
mov edx, 0x13d
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
cmp qword [rbx + 0x1d8], r12
jne 0x100029e3b
lea r8, [0x100004ae0]
mov edx, 0x1898
lea rcx, [0x100004680]
call fcn.10009a050
lea r15, [rbx + 0x28]
xor edx, edx
mov rcx, r15
call fcn.10010b1d8
mov edi, eax
test eax, eax
js 0x10002a25c
lea rcx, [rsp + 0x90]
call fcn.1000a2fe4
mov edi, eax
test eax, eax
jns 0x100029ea7
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a25c
test byte [rcx + 0x1c], 1
je 0x10002a25c
cmp byte [rcx + 0x19], 2
jb 0x10002a25c
mov edx, 0x13e
mov r9d, eax
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
jmp 0x10002a25c
cmp qword [rbx + 0x1d0], r12
jne 0x100029eee
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a25c
test byte [rcx + 0x1c], 1
je 0x10002a25c
cmp byte [rcx + 0x19], 4
jb 0x10002a25c
mov edx, 0x13f
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
jmp 0x10002a25c
test byte [rbx + 0x150], 4
je 0x10002a003
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.100120980
mov edi, eax
test eax, eax
js 0x100029ff9
lea rdx, [rsp + 0xa8]
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.10010c158
mov edi, eax
test eax, eax
jns 0x100029f90
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029f83
test byte [rcx + 0x1c], 1
je 0x100029f83
cmp byte [rcx + 0x19], 2
jb 0x100029f83
mov edx, 0x140
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001e39c
mov r12, qword [rsp + 0xa8]
jmp 0x10002a25c
mov r12, qword [rsp + 0xa8]
jmp 0x10002a25c
mov r12, qword [rsp + 0xa8]
test r12, r12
je 0x10002a003
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002a003
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100029fe6
test byte [rcx + 0x1c], 1
je 0x100029fe6
cmp byte [rcx + 0x19], 2
jb 0x100029fe6
mov edx, 0x141
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x10002a25c
mov r14, qword [rsp + 0x38]
jmp 0x10002a25c
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.100120980
mov edi, eax
test eax, eax
js 0x10002a223
mov r13, qword [rsp + 0x40]
test byte [rbx + 0x150], 1
je 0x10002a052
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10009bac4
mov edi, eax
test eax, eax
js 0x10002a21a
jmp 0x10002a077
lea r9, [rsp + 0x30]
mov r8b, 1
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.100120980
mov edi, eax
test eax, eax
js 0x10002a21a
cmp byte [rsp + 0x90], 0
jne 0x10002a0fe
test rbp, rbp
jne 0x10002a09e
lea r8, [0x100004af8]
mov edx, 0x18f5
lea rcx, [0x100004680]
call fcn.10009a050
mov rax, qword [rbp]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [rax + 0x60]
mov edi, eax
test eax, eax
jns 0x10002a0fe
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x10002a25c
test byte [rcx + 0x1c], 1
je 0x10002a25c
cmp byte [rcx + 0x19], 2
jb 0x10002a25c
mov edx, 0x142
mov r9d, eax
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
jmp 0x10002a25c
mov r9, qword [rsp + 0xa0]
test r9, r9
jne 0x10002a112
mov r9, qword [rbx + 0x1d0]
mov r8d, dword [rbx + 0x14c]
mov rdx, qword [rsp + 0x30]
mov rcx, r13
call fcn.10010b84c
mov edi, eax
test eax, eax
js 0x10002a243
test byte [rbx + 0x150], 0x80
je 0x10002a255
cmp byte [rbx + 0x11c], 0
je 0x10002a24c
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x90], rax
test rax, rax
je 0x10002a16e
mov rcx, rax
call fcn.10004401c
mov rbp, rax
jmp 0x10002a170
xor ebp, ebp
mov rdx, r13
mov rcx, rbp
call fcn.10001ecdc
mov edi, eax
test eax, eax
js 0x10002a23a
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x10002a197
mov rdi, rdx
jmp 0x10002a19e
mov rdi, qword [rbx + 0x1d0]
test rdx, rdx
jne 0x10002a1aa
mov rdx, qword [rbx + 0x1d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, rbp
call fcn.10001f008
mov edi, eax
test eax, eax
js 0x10002a231
mov rsi, qword [rbx + 0x310]
cmp rsi, qword [rbx + 0x318]
jb 0x10002a1f7
lea rdx, [rsi + 1]
lea rcx, [rbx + 0x308]
call fcn.10006a9e0
test al, al
jne 0x10002a1f7
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + rsi*8]
test rcx, rcx
je 0x10002a20a
mov qword [rcx], rbp
inc qword [rbx + 0x310]
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
jmp 0x10002a25c
mov r13, qword [rsp + 0x40]
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
jmp 0x10002a25c
lea rsi, [0x1001653b8]
mov rcx, r15
call fcn.10010b368
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x10002a280
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10002a290
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x10002a29e
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x10002a2ac
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x10002a2ba
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jns 0x10002a2f7
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a324
test byte [rcx + 0x1c], 1
je 0x10002a2fe
cmp byte [rcx + 0x19], 2
jb 0x10002a2fe
mov edx, 0x143
mov r9d, edi
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
mov rcx, qword [0x1001653b8]
jmp 0x10002a2fe
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002a324
test byte [rcx + 0x1c], 1
je 0x10002a324
cmp byte [rcx + 0x19], 4
jb 0x10002a324
mov edx, 0x144
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret