Function at 0x1c82c
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xf0
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
and dword [rsp + 0x48], 0
mov rsi, qword [0x00065e80]
xor eax, eax
test byte [0x00065e70], 4
mov dword [rsp + 0x4c], eax
mov edi, r8d
mov r13, rdx
je 0x1c888
mov eax, 0xc0000001
jmp 0x1cacc
mov ebx, edi
test edi, 0x1fff
je 0x1c89a
shr ebx, 0xd
inc ebx
shl ebx, 0xd
mov edx, ebx
xor ecx, ecx
mov ebp, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
test rax, rax
jne 0x1c8b8
mov eax, 0xc0000153
jmp 0x1cacc
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00028240
mov r8, rdi
mov rdx, r13
mov rcx, r12
call fcn.000283d0
and qword [rsp + 0x20], 0
lea rcx, [rsi + 0xfc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [rsi + 0xfa8]
lea rcx, [rsp + 0x58]
call qword [fcn.004e696c]
and qword [rsp + 0x70], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0x90], 0
lea rax, [rsp + 0x58]
mov rcx, rsi
mov dword [rsp + 0x68], 0x30
mov dword [rsp + 0x80], 0x240
mov qword [rsp + 0x78], rax
call fcn.0001b3b4
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov eax, 2
mov dword [rsp + 0x30], 0x68
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
lea r9d, [rax + 0x7e]
mov r8d, 0x40100000
mov dword [rsp + 0x20], eax
call fcn.0001549c
mov ebp, eax
test eax, eax
js 0x1c9d8
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x98]
mov r9d, ebx
mov r8, r12
call fcn.00015998
mov ebp, eax
test eax, eax
js 0x1c9cd
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x98]
mov r9d, 8
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rsi
call fcn.0001b458
test ebp, ebp
js 0x1cab0
mov rcx, rsi
call fcn.0001b3b4
mov rdx, qword [rsi + 0xfa8]
lea r8, [rsp + 0xa8]
mov rcx, rsi
call fcn.0001b4f0
mov rcx, rsi
mov ebx, eax
call fcn.0001b458
test ebx, ebx
js 0x1ca2f
lea rcx, [rsi + 0xf58]
lea rdx, [rsp + 0xa8]
mov r8d, 0x38
call fcn.000283d0
mov rcx, rsi
call fcn.0001b3b4
lea rcx, [rsi + 0xfa0]
lea rdx, [rsp + 0x50]
call fcn.00015530
mov rcx, rsi
mov ebp, eax
call fcn.0001b458
test ebp, ebp
js 0x1cab0
mov rcx, qword [rsi + 0xc18]
test rcx, rcx
je 0x1ca68
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdi, qword [rsp + 0x50]
lea rcx, [rsi + 0xc30]
mov qword [rsi + 0xc18], rdi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [rsi + 0xc18]
mov qword [rsi + 0xc98], rdx
lea rcx, [rsi + 0xc30]
mov dl, al
mov dword [rsi + 0xc88], 1
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.00015ee4
lea rcx, [rsi + 0xfc8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebp
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.000281c0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret