Function at 0x140036738
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rdi, rcx
lea rsi, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140036790
test byte [rcx + 0x1c], 1
je 0x140036790
cmp byte [rcx + 0x19], 4
jb 0x140036790
mov edx, 0x171
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
xor r15d, r15d
mov qword [rbp + 0x50], r15
mov r14d, r15d
mov qword [rbp + 0x40], r15
mov r12d, r15d
mov qword [rbp + 0x48], r15
cmp qword [rdi + 0x1d8], r15
jne 0x1400367c6
lea r8, [0x140004208]
mov edx, 0x1f58
lea rcx, [0x140003c50]
call fcn.1400a8be8
cmp qword [rdi + 0x358], r15
jne 0x1400367e7
lea r8, [0x140004228]
mov edx, 0x1f59
lea rcx, [0x140003c50]
call fcn.1400a8be8
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, qword [rdi + 0x1d8]
call fcn.1401350cc
mov ebx, eax
mov r13, qword [rbp + 0x50]
test eax, eax
js 0x140036a29
test byte [rdi + 0x154], 4
je 0x1400368e7
lea rdx, [rbp + 0x40]
mov rcx, r13
call fcn.14011f17c
mov ebx, eax
test eax, eax
jns 0x140036878
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x14003686f
test byte [rcx + 0x1c], 1
je 0x14003686f
cmp byte [rcx + 0x19], 2
jb 0x14003686f
mov edx, 0x172
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028ec8
mov r14, qword [rbp + 0x40]
jmp 0x140036a1c
mov r14, qword [rbp + 0x40]
jmp 0x140036a23
mov r14, qword [rbp + 0x40]
test r14, r14
je 0x1400368e7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400368e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140036a23
test byte [rcx + 0x1c], 1
je 0x140036a23
cmp byte [rcx + 0x19], 2
jb 0x140036a23
mov edx, 0x173
mov dword [rsp + 0x20], ebx
mov r9, r14
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
jmp 0x140036a1c
test byte [rdi + 0x154], 1
je 0x140036901
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, r13
call fcn.1400a99e4
jmp 0x140036913
lea r8, [rbp + 0x48]
mov dl, 1
mov rcx, qword [rdi + 0x1d8]
call fcn.1401350cc
test eax, eax
mov ebx, eax
mov r12, qword [rbp + 0x48]
js 0x140036a29
mov r9, qword [rdi + 0x358]
mov r8d, dword [rdi + reloc.ADVAPI32.dll_TraceEvent]
mov rdx, r12
mov rcx, r13
call fcn.14011e870
mov ebx, eax
test eax, eax
js 0x140036a29
test byte [rdi + 0x154], 0x80
je 0x140036a1c
cmp byte [rdi + 0x114], r15b
je 0x140036a1c
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14003697f
mov rcx, rax
call fcn.140052668
mov rsi, rax
jmp 0x140036982
mov rsi, r15
mov rdx, r13
mov rcx, rsi
call fcn.140029a6c
mov ebx, eax
test eax, eax
js 0x140036a03
mov rdx, qword [rdi + 0x358]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14003699e
lea r8, [r8*2 + 2]
mov rcx, rsi
call fcn.140029d98
mov ebx, eax
test eax, eax
js 0x140036a03
add rdi, 0x308
mov r15, qword [rdi + 8]
cmp r15, qword [rdi + 0x10]
jb 0x1400369ea
lea rdx, [r15 + 1]
mov rcx, rdi
call fcn.14008b270
test al, al
jne 0x1400369ea
mov ecx, 0x8007000e
call fcn.14001ad98
int3
mov rax, qword [rdi]
lea rcx, [rax + r15*8]
xor r15d, r15d
test rcx, rcx
je 0x1400369fc
mov qword [rcx], rsi
inc qword [rdi + 8]
mov rsi, r15
test rsi, rsi
je 0x140036a15
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
lea rsi, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x140036a60
jmp 0x140036a30
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140036a60
test byte [rcx + 0x1c], 1
je 0x140036a60
cmp byte [rcx + 0x19], 2
jb 0x140036a60
mov edx, 0x174
mov r9d, ebx
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
test r13, r13
je 0x140036a75
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test r12, r12
je 0x140036a8a
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test r14, r14
je 0x140036a9f
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x140036ac5
test byte [rcx + 0x1c], 1
je 0x140036ac5
cmp byte [rcx + 0x19], 4
jb 0x140036ac5
mov edx, 0x175
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret