Function at 0x10002a2b8
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
xor edi, edi
xor r15d, r15d
mov qword [r11 - 0x70], r15
xor r12d, r12d
mov qword [r11 - 0x68], r12
xor r13d, r13d
mov qword [r11 - 0x60], r13
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor ebp, ebp
mov qword [r11 - 0x78], rbp
mov rax, qword [rcx + 0x1c8]
test rax, rax
jne 0x10002a36a
lea rax, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rcx, rax
je 0x10002a773
test byte [rcx + 0x1c], 1
je 0x10002a773
cmp byte [rcx + 0x19], 4
jb 0x10002a773
mov edx, 0x145
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
jmp 0x10002a773
xor r14d, r14d
mov dword [rsp + 0x38], r14d
cmp dword [rax + 8], ebx
jbe 0x10002a773
test rbp, rbp
je 0x10002a38f
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, r14d
mov rcx, qword [rsi + 0x1c8]
call fcn.10012bb20
mov edi, eax
lea rbp, [0x1001653b8]
test eax, eax
js 0x10002a6f7
cmp qword [rsi + 0x1d8], 0
jne 0x10002a3db
lea r8, [0x100004b40]
mov edx, 0x1977
lea rcx, [0x1000046e0]
call fcn.100099ad8
test byte [rsi + 0x150], 4
je 0x10002a471
test r15, r15
je 0x10002a3fc
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsi + 0x1d8]
call fcn.100120a08
mov edi, eax
test eax, eax
js 0x10002a68b
test r12, r12
je 0x10002a43a
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov rcx, r15
call fcn.10010bcc8
mov edi, eax
test eax, eax
js 0x10002a684
mov r12, qword [rsp + 0x50]
test r12, r12
je 0x10002a471
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10002a633
test r13, r13
je 0x10002a485
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120a08
mov edi, eax
test eax, eax
js 0x10002a6dd
test rbx, rbx
je 0x10002a4c8
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x30], 0
mov r13, qword [rsp + 0x58]
test byte [rsi + 0x150], 1
je 0x10002a4f2
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10009b4ec
mov edi, eax
test eax, eax
js 0x10002a6cf
jmp 0x10002a521
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9b, 1
lea r8, [rsp + 0x70]
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120a08
mov edi, eax
test eax, eax
js 0x10002a6cf
mov rbp, qword [rsp + 0x40]
mov r9, rbp
mov r8d, dword [rsi + 0x14c]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r13
call fcn.10010b3bc
mov edi, eax
test eax, eax
js 0x10002a6c6
test byte [rsi + 0x150], 0x80
je 0x10002a615
cmp byte [rsi + 0x11c], 0
je 0x10002a615
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x68], rax
test rax, rax
je 0x10002a585
mov rcx, rax
call fcn.100043fcc
mov rbx, rax
jmp 0x10002a587
xor ebx, ebx
mov rdx, r13
mov rcx, rbx
call fcn.10001ec50
mov edi, eax
test eax, eax
js 0x10002a69d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rdx, rbp
mov rcx, rbx
call fcn.10001ef7c
mov edi, eax
test eax, eax
js 0x10002a69d
mov r14, qword [rsi + 0x310]
cmp r14, qword [rsi + 0x318]
jb 0x10002a5ec
lea rdx, [r14 + 1]
lea rcx, [rsi + 0x308]
call fcn.100043a28
test al, al
je 0x10002a692
mov rax, qword [rsi + 0x308]
lea rcx, [rax + r14*8]
test rcx, rcx
je 0x10002a5ff
mov qword [rcx], rbx
inc qword [rsi + 0x310]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x38]
inc r14d
mov dword [rsp + 0x38], r14d
mov rax, qword [rsi + 0x1c8]
cmp r14d, dword [rax + 8]
jae 0x10002a6bd
jmp 0x10002a37b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002a66f
test byte [rcx + 0x1c], 1
je 0x10002a66f
cmp byte [rcx + 0x19], 2
jb 0x10002a66f
mov edx, 0x146
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
mov rbx, qword [rsp + 0x30]
jmp 0x10002a6f7
mov r12, qword [rsp + 0x50]
jmp 0x10002a6f7
mov r15, qword [rsp + 0x48]
jmp 0x10002a6f7
mov ecx, 0x8007000e
call fcn.100019658
int3
test rbx, rbx
je 0x10002a6eb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
jmp 0x10002a6f7
lea rbp, [0x1001653b8]
jmp 0x10002a6f7
lea rbp, [0x1001653b8]
jmp 0x10002a6f7
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
jmp 0x10002a6f7
mov r13, qword [rsp + 0x58]
lea rbp, [0x1001653b8]
jmp 0x10002a6f7
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10002a707
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x10002a715
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x10002a723
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x10002a731
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x10002a73f
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jns 0x10002a773
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002a773
test byte [rcx + 0x1c], 1
je 0x10002a773
cmp byte [rcx + 0x19], 2
jb 0x10002a773
mov edx, 0x147
mov r9d, edi
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret