Function at 0x100104e8c
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xad0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0xac0], rax
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
mov dword [rsp + 0x40], ebx
xor r14d, r14d
mov word [rsp + 0x280], r14w
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x282]
call sub.msvcrt.dll_memset
mov word [rsp + 0x70], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov word [rsp + 0x490], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x492]
call sub.msvcrt.dll_memset
mov word [rsp + 0x8b0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x8b2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x6a0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x6a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x50], r14d
cmp ebx, dword [rbp + 0xa8]
jne 0x100104f76
lea edi, [r14 + 1]
mov ebx, edi
jmp 0x100105747
cmp dword [rbp + 0xa8], r14d
jne 0x100104fea
xor r9d, r9d
lea r8, [rbp + 0xa8]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000fc750
cmp eax, r14d
jne 0x100104fea
mov r9d, dword [rsp + 0x40]
cmp r9d, dword [rbp + 0xa8]
jne 0x100104fea
mov edi, 1
mov ebx, edi
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x100105747
test byte [rcx + 0x1c], 4
je 0x100105747
lea edx, [rdi + 0x6c]
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x100105747
mov qword [rsp + 0x20], r12
lea r9, [0x100026d38]
lea r8, [0x100026f90]
mov esi, 0x104
mov rdx, rsi
lea rcx, [rsp + 0x8b0]
call fcn.1000f1d78
mov ebx, eax
mov edi, 1
cmp eax, r14d
jge 0x10010505a
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
lea edx, [rdi + 0x6d]
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
lea r9, [rsp + 0x44]
lea r8, [0x1000278a0]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000f48d8
cmp eax, r14d
jne 0x1001050c2
cmp dword [rsp + 0x44], edi
jne 0x1001050c2
mov ebx, edi
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x100105747
test byte [rcx + 0x1c], 4
je 0x100105747
mov edx, 0x6f
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
jmp 0x100105747
mov r9, r12
lea r8, [0x100027380]
mov rdx, rsi
lea rcx, [rsp + 0x6a0]
call fcn.1000f1d78
mov ebx, eax
cmp eax, r14d
jge 0x100105121
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x70
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x40]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000fc750
cmp eax, r14d
je 0x10010518e
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x71
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x490]
lea r8, [0x1000278d0]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000f451c
cmp eax, r14d
je 0x100105221
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x1000278f0]
mov rdx, rsi
lea rcx, [rsp + 0x490]
call fcn.1000f1d78
mov ebx, eax
cmp eax, r14d
jge 0x100105221
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x72
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
mov rdx, rsi
lea rcx, [rsp + 0x70]
mov ebx, r14d
lea r8, [rsp + 0x280]
lea rax, [rsp + 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r14
je 0x10010525f
movzx eax, word [rcx + r8]
cmp ax, r14w
je 0x10010525f
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x10010523c
cmp rdx, r14
jne 0x10010526d
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x1001052b4
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x73
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [rsp + rcx*2 + 0x70]
lea rax, [rsp + 0x70]
cmp rdx, rax
jbe 0x1001052f9
sub rdx, 2
cmp word [rdx], 0x5c
je 0x1001052f3
cmp word [rdx], 0x2f
je 0x1001052f3
cmp word [rdx], 0x3a
je 0x1001052f3
lea rax, [rsp + 0x70]
cmp rdx, rax
ja 0x1001052d1
jmp 0x1001052f9
mov word [rdx], r14w
jmp 0x1001052fd
sub rdx, 2
mov eax, r14d
lea rcx, [rsp + 0x70]
cmp rdx, rcx
setne al
cmp eax, r14d
jne 0x100105355
mov ebx, 0x80004005
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x100105704
test byte [rcx + 0x1c], dil
je 0x100105704
mov edx, 0x74
lea r9, [rsp + 0x70]
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.1000347a8
jmp 0x100105704
lea rdx, [0x100027100]
lea rcx, [rsp + 0x70]
call fcn.1000f609c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x490]
mov rcx, qword [rbp + 0x90]
call fcn.1000f9bb0
mov ebx, eax
cmp eax, r14d
jge 0x1001053d4
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x75
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
mov rax, qword [rbp + 0x90]
mov r9d, dword [rax + 0x340]
cmp r9d, 0xc8
je 0x100105423
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x100105419
test byte [rcx + 0x1c], dil
je 0x100105419
mov edx, 0x76
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov ebx, 0x80004005
jmp 0x100105704
mov rcx, qword [rax + 0x348]
mov r8d, dword [rax + 0x350]
cmp rcx, r14
je 0x1001056cc
cmp r8d, r14d
je 0x1001056cc
cmp dword [rcx], 0x434d5153
je 0x100105483
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x100105479
test byte [rcx + 0x1c], dil
je 0x100105479
mov edx, 0x78
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov ebx, 0x10000a0b
jmp 0x100105747
lea r11d, [r8 - 0x10]
mov r9d, r11d
mov edx, r14d
lea r10, [rcx + 0x10]
cmp r11d, r14d
jbe 0x1001054aa
dec r9d
imul edx, edx, 0x65
movzx eax, byte [r10]
add edx, eax
add r10, rdi
cmp r9d, r14d
ja 0x100105496
cmp dword [rcx + 8], edx
je 0x1001054e7
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001054dd
test byte [rcx + 0x1c], dil
je 0x1001054dd
mov edx, 0x79
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov ebx, 0x10000a0b
jmp 0x100105747
cmp dword [rcx + 4], r8d
je 0x100105525
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x10010551b
test byte [rcx + 0x1c], dil
je 0x10010551b
mov edx, 0x7a
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov ebx, 0x10000a0b
jmp 0x100105747
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r11d
lea r8, [rcx + 0x10]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.100106698
mov ebx, eax
cmp eax, r14d
jl 0x100105704
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [0x100027420]
xor r8d, r8d
lea rdx, [rsp + 0x6a0]
call fcn.1000f4a7c
cmp eax, r14d
je 0x1001055d8
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x7b
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
lea rcx, [rbp + 0xb0]
mov ebx, r14d
lea rdx, [rsp + 0x280]
sub rdx, rcx
lea rax, [rsi + 0x7ffffefa]
cmp rax, r14
je 0x10010560f
movzx eax, word [rcx + rdx]
cmp ax, r14w
je 0x10010560f
mov word [rcx], ax
add rcx, 2
sub rsi, rdi
jne 0x1001055ed
cmp rsi, r14
jne 0x10010561d
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x100105664
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056ff
test byte [rcx + 0x1c], dil
je 0x1001056ff
mov edx, 0x7c
mov r9d, ebx
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1001056ff
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056bd
test byte [rcx + 0x1c], 4
je 0x1001056bd
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax + 0x350]
mov edx, 0x7d
mov dword [rsp + 0x30], r8d
lea rax, [rsp + 0x490]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.1000dd114
mov eax, dword [rsp + 0x40]
mov dword [rbp + 0xa8], eax
mov ebx, r14d
jmp 0x100105747
lea rax, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rax
je 0x1001056fa
test byte [rcx + 0x1c], dil
je 0x1001056fa
mov edx, 0x77
lea r8, [0x10001dad0]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov ebx, 0x80004005
cmp ebx, r14d
jge 0x100105747
cmp word [rsp + 0x6a0], r14w
je 0x100105738
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
lea r8, [0x100027420]
lea rdx, [rsp + 0x6a0]
call fcn.1000f4f4c
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1000f69f0
mov eax, ebx
mov rcx, qword [rsp + 0xac0]
xor rcx, rsp
call fcn.10011be80
add rsp, 0xad0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret