Function at 0x14003060c
Capabilities:
Delete directory
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rsi, rcx
or rdx, 0xffffffffffffffff
xor ecx, ecx
mov qword [rsp + 0x70], rdx
mov rax, r9
mov qword [rsp + 0x50], rax
mov r15, r8
mov r13, rdx
test rdi, rdi
je 0x14003065c
mov r14, qword [rdi]
jmp 0x14003065f
mov r14, rdx
xor ebx, ebx
mov qword [rsp + 0x68], rcx
test byte [r9 + 0x1c], 0x10
xorps xmm0, xmm0
xorps xmm1, xmm1
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], ebx
mov r12d, ebx
mov word [rsp + 0x44], bx
mov dword [rsp + 0x60], ebx
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x10], ecx
movups xmmword [rbp - 0x50], xmm0
mov qword [rsp + 0x58], rbx
movups xmmword [rbp - 0x40], xmm1
mov qword [rsp + 0x78], rbx
movups xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x68], rbx
movups xmmword [rbp - 0x20], xmm1
movdqu xmmword [rbp - 0x78], xmm0
je 0x140030789
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call fcn.14001bd88
test eax, eax
jne 0x140030784
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
je 0x140030780
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x140030780
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030732
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030737
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030753
mov r9d, ebx
mov r8d, 0x567
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x568
lea r9, str.CreateDirectory_failed
mov qword [rsp + 0x28], rdi
mov r8, r15
mov rdx, rsi
mov dword [rsp + 0x20], ebx
mov ecx, 1
call fcn.14000b4d0
jmp 0x140030947
mov dword [rsp + 0x40], ebx
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x1c]
and r8d, 0x210
mov qword [rbp - 0x80], r15
or r8d, 0x48000000
test rsi, rsi
je 0x1400307d1
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x78]
mov r9d, 4
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call fcn.140020ff4
mov r13, qword [rsp + 0x70]
jmp 0x1400307e4
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
test eax, eax
jne 0x14003096a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030823
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030828
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030844
mov r9d, ebx
mov r8d, 0x579
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x57a
lea r9, str.CreateFile_failed
mov qword [rsp + 0x28], rdi
mov r8, r15
mov rdx, rsi
mov dword [rsp + 0x20], ebx
mov ecx, 1
call fcn.14000b4d0
mov esi, dword [rsp + 0x40]
cmp r14, 0xffffffffffffffff
je 0x14003088c
cmp dword [rsp + 0x48], 0
je 0x14003088c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1400308c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp r13, 0xffffffffffffffff
je 0x1400308da
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rax, qword [rsp + 0x50]
test byte [rax + 0x1c], 0x10
je 0x1400308f8
test esi, esi
je 0x1400308f8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
test r12, r12
je 0x14003091d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rsp + 0x58], 0
je 0x140030947
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140068870
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp r14, 0xffffffffffffffff
jne 0x140030a7d
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rsi
call fcn.1400230c4
mov rbx, qword [rsp + 0x68]
mov r14, rax
test rbx, rbx
jne 0x1400309ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400309c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x1400309cc
mov ebx, 0x80004005
test ebx, ebx
jns 0x14003086c
mov r9d, ebx
mov r8d, 0x58a
lea rcx, str.RestoreReparsePoint
call fcn.1400064e0
jmp 0x14003086c
mov rdx, qword [rsp + 0x50]
mov r9, rbx
add rdx, 0x20
mov r8, rax
mov rcx, rsi
call fcn.14002c2f0
test eax, eax
jne 0x140030a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030a40
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030a45
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030a61
mov r9d, ebx
mov r8d, 0x594
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x595
lea r9, str.ResExtractToFile_failed
jmp 0x140030853
mov dword [rsp + 0x48], 1
lea rdx, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
nop dword [rax + rax]
test eax, eax
jne 0x140030b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030acb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030ad0
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030aec
mov r9d, ebx
mov r8d, 0x5a2
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x5a3
lea r9, str.stat._failed
jmp 0x140030853
movzx eax, word [rbp - 0x1c]
mov r12d, 8
add ax, r12w
movzx ebx, ax
mov word [rsp + 0x44], bx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x140030bab
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030b76
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030b7b
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030b97
mov r9d, ebx
mov r8d, 0x5ad
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x5ae
lea r9, str.MALLOC_failed
jmp 0x140030853
mov rbx, qword [rsp + 0x50]
lea rdx, [r12 + 8]
and dword [rsp + 0x20], 0
lea r9, [rbp - 0x60]
mov rcx, r14
mov eax, dword [rbx + 0x78]
mov dword [r12], eax
movzx eax, word [rbp - 0x1c]
mov word [r12 + 4], ax
movzx eax, word [rbx + 0x7c]
movzx r8d, word [r12 + 4]
mov word [r12 + 6], ax
call fcn.14001f03c
test eax, eax
jne 0x140030c57
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030c27
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030c43
mov r9d, ebx
mov r8d, 0x5bf
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x5c0
lea r9, str.ReadData_reparse_tag_from_filestream_failed
jmp 0x140030853
lea rax, [rsp + 0x44]
mov r9, r15
mov qword [rsp + 0x38], rax
mov r8, rbx
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rsi
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r12
call fcn.140017df8
mov ebx, eax
test eax, eax
jns 0x140030c9e
mov r9d, eax
mov r8d, 0x5c6
jmp 0x1400309dd
mov r8, qword [rsp + 0x58]
xor ebx, ebx
test r8, r8
jne 0x140030cb5
mov r8, r12
mov qword [rsp + 0x58], r12
mov r12d, ebx
movzx r9d, word [rsp + 0x44]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rbx
mov edx, 0x900a4
mov qword [rsp + 0x30], rax
mov rcx, r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x140030d57
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140030d22
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x140030d27
mov ebx, 0x80004005
lea rdi, str.RestoreReparsePoint
test ebx, ebx
jns 0x140030d43
mov r9d, ebx
mov r8d, 0x5d8
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x5d9
lea r9, str.ioctl:_setting_reparse_point_tag_failed
jmp 0x140030853
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or rsi, 0xffffffffffffffff
mov r14, rsi
test rdi, rdi
je 0x140030d78
mov qword [rdi], r13
mov r13, rsi
xor esi, esi
jmp 0x140030870