Function at 0x14000b6b0
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x2f0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor ebp, ebp
mov word [rsp + 0xd0], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x226]
call fcn.14002ea20
lea edx, [rbp + 1]
lea rcx, [rsp + 0xd0]
call fcn.14000b090
test eax, eax
je 0x14000ba6e
lea ecx, [rbp + 8]
call fcn.1400286ac
test rax, rax
je 0x14000b737
lea rcx, [rsp + 0x20]
mov qword [rax], rcx
jmp 0x14000b73a
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
lea r9, [rsp + 0x20]
lea r8, [0x14000b620]
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.140008f50
mov r11, qword [rsp + 0x40]
mov rcx, r11
mov r8, qword [rsp + 0x38]
sub rcx, r8
movabs r12, 0x6666666666666667
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x12c
jbe 0x14000b818
lea eax, [rdx - 0x12c]
mov rdi, rbp
test eax, eax
jle 0x14000b818
movsxd rsi, eax
mov rbx, rbp
nop word [rax + rax]
sub r11, r8
mov rax, r12
imul r11
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x14000b7e6
call fcn.140028a64
mov r8, qword [rsp + 0x38]
cmp qword [rbx + r8 + 0x20], 8
jb 0x14000b7f5
mov rcx, qword [rbx + r8 + 8]
jmp 0x14000b7fa
lea rcx, [rbx + r8 + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc rdi
add rbx, 0x28
cmp rdi, rsi
jge 0x14000b818
mov r11, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
jmp 0x14000b7c0
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbp
lea r9, [rsp + 0x58]
lea r8, [0x1400090e0]
mov edx, 1
lea rcx, [rsp + 0xd0]
call fcn.140008f50
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14000ba02
cmp rax, 0x3200000
jl 0x14000ba02
lea rax, [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov ecx, 8
call fcn.1400286ac
test rax, rax
je 0x14000b88d
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
jmp 0x14000b890
mov rax, rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.14000c390
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rbp
mov rax, qword [rsp + 0x50]
add rax, 0xfffffffffce00000
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbp
lea r9, [rsp + 0x70]
lea r8, [0x14000b4f0]
mov edx, 1
lea rcx, [rsp + 0xd0]
call fcn.140008f50
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsi]
mov rdi, qword [rsp + 0x80]
nop dword [rax + rax]
test rdi, rdi
je 0x14000b90a
cmp rdi, rdi
je 0x14000b90f
call fcn.140028a64
cmp rbx, rsi
je 0x14000b96a
test rdi, rdi
jne 0x14000b923
call fcn.140028a64
mov r11, rbp
jmp 0x14000b926
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x14000b931
call fcn.140028a64
cmp qword [rbx + 0x30], 8
jb 0x14000b93e
mov rcx, qword [rbx + 0x18]
jmp 0x14000b942
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jne 0x14000b957
call fcn.140028a64
mov r11, rbp
jmp 0x14000b95a
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x14000b965
call fcn.140028a64
mov rbx, qword [rbx]
jmp 0x14000b900
lea rcx, [rsp + 0x80]
call fcn.14000c3d0
mov rcx, qword [rsp + 0xa8]
call fcn.1400285b0
mov qword [rsp + 0xa8], rbp
mov rcx, qword [rsp + 0x80]
call fcn.1400285b0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000b9e7
mov rdi, qword [rsp + 0x40]
cmp rcx, rdi
je 0x14000b9e2
lea rbx, [rcx + 0x20]
cmp qword [rbx], 8
jb 0x14000b9c1
mov rcx, qword [rbx - 0x18]
call fcn.1400285b0
mov qword [rbx], 7
mov qword [rbx - 8], rbp
mov word [rbx - 0x18], bp
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x14000b9b2
mov rcx, qword [rsp + 0x38]
call fcn.1400285b0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x20]
call fcn.1400285b0
jmp 0x14000ba6e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000ba55
mov rdi, qword [rsp + 0x40]
cmp rcx, rdi
je 0x14000ba50
lea rbx, [rcx + 0x20]
nop word [rax + rax]
cmp qword [rbx], 8
jb 0x14000ba2f
mov rcx, qword [rbx - 0x18]
call fcn.1400285b0
mov qword [rbx], 7
mov qword [rbx - 8], rbp
mov word [rbx - 0x18], bp
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x14000ba20
mov rcx, qword [rsp + 0x38]
call fcn.1400285b0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x20]
call fcn.1400285b0
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140028300
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret