Function at 0x180074180
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
imul eax, ecx, 0xccc
mov rdi, r9
mov r13, r8
mov r14, rdx
mov r12d, ecx
mov dword [rbp - 0x38], eax
cmp ecx, eax
ja 0x180074a5c
mov ebx, dword [rbp + 0x70]
mov rsi, qword [rbp - 0x80]
xor r15d, r15d
cmp r12d, 0x1853d
ja 0x180074627
je 0x180074a57
cmp r12d, 0x7d19
ja 0x180074480
je 0x180074457
mov eax, r12d
sub eax, 0xaf
je 0x18007441d
sub eax, 8
je 0x18007437a
sub eax, 0x55
je 0x18007499f
cmp eax, 5
jne 0x18007497b
cmp dword [rdi], 1
jl 0x180074242
mov rax, qword [r14]
lea edx, [r15 + 0x26]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call fcn.18005f7e0
test eax, eax
jne 0x1800742b8
mov edi, pe_nt_image_headers64
mov eax, edi
sub eax, 0x100
je 0x18007425b
cmp eax, 1
je 0x180074a5c
jmp 0x1800742ae
mov r9d, 0x75
mov dword [rsp + 0x50], 1
lea r8, [rsp + 0x50]
mov rdx, r13
lea rcx, str.xeon_phi_not_right_first_line
call fcn.1800dd630
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rsp + 0x50], r15d
xor ecx, ecx
call fcn.1800e4220
mov dword [rsp + 0x58], r15d
inc edi
cmp edi, 0x102
jb 0x180074247
mov rax, qword [r14]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x13b
xor ecx, ecx
call fcn.180070d40
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1800742eb
cmp dword [rax + 0xa0], 0xdead635a
je 0x18007497b
mov edi, 0xdc
cmp edi, 0xdc
je 0x180074315
cmp edi, 0x25d0
je 0x18007430e
cmp edi, 0x4ac4
je 0x180074a5c
jmp 0x180074363
mov dword [rsp + 0x58], r15d
jmp 0x180074363
mov r9d, 0x75
mov dword [rsp + 0x50], 1
lea r8, [rsp + 0x50]
mov rdx, r13
lea rcx, str.set_AnticipatedLoadOperandMap
call fcn.1800dd630
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rsp + 0x50], r15d
xor ecx, ecx
call fcn.1800e4220
add edi, 0x24f4
cmp edi, 0x6edc
jbe 0x1800742f0
jmp 0x18007497b
cmp dword [rdi], 1
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x78], rax
jl 0x1800743a8
mov r8, qword [r14]
mov edx, 0x110
xor ecx, ecx
call fcn.1800e5740
test eax, eax
jne 0x18007497b
mov edi, 0x22
nop dword [rax]
mov eax, edi
sub eax, 0x21
je 0x180074a5c
cmp eax, 1
jne 0x180074411
lea r9d, [rax + 0x74]
mov dword [rsp + 0x50], 2
lea r8, [rsp + 0x50]
mov rdx, r13
lea rcx, str.CFileDiscovery.Search
call fcn.1800dd630
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rsp + 0x50], r15d
xor ecx, ecx
call fcn.1800e4220
mov dword [rsp + 0x58], r15d
dec edi
cmp edi, 0x20
ja 0x1800743b0
jmp 0x18007497b
mov qword [rsp + 0x28], r15
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call fcn.180064120
mov qword [rbp - 0x28], rax
test rax, rax
je 0x1800749e3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x68], eax
jmp 0x18007497b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rbp - 0x68]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x58], ecx
jmp 0x18007497b
cmp r12d, 0x82d1
je 0x18007459c
cmp r12d, 0xc327
je 0x18007456c
cmp r12d, 0xf983
je 0x180074a5c
cmp r12d, 0x104eb
jne 0x18007497b
mov r14, qword [rsp + 0x68]
test r14, r14
jne 0x180074534
mov edi, 0x10b
mov eax, edi
sub eax, 0x10b
je 0x1800744d7
cmp eax, 1
je 0x180074a5c
jmp 0x18007452a
mov r9d, 0x75
mov dword [rsp + 0x50], 2
lea r8, [rsp + 0x50]
mov rdx, r13
lea rcx, str.add_DrawingAttributesChanged
call fcn.1800dd630
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rsp + 0x50], r15d
xor ecx, ecx
call fcn.1800e4220
mov dword [rsp + 0x58], r15d
inc edi
cmp edi, 0x10d
jb 0x1800744c3
mov r9, qword [r13 + 0x60]
lea rax, [rsp + 0x60]
lea rsi, [r14 + 0x58]
mov qword [rsp + 0x20], rax
mov r8d, 0x12f
mov qword [rbp - 0x80], rsi
mov rdx, r14
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
call fcn.18006fb10
jmp 0x18007497b
mov rax, qword [rbp - 0x78]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xf1
xor ecx, ecx
mov eax, dword [rax + 4]
mov qword [rsp + 0x60], rax
call fcn.18002be30
jmp 0x18007497b
mov rax, qword [r14]
lea r8, [rbp - 0x64]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xac
call fcn.180093140
mov r9, qword [r13 + 0x60]
lea r8, [rbp - 0x60]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x78]
mov eax, dword [rbp - 0x64]
mov ecx, 0x16
mov dword [rbp - 0x60], eax
call fcn.180010b20
mov qword [rsp + 0x70], rax
cmp rax, 0
je 0x1800749f0
lea rax, [rbp - 0x58]
mov dword [rsp + 0x50], r15d
mov r9, r13
mov qword [rsp + 0x20], rax
mov r8d, 0x72
mov dword [rsp + 0x60], 1
lea rdx, [rsp + 0x50]
mov dword [rbp - 0x58], 0x80
lea rcx, [rsp + 0x60]
call fcn.1800c65d0
mov qword [rsp + 0x68], rax
jmp 0x18007497b
cmp r12d, 0x38f6d
ja 0x1800748d3
je 0x180074887
cmp r12d, 0x18705
je 0x18007473d
cmp r12d, 0x2091f
je 0x1800746a8
cmp r12d, 0x28b39
je 0x18007468e
cmp r12d, 0x30d53
jne 0x18007497b
mov rax, qword [rsp + 0x70]
mov edx, 0xd3
mov r9, qword [rbp - 0x70]
xor ecx, ecx
mov r8, qword [rbp - 0x30]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.1800144d0
jmp 0x18007497b
mov r9, qword [r13 + 0x60]
xor r8d, r8d
mov rcx, qword [rbp - 0x70]
mov edx, 0xdf
call fcn.1800e1220
jmp 0x18007497b
mov r9, qword [r13 + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
lea r8, [rbp - 0x48]
mov rax, qword [rsp + 0x70]
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x38], 0x7a
xor edx, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x40], r15d
mov dword [rbp - 0x50], r15d
mov dword [rbp - 0x48], 1
call fcn.18005a900
mov qword [rbp - 0x30], rax
cmp rax, 0
jne 0x180074730
mov edi, 0x65
mov ecx, edi
sub ecx, 0x64
je 0x180074a2d
cmp ecx, 1
jne 0x180074729
mov r9, qword [rsp + 0x78]
lea r8, str.blacklenticularbracketright
mov edx, ecx
mov rcx, r13
call fcn.1800fcd80
dec edi
cmp edi, 0x63
ja 0x180074703
lea rax, [rsi + 8]
mov qword [rbp - 0x70], rax
jmp 0x18007497b
mov rax, qword [r13 + 0x60]
mov rcx, qword [rsp + 0x70]
cmp rcx, qword [rax + 0x578]
jne 0x18007497b
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc8
xor ecx, ecx
call fcn.1800499b0
mov r15, rax
test rax, rax
je 0x18007497b
mov r9, qword [rax + 0x108]
test r9, r9
je 0x18007497b
mov rdi, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
lea rsi, [rdi + 0x10]
lea r14, [rdi + 8]
mov r8, rsi
mov rdx, r14
call r9
mov ebx, eax
test eax, eax
jne 0x180074978
mov edi, 0xe1
nop word [rax + rax]
mov eax, edi
sub eax, 0xe0
je 0x1800747f2
cmp eax, 1
jne 0x1800747df
mov eax, dword [rsi]
lea r9, [rsp + 0x60]
mov rdx, qword [r14]
mov r8d, 0x68
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x60], eax
call fcn.18002f810
mov rbx, rax
dec edi
cmp edi, 0xdf
ja 0x1800747b0
mov rsi, qword [rbp - 0x80]
jmp 0x18007497b
test ebx, ebx
je 0x180074874
mov edi, 0x5e
xor r12d, r12d
nop
mov eax, edi
sub eax, 0x5c
je 0x180074a12
sub eax, 1
je 0x180074841
cmp eax, 1
jne 0x18007486d
mov rax, qword [r15 + 0x110]
test rax, rax
je 0x180074829
mov rdx, qword [rsi]
mov rcx, qword [r14]
call rax
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov r8d, 0xf9
mov rcx, r13
call fcn.1800dfae0
jmp 0x18007486d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rsp + 0x60], r12d
xor ecx, ecx
call fcn.1800e4220
dec edi
cmp edi, 0x5b
ja 0x180074800
mov rsi, qword [rbp - 0x80]
mov dword [rsi], 1
mov qword [rsi + 0x18], r15
jmp 0x18007495e
mov rdi, qword [rbp - 0x70]
mov ebx, 0xfffffff7
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x1800748b4
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r8d, [rbx + 0x71]
mov dword [rsp + 0x60], eax
call fcn.18002f810
mov ebx, eax
mov r9, qword [rbp - 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov dword [rsi], 2
lea r8d, [rdx + 0x36]
call fcn.18004ad10
jmp 0x18007497b
cmp r12d, 0x41187
je 0x180074913
cmp r12d, 0x493a1
je 0x1800748f7
cmp r12d, 0x515bb
je 0x180074a5c
jmp 0x18007497b
mov r8, qword [rsp + 0x68]
mov r9d, 0x8c
mov rdx, r13
xor ecx, ecx
call fcn.1800801d0
mov dword [rsp + 0x58], r15d
jmp 0x18007497b
test ebx, ebx
je 0x18007495e
mov edi, 0x38
nop dword [rax]
mov eax, edi
sub eax, 0x37
je 0x180074a17
cmp eax, 1
jne 0x180074957
mov r8, qword [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov ecx, 0xb4
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18002fc30
dec edi
cmp edi, 0x36
ja 0x180074920
mov r8, qword [rsp + 0x68]
xor edx, edx
xor r9d, r9d
mov r12d, 0x41187
lea ecx, [rdx + 0x10]
call fcn.1800856c0
jmp 0x18007497b
mov rsi, rdi
imul eax, dword [rbp + 0x70], 0xb6
add r12d, eax
cmp r12d, dword [rbp - 0x38]
ja 0x180074a5c
mov r14, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x88]
jmp 0x1800741ce
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 0x114
xor ecx, ecx
call fcn.180094bb0
mov ecx, dword [rdi]
lea r9, [rbp + 0x70]
mov dword [rbp + 0x70], ecx
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 8]
mov qword [rbp - 0x78], rax
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpNICW
call fcn.1800b1a40
mov rax, qword [rax]
jmp 0x180074a61
mov dword [rsp + 0x58], 0xffffffff
jmp 0x180074a5c
mov r9d, 0x75
mov dword [rbp + 0x70], 2
lea r8, [rbp + 0x70]
mov rdx, r13
lea rcx, str.vcs_tpss2_tpss_srccontrollercontroller.cpp
call fcn.1800dd630
jmp 0x180074a2d
xor r15d, r15d
jmp 0x180074a57
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov r8d, 0xf9
mov rcx, r13
call fcn.1800dfae0
lea rax, [rbp + 0x70]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
mov rdx, r13
mov dword [rbp + 0x70], r15d
xor ecx, ecx
call fcn.1800e4220
mov dword [rsp + 0x58], r15d
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret