Function at 0x10002a344
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
xor edi, edi
xor r15d, r15d
mov qword [r11 - 0x70], r15
xor r12d, r12d
mov qword [r11 - 0x68], r12
xor r13d, r13d
mov qword [r11 - 0x60], r13
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor ebp, ebp
mov qword [r11 - 0x78], rbp
mov rax, qword [rcx + 0x1c8]
test rax, rax
jne 0x10002a3f6
lea rax, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rcx, rax
je 0x10002a7ff
test byte [rcx + 0x1c], 1
je 0x10002a7ff
cmp byte [rcx + 0x19], 4
jb 0x10002a7ff
mov edx, 0x145
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
jmp 0x10002a7ff
xor r14d, r14d
mov dword [rsp + 0x38], r14d
cmp dword [rax + 8], ebx
jbe 0x10002a7ff
test rbp, rbp
je 0x10002a41b
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, r14d
mov rcx, qword [rsi + 0x1c8]
call fcn.10012bbc4
mov edi, eax
lea rbp, [0x1001653b8]
test eax, eax
js 0x10002a783
cmp qword [rsi + 0x1d8], 0
jne 0x10002a467
lea r8, [0x100004ae0]
mov edx, 0x1977
lea rcx, [0x100004680]
call fcn.10009a050
test byte [rsi + 0x150], 4
je 0x10002a4fd
test r15, r15
je 0x10002a488
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsi + 0x1d8]
call fcn.100120aac
mov edi, eax
test eax, eax
js 0x10002a717
test r12, r12
je 0x10002a4c6
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov rcx, r15
call fcn.10010c158
mov edi, eax
test eax, eax
js 0x10002a710
mov r12, qword [rsp + 0x50]
test r12, r12
je 0x10002a4fd
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10002a6bf
test r13, r13
je 0x10002a511
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120aac
mov edi, eax
test eax, eax
js 0x10002a769
test rbx, rbx
je 0x10002a554
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x30], 0
mov r13, qword [rsp + 0x58]
test byte [rsi + 0x150], 1
je 0x10002a57e
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.10009bac4
mov edi, eax
test eax, eax
js 0x10002a75b
jmp 0x10002a5ad
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9b, 1
lea r8, [rsp + 0x70]
lea rdx, [rsi + 0x130]
mov rcx, qword [rsi + 0x1d8]
call fcn.100120aac
mov edi, eax
test eax, eax
js 0x10002a75b
mov rbp, qword [rsp + 0x40]
mov r9, rbp
mov r8d, dword [rsi + 0x14c]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, r13
call fcn.10010b84c
mov edi, eax
test eax, eax
js 0x10002a752
test byte [rsi + 0x150], 0x80
je 0x10002a6a1
cmp byte [rsi + 0x11c], 0
je 0x10002a6a1
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x68], rax
test rax, rax
je 0x10002a611
mov rcx, rax
call fcn.10004401c
mov rbx, rax
jmp 0x10002a613
xor ebx, ebx
mov rdx, r13
mov rcx, rbx
call fcn.10001ecdc
mov edi, eax
test eax, eax
js 0x10002a729
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rdx, rbp
mov rcx, rbx
call fcn.10001f008
mov edi, eax
test eax, eax
js 0x10002a729
mov r14, qword [rsi + 0x310]
cmp r14, qword [rsi + 0x318]
jb 0x10002a678
lea rdx, [r14 + 1]
lea rcx, [rsi + 0x308]
call fcn.10006a9e0
test al, al
je 0x10002a71e
mov rax, qword [rsi + 0x308]
lea rcx, [rax + r14*8]
test rcx, rcx
je 0x10002a68b
mov qword [rcx], rbx
inc qword [rsi + 0x310]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x38]
inc r14d
mov dword [rsp + 0x38], r14d
mov rax, qword [rsi + 0x1c8]
cmp r14d, dword [rax + 8]
jae 0x10002a749
jmp 0x10002a407
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002a6fb
test byte [rcx + 0x1c], 1
je 0x10002a6fb
cmp byte [rcx + 0x19], 2
jb 0x10002a6fb
mov edx, 0x146
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
mov rbx, qword [rsp + 0x30]
jmp 0x10002a783
mov r12, qword [rsp + 0x50]
jmp 0x10002a783
mov r15, qword [rsp + 0x48]
jmp 0x10002a783
mov ecx, 0x8007000e
call fcn.1000196c8
int3
test rbx, rbx
je 0x10002a777
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
jmp 0x10002a783
lea rbp, [0x1001653b8]
jmp 0x10002a783
lea rbp, [0x1001653b8]
jmp 0x10002a783
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
jmp 0x10002a783
mov r13, qword [rsp + 0x58]
lea rbp, [0x1001653b8]
jmp 0x10002a783
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1001653b8]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10002a793
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x10002a7a1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x10002a7af
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x10002a7bd
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x10002a7cb
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jns 0x10002a7ff
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10002a7ff
test byte [rcx + 0x1c], 1
je 0x10002a7ff
cmp byte [rcx + 0x19], 2
jb 0x10002a7ff
mov edx, 0x147
mov r9d, edi
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret