Function at 0x14000c330
Capabilities:
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov rbp, rcx
lea rcx, [rsp + 0xa0]
call fcn.1400dd0c8
nop
call fcn.1400da76c
mov rcx, rax
xor edi, edi
mov edx, edi
test rax, rax
setne dl
test edx, edx
jne 0x14000c37e
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x118], rax
call fcn.1400da76c
mov r11, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c3af
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x120], rbx
call fcn.1400da76c
mov r11, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c3e3
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [0x14014043c]
mov rsi, rax
shr rsi, 0x10
test rsi, rsi
jne 0x14000c429
movzx edi, ax
mov ecx, edi
call fcn.1400dcc48
test rax, rax
je 0x14000c437
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002350
jmp 0x14000c437
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140002280
nop
lea r8, [rsp + 0x38]
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.140002850
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or edi, 0xffffffff
cmp rcx, rbx
je 0x14000c4b5
cmp dword [rbx + 0x10], 0
jl 0x14000c4a3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000c4a3
call fcn.140001e00
mov rbp, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000c48d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x120], rax
mov rbp, qword [rsp + 0x110]
jmp 0x14000c4b5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x120]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c4d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c4f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140002140
mov rcx, qword [rax]
mov eax, dword [rcx - 0x10]
cmp eax, 1
jne 0x14000c52b
test eax, eax
jns 0x14000c521
mov ecx, 0x80070057
call fcn.140001000
int3
cmp word [rcx], 0x5c
jne 0x14000c52b
xor bl, bl
jmp 0x14000c52d
mov bl, 1
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c54c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000c68d
call fcn.1400da76c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c573
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rsi, rsi
jne 0x14000c5b2
lea rdx, [0x14014043c]
movzx ebx, dx
mov ecx, ebx
call fcn.1400dcc48
test rax, rax
je 0x14000c5c4
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002350
jmp 0x14000c5c4
lea rdx, [0x14014043c]
lea rcx, [rsp + 0x40]
call fcn.140002280
nop
lea r8, [rsp + 0x40]
mov rdx, rbp
lea rcx, [rsp + 0x98]
call fcn.140002850
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x120]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000c642
cmp dword [rbx + 0x10], 0
jl 0x14000c630
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000c630
call fcn.140001e00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000c622
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x120], rax
jmp 0x14000c642
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x120]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c665
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c7b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000c7b4
call fcn.1400da76c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c6ac
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x140140438]
test rdx, 0xffffffffffff0000
jne 0x14000c6ef
movzx ebx, dx
mov ecx, ebx
call fcn.1400dcc48
test rax, rax
je 0x14000c6fa
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002350
jmp 0x14000c6fa
lea rcx, [rsp + 0x48]
call fcn.140002280
nop
lea r8, [rsp + 0x48]
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140002850
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x120]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000c775
cmp dword [rbx + 0x10], 0
jl 0x14000c763
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000c763
call fcn.140001e00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000c755
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x120], rax
jmp 0x14000c775
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x120]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c795
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c7b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rbx, qword [rsp + 0x120]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.1400dd1cc
test eax, eax
je 0x14000cddd
mov rbx, qword [rsp + 0x118]
nop
lea rcx, [rsp + 0xa0]
call fcn.1400dce98
mov ebp, eax
lea rcx, [rsp + 0xa0]
call fcn.1400dd074
test eax, eax
jne 0x14000cd82
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xa0]
call fcn.1400dd6ec
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000c87a
cmp dword [rbx + 0x10], 0
jl 0x14000c868
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000c868
call fcn.140001e00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000c85a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x118], rax
jmp 0x14000c87a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x118]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c89c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x10
lea rcx, [rsp + 0xa0]
mov rax, qword [rsp + 0xa0]
call qword [rax + 0x70]
test eax, eax
je 0x14000cb1c
call fcn.1400da76c
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x14000cda1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x128], rbx
lea rax, [0x14013e968]
test rax, 0xffffffffffff0000
jne 0x14000c922
movzx ebx, ax
mov ecx, ebx
call fcn.1400dcc48
test rax, rax
je 0x14000c9f2
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.140002350
jmp 0x14000c9f2
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8, rax
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
test esi, esi
jle 0x14000c9a0
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, esi
or ecx, edx
jge 0x14000c96b
mov edx, esi
lea rcx, [rsp + 0x128]
call fcn.140001da0
mov rbx, qword [rsp + 0x128]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [0x14013e968]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, dword [rbx - 0xc]
jg 0x14000cd8b
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x14000c9f2
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000c9f2
cmp dword [rdx + 0x10], 0
jge 0x14000c9c7
cmp dword [rbx - 0xc], 0
jl 0x14000cd96
xor eax, eax
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x14000c9f2
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000c9dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x128], rax
lea r8, [rsp + 0x128]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x58]
call fcn.140002850
nop
lea r8, [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140002850
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x118]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000ca8e
cmp dword [rbx + 0x10], 0
jl 0x14000ca7c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000ca7c
call fcn.140001e00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000ca6e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x118], rax
jmp 0x14000ca8e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x118]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000cab1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000cad1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000caf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x118]
lea rcx, [rbx - 0x18]
call fcn.140001e00
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.14000c330
jmp 0x14000cd82
call fcn.1400da76c
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x14000cdc2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rax, [0x14013e968]
test rax, 0xffffffffffff0000
jne 0x14000cb7c
movzx ebx, ax
mov ecx, ebx
call fcn.1400dcc48
test rax, rax
je 0x14000cc43
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140002350
jmp 0x14000cc43
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8, rax
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
test esi, esi
jle 0x14000cbf4
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, esi
or ecx, edx
jge 0x14000cbbf
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140001da0
mov rbx, qword [rsp + 0x30]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [0x14013e968]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, dword [rbx - 0xc]
jg 0x14000cdac
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x14000cc43
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000cc43
cmp dword [rdx + 0x10], 0
jge 0x14000cc1b
cmp dword [rbx - 0xc], 0
jl 0x14000cdb7
xor eax, eax
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x14000cc43
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000cc31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x88]
call fcn.140002850
nop
lea r8, [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140002850
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x118]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000ccdc
cmp dword [rbx + 0x10], 0
jl 0x14000ccca
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000ccca
call fcn.140001e00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000ccbc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x118], rax
jmp 0x14000ccdc
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x118]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ccfc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000cd1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000cd3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 1
lea rcx, [rsp + 0xa0]
mov rax, qword [rsp + 0xa0]
call qword [rax + 0x70]
mov rbx, qword [rsp + 0x118]
test eax, eax
je 0x14000cd79
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
je 0x14000cdcd
jmp 0x14000c7e0
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov rbx, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x110]
lea rcx, [rsp + 0xa0]
call fcn.1400dcdc4
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ce10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ce33
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xa0]
call fcn.1400dd124
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x14000ce5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0xe8
pop rdi
pop rsi
pop rbp
pop rbx
ret