Function at 0x10002a838
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rsi, rcx
xor r15d, r15d
mov r14, r15
mov qword [rax + 0x20], r15
mov rbp, r15
mov qword [rax + 8], r15
mov r13, r15
mov qword [rsp + 0x30], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rsp + 0x40], r15
mov qword [rax - 0x80], r15
mov qword [rax - 0x78], r15
mov dword [rax - 0x70], r15d
mov qword [rax - 0x68], r15
mov qword [rax - 0x60], r15
mov qword [rax - 0x58], r15
mov dword [rax - 0x50], r15d
cmp qword [rcx + 0x1d8], r15
jne 0x10002a8bd
lea r8, [0x100004ae0]
mov edx, 0x1a3a
lea rcx, [0x100004680]
call fcn.10009a050
lea r12, [0x1001653b8]
test byte [rsi + 0x150], 4
je 0x10002a9e6
lea r9, [rsp + 0xe8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsi + 0x1d8]
call fcn.100120d1c
mov ebx, eax
cmp eax, r15d
jl 0x10002a9d9
lea rdx, [rsp + 0xd0]
mov r14, qword [rsp + 0xe8]
mov rcx, r14
call fcn.10010c158
mov ebx, eax
cmp eax, r15d
jge 0x10002a96e
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002a961
test byte [rcx + 0x1c], 1
je 0x10002a961
cmp byte [rcx + 0x19], 2
jb 0x10002a961
mov edx, 0x148
mov dword [rsp + 0x28], eax
mov rax, qword [rsi + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001e39c
mov rbp, qword [rsp + 0xd0]
jmp 0x10002ac23
mov rbp, qword [rsp + 0xd0]
jmp 0x10002ac23
mov rbp, qword [rsp + 0xd0]
cmp rbp, r15
je 0x10002a9e6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r15d
jne 0x10002a9e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002a9c5
test byte [rcx + 0x1c], 1
je 0x10002a9c5
cmp byte [rcx + 0x19], 2
jb 0x10002a9c5
mov edx, 0x149
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
movzx ebx, di
or ebx, 0x80070000
cmp edi, r15d
cmovle ebx, edi
jmp 0x10002ac23
mov r14, qword [rsp + 0xe8]
jmp 0x10002ac3f
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120d1c
mov ebx, eax
cmp eax, r15d
jl 0x10002ac1e
mov r13, qword [rsp + 0x30]
test byte [rsi + 0x150], 1
je 0x10002aa3a
xor r8d, r8d
lea rdx, [rsp + 0xd8]
mov rcx, r13
call fcn.10009bac4
mov ebx, eax
cmp eax, r15d
jl 0x10002ac09
jmp 0x10002aa63
lea r9, [rsp + 0xd8]
mov r8b, 1
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120d1c
mov ebx, eax
cmp eax, r15d
jl 0x10002ac09
mov rcx, qword [rsi + 0x1c8]
cmp rcx, r15
je 0x10002aa84
lea rdx, [rsp + 0x40]
call fcn.10012be38
mov ebx, eax
cmp eax, r15d
jl 0x10002ac09
lea rcx, [rsi + 0x3c8]
lea rdx, [rsp + 0x60]
call fcn.10012d64c
mov ebx, eax
cmp eax, r15d
jge 0x10002aadd
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002ac09
test byte [rcx + 0x1c], 1
je 0x10002ac09
cmp byte [rcx + 0x19], 2
jb 0x10002ac09
mov edx, 0x14a
mov r9d, eax
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
jmp 0x10002ac09
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.10013dd70
mov ebx, eax
cmp eax, r15d
jl 0x10002ac09
mov r9, qword [rsp + 0xe0]
mov r8d, dword [rsi + 0x14c]
mov rdx, qword [rsp + 0xd8]
mov rcx, r13
call fcn.10010b84c
mov ebx, eax
cmp eax, r15d
jl 0x10002ac09
test byte [rsi + 0x150], 0x80
je 0x10002ac09
cmp byte [rsi + 0x11c], r15b
je 0x10002ac09
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0xd0], rax
cmp rax, r15
je 0x10002ab67
mov rcx, rax
call fcn.10004401c
mov r12, rax
jmp 0x10002ab6a
mov r12, r15
mov rdx, r13
mov rcx, r12
call fcn.10001ecdc
mov ebx, eax
cmp eax, r15d
jl 0x10002abf9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0xe0]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, r12
call fcn.10001f008
mov ebx, eax
cmp eax, r15d
jl 0x10002ac02
mov rdi, qword [rsi + 0x310]
cmp rdi, qword [rsi + 0x318]
jb 0x10002abd6
lea rdx, [rdi + 1]
lea rcx, [rsi + 0x308]
call fcn.10006a9e0
cmp al, r15b
jne 0x10002abd6
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rsi + 0x308]
lea rcx, [rax + rdi*8]
cmp rcx, r15
je 0x10002abe9
mov qword [rcx], r12
inc qword [rsi + 0x310]
lea r12, [0x1001653b8]
jmp 0x10002ac09
lea r12, [0x1001653b8]
jmp 0x10002ac09
lea r12, [0x1001653b8]
mov rcx, qword [rsp + 0xd8]
cmp rcx, r15
je 0x10002ac23
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10002ac23
mov r13, qword [rsp + 0x30]
cmp rbp, r15
je 0x10002ac31
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10002ac3f
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r15
je 0x10002ac4d
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x60]
call fcn.10013f5c8
mov ebp, r15d
mov rsi, r15
cmp qword [rsp + 0x48], r15
jbe 0x10002acb1
cmp rsi, qword [rsp + 0x48]
jae 0x10002ac8e
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rdi + rsi*8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi + rsi*8], r15
inc ebp
inc rsi
mov eax, ebp
cmp rax, qword [rsp + 0x48]
jae 0x10002acb1
jmp 0x10002ac64
lea r8, [0x100005a58]
mov edx, 0x2cd
lea rcx, [0x1000059a0]
call fcn.10009a050
mov ecx, 0x80070057
call fcn.1000196c8
int3
mov rdi, qword [rsp + 0x40]
cmp rdi, r15
je 0x10002acd6
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1000439c0
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
cmp ebx, r15d
jge 0x10002ad16
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10002ad16
test byte [rcx + 0x1c], 1
je 0x10002ad16
cmp byte [rcx + 0x19], 2
jb 0x10002ad16
mov edx, 0x14b
mov r9d, ebx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
nop
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x10002ad27
call qword [sym.imp.msvcrt.dll_free]
nop
lea rcx, [rsp + 0x40]
call fcn.1000433c4
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret