Function at 0x1401954b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
mov qword [rbp + 0x1f], rcx
mov ebx, r15d
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], rbx
movzx r14d, r8b
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
jne 0x14019550d
mov eax, 0x80040007
mov dword [rbp + 0x17], eax
jmp 0x140195654
mov rax, qword [rcx]
lea r8, [rbp + 7]
xor edx, edx
call qword [rax + 0x28]
mov dword [rbp + 0x17], eax
test eax, eax
js 0x140195650
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140195533
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
xor eax, eax
mov qword [rbp + 0xf], r15
mov word [rbp - 0x19], 1
mov word [rbp - 0x11], bx
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], r15
mov dword [rbp - 1], r15d
mov dword [rbp - 0x15], r15d
mov dword [rbp - 0xd], r15d
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x14019558b
mov rcx, qword [rbp + 7]
lea r8, [rbp + 0xf]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + reloc.SHELL32.dll_ILFindChild]
test eax, eax
jne 0x14019558b
lea rcx, [rbp - 0x29]
call fcn.140194de0
mov dword [rbp + 0x17], eax
test eax, eax
js 0x140195650
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x1401955a5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
xor eax, eax
mov qword [rbp + 0xf], r15
mov word [rbp - 0x19], 1
mov word [rbp - 0x11], bx
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], r15
mov dword [rbp - 1], r15d
mov dword [rbp - 0x15], r15d
mov dword [rbp - 0xd], r15d
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140195647
nop dword [rax]
mov rcx, qword [rbp + 7]
lea r8, [rbp + 0xf]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + reloc.SHELL32.dll_ILFindChild]
mov edi, eax
test eax, eax
jne 0x140195647
mov rcx, qword [rbp + 0xf]
lea rdx, [rbp + 0x27]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov edi, eax
test eax, eax
js 0x140195622
mov rax, qword [rbp + 0x27]
cmp rax, qword [rsi]
jne 0x140195622
mov rax, qword [rbp + 0x2f]
cmp rax, qword [rsi + 8]
je 0x14019563c
mov rcx, qword [rbp + 0xf]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, r15
mov qword [rbp + 0xf], rbx
test edi, edi
je 0x1401955e0
mov eax, dword [rbp + 0x17]
jmp 0x140195656
lea rcx, [rbp - 0x29]
call fcn.140194de0
mov edi, eax
mov rbx, qword [rbp + 0xf]
mov eax, dword [rbp + 0x17]
jmp 0x140195656
mov rbx, qword [rbp + 0xf]
mov edi, eax
test edi, edi
jne 0x140195730
test eax, eax
jns 0x140195667
mov rbx, r15
jmp 0x140195675
test rbx, rbx
je 0x140195675
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbx
mov rax, qword [rbx]
cmp byte [rbp - 0x10], r15b
je 0x140195686
call qword [rax + SHCreateStdEnumFmtEtc]
jmp 0x140195689
call qword [rax + 0x40]
mov edi, eax
test r14b, r14b
je 0x140195723
cmp dword [rbp + 0x17], r15d
jl 0x140195723
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140195723
mov qword [rbp - 0x31], r15
lea rdx, [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jne 0x140195714
nop dword [rax]
mov rcx, qword [rbp - 0x31]
lea r8, [rbp - 0x39]
xor r9d, r9d
mov qword [rbp - 0x39], r15
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + reloc.SHELL32.dll_ILFindChild]
mov esi, eax
test eax, eax
jne 0x140195701
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp + 0x27]
mov qword [rbp + 0x27], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
mov esi, eax
test eax, eax
js 0x140195701
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140195710
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
je 0x1401956c0
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140195723
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rbx, qword [rbp + 0xf]
test rbx, rbx
je 0x14019573e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rbp + 7]
mov qword [rbp + 0xf], r15
test rcx, rcx
je 0x140195751
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14039bbb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret