Function at 0x140089a30
Capabilities:
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ebx, edx
mov rdi, rcx
test edx, edx
je 0x140089a6c
call fcn.140089660
mov ebx, eax
mov rcx, qword [rdi + 0x298]
add rcx, 0x1690
cmp byte [rcx], 0
je 0x140089ad8
test ebx, ebx
je 0x140089a94
lea rdx, str.dhcplex.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089ad8
mov rcx, qword [rdi + 0x298]
add rcx, 0x1690
call fcn.1400b6a90
test eax, eax
je 0x140089ad8
mov rcx, qword [rdi + 0x298]
add rcx, 0x1690
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089ad8
mov rcx, qword [rdi + 0x298]
add rcx, 0x1690
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x41c
cmp byte [rcx], 0
je 0x140089b21
call fcn.1400b6a90
test eax, eax
je 0x140089b21
mov rcx, qword [rdi + 0x298]
add rcx, 0x41c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089b21
mov rcx, qword [rdi + 0x298]
add rcx, 0x41c
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x624
cmp byte [rcx], 0
je 0x140089b8d
test ebx, ebx
je 0x140089b49
lea rdx, str.dhcplex.sys
call fcn.1400b3b50
test rax, rax
jne 0x140089b8d
mov rcx, qword [rdi + 0x298]
add rcx, 0x624
call fcn.1400b6a90
test eax, eax
je 0x140089b8d
mov rcx, qword [rdi + 0x298]
add rcx, 0x624
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089b8d
mov rcx, qword [rdi + 0x298]
add rcx, 0x624
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1794
cmp byte [rcx], 0
je 0x140089bf9
test ebx, ebx
je 0x140089bb5
lea rdx, str.rsvspool.exe
call fcn.1400b3b50
test rax, rax
jne 0x140089bf9
mov rcx, qword [rdi + 0x298]
add rcx, 0x1794
call fcn.1400b6a90
test eax, eax
je 0x140089bf9
mov rcx, qword [rdi + 0x298]
add rcx, 0x1794
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089bf9
mov rcx, qword [rdi + 0x298]
add rcx, 0x1794
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1898
cmp byte [rcx], 0
je 0x140089c65
test ebx, ebx
je 0x140089c21
lea rdx, str.npdextsh.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089c65
mov rcx, qword [rdi + 0x298]
add rcx, 0x1898
call fcn.1400b6a90
test eax, eax
je 0x140089c65
mov rcx, qword [rdi + 0x298]
add rcx, 0x1898
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089c65
mov rcx, qword [rdi + 0x298]
add rcx, 0x1898
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1fb4
cmp byte [rcx], 0
je 0x140089cd1
test ebx, ebx
je 0x140089c8d
lea rdx, str.BlockedFiles.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089cd1
mov rcx, qword [rdi + 0x298]
add rcx, 0x1fb4
call fcn.1400b6a90
test eax, eax
je 0x140089cd1
mov rcx, qword [rdi + 0x298]
add rcx, 0x1fb4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089cd1
mov rcx, qword [rdi + 0x298]
add rcx, 0x1fb4
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x55a8
cmp byte [rcx], 0
je 0x140089d1a
call fcn.1400b6a90
test eax, eax
je 0x140089d1a
mov rcx, qword [rdi + 0x298]
add rcx, 0x55a8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089d1a
mov rcx, qword [rdi + 0x298]
add rcx, 0x55a8
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x57b0
cmp byte [rcx], 0
je 0x140089d86
test ebx, ebx
je 0x140089d42
lea rdx, str.tcpdvr32.exe
call fcn.1400b3b50
test rax, rax
jne 0x140089d86
mov rcx, qword [rdi + 0x298]
add rcx, 0x57b0
call fcn.1400b6a90
test eax, eax
je 0x140089d86
mov rcx, qword [rdi + 0x298]
add rcx, 0x57b0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089d86
mov rcx, qword [rdi + 0x298]
add rcx, 0x57b0
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1ca8
cmp byte [rcx], 0
je 0x140089df2
test ebx, ebx
je 0x140089dae
lea rdx, str.mxevtmap.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089df2
mov rcx, qword [rdi + 0x298]
add rcx, 0x1ca8
call fcn.1400b6a90
test eax, eax
je 0x140089df2
mov rcx, qword [rdi + 0x298]
add rcx, 0x1ca8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089df2
mov rcx, qword [rdi + 0x298]
add rcx, 0x1ca8
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1dac
cmp byte [rcx], 0
je 0x140089e5e
test ebx, ebx
je 0x140089e1a
lea rdx, str.AgentWOW64.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089e5e
mov rcx, qword [rdi + 0x298]
add rcx, 0x1dac
call fcn.1400b6a90
test eax, eax
je 0x140089e5e
mov rcx, qword [rdi + 0x298]
add rcx, 0x1dac
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089e5e
mov rcx, qword [rdi + 0x298]
add rcx, 0x1dac
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1eb0
cmp byte [rcx], 0
je 0x140089eca
test ebx, ebx
je 0x140089e86
lea rdx, str.AgentLoader.exe
call fcn.1400b3b50
test rax, rax
jne 0x140089eca
mov rcx, qword [rdi + 0x298]
add rcx, 0x1eb0
call fcn.1400b6a90
test eax, eax
je 0x140089eca
mov rcx, qword [rdi + 0x298]
add rcx, 0x1eb0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089eca
mov rcx, qword [rdi + 0x298]
add rcx, 0x1eb0
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x728
cmp byte [rcx], 0
je 0x140089f36
test ebx, ebx
je 0x140089ef2
lea rdx, str.svrltwp.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089f36
mov rcx, qword [rdi + 0x298]
add rcx, 0x728
call fcn.1400b6a90
test eax, eax
je 0x140089f36
mov rcx, qword [rdi + 0x298]
add rcx, 0x728
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089f36
mov rcx, qword [rdi + 0x298]
add rcx, 0x728
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x82c
cmp byte [rcx], 0
je 0x140089fa2
test ebx, ebx
je 0x140089f5e
lea rdx, str.svrltwp.dll
call fcn.1400b3b50
test rax, rax
jne 0x140089fa2
mov rcx, qword [rdi + 0x298]
add rcx, 0x82c
call fcn.1400b6a90
test eax, eax
je 0x140089fa2
mov rcx, qword [rdi + 0x298]
add rcx, 0x82c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089fa2
mov rcx, qword [rdi + 0x298]
add rcx, 0x82c
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x199c
cmp byte [rcx], 0
je 0x140089feb
call fcn.1400b6a90
test eax, eax
je 0x140089feb
mov rcx, qword [rdi + 0x298]
add rcx, 0x199c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140089feb
mov rcx, qword [rdi + 0x298]
add rcx, 0x199c
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1c8
cmp byte [rcx], 0
je 0x14008a030
call fcn.1400b6a90
test eax, eax
je 0x14008a030
mov rcx, qword [rdi + 0x298]
add rcx, 0x1c8
xor edx, edx
call fcn.1400b8880
mov rcx, qword [rdi + 0x298]
add rcx, 0x1c8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rdi + 0x298]
add rcx, 0x56ac
cmp byte [rcx], 0
je 0x14008a079
call fcn.1400b6a90
test eax, eax
je 0x14008a079
mov rcx, qword [rdi + 0x298]
add rcx, 0x56ac
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14008a079
mov rcx, qword [rdi + 0x298]
add rcx, 0x56ac
xor edx, edx
call fcn.1400b8880
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x30]
call fcn.1400b3390
lea rdi, [rsp + 0x30]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [0x140167250]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x14008a0b0
cmp byte [rsp + 0x30], al
je 0x14008a0eb
lea rcx, [rsp + 0x30]
call fcn.1400b6a90
test eax, eax
je 0x14008a0eb
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b8880
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x30]
call fcn.140092fa0
cmp byte [rsp + 0x30], 0
je 0x14008a122
lea rcx, [rsp + 0x30]
call fcn.1400b6a90
test eax, eax
je 0x14008a122
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b8880
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret