Function at 0x18001ab7c
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov r12b, dl
mov rsi, rcx
je 0x18001b1c3
mov rcx, qword [rcx + 8]
mov edx, 8
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x18001b1c5
mov r9, qword [rsi + 0x10]
lea rax, str.1DC12691_2B24_2265_435D_735D3B118A70
lea r15, str._s:_s
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x30]
or r13, 0xffffffffffffffff
cmp rcx, r13
je 0x18001ac20
call fcn.1800196a8
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.6CEE6FE1_10A2_4C33_7E7F_855A51733C77
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x38]
cmp rcx, r13
je 0x18001ac80
call fcn.1800196a8
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x38], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.629336E3_58D6_633B_5182_576588CF702A
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x20]
cmp rcx, r13
je 0x18001ace0
call fcn.1800196a8
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x20], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.119D263D_68FC_1942_3CA3_46B23FA652A0
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x28]
cmp rcx, r13
je 0x18001ad40
call fcn.1800196a8
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x28], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.3CDC155D_398A_646E_1021_23047D9B4366
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x58]
cmp rcx, r13
je 0x18001ada0
call fcn.1800196a8
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x58], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsi + 0x108], 0
je 0x18001adec
mov rbx, qword [rsi + 0x100]
mov rdi, qword [rbx]
jmp 0x18001ade7
mov rcx, rdi
mov rdi, qword [rdi]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add qword [rsi + 0x108], r13
cmp rdi, rbx
jne 0x18001adbf
mov rcx, qword [rsi + 0xb8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.81A03BF8_60AA_4A56_253C_449121D61CAF
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xa8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x48]
cmp rcx, r13
je 0x18001ae43
call fcn.1800196a8
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x48], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsi + 0x120], 0
je 0x18001ae8f
mov rbx, qword [rsi + 0x118]
mov rdi, qword [rbx]
jmp 0x18001ae8a
mov rcx, rdi
mov rdi, qword [rdi]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add qword [rsi + 0x120], r13
cmp rdi, rbx
jne 0x18001ae62
mov rcx, qword [rsi + 0xa8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.31AC34A1_2DE2_36AC_1F6E_86F43772841F
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x40]
cmp rcx, r13
je 0x18001aee6
call fcn.1800196a8
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x40], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsi + 0xf0], 0
je 0x18001af32
mov rbx, qword [rsi + 0xe8]
mov rdi, qword [rbx]
jmp 0x18001af2d
mov rcx, rdi
mov rdi, qword [rdi]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add qword [rsi + 0xf0], r13
cmp rdi, rbx
jne 0x18001af05
mov rcx, qword [rsi + 0xa0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.8E9810C5_3014_4678_27EE_3B7A7AC346AF
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x50]
cmp rcx, r13
je 0x18001af89
call fcn.1800196a8
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x50], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsi + 0x138], 0
je 0x18001afd5
mov rbx, qword [rsi + 0x130]
mov rdi, qword [rbx]
jmp 0x18001afd0
mov rcx, rdi
mov rdi, qword [rdi]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add qword [rsi + 0x138], r13
cmp rdi, rbx
jne 0x18001afa8
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.28E74BDA_4327_31B0_17B9_56A66A818C1D
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x60]
cmp rcx, r13
je 0x18001b02c
call fcn.1800196a8
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x60], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsi + 0x150], 0
je 0x18001b078
mov rbx, qword [rsi + 0x148]
mov rdi, qword [rbx]
jmp 0x18001b073
mov rcx, rdi
mov rdi, qword [rdi]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
add qword [rsi + 0x150], r13
cmp rdi, rbx
jne 0x18001b04b
mov rcx, qword [rsi + 0xc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.56594FEA_5774_746D_4496_6361266C40D0
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xc8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x68]
cmp rcx, r13
je 0x18001b0cf
call fcn.1800196a8
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x68], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0xc8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.4A3130BD_2608_730F_31A7_86D16CE66100
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x70]
cmp rcx, r13
je 0x18001b12f
call fcn.1800196a8
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x70], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rsi + 0x10]
lea r11, str.831511FA_190D_5D85_8A4A_279F2F592CC7
mov r8, r15
mov edx, 0x400
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.msvcrt.dll__snwprintf]
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x78]
cmp rcx, r13
je 0x18001b18f
call fcn.1800196a8
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x78], r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12b, r12b
je 0x18001b1b4
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r13
pop r12
ret