Function at 0x14002b5e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x14002b627
test byte [rcx + 0x1c], 4
je 0x14002b627
cmp byte [rcx + 0x19], 5
jb 0x14002b627
mov rcx, qword [rcx + 0x10]
lea r8, [0x140082b80]
mov edx, 0x14
call fcn.140001024
lea rcx, [0x1400980f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002b66c
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002b7ed
lea rcx, [0x140098008]
call fcn.14003414c
jmp case.default.0x14002b7ed
cmp eax, 2
jne 0x14002b6db
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002b7ed
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne case.default.0x14002b7ed
mov rax, qword [str.___t_]
cmp rax, r14
je case.default.0x14002b7ed
test byte [rax + 0x1c], 4
je case.default.0x14002b7ed
cmp byte [rax + 0x19], 2
jb case.default.0x14002b7ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001048
jmp case.default.0x14002b7ed
cmp eax, 3
jne case.default.0x14002b7ed
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002b72f
mov rax, qword [str.___t_]
cmp rax, r14
je 0x14002b72f
test byte [rax + 0x1c], 4
je 0x14002b72f
cmp byte [rax + 0x19], 2
jb 0x14002b72f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001048
cmp dword [rbx + 0x660], 0
je 0x14002b78a
cmp dword [rbx + 0x65c], 0
je 0x14002b793
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002b78a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14002b78a
test byte [rcx + 0x1c], 4
je 0x14002b78a
cmp byte [rcx + 0x19], 2
jb 0x14002b78a
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140082b80]
call fcn.1400012fc
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002b7ed
cmp qword [rbx + 0x668], 0
je case.default.0x14002b7ed
lea rcx, [0x140098180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003c0b8
lea rcx, [0x140098180]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.1400634d4
lea rcx, [0x1400980f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
invalid
cld
insb byte [rdi], dx
pop rbp
imul ebp, edi, 0x25fdf614
adc al, 0xf6
std
and eax, 0xf3b7b505
sbb ah, al
adc al, 0xf6
std
and eax, 0xf3b7b505
sbb ah, al
adc dword [rdi + 0x25], esp
invalid
test al, 0x29
invalid
and eax, 0xc64229a8
push rdx
jg 0x140113a11
mov bh, 0xb6
jbe 0x1401139ef
mov dh, 0xd4
cmp byte [rdi - 0x78ec99e5], cl
pop rbp
repe cmpsb byte [rsi], byte [rdi]
mov ecx, 0x309caf06
invalid
scasd eax, dword [rdi]
pushfq
xor byte [rbx], bl
sub ch, byte [0x1a81b6c83]
sub edx, dword [rax]
invalid
invalid