Function at 0x10002b190
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rsi, [0x1001653b8]
lea r12, [0x100003cc8]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b1e2
test byte [rcx + 0x1c], 1
je 0x10002b1e2
cmp byte [rcx + 0x19], 4
jb 0x10002b1e2
mov edx, 0x14f
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
and qword [rsp + 0x90], 0
xor ebp, ebp
mov qword [rsp + 0x80], rbp
xor r13d, r13d
mov qword [rsp + 0x88], r13
cmp qword [rbx + 0x1d8], rbp
jne 0x10002b221
lea r8, [0x100004ae0]
mov edx, 0x1b97
lea rcx, [0x100004680]
call fcn.10009a050
cmp qword [rbx + 0x350], rbp
jne 0x10002b242
lea r8, [0x100004b00]
mov edx, 0x1b98
lea rcx, [0x100004680]
call fcn.10009a050
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.100124960
mov edi, eax
mov r14, qword [rsp + 0x90]
test eax, eax
js 0x10002b4f8
test byte [rbx + 0x150], 4
je 0x10002b360
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.10010c158
mov edi, eax
test eax, eax
jns 0x10002b2ea
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b2dd
test byte [rcx + 0x1c], 1
je 0x10002b2dd
cmp byte [rcx + 0x19], 2
jb 0x10002b2dd
mov edx, 0x150
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001e39c
mov rbp, qword [rsp + 0x80]
mov rcx, qword [0x1001653b8]
jmp 0x10002b4d8
mov rbp, qword [rsp + 0x80]
jmp 0x10002b4d8
mov rbp, qword [rsp + 0x80]
test rbp, rbp
je 0x10002b360
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002b360
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b4d8
test byte [rcx + 0x1c], 1
je 0x10002b4d8
cmp byte [rcx + 0x19], 2
jb 0x10002b4d8
mov edx, 0x151
mov dword [rsp + 0x20], edi
mov r9, rbp
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
jmp 0x10002b4d8
test byte [rbx + 0x150], 1
je 0x10002b388
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.10009bac4
mov edi, eax
test eax, eax
js 0x10002b4e7
jmp 0x10002b3a8
lea r8, [rsp + 0x88]
mov dl, 1
mov rcx, qword [rbx + 0x1d8]
call fcn.100124960
mov edi, eax
test eax, eax
js 0x10002b4e7
mov r9, qword [rbx + 0x350]
mov r8d, dword [rbx + 0x14c]
mov r13, qword [rsp + 0x88]
mov rdx, r13
mov rcx, r14
call fcn.10010b84c
mov edi, eax
test eax, eax
js 0x10002b4de
test byte [rbx + 0x150], 0x80
je 0x10002b4d1
cmp byte [rbx + 0x11c], 0
je 0x10002b4d1
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x80], rax
test rax, rax
je 0x10002b411
mov rcx, rax
call fcn.10004401c
mov rsi, rax
jmp 0x10002b413
xor esi, esi
mov rdx, r14
mov rcx, rsi
call fcn.10001ecdc
mov edi, eax
test eax, eax
js 0x10002b49f
mov rdx, qword [rbx + 0x350]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, rsi
call fcn.10001f008
mov edi, eax
test eax, eax
js 0x10002b49f
mov r12, qword [rbx + 0x310]
cmp r12, qword [rbx + 0x318]
jb 0x10002b47c
lea rdx, [r12 + 1]
lea rcx, [rbx + 0x308]
call fcn.10006a9e0
test al, al
jne 0x10002b47c
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x10002b48f
mov qword [rcx], rsi
inc qword [rbx + 0x310]
xor esi, esi
lea r12, [0x100003cc8]
test rsi, rsi
je 0x10002b4c1
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
jmp 0x10002b4d8
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
jmp 0x10002b4d8
mov rcx, qword [0x1001653b8]
test edi, edi
jns 0x10002b52b
jmp 0x10002b4ff
mov rcx, qword [0x1001653b8]
jmp 0x10002b4ff
mov r13, qword [rsp + 0x88]
mov rcx, qword [0x1001653b8]
jmp 0x10002b4ff
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b52b
test byte [rcx + 0x1c], 1
je 0x10002b52b
cmp byte [rcx + 0x19], 2
jb 0x10002b52b
mov edx, 0x152
mov r9d, edi
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
mov rcx, qword [0x1001653b8]
test r14, r14
je 0x10002b540
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r13, r13
je 0x10002b555
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test rbp, rbp
je 0x10002b56a
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b58c
test byte [rcx + 0x1c], 1
je 0x10002b58c
cmp byte [rcx + 0x19], 4
jb 0x10002b58c
mov edx, 0x153
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
mov eax, edi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret