Function at 0x140037460
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, edx
mov rdi, rcx
mov ebp, 1
mov rcx, qword [str.___t_]
lea r15, str.___t_
mov r13b, 4
cmp rcx, r15
je 0x1400374bc
test byte [rcx + 0x1c], r13b
je 0x1400374bc
cmp byte [rcx + 0x19], 5
jb 0x1400374bc
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x72]
lea r8, [0x1400836a8]
call fcn.140001024
mov rcx, qword [rdi + 0x198]
test rcx, rcx
je 0x140037503
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x140037503
mov rcx, qword [str.___t_]
cmp rcx, r15
je 0x140037525
test byte [rcx + 0x1c], r13b
je 0x140037525
cmp byte [rcx + 0x19], 2
jb 0x140037525
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400836a8]
call fcn.140001048
jmp 0x140037525
mov rcx, rdi
call fcn.14003723c
lea r14d, [rax + 0x678]
mov ecx, r14d
mov ebx, r14d
call fcn.140063430
mov rsi, rax
test rax, rax
jne 0x14003752c
xor eax, eax
jmp 0x140037b4c
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov ebx, 0x678
lea r8, [rdi + 0x498]
mov dword [rsi], ebx
lea rcx, [rsi + 0x470]
mov rax, qword [rdi + 0x10]
mov edx, 0x100
mov qword [rsi + 8], rax
mov rax, qword [rdi + 0x18]
mov qword [rsi + 0x10], rax
mov rax, qword [rdi + 0x1a0]
mov qword [rsi + 0x180], rax
mov rax, qword [rdi + 0x1a8]
mov qword [rsi + 0x188], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x18], eax
mov eax, dword [rdi + 0x734]
mov dword [rsi + 0x28], eax
mov eax, dword [rdi + 0x698]
mov dword [rsi + 0x670], eax
mov qword [rsp + 0x70], rbx
call fcn.140002a68
test eax, eax
jns 0x1400375df
mov rcx, qword [str.___t_]
cmp rcx, r15
je 0x1400375d8
test byte [rcx + 0x1c], r13b
je 0x1400375d8
cmp byte [rcx + 0x19], 2
jb 0x1400375d8
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400836a8]
mov r9d, eax
call fcn.140001048
xor ebp, ebp
jmp 0x140037b42
lea r8, [rdi + 0x288]
mov edx, 0x100
lea rcx, [rsi + 0x22c]
call fcn.140002a68
test eax, eax
jns 0x14003761a
mov rcx, qword [str.___t_]
cmp rcx, r15
je 0x1400375d8
test byte [rcx + 0x1c], r13b
je 0x1400375d8
cmp byte [rcx + 0x19], 2
jb 0x1400375d8
mov edx, 0x76
jmp 0x1400375c5
mov eax, dword [rdi + 0x40]
mov dword [rsi + 0x2c], eax
mov eax, dword [rdi + 0xe8]
mov dword [rsi + 0xc0], eax
mov eax, dword [rdi + 0x17c]
mov dword [rsi + 0x154], eax
mov eax, dword [rdi + 0x178]
mov dword [rsi + 0x150], eax
mov eax, dword [rdi + 0x184]
mov dword [rsi + 0x158], eax
cmp dword [rdi + 0x24], 2
jne 0x140037668
mov rax, qword [rdi + 0x248]
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x220], rcx
mov eax, dword [rdi + 0x250]
mov dword [rsi + 0x228], eax
mov rax, qword [rdi + 0x488]
mov qword [rsi + 0x460], rax
mov rax, qword [rdi + 0x490]
mov qword [rsi + 0x468], rax
mov rcx, qword [rdi + 0x198]
test rcx, rcx
je 0x1400376cd
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov qword [rsi + 0x178], rbx
lea rcx, [rsi + 0x678]
mov rdx, qword [rdi + 0x198]
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rax, [rbx + 0x678]
mov qword [rsp + 0x70], rax
mov rcx, qword [rdi + 0x1b8]
lea rdx, [rsi + 0x190]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r14d
mov r8, rsi
call fcn.140064af4
xor eax, eax
mov dword [rsp + 0x20], r14d
mov qword [rsi + 0x450], rax
lea r9, [rsp + 0x70]
mov qword [rsi + 0x458], rax
lea rdx, [rsi + 0x20]
mov rcx, qword [rdi + 0x38]
mov r8, rsi
call fcn.140064af4
cmp dword [rdi + 0x24], 0x20
je 0x140037723
cmp dword [rdi + 0x24], 8
jne 0x14003773d
mov rcx, qword [rdi + 0x48]
lea rdx, [rsi + 0x30]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r14d
mov r8, rsi
call fcn.140064af4
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], r14d
lea rcx, [rdi + 0x50]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.140036c20
test eax, eax
jne 0x1400377a5
lea ebp, [rax + 0x7a]
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037b42
test byte [rcx + 0x1c], r13b
je 0x140037b42
cmp byte [rcx + 0x19], 2
jb 0x140037b42
lea edx, [rax + 0x77]
mov r9d, dword [rdi + 0x20]
lea r8, [0x1400836a8]
mov rcx, qword [rcx + 0x10]
call fcn.140001048
jmp 0x140037b42
lea rdx, [rsi + 0x98]
mov dword [rsp + 0x20], r14d
lea rcx, [rdi + 0xb0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.140036ccc
test eax, eax
jne 0x1400377fc
lea ebp, [rax + 0x7a]
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037b42
test byte [rcx + 0x1c], r13b
je 0x140037b42
cmp byte [rcx + 0x19], 2
jb 0x140037b42
lea edx, [rax + 0x78]
jmp 0x14003778c
lea rdx, [rsi + 0xc8]
mov dword [rsp + 0x20], r14d
lea rcx, [rdi + 0xf0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.140036d78
test eax, eax
jne 0x140037856
lea ebp, [rax + 0x7a]
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037b42
test byte [rcx + 0x1c], r13b
je 0x140037b42
cmp byte [rcx + 0x19], 2
jb 0x140037b42
lea edx, [rax + 0x79]
jmp 0x14003778c
mov rcx, qword [rdi + 0x190]
lea rdx, [rsi + 0x170]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r14d
mov r8, rsi
call fcn.140064af4
lea rdx, [rsi + 0x198]
mov dword [rsp + 0x20], r14d
lea rcx, [rdi + 0x1c0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.140036d78
test eax, eax
jne 0x1400378cf
lea ebp, [rax + 0x7a]
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037b42
test byte [rcx + 0x1c], r13b
je 0x140037b42
cmp byte [rcx + 0x19], 2
jb 0x140037b42
mov edx, ebp
jmp 0x14003778c
cmp dword [rdi + 0x24], 8
jne 0x140037946
mov r9d, r14d
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rdi
call fcn.140036f44
mov ebp, eax
test eax, eax
jne 0x140037946
mov rax, qword [str.___t_]
lea r14, str.___t_
cmp rax, r14
je 0x140037b42
test byte [rax + 0x1c], r13b
je 0x140037b42
cmp byte [rax + 0x19], 2
jb 0x140037b42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea edx, [rbp + 0x7b]
mov r9d, dword [rdi + 0x20]
lea r8, [0x1400836a8]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.140001378
jmp 0x140037b42
mov rcx, qword [rdi + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 0x80000080
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call fcn.140065c60
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400379c0
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x1400375d8
test byte [rcx + 0x1c], r13b
je 0x1400375d8
cmp byte [rcx + 0x19], 2
jb 0x1400375d8
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x7d]
mov rax, qword [rdi + 0x38]
lea r8, [0x1400836a8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.140001084
jmp 0x1400375d8
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.14003ce68
test eax, eax
je 0x140037af2
test r12d, r12d
je 0x140037aa9
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037a24
test byte [rcx + 0x1c], r13b
je 0x140037a24
cmp byte [rcx + 0x19], 2
jb 0x140037a24
mov r9d, dword [rdi + 0x20]
lea r8, [0x1400836a8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x7d
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14002bf08
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140037a6b
mov rax, qword [str.___t_]
cmp rax, r14
je 0x140037a6b
test byte [rax + 0x1c], r13b
je 0x140037a6b
cmp byte [rax + 0x19], 2
jb 0x140037a6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
mov r9, qword [rsi + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140033e98
mov rcx, qword [rdi + 0x38]
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140037aee
mov rax, qword [str.___t_]
cmp rax, r14
je 0x140037aee
test byte [rax + 0x1c], r13b
je 0x140037aee
cmp byte [rax + 0x19], 2
jb 0x140037aee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
mov edx, 0x7f
jmp 0x140037acd
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037aee
test byte [rcx + 0x1c], r13b
je 0x140037aee
cmp byte [rcx + 0x19], 2
jb 0x140037aee
mov edx, 0x80
mov r9d, dword [rdi + 0x20]
lea r8, [0x1400836a8]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14002bf08
xor ebp, ebp
jmp 0x140037b33
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x140037b33
test byte [rcx + 0x1c], r13b
je 0x140037b33
cmp byte [rcx + 0x19], 5
jb 0x140037b33
mov rax, qword [rdi + 0x38]
lea r8, [0x1400836a8]
mov r9d, dword [rdi + 0x20]
mov edx, 0x81
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.140001084
cmp rbx, 0xffffffffffffffff
je 0x140037b42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.1400634d4
mov eax, ebp
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret