Function at 0x140017b20
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov rcx, r8
call fcn.140004c80
mov rcx, r15
call fcn.140002a60
test al, al
jne 0x140017da6
mov rcx, rdi
call fcn.140002a60
test al, al
jne 0x140017da6
xor r14d, r14d
cmp byte [rdi + 0x38], r14b
jne 0x140017c69
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.14001ac00
nop
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], ax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.1400082d0
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 1], rax
mov byte [rbp + 7], r14b
mov rcx, qword [rbp - 0x39]
test rcx, rcx
jne 0x140017bda
xor bl, bl
jmp 0x140017bf6
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x140017bf0
xor bl, bl
jmp 0x140017bf6
mov byte [rbp - 0x31], 1
mov bl, 1
mov byte [rbp + 7], bl
mov byte [rbp - 0x49], 0
lea r8, [rdi + 0x20]
lea r9, [rbp - 0x49]
mov rdx, rdi
call fcn.140019ca0
test al, al
jne 0x140017c28
cmp byte [rbp - 0x49], al
je 0x140017c28
mov rcx, rdi
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test bl, bl
je 0x140017c3f
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140017c3b
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x31], 0
mov qword [rbp - 1], r14
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140017c56
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x39], r14
mov word [rbp - 0x31], 0
lea rcx, [rbp - 0x29]
call fcn.140002b70
mov byte [rdi + 0x38], 1
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x28]
cmp rcx, rax
je 0x140017da6
mov esi, r14d
sub rax, rcx
sar rax, 7
test rax, rax
je 0x140017dbf
mov rbx, r14
shl rbx, 7
add rbx, rcx
mov rcx, rbx
call fcn.140002a6c
mov rdx, rax
mov rcx, r15
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140017cd4
inc esi
mov rcx, qword [rdi + 0x20]
mov ebx, esi
mov rax, qword [rdi + 0x28]
sub rax, rcx
sar rax, 7
cmp rbx, rax
jb 0x140017c90
jmp 0x140017dbf
mov rcx, r15
call fcn.140002a60
test al, al
jne 0x140017da6
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
lea r8, [rbp - 0x29]
call fcn.140008190
test al, al
je 0x140017da6
mov edx, dword [rbp - 0x21]
shl rdx, 0x20
mov eax, dword [rbp - 0x25]
add rdx, rax
mov r8d, dword [rbp - 0x11]
shl r8, 0x20
mov eax, dword [rbp - 0x15]
add r8, rax
mov ecx, dword [rbp - 0xd]
shl rcx, 0x20
mov eax, dword [rbp - 9]
add rcx, rax
cmp qword [rbx + 0x60], rcx
jne 0x140017da6
cmp qword [rbx + 0x68], r8
jne 0x140017da6
cmp qword [rbx + 0x70], rdx
jne 0x140017da6
cmp byte [rdi + 0x39], 0
je 0x140017daf
lea rcx, [rbx + 0x40]
call fcn.140002a60
test al, al
jne 0x140017da6
lea rcx, [rbp - 1]
call fcn.140002d0c
nop
lea r8, [rbp - 1]
mov rdx, r15
call fcn.14001b010
test al, al
jne 0x140017d7a
lea rcx, [rbp - 1]
call fcn.140004c80
lea rcx, [rbx + 0x40]
call fcn.140002a6c
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop
lea rcx, [rbp - 1]
test eax, eax
je 0x140017daa
call fcn.140002b70
xor eax, eax
jmp 0x140017dc2
call fcn.140002b70
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.140002afc
mov r14d, dword [rbx + 0x78]
mov eax, r14d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret