Function at 0x180070da0
Capabilities:
Delete file
Terminate process

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, rcx
xor esi, esi
lea rbp, [rcx + 0x150]
mov rcx, rbp
call fcn.1800875f0
lea r12, [0x1800c9a10]
test eax, eax
je 0x180070fb7
cmp byte [rdi + 0x2c2], sil
je 0x180070df7
mov rcx, rbp
call fcn.180082204
xor eax, eax
jmp 0x18007105b
mov rdx, qword [rdi + 0x280]
test rdx, rdx
je 0x180070e5c
mov rcx, rbp
call fcn.180082430
mov esi, eax
test eax, eax
jns 0x180070e42
mov rcx, qword [0x1800c9a10]
cmp rcx, r12
je 0x180070e42
test byte [rcx + 0x1c], 1
je 0x180070e42
cmp byte [rcx + 0x19], 2
jb 0x180070e42
mov edx, 0x21
mov r9d, eax
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001560
nop
mov rcx, qword [rdi + 0x280]
test rcx, rcx
je 0x180070e5c
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rdi + 0x280], 0
mov byte [rsp + 0x60], 1
call fcn.180001d84
mov rcx, rax
test rax, rax
je 0x18007106e
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
cmp byte [rdi + 0x2c1], 0
je 0x180070f2b
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180071268
lea rdx, [0x1800cc3c0]
lea rcx, [rsp + 0x28]
call fcn.180082c88
cmp qword [0x1800cc430], 0
je 0x180070f10
mov byte [rdi + 0x2c2], 1
mov rcx, qword [0x1800cc430]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov esi, eax
mov byte [rdi + 0x2c2], 0
test eax, eax
jns 0x180070f10
mov rcx, qword [0x1800c9a10]
cmp rcx, r12
je 0x180070f10
test byte [rcx + 0x1c], 1
je 0x180070f10
cmp byte [rcx + 0x19], 2
jb 0x180070f10
mov edx, 0x22
mov r9d, eax
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001560
lea rax, [0x1800ad540]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.180082c10
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call fcn.180082204
cmp byte [rdi + 0x2c1], 0
je 0x180070f9c
cmp byte [rsp + 0x60], 0
je 0x180070f9c
cmp dword [rbx - 0x10], 0
je 0x180070f9c
mov rdx, rbx
mov rcx, rdi
call fcn.18006e6e0
mov esi, eax
cmp byte [rdi + 0x2c4], 0
je 0x180070f9c
test eax, eax
je 0x180070f9c
mov rcx, qword [0x1800c9a10]
cmp rcx, r12
je 0x180070f93
test byte [rcx + 0x1c], 1
je 0x180070f93
cmp byte [rcx + 0x19], 3
jb 0x180070f93
mov edx, 0x23
mov r9d, eax
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001560
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180070fb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rdi + 0x78]
call fcn.180080318
cmp byte [rdi + 0x2c3], 0
je 0x180071059
mov rcx, qword [0x1800c9a10]
cmp rcx, r12
je 0x180070ffa
test byte [rcx + 0x1c], 1
je 0x180070ffa
cmp byte [rcx + 0x19], 2
jb 0x180070ffa
mov edx, 0x24
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001ae4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x40010004
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x180071059
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1800c9a10]
cmp rcx, r12
je 0x18007104a
test byte [rcx + 0x1c], 1
je 0x18007104a
cmp byte [rcx + 0x19], 2
jb 0x18007104a
mov edx, 0x25
mov r9d, eax
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001560
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x18007105b
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.180001b3c
int3