Function at 0x140039560
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, edx
mov rdi, rcx
mov r14d, 1
mov rcx, qword [str._0_n_]
lea rbx, str._0_n_
mov r12b, 4
cmp rcx, rbx
je 0x1400395be
test byte [rcx + 0x1c], r12b
je 0x1400395be
cmp byte [rcx + 0x19], 5
jb 0x1400395be
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x72]
lea r8, [0x140093fa8]
call fcn.14000459c
mov rcx, qword [rdi + 0x198]
xor ebp, ebp
test rcx, rcx
je 0x140039610
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
jne 0x140039610
mov rcx, qword [str._0_n_]
cmp rcx, rbx
je 0x140039632
test byte [rcx + 0x1c], r12b
je 0x140039632
lea ebp, [rax + 2]
cmp byte [rcx + 0x19], bpl
jb 0x140039632
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140093fa8]
call fcn.140004994
jmp 0x140039632
mov rcx, rdi
call fcn.1400390c4
lea r15d, [rax + 0x678]
mov ecx, r15d
mov ebx, r15d
call fcn.14006a264
mov rsi, rax
test rax, rax
jne 0x140039639
xor eax, eax
jmp 0x140039d13
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov eax, 0x678
lea rcx, [rsi + 0x470]
mov qword [rsp + 0x70], rax
mov r9, rdi
mov dword [rsi], eax
mov r8d, 0x100
mov rax, qword [rdi + 0x10]
sub r9, rcx
mov qword [rsi + 8], rax
mov edx, r8d
mov rax, qword [rdi + 0x18]
mov ebp, 2
mov qword [rsi + 0x10], rax
xor ebx, ebx
mov rax, qword [rdi + 0x1a0]
mov qword [rsi + 0x180], rax
mov rax, qword [rdi + 0x1a8]
mov qword [rsi + 0x188], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x18], eax
mov eax, dword [rdi + 0x734]
mov dword [rsi + 0x28], eax
mov eax, dword [rdi + 0x698]
mov dword [rsi + 0x670], eax
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x1400396db
movzx eax, word [r9 + rcx + 0x498]
test ax, ax
je 0x1400396db
mov word [rcx], ax
add rcx, rbp
sub rdx, r14
jne 0x1400396b6
test rdx, rdx
lea rax, [rcx - 2]
mov r10d, 0x8007007a
cmovne rax, rcx
mov word [rax], bx
mov rax, rdx
neg rax
sbb r9d, r9d
not r9d
and r9d, r10d
test rdx, rdx
jne 0x14003973f
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039737
test byte [rcx + 0x1c], r12b
je 0x140039737
cmp byte [rcx + 0x19], bpl
jb 0x140039737
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
lea r8, [0x140093fa8]
call fcn.1400045c8
mov r14d, ebx
jmp 0x140039d08
lea rcx, [rsi + 0x22c]
mov rdx, rdi
sub rdx, rcx
lea rax, [r8 + 0x7ffffefe]
test rax, rax
je 0x140039770
movzx eax, word [rdx + rcx + 0x288]
test ax, ax
je 0x140039770
mov word [rcx], ax
add rcx, rbp
sub r8, r14
jne 0x14003974c
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
mov rax, r8
neg rax
sbb r9d, r9d
not r9d
and r9d, r10d
test r8, r8
jne 0x1400397ba
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039737
test byte [rcx + 0x1c], r12b
je 0x140039737
cmp byte [rcx + 0x19], bpl
jb 0x140039737
lea edx, [r8 + 0x76]
jmp 0x140039727
mov eax, dword [rdi + 0x40]
mov dword [rsi + 0x2c], eax
mov eax, dword [rdi + 0xe8]
mov dword [rsi + 0xc0], eax
mov eax, dword [rdi + 0x17c]
mov dword [rsi + 0x154], eax
mov eax, dword [rdi + 0x178]
mov dword [rsi + 0x150], eax
mov eax, dword [rdi + 0x184]
mov dword [rsi + 0x158], eax
cmp dword [rdi + 0x24], ebp
jne 0x140039807
mov rax, qword [rdi + 0x248]
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x220], rcx
mov eax, dword [rdi + 0x250]
mov dword [rsi + 0x228], eax
mov rax, qword [rdi + 0x488]
mov qword [rsi + 0x460], rax
mov rax, qword [rdi + 0x490]
mov qword [rsi + 0x468], rax
mov rcx, qword [rdi + 0x198]
test rcx, rcx
je 0x140039876
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
mov qword [rsi + 0x178], 0x678
lea rcx, [rsi + 0x678]
mov rdx, qword [rdi + 0x198]
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rax, [rbx + 0x678]
mov qword [rsp + 0x70], rax
mov rcx, qword [rdi + 0x1b8]
lea rdx, [rsi + 0x190]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006bc9c
xorps xmm0, xmm0
mov dword [rsp + 0x20], r15d
movups xmmword [rsi + 0x450], xmm0
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x70]
mov r8, rsi
lea rdx, [rsi + 0x20]
call fcn.14006bc9c
cmp dword [rdi + 0x24], 0x20
je 0x1400398c6
cmp dword [rdi + 0x24], 8
jne 0x1400398e0
mov rcx, qword [rdi + 0x48]
lea rdx, [rsi + 0x30]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006bc9c
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0x50]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003bb24
test eax, eax
jne 0x140039949
lea r14d, [rax + 0x7a]
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039d08
test byte [rcx + 0x1c], r12b
je 0x140039d08
cmp byte [rcx + 0x19], bpl
jb 0x140039d08
lea edx, [rax + 0x77]
mov r9d, dword [rdi + 0x20]
lea r8, [0x140093fa8]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
jmp 0x140039d08
lea rdx, [rsi + 0x98]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0xb0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003a184
test eax, eax
jne 0x1400399a1
lea r14d, [rax + 0x7a]
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039d08
test byte [rcx + 0x1c], r12b
je 0x140039d08
cmp byte [rcx + 0x19], bpl
jb 0x140039d08
lea edx, [rax + 0x78]
jmp 0x140039930
lea rdx, [rsi + 0xc8]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0xf0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003cb74
test eax, eax
jne 0x1400399fc
lea r14d, [rax + 0x7a]
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039d08
test byte [rcx + 0x1c], r12b
je 0x140039d08
cmp byte [rcx + 0x19], bpl
jb 0x140039d08
lea edx, [rax + 0x79]
jmp 0x140039930
mov rcx, qword [rdi + 0x190]
lea rdx, [rsi + 0x170]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006bc9c
lea rdx, [rsi + 0x198]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0x1c0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003cb74
test eax, eax
jne 0x140039a77
lea r14d, [rax + 0x7a]
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039d08
test byte [rcx + 0x1c], r12b
je 0x140039d08
cmp byte [rcx + 0x19], bpl
jb 0x140039d08
mov edx, r14d
jmp 0x140039930
cmp dword [rdi + 0x24], 8
jne 0x140039af6
mov r9d, r15d
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rdi
call fcn.1400408d0
mov r14d, eax
test eax, eax
jne 0x140039af6
mov rax, qword [str._0_n_]
lea r13, str._0_n_
cmp rax, r13
je 0x140039d08
test byte [rax + 0x1c], r12b
je 0x140039d08
cmp byte [rax + 0x19], bpl
jb 0x140039d08
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea edx, [r14 + 0x7b]
mov r9d, dword [rdi + 0x20]
lea r8, [0x140093fa8]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.140023bdc
jmp 0x140039d08
mov rcx, qword [rdi + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 0x80000080
mov edx, 0x40000000
mov dword [rsp + 0x20], ebp
call fcn.14006c054
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140039b65
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039b5b
test byte [rcx + 0x1c], r12b
je 0x140039b5b
cmp byte [rcx + 0x19], bpl
jb 0x140039b5b
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x7d]
mov rax, qword [rdi + 0x38]
lea r8, [0x140093fa8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.14000c964
xor ebp, ebp
mov r14d, ebp
jmp 0x140039d08
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.1400392f0
xor r15d, r15d
test eax, eax
je 0x140039cb8
test r13d, r13d
je 0x140039c68
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039bcb
test byte [rcx + 0x1c], r12b
je 0x140039bcb
cmp byte [rcx + 0x19], bpl
jb 0x140039bcb
mov r9d, dword [rdi + 0x20]
lea edx, [r15 + 0x7d]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140093fa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14003794c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x140039c1e
mov rax, qword [str._0_n_]
cmp rax, r13
je 0x140039c1e
test byte [rax + 0x1c], r12b
je 0x140039c1e
cmp byte [rax + 0x19], bpl
jb 0x140039c1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
mov r9, qword [rsi + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400418c8
mov rcx, qword [rdi + 0x38]
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140039cad
mov rax, qword [str._0_n_]
cmp rax, r13
je 0x140039cad
test byte [rax + 0x1c], r12b
je 0x140039cad
cmp byte [rax + 0x19], bpl
jb 0x140039cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
mov edx, 0x7f
jmp 0x140039c8c
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039cad
test byte [rcx + 0x1c], r12b
je 0x140039cad
cmp byte [rcx + 0x19], bpl
jb 0x140039cad
mov edx, 0x80
mov r9d, dword [rdi + 0x20]
lea r8, [0x140093fa8]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14003794c
mov r14d, r15d
cmp rbx, 0xffffffffffffffff
je 0x140039d08
jmp 0x140039cf9
mov rcx, qword [str._0_n_]
lea r13, str._0_n_
cmp rcx, r13
je 0x140039cf9
test byte [rcx + 0x1c], r12b
je 0x140039cf9
cmp byte [rcx + 0x19], 5
jb 0x140039cf9
mov rax, qword [rdi + 0x38]
lea r8, [0x140093fa8]
mov r9d, dword [rdi + 0x20]
mov edx, 0x81
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.14000c964
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rsi
call fcn.14006a328
mov eax, r14d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret