Function at 0x10002acd0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
mov qword [rax + 0x18], r12
xor r15d, r15d
mov qword [rax + 0x20], r15
xor esi, esi
mov qword [rax + 0x10], rsi
xor r13d, r13d
mov qword [rax - 0x58], r13
and qword [rax + 8], rsi
xor r14d, r14d
cmp qword [rcx + 0x1d8], rsi
jne 0x10002ad32
lea r8, [0x100004b40]
mov edx, 0x1af6
lea rcx, [0x1000046e0]
call fcn.100099ad8
lea rbp, [0x1001653b8]
test byte [rbx + 0x150], 4
je 0x10002ae6c
lea r9, [rsp + 0xa8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.100140130
mov edi, eax
test eax, eax
js 0x10002ae58
lea rdx, [rsp + 0x98]
mov r15, qword [rsp + 0xa8]
mov rcx, r15
call fcn.10010bcc8
mov edi, eax
test eax, eax
jns 0x10002ade8
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002addb
test byte [rcx + 0x1c], 1
je 0x10002addb
cmp byte [rcx + 0x19], 2
jb 0x10002addb
mov edx, 0x14c
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r15
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001e360
mov rsi, qword [rsp + 0x98]
mov rcx, qword [0x1001653b8]
jmp 0x10002b055
mov rsi, qword [rsp + 0x98]
jmp 0x10002b055
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x10002ae6c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002ae6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002ae45
test byte [rcx + 0x1c], 1
je 0x10002ae45
cmp byte [rcx + 0x19], 2
jb 0x10002ae45
mov edx, 0x14d
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x10002b055
mov r15, qword [rsp + 0xa8]
mov rcx, qword [0x1001653b8]
jmp 0x10002b07f
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.100140130
mov edi, eax
test eax, eax
js 0x10002b042
mov r13, qword [rsp + 0x30]
test byte [rbx + 0x150], 1
je 0x10002aebe
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.10009b4ec
mov edi, eax
test eax, eax
js 0x10002b00c
jmp 0x10002aee6
lea r9, [rsp + 0x90]
mov r8b, 1
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.100140130
mov edi, eax
test eax, eax
js 0x10002b00c
lea rcx, [rsp + 0xa0]
call fcn.10013fa1c
mov edi, eax
test eax, eax
js 0x10002affa
mov r12, qword [rsp + 0xa0]
mov r9, r12
mov r8d, dword [rbx + 0x14c]
mov rbp, qword [rsp + 0x90]
mov rdx, rbp
mov rcx, r13
call fcn.10010b3bc
mov edi, eax
test eax, eax
js 0x10002b014
test byte [rbx + 0x150], 0x80
je 0x10002b014
cmp byte [rbx + 0x11c], r14b
je 0x10002b014
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x90], rax
test rax, rax
je 0x10002af6a
mov rcx, rax
call fcn.100043fcc
mov r14, rax
jmp 0x10002af6d
xor r14d, r14d
mov rdx, r13
mov rcx, r14
call fcn.10001ec50
mov edi, eax
test eax, eax
js 0x10002b014
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rdx, r12
mov rcx, r14
call fcn.10001ef7c
mov edi, eax
test eax, eax
js 0x10002b014
mov r12, qword [rbx + 0x310]
cmp r12, qword [rbx + 0x318]
jb 0x10002afd6
lea rdx, [r12 + 1]
lea rcx, [rbx + 0x308]
call fcn.100043a28
test al, al
jne 0x10002afd6
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x10002afe9
mov qword [rcx], r14
inc qword [rbx + 0x310]
mov r12, qword [rsp + 0xa0]
jmp 0x10002b014
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa0]
jmp 0x10002b014
mov rbp, qword [rsp + 0x90]
test rbp, rbp
je 0x10002b032
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
jmp 0x10002b055
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
jmp 0x10002b055
mov r13, qword [rsp + 0x30]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
test rsi, rsi
je 0x10002b06a
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r13, r13
je 0x10002b07f
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r15, r15
je 0x10002b094
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test edi, edi
jns 0x10002b0da
test r14, r14
je 0x10002b0b1
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002b0da
test byte [rcx + 0x1c], 1
je 0x10002b0da
cmp byte [rcx + 0x19], 2
jb 0x10002b0da
mov edx, 0x14e
mov r9d, edi
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
test r12, r12
je 0x10002b0e8
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret