Function at 0x140035574
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r14, rdx
mov rdi, rcx
xor esi, esi
mov r13d, esi
mov qword [rbp - 0x28], rsi
mov r15d, esi
mov qword [rbp + 0x58], rsi
mov r12d, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp + 0x50], rsi
mov byte [rbp + 0x40], sil
lea rax, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rax
je 0x1400355f2
test byte [rcx + 0x1c], 1
je 0x1400355f2
cmp byte [rcx + 0x19], 4
jb 0x1400355f2
mov edx, 0x15f
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
cmp qword [rdi + 0x1d8], rsi
jne 0x140035613
lea r8, [0x140004208]
mov edx, 0x1c59
lea rcx, [0x140003c50]
call fcn.1400a8be8
lea rax, [rdi + 0x28]
mov qword [rbp - 0x18], rax
xor edx, edx
mov rcx, rax
call fcn.14011e208
mov ebx, eax
test eax, eax
js 0x14003599f
lea rcx, [rbp + 0x40]
call fcn.1400b2d34
mov ebx, eax
test eax, eax
jns 0x140035686
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1400359a6
test byte [rcx + 0x1c], 1
je 0x1400359a6
cmp byte [rcx + 0x19], 2
jb 0x1400359a6
mov edx, 0x160
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
jmp 0x1400359a6
cmp qword [rdi + 0x1d0], rsi
jne 0x1400356d4
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1400359a6
test byte [rcx + 0x1c], 1
je 0x1400359a6
cmp byte [rcx + 0x19], 4
jb 0x1400359a6
mov edx, 0x161
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
jmp 0x1400359a6
test byte [rdi + 0x154], 4
je 0x1400357d2
lea r9, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x1d8]
call fcn.1401315cc
mov ebx, eax
mov r13, qword [rbp - 0x28]
test eax, eax
js 0x14003599f
lea rdx, [rbp + 0x58]
mov rcx, r13
call fcn.14011f17c
mov ebx, eax
test eax, eax
jns 0x140035766
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x14003575d
test byte [rcx + 0x1c], 1
je 0x14003575d
cmp byte [rcx + 0x19], 2
jb 0x14003575d
mov edx, 0x162
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028ec8
mov r15, qword [rbp + 0x58]
jmp 0x1400359a6
mov r15, qword [rbp + 0x58]
test r15, r15
je 0x1400357d2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400357d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1400357bf
test byte [rcx + 0x1c], 1
je 0x1400357bf
cmp byte [rcx + 0x19], 2
jb 0x1400357bf
mov edx, 0x163
mov dword [rsp + 0x20], eax
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400359a6
lea rsi, [rdi + 0x128]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rdi + 0x1d8]
call fcn.1401315cc
mov ebx, eax
mov r12, qword [rbp - 0x20]
test eax, eax
js 0x14003599d
test byte [rdi + 0x154], 1
je 0x140035817
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, r12
call fcn.1400a99e4
jmp 0x14003582d
lea r9, [rbp - 0x30]
mov r8b, 1
mov rdx, rsi
mov rcx, qword [rdi + 0x1d8]
call fcn.1401315cc
xor esi, esi
test eax, eax
mov ebx, eax
js 0x14003599f
cmp byte [rbp + 0x40], sil
jne 0x1400358a4
test r14, r14
jne 0x14003585c
lea r8, [0x140004220]
mov edx, 0x1cb6
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov rax, qword [r14]
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [rax + reloc.KERNEL32.dll_EnterCriticalSection]
mov ebx, eax
test eax, eax
jns 0x1400358a4
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1400359a6
test byte [rcx + 0x1c], 1
je 0x1400359a6
cmp byte [rcx + 0x19], 2
jb 0x1400359a6
mov edx, 0x164
jmp 0x14003566e
mov r9, qword [rbp + 0x50]
test r9, r9
jne 0x1400358b4
mov r9, qword [rdi + 0x1d0]
mov r8d, dword [rdi + reloc.ADVAPI32.dll_TraceEvent]
mov rdx, qword [rbp - 0x30]
mov rcx, r12
call fcn.14011e870
mov ebx, eax
test eax, eax
js 0x14003599f
test byte [rdi + 0x154], 0x80
je 0x14003599f
cmp byte [rdi + 0x114], sil
je 0x14003599f
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14003590c
mov rcx, rax
call fcn.140052668
mov r14, rax
jmp 0x14003590f
mov r14, rsi
mov rdx, r12
mov rcx, r14
call fcn.140029a6c
mov ebx, eax
test eax, eax
js 0x14003599f
mov rdx, qword [rbp + 0x50]
test rdx, rdx
mov rax, rdx
jne 0x140035936
mov rax, qword [rdi + 0x1d0]
mov rdx, rax
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14003593a
lea r8, [r8*2 + 2]
mov rcx, r14
call fcn.140029d98
mov ebx, eax
test eax, eax
js 0x14003599f
add rdi, 0x308
mov rsi, qword [rdi + 8]
cmp rsi, qword [rdi + 0x10]
jb 0x140035986
lea rdx, [rsi + 1]
mov rcx, rdi
call fcn.14008b270
test al, al
jne 0x140035986
mov ecx, 0x8007000e
call fcn.14001ad98
int3
mov rax, qword [rdi]
lea rcx, [rax + rsi*8]
xor esi, esi
test rcx, rcx
je 0x140035997
mov qword [rcx], r14
inc qword [rdi + 8]
jmp 0x14003599f
xor esi, esi
lea r14, [0x14017d3a8]
mov rcx, qword [rbp - 0x18]
call fcn.14011e39c
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400359c2
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp + 0x50], rsi
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400359d1
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x1400359df
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x1400359ed
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x1400359fb
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jns 0x140035a2f
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x140035a5c
test byte [rcx + 0x1c], 1
je 0x140035a36
cmp byte [rcx + 0x19], 2
jb 0x140035a36
mov edx, 0x165
mov r9d, ebx
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x140035a5c
test byte [rcx + 0x1c], 1
je 0x140035a5c
cmp byte [rcx + 0x19], 4
jb 0x140035a5c
mov edx, 0x166
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret