Function at 0x1400a4b00
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x10]
test rax, rax
jne 0x1400a4bf0
movabs rbx, 0xb0100010003
test byte [0x1401e24c0], 2
je 0x1400a4bb2
lea edx, [rax + 0x5c]
lea rcx, str..._shortcut_file.cpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400a4b75
inc rax
jmp 0x1400a4b7c
lea rax, str..._shortcut_file.cpp
mov rdx, rax
lea rcx, [0x1401e26e8]
call fcn.140005f30
shl rax, 0x34
mov r8, qword [rdi]
add r8, 0x20
cmp qword [r8 + 0x18], 8
jb 0x1400a4ba0
mov r8, qword [r8]
or rax, rbx
mov r9, rax
lea rdx, [0x140145570]
call fcn.140030ba0
mov edx, MsiPreviewDialogW
lea rcx, str..._shortcut_file.cpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400a4bce
inc rax
jmp 0x1400a4bd5
lea rax, str..._shortcut_file.cpp
mov rdx, rax
lea rcx, [0x1401e26e8]
call fcn.140005f30
shl rax, 0x34
or rax, rbx
jmp 0x1400a50c5
inc rax
cmp rax, 0x104
jbe 0x1400a4c82
test byte [0x1401e24c0], 2
je 0x1400a4c3a
mov rbx, qword [r8]
add rbx, 0x20
cmp qword [rbx + 0x18], 8
jb 0x1400a4c19
mov rbx, qword [rbx]
call fcn.1400a4640
movabs r9, 0xc0100010003
or r9, rax
mov r8, rbx
lea rdx, [0x1401454b8]
call fcn.140030ba0
mov edx, MsiPreviewDialogW
lea rcx, str..._shortcut_file.cpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400a4c56
inc rax
jmp 0x1400a4c5d
lea rax, str..._shortcut_file.cpp
mov rdx, rax
lea rcx, [0x1401e26e8]
call fcn.140005f30
shl rax, 0x34
movabs rcx, 0xd0100010003
or rax, rcx
jmp 0x1400a50c5
xor r15d, r15d
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r15
mov word [rbp + 0xf], r15w
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov qword [rbp + 7], 7
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0xf]
mov rcx, rbx
call fcn.14003ea70
test al, al
jne 0x1400a4d12
movabs rsi, 0xe0100010003
test byte [0x1401e24c0], 2
je 0x1400a4d02
cmp qword [rbx + 0x18], 8
jb 0x1400a4ce8
mov rbx, qword [rbx]
call fcn.1400a4640
or rax, rsi
mov r9, rax
mov r8, rbx
lea rdx, [0x140145600]
call fcn.140030ba0
call fcn.1400a4640
mov rdi, rax
or rdi, rsi
jmp 0x1400a507e
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r15
mov word [rbp - 0x31], r15w
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x31]
call fcn.14006c810
test al, al
jne 0x1400a4d87
movabs rsi, 0xf0100010003
test byte [0x1401e24c0], 2
je 0x1400a4d77
cmp qword [rbx + 0x18], 8
jb 0x1400a4d5d
mov rbx, qword [rbx]
call fcn.1400a4640
or rax, rsi
mov r9, rax
mov r8, rbx
lea rdx, [0x1401456e0]
call fcn.140030ba0
call fcn.1400a4640
mov rdi, rax
or rdi, rsi
jmp 0x1400a505c
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400a4e12
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rdx, qword [rbp - 0x31]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov r14d, eax
test eax, eax
je 0x1400a4e12
cmp r14d, 0xb7
je 0x1400a4e12
cmp r14d, 0x50
je 0x1400a4e12
call fcn.1400a4640
mov rdi, rax
or rdi, r14
movabs rax, 0x102100000000
or rdi, rax
test byte [0x1401e24c0], 2
je 0x1400a505c
lea r8, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae r8, qword [rbp - 0x31]
mov r9, rdi
lea rdx, [0x140145740]
call fcn.140030ba0
jmp 0x1400a505c
mov rdx, qword [rdi]
add rdx, 0x20
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400a4e3c
cmp qword [rdx + 0x10], 0
je 0x1400a4e3c
cmp qword [rdx + 0x18], 8
jb 0x1400a4e33
mov rdx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.msi.dll_MsiDatabaseIsTablePersistentA]
mov rdx, qword [rdi]
add rdx, 0x68
mov rcx, rsi
call fcn.1400efbc0
mov rcx, qword [rdi]
cmp qword [rcx + 0x50], 0
je 0x1400a4e67
lea rdx, [rcx + 0x40]
mov r8d, dword [rcx + 0x60]
mov rcx, rsi
call fcn.1400efc00
jmp 0x1400a4ea1
add rcx, 0x20
call fcn.1400a4720
test al, al
je 0x1400a4ea1
mov rdx, qword [rdi]
add rdx, 0x20
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400a4ea1
cmp qword [rdx + 0x10], 0
je 0x1400a4ea1
cmp qword [rdx + 0x18], 8
jb 0x1400a4e95
mov rdx, qword [rdx]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x88]
mov rdx, qword [rdi]
add rdx, 0x88
mov rcx, rsi
call fcn.1400efc40
mov r8, qword [rdi]
add r8, 0xa8
mov rcx, rsi
call fcn.1400efcc0
mov rax, qword [rdi]
mov rcx, qword [rax + 0xc8]
test rcx, rcx
je 0x1400a4f02
mov eax, dword [rcx]
mov dword [rbp - 0x51], eax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x41], rax
mov rcx, qword [rsi + 8]
mov qword [rbp - 0x49], rcx
test rcx, rcx
je 0x1400a4ef5
mov rax, qword [rcx]
call qword [rax + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
nop
lea r8, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.1400efe00
mov rax, qword [rdi]
mov rcx, qword [rax + 0xd8]
test rcx, rcx
je 0x1400a4f40
movzx eax, byte [rcx]
mov byte [rbp - 0x59], al
lea rax, [rbp - 0x49]
mov qword [rbp - 0x41], rax
mov rcx, qword [rsi + 8]
mov qword [rbp - 0x49], rcx
test rcx, rcx
je 0x1400a4f33
mov rax, qword [rcx]
call qword [rax + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
nop
lea r8, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.1400eff50
mov rdx, qword [rdi]
add rdx, 0xe8
mov rcx, rsi
call fcn.1400efc80
mov rdx, qword [rdi]
add rdx, 0x128
mov rcx, rsi
call fcn.1400a50f0
mov rdx, qword [rdi]
add rdx, 0x108
mov rcx, rsi
call fcn.1400a5130
cmp qword [rbx + 0x18], 8
jb 0x1400a4f82
mov rcx, qword [rbx]
jmp 0x1400a4f85
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 8]
test rcx, rcx
jne 0x1400a4f9b
mov esi, 0x80070057
jmp 0x1400a5011
mov qword [rbp - 0x51], r15
test rcx, rcx
je 0x1400a4fc2
mov rax, qword [rcx]
lea r8, [rbp - 0x51]
lea rdx, [0x14012b698]
call qword [rax]
mov rcx, qword [rbp - 0x51]
test eax, eax
cmovs rcx, r15
mov qword [rbp - 0x51], rcx
mov rcx, qword [rbp - 0x51]
test rcx, rcx
jne 0x1400a4fe1
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400a4fda
mov rax, qword [rcx]
call qword [rax + 0x10]
mov esi, 0x80004002
jmp 0x1400a5011
cmp qword [rbx + 0x18], 8
jb 0x1400a4fed
mov rdx, qword [rbx]
jmp 0x1400a4ff0
mov rdx, rbx
mov rax, qword [rcx]
mov r8d, 1
call qword [rax + MsiGetFeatureCostA]
mov esi, eax
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400a500d
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test esi, esi
jns 0x1400a5052
call fcn.1400a4640
mov rdi, rax
mov eax, esi
or rdi, rax
movabs rax, 0x142100000000
or rdi, rax
test byte [0x1401e24c0], 2
je 0x1400a505c
cmp qword [rbx + 0x18], 8
jb 0x1400a503e
mov rbx, qword [rbx]
mov r9, rdi
mov r8, rbx
lea rdx, [0x140145740]
call fcn.140030ba0
jmp 0x1400a505c
movabs rdi, 0x8000000000
cmp qword [rbp - 0x19], 8
jb 0x1400a506d
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r15
mov word [rbp - 0x31], r15w
cmp qword [rbp + 7], 8
jb 0x1400a508f
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 7], 7
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
cmp qword [rbp + 0x27], 8
jb 0x1400a50b1
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r15
mov word [rbp + 0xf], r15w
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400f5ff0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret