Function at 0x14002dcc8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x14009b020]
lea r14, [0x14009b020]
cmp rcx, r14
je 0x14002dd0f
test byte [rcx + 0x1c], 4
je 0x14002dd0f
cmp byte [rcx + 0x19], 5
jb 0x14002dd0f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008c248]
mov edx, 0x14
call fcn.1400042fc
lea rcx, [0x14009f1f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002dd5a
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002df0b
lea rcx, [0x14009f108]
call fcn.14004020c
jmp case.default.0x14002df0b
cmp eax, 2
jne 0x14002ddd5
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002df0b
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
test eax, eax
jne case.default.0x14002df0b
mov rax, qword [0x14009b020]
cmp rax, r14
je case.default.0x14002df0b
test byte [rax + 0x1c], 4
je case.default.0x14002df0b
cmp byte [rax + 0x19], 2
jb case.default.0x14002df0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
lea r8, [0x14008c248]
mov edx, 0x15
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1400046fc
jmp case.default.0x14002df0b
cmp eax, 3
jne case.default.0x14002df0b
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002de35
mov rax, qword [0x14009b020]
cmp rax, r14
je 0x14002de35
test byte [rax + 0x1c], 4
je 0x14002de35
cmp byte [rax + 0x19], 2
jb 0x14002de35
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
lea r8, [0x14008c248]
mov edx, 0x16
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1400046fc
cmp dword [rbx + 0x660], 0
je 0x14002de9c
cmp dword [rbx + 0x65c], 0
je 0x14002dea5
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14002de9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
cmp rcx, r14
je 0x14002de9c
test byte [rcx + 0x1c], 4
je 0x14002de9c
cmp byte [rcx + 0x19], 2
jb 0x14002de9c
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x14008c248]
call fcn.1400045e8
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002df0b
cmp qword [rbx + 0x668], 0
je case.default.0x14002df0b
lea rcx, [0x14009f280]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.140039cf0
lea rcx, [0x14009f280]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140069d30
lea rcx, [0x14009f1f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sbb byte [rsi + rax*2], 0xd8
xor dword [rcx], esi
movsb byte [rdi], byte [rsi]
xor dword [rbx - 0x59b8ea4a], ecx
xor byte [rdx], dl
xchg r12, rax
adc bh, dh
invalid
shr byte [rsi + rdx*8], cl
clc
pop rsp
cld
pop cx
rol dword [rsi], 0xa3
push rsp
push rsp
cmpsb byte [rsi], byte [rdi]
invalid
jno 0x14012265d
out dx, al
imul ecx, dword [rbx - 0x3170f463], 0x32
js 0x140122603
cmp cl, al
xlatb
mov ah, 0x49
call [rsi + 0x1d]
sub eax, 0x46b6d8df
mov dh, 0x46
add byte [rsi - 0x3b2dbb2e], bl
rol spl, cl
movabs byte [0x6c5211e768dcfcf4], al
add byte gs:[rbx - 0x723fb226], cl
fidiv word [rsi]
invalid
fcompi st(7)
xlatb
ret 0x4707
and al, 0
jns 0x14012264a
mov dh, 0xa2
add eax, 0x74009719
pop rbp
cwde
invalid
push rax
loopne case.0x140051048.12
out 0x4c, al
invalid
int1
xchg edx, eax
and al, 0x90
adc dh, dl
leave
xchg esi, eax
adc eax, 0x40157bf6
pop rdx
add byte [rsi + rcx*8 - 0x57cc0180], cl
sub al, 0xe7
mov dh, 0x9b
rol byte [rax], cl
in eax, 0xaa
invalid