Function at 0x1400ea8c0
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x5e8
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
mov r14, rdx
mov rbp, rcx
mov esi, 1
call fcn.1400e25b0
mov rdi, rax
test rax, rax
je 0x1400eab93
mov qword [rsp + 0x5e0], r12
movabs r12, 0xd0000404ffffffff
mov qword [rsp + 0x5d8], r13
lea r13, [0x1401ba2d4]
mov qword [rsp + 0x5d0], r15
xor r15d, r15d
mov qword [rsp + 0x620], rbx
nop
cmp qword [rdi], 0xffffffffffffffff
je 0x1400eab47
mov qword [rsp + 0x38], r15
lea rbx, [rdi + 0x258]
xor edx, edx
mov qword [rsp + 0x30], r15
lea r8, [rdi + 0x34]
mov dword [rsp + 0x28], 0x30c
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rdi]
lea rdx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ea98e
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi], 0xffffffffffffffff
test rbx, rbx
je 0x1400eab52
cmp byte [rbx], 0x2e
jne 0x1400ea9b7
cmp byte [rbx + 1], r15b
je 0x1400ea930
cmp byte [rbx], 0x2e
jne 0x1400ea9b7
cmp byte [rbx + 1], 0x2e
jne 0x1400ea9b7
cmp byte [rbx + 2], r15b
je 0x1400ea930
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
mov r9d, 0x30c
mov qword [rsp + 0x20], r13
mov rcx, rbp
call fcn.1400e46d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
cmp dword [rsp + 0x40], r15d
je 0x1400ea9f8
mov esi, r15d
jmp 0x1400ea930
movzx eax, byte [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
test al, al
je 0x1400eaaa2
cmp al, 0x3f
ja 0x1400eaa1e
bt r12, rax
jb 0x1400eaaa2
cmp al, 0x7c
je 0x1400eaaa2
movzx eax, byte [rdx + 1]
inc rdx
test al, al
jne 0x1400eaa10
mov r9d, 0x104
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call fcn.1400e7680
lea rcx, [rsp + 0xa0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400eaa60
test rax, rax
je 0x1400eaaa2
movzx ecx, byte [rsp + rax + 0x9f]
cmp cl, 0x20
je 0x1400eaaa2
cmp cl, 0x2e
je 0x1400eaaa2
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1400eaaa2
mov eax, dword [rsp + 0x70]
and eax, 0x10
jmp 0x1400eaaf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018a088
mov qword [rsp + 0x38], rax
lea rbx, str.remove_directory
lea rax, [rsp + 0xa0]
mov r9d, 0x269b
mov qword [rsp + 0x30], rax
mov r8, rbx
lea rax, str._s:_mg_stat__s__failed:__s
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.1400e1360
mov eax, dword [rsp + 0x60]
mov esi, r15d
lea rdx, [rsp + 0xa0]
mov rcx, rbp
test eax, eax
je 0x1400eab16
call fcn.1400ea8c0
test eax, eax
mov ecx, r15d
cmovne ecx, esi
mov esi, ecx
jmp 0x1400ea930
mov r9d, 0x104
lea r8, [rsp + 0x3b0]
call fcn.1400e7680
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400ea930
mov esi, r15d
jmp 0x1400ea930
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rdi]
mov r15, qword [rsp + 0x5d0]
mov r13, qword [rsp + 0x5d8]
mov r12, qword [rsp + 0x5e0]
mov rbx, qword [rsp + 0x620]
cmp rcx, 0xffffffffffffffff
je 0x1400eab81
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call fcn.140180564
mov rcx, r14
call fcn.14018a5c0
mov eax, esi
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.1401702b0
add rsp, 0x5e8
pop r14
pop rdi
pop rsi
pop rbp
ret