Function at 0x14003c170
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rsi + 0xb90]
test rcx, rcx
je 0x14003c193
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0xb78]
test rcx, rcx
je 0x14003c1ad
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0xb70]
test rcx, rcx
je 0x14003c1c7
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp byte [rsi + 0xc34], 0
je 0x14003c1ea
mov rcx, qword [rsi + 0xb68]
test rcx, rcx
je 0x14003c1ea
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx eax, byte [rsi + 0xc35]
test eax, eax
je 0x14003c216
mov rcx, qword [rsi + 0xb60]
test rcx, rcx
je 0x14003c216
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx eax, byte [rsi + 0xc35]
cmp eax, 2
jg 0x14003c235
mov rcx, qword [rsi + 0xb58]
test rcx, rcx
je 0x14003c235
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0xb50]
test rcx, rcx
je 0x14003c24f
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp byte [rsi + 0xc2c], 0
je 0x14003c4c8
mov rcx, qword [rsi + 0xae8]
test rcx, rcx
je 0x14003c276
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0xa90]
test rcx, rcx
je 0x14003c290
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, qword [rsi + 0xa80]
test r8, r8
je 0x14003c2ab
mov rcx, qword [rsi + 0xa88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi + 0xa68]
test rcx, rcx
je 0x14003c2c5
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0x9c8]
test rcx, rcx
je 0x14003c2ec
call fcn.140045d80
cmp byte [rsi + 0x9e0], 0
je 0x14003c2ec
mov rcx, qword [rsi + 0x9c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsi + 0x9b8]
test rcx, rcx
je 0x14003c306
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, qword [rsi + 0x9c0]
test rbx, rbx
je 0x14003c326
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsi + 0x998]
xor ebx, ebx
test rax, rax
jbe 0x14003c63c
mov r8, qword [rsi + 0x9a8]
mov qword [rsp + 0x20], rdi
mov rdi, rax
mov rcx, qword [r8 + rbx*8]
test rcx, 1
jne 0x14003c36e
test rcx, rcx
je 0x14003c36e
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, qword [rsi + 0x9a8]
inc rbx
cmp rbx, rdi
jb 0x14003c347
mov rdi, qword [rsp + 0x20]
test r8, r8
je 0x14003c38f
mov rcx, qword [rsi + 0x9b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi + 0x988]
test rcx, rcx
je 0x14003c3a9
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, qword [rsi + 0x978]
test r8, r8
je 0x14003c3c4
mov rcx, qword [rsi + 0x980]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi + 0x958]
test rcx, rcx
je 0x14003c3de
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi + 0x940]
test rcx, rcx
je 0x14003c3f8
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, qword [rsi + 0x930]
test r8, r8
je 0x14003c413
mov rcx, qword [rsi + 0x938]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsi + 0x910]
test r8, r8
je 0x14003c42e
mov rcx, qword [rsi + 0x918]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi + 0xab8]
test rcx, rcx
je 0x14003c448
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, qword [rsi + 0xb00]
test rbx, rbx
je 0x14003c468
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xaf8]
test rbx, rbx
je 0x14003c488
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xb20]
test rbx, rbx
je 0x14003c4a8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xb18]
test rbx, rbx
je 0x14003c4c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xc08]
test rbx, rbx
je 0x14003c4e8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xc00]
test rbx, rbx
je 0x14003c508
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xbe8]
test rbx, rbx
je 0x14003c528
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xbe0]
test rbx, rbx
je 0x14003c548
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xbc8]
test rbx, rbx
je 0x14003c568
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xbc0]
test rbx, rbx
je 0x14003c588
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [rsi + 0xc34], 0
je 0x14003c5eb
mov rbx, qword [rsi + 0xba8]
test rbx, rbx
je 0x14003c5b1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0xba0]
test rbx, rbx
je 0x14003c5d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi + 0xc90]
test rcx, rcx
je 0x14003c5eb
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsi + 0x8b8]
xor ebx, ebx
test rax, rax
jbe 0x14003c621
mov rcx, qword [rsi + rbx*8 + 0x4b0]
test rcx, rcx
je 0x14003c619
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsi + 0x8b8]
inc rbx
cmp rbx, rax
jb 0x14003c5f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r8, qword [rsi + 0x9a8]
jmp 0x14003c37b