Function at 0x14003bd30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rax, qword [rcx + 0x18]
xor ebx, ebx
mov r14d, dword [rcx + 0x50]
mov r15, rdx
mov qword [rsp + 0x48], rdx
mov rsi, rcx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x34], 0xffffffff
mov r12, qword [rax + 0x20]
mov r13d, 2
mov eax, dword [rcx + 0x54]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
call fcn.140017e30
lea rax, [rsp + 0x30]
mov rdx, r15
lea r8, [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.14003ba40
mov edi, eax
test eax, eax
jne 0x14003c006
lea rdx, [rbp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14003bdef
mov ebx, dword [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsi + 0x10]
mov r8d, ebx
mov rdx, r15
call fcn.140026fa0
test rax, rax
je 0x14003be19
test r14d, r14d
jne 0x14003be0c
mov r14d, dword [rax + 0x24]
mov ebx, dword [rax + 0x2c]
mov r13d, dword [rax + 0x28]
mov dword [rsp + 0x34], ebx
jmp 0x14003be1e
mov ebx, 0xffffffff
movzx eax, byte [rsi + 0x58]
neg al
sbb ecx, ecx
and ecx, 0x80000000
or r14d, ecx
nop
mov r8, rsi
lea rdx, [0x14003b950]
mov rcx, r12
call fcn.1400502f0
mov ecx, dword [rsp + 0x30]
call fcn.14003f780
mov r9d, r14d
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0x2c0]
mov dword [rsp + 0x20], r13d
mov rdx, r15
mov rcx, r12
call fcn.14004fbb0
test al, al
jne 0x14003be75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1400502f0
cmp edi, 0xb7
jne 0x14003bfa6
cmp byte [rsi + 0x59], 0
jne 0x14003bf9b
xor ecx, ecx
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], ecx
lea r8, [rbp + 0x2c0]
mov qword [rsp + 0x20], rcx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x68], rcx
mov r9d, ebx
mov word [rsp + 0x70], cx
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cdqe
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14003bf39
lea rcx, [rax + 1]
cmp rcx, 0x80
jbe 0x14003bf11
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140094b74
mov rcx, rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
jmp 0x14003bf16
mov rcx, qword [rsp + 0x60]
inc rax
lea r8, [rbp + 0x2c0]
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, qword [rsp + 0x60]
mov edx, 0x13a
mov rcx, qword [rsi + 0x48]
lea r8d, [rdx + 1]
call fcn.140018790
mov rcx, qword [rsp + 0x60]
mov ebx, eax
test rcx, rcx
je 0x14003bf6b
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x14003bf6b
call fcn.140062970
sub ebx, 2
je 0x14003bf9f
sub ebx, 4
je 0x14003bf83
sub ebx, 1
je 0x14003bf9b
sub ebx, 6
jne 0x14003bf93
mov byte [rsi + 0x58], 1
mov ebx, dword [rsp + 0x34]
bts r14d, 0x1f
xor edi, edi
jmp 0x14003be30
cmp ebx, 1
jne 0x14003bfb2
mov byte [rsi + 0x59], bl
xor eax, eax
jmp 0x14003c006
mov eax, 0x4c7
jmp 0x14003c006
test edi, edi
je 0x14003bfc2
cmp edi, 0x2713
je 0x14003bfbc
mov r8d, edi
mov edx, 0xc2
jmp 0x14003bff8
xor eax, eax
mov edi, eax
jmp 0x14003c004
mov rcx, qword [rsi + 0x18]
lea r8, [rbp + 0x2c0]
mov rdx, r12
call fcn.14003a310
cmp byte [rsi + 0x5a], 0
je 0x14003c004
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14003c004
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r8d, eax
mov edx, 0x1a7
mov rcx, qword [rsi + 0x48]
mov r9, r15
call fcn.1400187f0
mov eax, edi
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140094850
mov rbx, qword [rsp + 0x530]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret