Function at 0x100033e44
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r14d, r14d
or qword [r11 - 0x60], 0xffffffffffffffff
mov r13, rcx
mov rbx, r14
mov qword [r11 - 0x50], r14
mov rsi, r14
mov qword [r11 - 0x68], rbx
mov qword [r11 - 0x58], r14
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100033ebb
test byte [rcx + 0x1c], 1
je 0x100033ebb
cmp byte [rcx + 0x19], 4
jb 0x100033ebb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x208
call fcn.10001c854
mov rcx, qword [r13 + 0x1d8]
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call fcn.100120c14
cmp eax, r14d
mov edi, eax
jl 0x100034550
mov rax, qword [r13 + 0x1d8]
mov r12, r14
cmp rax, r14
je 0x100033f13
mov r12d, 0x7fffffff
mov edi, r14d
mov rcx, r12
cmp word [rax], r14w
je 0x100033f07
add rax, 2
sub rcx, 1
jne 0x100033ef7
cmp rcx, r14
jne 0x100033f9e
mov r12, r14
mov edi, 0x80070057
cmp edi, r14d
cmovl r12, r14
cmp edi, r14d
jl 0x100034550
mov rbp, qword [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbp
xor r9d, r9d
call fcn.10010bd44
cmp eax, r14d
mov edi, eax
jge 0x10003428a
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034549
test byte [rcx + 0x1c], 1
je 0x100034549
cmp byte [rcx + 0x19], 2
jb 0x100034549
mov edx, 0x209
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rbx, qword [rsp + 0x30]
jmp 0x10003455c
sub r12, rcx
jmp 0x100033f18
cmp rsi, r14
je 0x100033fb9
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], r14
lea rcx, [rbx + r12*2 + 2]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call fcn.10009bac4
mov rsi, qword [rsp + 0x40]
cmp eax, r14d
mov edi, eax
jl 0x100034555
lea rdx, [0x100004aa0]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x1000340a3
mov edx, dword [r13 + 0x170]
mov ecx, r14d
cmp edx, r14d
jbe 0x100034025
mov rax, qword [r13 + 0xd8]
add rax, 0x54
test byte [rax], 1
jne 0x100034025
inc ecx
add rax, 0x160
cmp ecx, edx
jb 0x100034014
cmp ecx, edx
jne 0x10003425c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x10003425c
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x10003425c
test byte [rax + 0x1c], 1
je 0x10003425c
cmp byte [rax + 0x19], 2
jb 0x10003425c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
mov edx, 0x20a
or r9d, 0x80070000
cmp eax, r14d
cmovle r9d, eax
call fcn.10001c878
jmp 0x10003425c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jb 0x100034225
mov word [rsi + 0x48], r14w
movdqu xmm0, xmmword [0x10000f0f8]
lea rdx, [rsp + 0x50]
mov rcx, rsi
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r14d
jne 0x1000341ff
lea rax, [rsp + 0x50]
lea rcx, [0x10000f0f8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10003410c
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10003410c
mov eax, r14d
jmp 0x100034111
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
jne 0x10003412e
lea r8, [0x100005138]
lea rcx, [0x100004680]
mov edx, 0x30ad
call fcn.10009a050
mov r8d, dword [r13 + 0x170]
mov ecx, r14d
cmp r8d, r14d
jbe 0x10003417f
mov r9, qword [r13 + 0xd8]
mov eax, ecx
imul rax, rax, 0x160
lea rdx, [rax + r9 + 0x44]
lea rax, [rsp + 0x50]
mov rdi, qword [rdx]
cmp rdi, qword [rax]
jne 0x10003416e
mov rdi, qword [rdx + 8]
cmp rdi, qword [rax + 8]
jne 0x10003416e
mov eax, r14d
jmp 0x100034173
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
je 0x10003417f
inc ecx
cmp ecx, r8d
jb 0x100034144
cmp ecx, r8d
jne 0x10003425c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x10003425c
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x10003425c
test byte [rax + 0x1c], 1
je 0x10003425c
cmp byte [rax + 0x19], 2
jb 0x10003425c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003cc8]
mov edx, 0x20b
movzx ecx, ax
mov r9, rbx
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
jmp 0x10003425c
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003425c
test byte [rcx + 0x1c], 1
je 0x10003425c
cmp byte [rcx + 0x19], 3
jb 0x10003425c
mov edx, 0x20c
jmp 0x100034249
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003425c
test byte [rcx + 0x1c], 1
je 0x10003425c
cmp byte [rcx + 0x19], 3
jb 0x10003425c
mov edx, 0x20d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov r9, rbx
call fcn.10001db08
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x30], r14
call fcn.10010bf68
cmp eax, r14d
mov edi, eax
jl 0x10003435c
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x100033fa6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rsp + 0x38], 0xffffffffffffffff
cmp rbp, r14
je 0x1000342bc
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x48], r14
mov rcx, qword [r13 + 0x1d8]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.100120aac
cmp eax, r14d
mov edi, eax
jl 0x100034550
cmp rbx, r14
je 0x100034302
lea r8, [0x100005158]
lea rcx, [0x100004680]
mov edx, 0x30e4
call fcn.10009a050
mov rbp, qword [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbp
xor r9d, r9d
call fcn.10010bd44
cmp eax, r14d
mov edi, eax
jge 0x100034510
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034549
test byte [rcx + 0x1c], 1
je 0x100034549
cmp byte [rcx + 0x19], 3
jb 0x100034549
mov edx, 0x20e
jmp 0x100033f7d
mov rbx, qword [rsp + 0x30]
jmp 0x100034555
cmp rsi, r14
je 0x100034379
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], r14
lea rcx, [rbx + r12*2 + 2]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call fcn.10009bac4
mov rsi, qword [rsp + 0x40]
cmp eax, r14d
mov edi, eax
jl 0x100034555
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jb 0x1000344af
mov word [rsi + 0x48], r14w
movdqu xmm0, xmmword [0x10000f0f8]
lea rdx, [rsp + 0x50]
mov rcx, rsi
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r14d
jne 0x100034489
lea rcx, [rsp + 0x50]
mov rdx, qword [rcx]
cmp rdx, qword [r13 + 0x130]
jne 0x100034404
mov rdx, qword [rcx + 8]
cmp rdx, qword [r13 + 0x138]
jne 0x100034404
mov eax, r14d
jmp 0x100034409
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r14d
je 0x1000344e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r14d
jne 0x1000344e6
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000344e6
test byte [rax + 0x1c], 1
je 0x1000344e6
cmp byte [rax + 0x19], 3
jb 0x1000344e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003cc8]
mov edx, 0x20f
movzx ecx, ax
mov r9, rbx
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
jmp 0x1000344e6
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000344e6
test byte [rcx + 0x1c], 1
je 0x1000344e6
cmp byte [rcx + 0x19], 3
jb 0x1000344e6
mov edx, 0x210
jmp 0x1000344d3
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000344e6
test byte [rcx + 0x1c], 1
je 0x1000344e6
cmp byte [rcx + 0x19], 3
jb 0x1000344e6
mov edx, 0x211
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov r9, rbx
call fcn.10001db08
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x30], r14
call fcn.10010bf68
cmp eax, r14d
mov edi, eax
jl 0x100034520
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x100034366
jmp 0x100034555
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100034549
test byte [rcx + 0x1c], 1
je 0x100034549
cmp byte [rcx + 0x19], 2
jb 0x100034549
mov edx, 0x212
jmp 0x100033f7d
mov rbx, qword [rsp + 0x30]
jmp 0x100034563
mov rbp, qword [rsp + 0x48]
lea r12, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rbp, r14
je 0x100034578
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rbx, r14
je 0x10003458d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rsi, r14
je 0x1000345a2
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x1000345bc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000345e2
test byte [rcx + 0x1c], 1
je 0x1000345e2
cmp byte [rcx + 0x19], 4
jb 0x1000345e2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x213
call fcn.10001c854
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret