Function at 0x1400d0660
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14015d3e0]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r12, rcx
lea rdi, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rdi
lea rsi, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rsi
lea r15, str.WRTDELET
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x107
mov ebx, 4
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], 0xff
xor r13d, r13d
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x74]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.1400bec34
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp + 0x18], r13
lea rax, [0x1400f6250]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], r13
mov qword [rbp], 0x20019
mov r14d, r13d
mov rcx, r12
call fcn.1400d2f74
bt eax, 0x16
jb 0x1400d0797
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], VarUI4FromDisp
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rbx + 0x74]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.skipping_file_deletion_since_autorecovery_isnt_enabled
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140009fb0
jmp 0x1400d0b04
mov rcx, r12
call fcn.1400d2f74
mov ebx, eax
and ebx, 0x1000000
mov ecx, ebx
neg ecx
sbb rdi, rdi
and edi, 0x4e20
add rdi, 0x2710
mov esi, 0x7530
mov r15d, 0xc350
lea r8, str.SYSTEMCurrentControlSetServicesVSSSettings
mov rdx, 0xffffffff80000002
lea rcx, [rbp]
call fcn.14000a6b0
test al, al
je 0x1400d0869
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rcx, [rbp]
test ebx, ebx
lea rdx, str.MaxDeletionTimeOptimized
jne 0x1400d0805
lea rdx, str.MaxDeletionTime
call fcn.1400088e0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400d0818
imul edi, eax, 0x3e8
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeFilespec
lea rcx, [rbp]
call fcn.1400088e0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400d0840
imul esi, eax, 0x3e8
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeGlobal
lea rcx, [rbp]
call fcn.1400088e0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400d0869
imul r15d, eax, 0x3e8
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov r9b, 1
lea r8, [rbp - 0x20]
mov dl, r9b
mov rcx, r12
call fcn.1400d0c74
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, qword [rbp - 0x10]
call fcn.1400cfaa4
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
nop dword [rax + rax]
mov r15, rax
mov rbx, qword [rbp - 0x18]
add rbx, 0x10
mov r12d, 4
lea rcx, [rbx - 0x10]
cmp rcx, qword [rbp - 0x10]
sete cl
test cl, cl
jne 0x1400d0b04
mov eax, 0x66666667
imul r14d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp r14d, ecx
jne 0x1400d0919
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
nop dword [rax + rax]
lea rcx, [rdi + r15]
cmp rax, rcx
ja 0x1400d0a9d
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x1400f9fa8]
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call fcn.1400053e0
mov esi, eax
mov dword [rbp + 0x38], eax
mov ecx, eax
shr ecx, 0x1f
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
test cl, cl
lea rcx, [rsp + 0x60]
je 0x1400d09b8
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x16c
call sub.msvcrt.dll_memset
mov r9d, esi
lea r8, str.StringCchPrintf_failed_with_0x_08lx
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140009fb0
jmp 0x1400d0a91
lea rsi, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rsi
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x171
call sub.msvcrt.dll_memset
lea r9, [rbp + 0xa0]
lea r8, str.deleting_file__s
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140009fb0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400d0a91
mov qword [rsp + 0x38], rsi
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x175
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0xa0]
lea r8, str.failed_to_delete_file__s_from_snapshot.__Error__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140009fb0
add rbx, 0x48
inc r14d
jmp 0x1400d08d1
lea rax, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rax
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x15c
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, r12d
lea r8, [rsp + 0x38]
mov edx, 0x201c
lea rcx, [rbp + 0x30]
call fcn.1400c09a4
nop
lea rcx, [rbp]
call fcn.1400d5078
lea rcx, [rbp + 0x10]
call fcn.14002e4f8
nop
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400d0b46
mov rdi, qword [rbp - 0x10]
cmp rbx, rdi
je 0x1400d0b3e
mov rcx, rbx
call fcn.1400d0420
add rbx, 0x48
cmp rbx, rdi
jne 0x1400d0b29
mov rbx, qword [rbp - 0x18]
mov rcx, rbx
call fcn.140015ff8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
lea rcx, [rbp + 0x30]
call fcn.140009990
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400164a0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret