Function at 0x140029c40
Capabilities:
Create thread
Delete file
Read file via mapping
Set file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov word [rsp + 8], cx
sub rsp, 0x188
mov dword [rsp + 0x30], 0
movzx ecx, word [rsp + 0x190]
call fcn.140027f90
cmp dword [rsp + 0x198], 0
je 0x140029edc
cmp qword [rsp + 0x1a8], 0
je 0x140029edc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x70], rax
lea rax, str.GlobalShadowDefenderSharedMemory
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140029d43
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140029d43
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [0x140027bd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
call fcn.140027e80
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140027340
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029dc5
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140026a50
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029df1
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140027340
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029e1d
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140026a50
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
call fcn.140027d70
cmp dword [rsp + 0x30], 0
je 0x140029e84
movzx eax, word [rsp + 0x190]
lea rcx, str.diskpt0.sys
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, str._c:_s
mov edx, 0x80
lea rcx, [rsp + 0x80]
call fcn.1400026e0
mov edx, 0x80
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x60], 0
je 0x140029ebd
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp qword [rsp + 0x38], 0
je 0x140029ed0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140029eff
xor r9d, r9d
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140027340
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x188
ret