Function at 0x1400158b4
Capabilities:
Delete file

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
xor r12d, r12d
xor r13d, r13d
xor eax, eax
mov qword [rbp - 0x31], r12
xor ebx, ebx
mov dword [rbp + 0x67], r13d
mov dword [rbp + 0x6f], eax
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x140015908
mov r8, rcx
lea rdx, [rbp + 0x6f]
lea rcx, [rbp + 0x67]
call fcn.140007540
mov eax, dword [rbp + 0x6f]
mov r13d, dword [rbp + 0x67]
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx + 0x1c]
mov r8d, ecx
and r8d, 0x400
mov dword [rbp + 0x6f], r8d
je 0x140015923
test al, al
jns 0x140015934
and ecx, 0x4000
mov dword [rbp + 0x7f], ecx
je 0x14001593b
bt eax, 0x11
jb 0x14001593b
xor eax, eax
jmp 0x140015fe9
mov eax, 2
lea r14, str.RestoreFileData
test byte [rdi + 0x4c], al
jne 0x140015f1d
cmp qword [rdi + 0x20], 0xffffffffffffffff
lea r10d, [rax - 1]
je 0x1400159ae
mov rcx, rsi
call fcn.140007518
test rax, rax
je 0x140015980
add rdx, 0x20
lea r9, [rbp + 0x67]
mov r8d, r10d
mov rcx, rax
call fcn.14001ded4
mov rcx, rax
jmp 0x140015993
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor ecx, ecx
xor eax, eax
lea r10d, [rax + 1]
test rcx, rcx
je 0x1400159a6
test byte [rcx + 0xf], 0x20
cmovne eax, r10d
test eax, eax
jne 0x140015a10
mov r8d, dword [rbp + 0x6f]
bt r13d, 0x18
jae 0x140015a10
test r8d, r8d
jne 0x140015a10
xor eax, eax
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], eax
mov rdx, rdi
mov rcx, rsi
call fcn.14002fc10
mov ebx, eax
test eax, eax
jns 0x1400159e5
mov r9d, eax
mov r8d, 0xc56
mov rcx, r14
call fcn.1400064e0
cmp ebx, 0x80070020
je 0x1400159f9
cmp ebx, 0x80070015
jne 0x140015f0e
mov edx, 5
lea rcx, [rbp - 0x19]
call fcn.140018ecc
test eax, eax
jne 0x1400159c3
jmp 0x140015f0e
mov rcx, rsi
call fcn.140007518
and qword [rbp - 0x29], rbx
mov r12, rax
cmp qword [rdi + 0x20], 0xffffffffffffffff
je 0x140015c93
mov rdx, qword [rdi + 0x18]
xor r15d, r15d
and qword [rbp - 0x19], rbx
add rdx, 0x20
mov qword [rbp - 0x21], r15
call fcn.140007518
test rax, rax
je 0x140015a5b
lea r9, [rbp - 0x29]
mov r8d, r10d
mov rcx, rax
call fcn.14001ded4
mov r12, rax
jmp 0x140015a6f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor r12d, r12d
test r12, r12
jne 0x140015ad4
mov rdx, qword [rdi + 0x18]
mov rcx, rsi
add rdx, 0x20
call fcn.140007518
test rax, rax
je 0x140015a9a
lea r8, [rbp - 0x19]
mov rcx, rax
call fcn.1400222d0
mov r15, rax
jmp 0x140015aab
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov qword [rbp - 0x21], r15
test r15, r15
jne 0x140015ad4
mov r9d, 0x80070714
lea rcx, str.RestoreFileData
mov r8d, 0xb65
mov ebx, r9d
call fcn.1400064e0
jmp 0x140015fe7
test dword [rdi + 0x4c], 0x20000000
lea rcx, [rdi + 0x20]
je 0x140015af9
lea rax, [0x140015740]
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rax
lea rax, [0x140015830]
jmp 0x140015b12
mov rax, qword [rcx]
mov qword [rbp - 9], rax
lea rax, [0x14001f260]
mov qword [rbp - 1], rax
lea rax, [fcn.1400318b0]
mov qword [rbp + 7], rax
mov rax, qword [rdi + 0x18]
test dword [rax + 0x1c], 0x800
je 0x140015c0d
and qword [rsp + 0x38], rbx
lea rax, [rbp - 0x39]
mov rcx, qword [rcx]
lea r8, [rbp + 0x67]
and dword [rbp - 0x39], ebx
mov edx, 2
mov qword [rsp + 0x30], rax
mov r9d, edx
and dword [rsp + 0x28], ebx
and qword [rsp + 0x20], rbx
mov word [rbp + 0x67], dx
mov edx, 0x9c040
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x140015c0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x301
je 0x140015c05
cmp eax, 0x32
je 0x140015c05
movzx ebx, ax
or ebx, 0x80070000
cmp eax, 1
jne 0x140015bc2
mov r8, qword [rdi + 0x28]
lea r9, str.Could_not_set_compression._Invalid_cluster_size.
mov dword [rsp + 0x30], 0xb9c
lea ecx, [rax + 1]
mov qword [rsp + 0x28], r14
mov rdx, rsi
mov dword [rsp + 0x20], ebx
call fcn.14000b4d0
xor ebx, ebx
jmp 0x140015c0d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140015bdc
mov r9d, ebx
mov r8d, 0xba6
mov rcx, r14
call fcn.1400064e0
mov r8, qword [rdi + 0x28]
lea r9, str.Error_setting_compression
mov dword [rsp + 0x30], 0xba7
mov rdx, rsi
mov qword [rsp + 0x28], r14
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.14000b4d0
test ebx, ebx
js 0x140015fe7
bt r13d, 0xd
jae 0x140015c28
mov r8, qword [rdi + 0x28]
mov rcx, rsi
mov rdx, qword [rdi + 0x18]
call fcn.14002eb88
test eax, eax
jne 0x140015c82
test r12, r12
je 0x140015c35
test byte [r12 + 0xf], 0x20
jne 0x140015c82
mov r9, qword [rbp - 0x19]
lea rax, [rbp - 9]
mov rdx, qword [rbp - 0x29]
mov r8, r12
mov dword [rsp + 0x38], 1
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x20], rax
call fcn.14002c76c
mov ebx, eax
test eax, eax
jns 0x140015c8a
mov r9d, eax
mov r8d, 0xbc4
mov rcx, r14
call fcn.1400064e0
test ebx, ebx
js 0x140015fe7
or dword [rdi + 0x4c], 2
jmp 0x140015f0a
xor r13d, r13d
mov r15d, 0x80070000
cmp dword [rbp + 0x6f], r13d
jne 0x140015ca8
cmp dword [rbp + 0x7f], r13d
je 0x140015d07
call fcn.140022ee8
mov qword [rbp - 0x31], rax
mov r10, rax
test rax, rax
jne 0x140015d18
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r15d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140015ced
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
jmp 0x140015cf2
mov ebx, 0x80004005
test ebx, ebx
jns 0x140015d07
mov r9d, ebx
mov r8d, 0xbe9
mov rcx, r14
call fcn.1400064e0
mov rax, qword [rdi + 0x18]
lea r13, [rdi + 0x20]
mov r9, qword [rax + 0x10]
jmp 0x140015e6d
mov rdx, qword [rdi + 0x18]
mov rcx, r13
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, qword [0x14007b9d0]
jne 0x140015d50
mov rax, qword [rdx + 8]
cmp rax, qword [0x14007b9d8]
jne 0x140015d50
mov eax, dword [rdx + 0x10]
cmp eax, dword [0x14007b9e0]
jne 0x140015d50
mov qword [rbp + 0x67], r13
jmp 0x140015dd2
mov rcx, rsi
call fcn.140007518
test rax, rax
je 0x140015d74
lea r9, [rbp - 0x29]
mov r8d, 1
mov rcx, rax
call fcn.14001ded4
mov rcx, rax
jmp 0x140015d88
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, r13
test rcx, rcx
jne 0x140015dad
mov r9d, 0x80070714
mov r8d, 0xbff
mov rcx, r14
mov ebx, r9d
call fcn.1400064e0
lea r13, [rdi + 0x20]
jmp 0x140015e53
test byte [rcx + 0xf], 0x10
je 0x140015dc6
mov rax, qword [rcx + 8]
movabs rdx, 0xffffffffffffff
and rax, rdx
jmp 0x140015dca
mov rax, qword [rcx + 0x18]
mov r10, qword [rbp - 0x31]
mov qword [rbp + 0x67], rax
neg rcx
lea r13, [rdi + 0x20]
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x30], r13
sbb rax, rax
mov r9d, 0x4a200100
and rax, rcx
mov r8, r10
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov rdx, r10
call fcn.140020f78
test eax, eax
jne 0x140015e53
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r15d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140015e39
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
jmp 0x140015e3e
mov ebx, 0x80004005
test ebx, ebx
jns 0x140015e53
mov r9d, ebx
mov r8d, 0xc1c
mov rcx, r14
call fcn.1400064e0
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x140015e6a
cmp r12, rax
je 0x140015e6a
test rsi, rsi
je 0x140015e6a
mov qword [rsi + 8], rax
xor r9d, r9d
mov r8, qword [rbp - 0x31]
test r8, r8
jne 0x140015e7a
mov r8, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x18]
mov rcx, rsi
add rdx, 0x20
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call fcn.14002c468
test eax, eax
je 0x140015ea1
or dword [rdi + 0x4c], 3
jmp 0x140015eef
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r15d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140015ed5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
jmp 0x140015eda
mov ebx, 0x80004005
test ebx, ebx
jns 0x140015eef
mov r9d, ebx
mov r8d, 0xc3f
mov rcx, r14
call fcn.1400064e0
mov rcx, rsi
call fcn.140007518
cmp r12, rax
je 0x140015f0a
test rsi, rsi
je 0x140015f0a
test r12, r12
je 0x140015f0a
mov qword [rsi + 8], r12
mov r12, qword [rbp - 0x31]
test ebx, ebx
js 0x140015fb3
mov ecx, dword [rbp + 0x7f]
mov r8d, dword [rbp + 0x6f]
cmp dword [rbp + 0x77], 0
je 0x140015fb3
test ecx, ecx
je 0x140015f4d
mov r9, qword [rdi + 0x18]
lea rdx, [rdi + 0x20]
mov r8, qword [rdi + 0x28]
mov rcx, rsi
call fcn.140030e48
mov ebx, eax
test eax, eax
jns 0x140015f81
mov r8d, 0xc6a
jmp 0x140015f72
test r8d, r8d
je 0x140015f7d
mov r9, qword [rdi + 0x18]
lea rdx, [rdi + 0x20]
mov r8, qword [rdi + 0x28]
mov rcx, rsi
call fcn.14003060c
mov ebx, eax
test eax, eax
jns 0x140015f81
mov r8d, 0xc76
mov r9d, eax
mov rcx, r14
call fcn.1400064e0
test ebx, ebx
js 0x140015fb3
mov r8, qword [rdi + 0x18]
cmp qword [r8 + 0x60], 0
je 0x140015fb3
mov rdx, qword [rdi + 0x28]
lea r9, [rdi + 0x20]
mov rcx, rsi
call fcn.140030368
mov ebx, eax
test eax, eax
jns 0x140015fb3
mov r9d, eax
mov r8d, 0xc84
mov rcx, r14
call fcn.1400064e0
test r12, r12
je 0x140015fe7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret