Function at 0x10002ad5c
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
mov qword [rax + 0x18], r12
xor r15d, r15d
mov qword [rax + 0x20], r15
xor esi, esi
mov qword [rax + 0x10], rsi
xor r13d, r13d
mov qword [rax - 0x58], r13
and qword [rax + 8], rsi
xor r14d, r14d
cmp qword [rcx + 0x1d8], rsi
jne 0x10002adbe
lea r8, [0x100004ae0]
mov edx, 0x1af6
lea rcx, [0x100004680]
call fcn.10009a050
lea rbp, [0x1001653b8]
test byte [rbx + 0x150], 4
je 0x10002aef8
lea r9, [rsp + 0xa8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.10014037c
mov edi, eax
test eax, eax
js 0x10002aee4
lea rdx, [rsp + 0x98]
mov r15, qword [rsp + 0xa8]
mov rcx, r15
call fcn.10010c158
mov edi, eax
test eax, eax
jns 0x10002ae74
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002ae67
test byte [rcx + 0x1c], 1
je 0x10002ae67
cmp byte [rcx + 0x19], 2
jb 0x10002ae67
mov edx, 0x14c
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r15
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001e39c
mov rsi, qword [rsp + 0x98]
mov rcx, qword [0x1001653b8]
jmp 0x10002b0e1
mov rsi, qword [rsp + 0x98]
jmp 0x10002b0e1
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x10002aef8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002aef8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002aed1
test byte [rcx + 0x1c], 1
je 0x10002aed1
cmp byte [rcx + 0x19], 2
jb 0x10002aed1
mov edx, 0x14d
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x10002b0e1
mov r15, qword [rsp + 0xa8]
mov rcx, qword [0x1001653b8]
jmp 0x10002b10b
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.10014037c
mov edi, eax
test eax, eax
js 0x10002b0ce
mov r13, qword [rsp + 0x30]
test byte [rbx + 0x150], 1
je 0x10002af4a
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.10009bac4
mov edi, eax
test eax, eax
js 0x10002b098
jmp 0x10002af72
lea r9, [rsp + 0x90]
mov r8b, 1
lea rdx, [rbx + 0x130]
mov rcx, qword [rbx + 0x1d8]
call fcn.10014037c
mov edi, eax
test eax, eax
js 0x10002b098
lea rcx, [rsp + 0xa0]
call fcn.10013fc68
mov edi, eax
test eax, eax
js 0x10002b086
mov r12, qword [rsp + 0xa0]
mov r9, r12
mov r8d, dword [rbx + 0x14c]
mov rbp, qword [rsp + 0x90]
mov rdx, rbp
mov rcx, r13
call fcn.10010b84c
mov edi, eax
test eax, eax
js 0x10002b0a0
test byte [rbx + 0x150], 0x80
je 0x10002b0a0
cmp byte [rbx + 0x11c], r14b
je 0x10002b0a0
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x90], rax
test rax, rax
je 0x10002aff6
mov rcx, rax
call fcn.10004401c
mov r14, rax
jmp 0x10002aff9
xor r14d, r14d
mov rdx, r13
mov rcx, r14
call fcn.10001ecdc
mov edi, eax
test eax, eax
js 0x10002b0a0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rdx, r12
mov rcx, r14
call fcn.10001f008
mov edi, eax
test eax, eax
js 0x10002b0a0
mov r12, qword [rbx + 0x310]
cmp r12, qword [rbx + 0x318]
jb 0x10002b062
lea rdx, [r12 + 1]
lea rcx, [rbx + 0x308]
call fcn.10006a9e0
test al, al
jne 0x10002b062
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x10002b075
mov qword [rcx], r14
inc qword [rbx + 0x310]
mov r12, qword [rsp + 0xa0]
jmp 0x10002b0a0
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa0]
jmp 0x10002b0a0
mov rbp, qword [rsp + 0x90]
test rbp, rbp
je 0x10002b0be
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
jmp 0x10002b0e1
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
jmp 0x10002b0e1
mov r13, qword [rsp + 0x30]
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
test rsi, rsi
je 0x10002b0f6
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r13, r13
je 0x10002b10b
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r15, r15
je 0x10002b120
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test edi, edi
jns 0x10002b166
test r14, r14
je 0x10002b13d
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002b166
test byte [rcx + 0x1c], 1
je 0x10002b166
cmp byte [rcx + 0x19], 2
jb 0x10002b166
mov edx, 0x14e
mov r9d, edi
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
test r12, r12
je 0x10002b174
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret