Function at 0x140020804
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140173708]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r14d, r14d
mov r13, rcx
or qword [rbp - 0x40], 0xffffffffffffffff
mov edi, r14d
mov qword [rbp - 0x30], r14
mov esi, r14d
mov qword [rbp - 0x50], r14
mov r12d, r14d
mov qword [rbp - 0x48], r14
mov r15d, r14d
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x38], r14d
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x140020893
test byte [rcx + 0x1c], 1
je 0x140020893
cmp byte [rcx + 0x19], 4
jb 0x140020893
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov edx, 0x25d
call fcn.14000c328
mov rcx, qword [r13 + 0x1d8]
lea rax, [rbp - 0x30]
lea r9, str..vhdx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.1401132c0
mov ebx, eax
test eax, eax
js 0x140020f79
mov rcx, qword [r13 + 0x1d8]
lea r8, [rbp - 0x28]
mov edx, 0x7fffffff
mov qword [rbp - 0x28], r14
call fcn.14003ae8c
mov ebx, eax
test eax, eax
js 0x140020f79
cmp byte [r13 + 0x187], r14b
je 0x140020941
mov rcx, qword [r13 + 0x340]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call fcn.14000f3b8
test eax, eax
jns 0x140020939
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x140020939
test byte [rcx + 0x1c], 1
je 0x140020939
cmp byte [rcx + 0x19], 3
jb 0x140020939
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov edx, 0x25e
mov r9d, eax
call fcn.14000c354
mov r15d, dword [rbp - 0x38]
mov r12, qword [rbp - 0x20]
mov r14, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rcx, r14
lea rdx, [rbp - 0x50]
xor r9d, r9d
call fcn.140102a3c
mov ebx, eax
test eax, eax
jns 0x1400209ae
mov rcx, qword [0x140173048]
lea r13, [0x140173048]
cmp rcx, r13
je 0x140020f73
test byte [rcx + 0x1c], 1
je 0x140020f73
cmp byte [rcx + 0x19], 2
jb 0x140020f73
mov edx, 0x25f
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov r9, r14
call fcn.1400151b8
mov rdi, qword [rbp - 0x50]
jmp 0x140020f84
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x140020ce2
test rsi, rsi
je 0x1400209d4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
and qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 0x48]
inc rax
xor r8d, r8d
lea rcx, [rdi + rax*2]
call fcn.140091bf0
mov rsi, qword [rbp - 0x48]
mov ebx, eax
test eax, eax
js 0x140020f7d
mov r8d, 3
lea rdx, [0x140151678]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x140020ace
mov edx, dword [r13 + 0x170]
mov ecx, ebx
test edx, edx
je 0x140020a48
mov rax, qword [r13 + 0xd8]
add rax, 0x54
test byte [rax], 1
jne 0x140020a48
inc ecx
add rax, 0x170
cmp ecx, edx
jb 0x140020a37
cmp ecx, edx
jne 0x140020ca9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140020ca9
mov rax, qword [0x140173048]
lea rcx, [0x140173048]
cmp rax, rcx
je 0x140020ca9
test byte [rax + 0x1c], 1
je 0x140020ca9
cmp byte [rax + 0x19], 2
jb 0x140020ca9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140020aaa
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x140173048]
lea r8, [0x1401529e0]
mov edx, 0x260
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.14000c354
jmp 0x140020ca9
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bx
jne 0x140020ad2
cmp rax, 0x24
jb 0x140020c72
mov word [rsi + 0x48], bx
lea rdx, [rbp - 0x20]
movups xmm0, xmmword [0x14014fdf0]
mov rcx, rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
nop dword [rax + rax]
test eax, eax
jne 0x140020c4c
mov r11, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov rax, r11
sub rax, qword [0x14014fdf0]
jne 0x140020b2e
mov rax, r9
sub rax, qword [0x14014fdf8]
test rax, rax
jne 0x140020b53
lea r8, str.guidBagVolumeId___GUID_NULL
mov edx, 0x3800
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400906e0
mov r9, qword [rbp - 0x18]
mov r11, qword [rbp - 0x20]
mov r10d, dword [r13 + 0x170]
mov r8d, ebx
test r10d, r10d
je 0x140020b92
mov rdx, qword [r13 + 0xd8]
mov eax, r8d
imul rcx, rax, 0x170
mov rax, qword [rcx + rdx + 0x44]
sub rax, r11
jne 0x140020b85
mov rax, qword [rcx + rdx + 0x4c]
sub rax, r9
test rax, rax
je 0x140020b92
inc r8d
cmp r8d, r10d
jb 0x140020b69
mov ecx, ebx
test r15d, r15d
je 0x140020bbb
mov edx, ecx
add rdx, rdx
mov rax, qword [r12 + rdx*8]
sub rax, r11
jne 0x140020baf
mov rax, qword [r12 + rdx*8 + 8]
sub rax, r9
test rax, rax
je 0x140020bbb
inc ecx
cmp ecx, r15d
jb 0x140020b99
cmp r8d, r10d
jne 0x140020ca9
cmp ecx, r15d
jne 0x140020ca9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140020ca9
mov rax, qword [0x140173048]
lea rcx, [0x140173048]
cmp rax, rcx
je 0x140020ca9
test byte [rax + 0x1c], 1
je 0x140020ca9
cmp byte [rax + 0x19], 2
jb 0x140020ca9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140020c27
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x140173048]
lea r8, [0x1401529e0]
mov edx, 0x261
mov dword [rsp + 0x20], eax
mov r9, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400151b8
jmp 0x140020ca9
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x140020ca9
test byte [rcx + 0x1c], 1
je 0x140020ca9
cmp byte [rcx + 0x19], 3
jb 0x140020ca9
mov edx, 0x262
jmp 0x140020c96
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x140020ca9
test byte [rcx + 0x1c], 1
je 0x140020ca9
cmp byte [rcx + 0x19], 3
jb 0x140020ca9
mov edx, 0x263
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov r9, rdi
call fcn.140015150
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x40]
lea r8, [rbp - 0x50]
xor r9d, r9d
mov qword [rbp - 0x50], rbx
mov rcx, r14
call fcn.140102db8
mov ebx, eax
test eax, eax
jns 0x1400209ae
mov rdi, qword [rbp - 0x50]
jmp 0x140020f7d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
or qword [rbp - 0x40], 0xffffffffffffffff
xor r15d, r15d
test r14, r14
je 0x140020d12
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x30], r15
mov rcx, qword [r13 + 0x1d8]
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14011371c
mov ebx, eax
test eax, eax
js 0x140020f79
mov r14, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rcx, r14
lea rdx, [rbp - 0x50]
xor r9d, r9d
call fcn.140102a3c
mov ebx, eax
test eax, eax
jns 0x140020d8f
mov rcx, qword [0x140173048]
lea r13, [0x140173048]
cmp rcx, r13
je 0x140020f73
test byte [rcx + 0x1c], 1
je 0x140020f73
cmp byte [rcx + 0x19], 3
jb 0x140020f73
mov edx, 0x264
mov dword [rsp + 0x20], eax
jmp 0x140020992
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x140020f7d
test rsi, rsi
je 0x140020db4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x48], r15
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 0x48]
inc rax
xor r8d, r8d
lea rcx, [rdi + rax*2]
call fcn.140091bf0
mov rsi, qword [rbp - 0x48]
mov ebx, eax
test eax, eax
js 0x140020f7d
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r15w
jne 0x140020ddd
cmp rax, 0x24
jb 0x140020ee3
mov word [rsi + 0x48], r15w
lea rdx, [rbp - 0x20]
movups xmm0, xmmword [0x14014fdf0]
mov rcx, rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
nop dword [rax + rax]
test eax, eax
jne 0x140020ebd
mov rax, qword [rbp - 0x20]
sub rax, qword [r13 + 0x128]
jne 0x140020e35
mov rax, qword [rbp - 0x18]
sub rax, qword [r13 + 0x130]
test rax, rax
je 0x140020f1a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140020f1a
mov rax, qword [0x140173048]
lea rcx, [0x140173048]
cmp rax, rcx
je 0x140020f1a
test byte [rax + 0x1c], 1
je 0x140020f1a
cmp byte [rax + 0x19], 3
jb 0x140020f1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140020e98
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x140173048]
lea r8, [0x1401529e0]
mov edx, 0x265
mov dword [rsp + 0x20], eax
mov r9, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400151b8
jmp 0x140020f1a
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x140020f1a
test byte [rcx + 0x1c], 1
je 0x140020f1a
cmp byte [rcx + 0x19], 3
jb 0x140020f1a
mov edx, 0x266
jmp 0x140020f07
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x140020f1a
test byte [rcx + 0x1c], 1
je 0x140020f1a
cmp byte [rcx + 0x19], 3
jb 0x140020f1a
mov edx, 0x267
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov r9, rdi
call fcn.140015150
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x40]
lea r8, [rbp - 0x50]
xor r9d, r9d
mov qword [rbp - 0x50], r15
mov rcx, r14
call fcn.140102db8
mov ebx, eax
test eax, eax
jns 0x140020d8f
mov rcx, qword [0x140173048]
lea r13, [0x140173048]
cmp rcx, r13
je 0x140020f73
test byte [rcx + 0x1c], 1
je 0x140020f73
cmp byte [rcx + 0x19], 2
jb 0x140020f73
mov edx, 0x268
jmp 0x140020d86
mov rdi, qword [rbp - 0x50]
jmp 0x140020f8b
mov r14, qword [rbp - 0x30]
lea r13, [0x140173048]
mov rcx, qword [0x140173048]
test r14, r14
je 0x140020fa6
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
test rdi, rdi
je 0x140020fc1
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
test rsi, rsi
je 0x140020fdc
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
cmp qword [rbp - 0x40], 0xffffffffffffffff
je 0x140020ffa
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
test r12, r12
je 0x140021015
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
cmp rcx, r13
je 0x14002103b
test byte [rcx + 0x1c], 1
je 0x14002103b
cmp byte [rcx + 0x19], 4
jb 0x14002103b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401529e0]
mov edx, 0x269
call fcn.14000c328
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007410
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret