Function at 0x14000c2f0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
xor edi, edi
mov dword [rsp + 0x60], edi
lea r15d, [rdi + 1]
cmp byte [0x140060943], dil
jne 0x14000c362
lea rcx, str.SeRestorePrivilege
call fcn.14000de04
lea rcx, str.SeCreateSymbolicLinkPrivilege
call fcn.14000de04
mov byte [0x140060943], r15b
lea r14, [r12 + 0x130]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x40], rax
lea edx, [rax*4 + 0x1c]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x70]
call fcn.14000bd8c
nop
lea rcx, [0x140048e68]
call fcn.14003797c
mov rcx, r14
mov edx, 8
cmp qword [r14 + 0x18], rdx
jb 0x14000c3af
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x140048e68]
xor r8d, r8d
mov rdx, rbx
call fcn.14000bf50
mov r13, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
je 0x14000c422
mov qword [rbp - 0x18], rdi
movdqu xmmword [rbp - 8], xmm0
cmp rbx, 4
jb 0x14000ce95
lea rax, [rbx - 4]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c40a
mov rdx, qword [r14]
add rdx, 8
lea rcx, [rbp - 0x18]
call fcn.14000129c
lea rbx, [rbp - 0x18]
mov edi, 5
jmp 0x14000c44d
mov qword [rbp - 0x38], rdi
movdqu xmmword [rbp - 0x28], xmm0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14000c438
mov rdx, qword [r14]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.140008d04
lea rbx, [rbp - 0x38]
mov edi, 2
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea r8d, [rax + 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140033640
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea ebx, [rax + 8]
test dil, 2
je 0x14000c4da
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x20]
cmp rdx, rbx
jb 0x14000c4c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce9b
call fcn.14003220c
xor eax, eax
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], ax
test r15b, dil
je 0x14000c533
mov rdx, qword [rbp]
cmp rdx, rbx
jb 0x14000c51e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cea1
call fcn.14003220c
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 8], xmm0
xor edi, edi
mov word [rbp - 0x18], di
jmp 0x14000c535
xor edi, edi
cmp r13, 0xffffffffffffffff
je 0x14000c663
lea rcx, str.UNC_
call fcn.14003797c
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, str.UNC_
xor r8d, r8d
mov r13, qword [rbp - 0x48]
mov rdx, r13
call fcn.14000bf50
cmp rax, 0xffffffffffffffff
je 0x14000c667
mov qword [rbp - 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
cmp r13, 3
jb 0x14000cea7
lea rax, [r13 - 3]
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], rbx
cmovae rdx, qword [rbp - 0x58]
add rdx, 6
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea r8, [rbp - 0x78]
lea rdx, [0x140048e84]
lea rcx, [rbp + 0x80]
call fcn.140003c84
mov rbx, rax
lea rax, [rbp - 0x58]
cmp rax, rbx
je 0x14000c64d
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14000c620
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c61b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cead
call fcn.14003220c
mov qword [rbp - 0x48], rdi
mov r13d, 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x58], di
lea r8d, [r13 + 0x19]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140033640
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], r13
mov word [rbx], di
lea rcx, [rbp + 0x80]
call fcn.140001fa0
nop
lea rcx, [rbp - 0x78]
call fcn.140001fa0
mov r13, qword [rbp - 0x48]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
cmp byte [rbx + 0x93], 0
jne 0x14000c6e2
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000c6cb
mov rcx, r14
call fcn.140017138
xor ecx, ecx
test al, al
jne 0x14000c6cb
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
lea rdx, [r12 + 0x28]
mov r9, r14
lea r8, [rbp - 0x78]
mov rcx, rbx
call fcn.14000d96c
test al, al
jne 0x14000c6e2
lea rdx, [r12 + 0x28]
mov r8, r14
mov ecx, 0x67
call fcn.14000433c
jmp 0x14000cab0
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
mov r8b, byte [rbx + 0x5b]
mov dl, r15b
lea rcx, [rbp - 0x78]
call fcn.140012f58
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c758
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ceb3
call fcn.14003220c
and qword [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.1400132a8
mov bl, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c7c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ceb9
call fcn.14003220c
xor eax, eax
test bl, bl
je 0x14000c8ed
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.1400132bc
mov ecx, eax
call fcn.1400133a0
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.140001fa0
xorps xmm0, xmm0
mov rcx, rsi
movdqu xmmword [rbp - 0x68], xmm0
test bl, bl
je 0x14000c88b
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.1400130d0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c8ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cebf
call fcn.14003220c
jmp 0x14000c8ef
xor ebx, ebx
mov qword [rbp - 0x78], rbx
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.1400131bc
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000c8ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce8f
jmp 0x14000c884
xor ebx, ebx
cmp byte [r12 + 0x111], bl
jne 0x14000ca54
cmp byte [r12 + 0x150], bl
jne 0x14000ca54
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c9bf
xor r14d, r14d
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x1400609e0]
call fcn.14000b5a8
nop
mov rdx, qword [rbp - 0x60]
lea r13d, [r14 + 8]
cmp rdx, r13
jb 0x14000cac8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cec5
call fcn.14003220c
jmp 0x14000cac8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r12 + 0x128]
cmp eax, 3
jne 0x14000cb81
mov dword [rdi], 0xa0000003
mov rcx, qword [rsp + 0x40]
lea eax, [r13 + 6]
add ax, cx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], 8
jb 0x14000ca0a
mov r14, qword [r14]
lea rcx, [rdi + 0x10]
mov rdx, r14
call fcn.140037ab4
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 9
lea rcx, [rdi + rax*2]
call fcn.140037ab4
xor r14d, r14d
jmp 0x14000cc15
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rcx, [rbp - 0x78]
call fcn.140012f40
mov bl, al
lea rcx, [rbp - 0x78]
call fcn.140001fa0
test bl, bl
jne 0x14000c9c8
lea r8, [rsp + 0x50]
lea rdx, [0x1400489d4]
mov ecx, 0x14
call fcn.14000bfe0
mov r15d, 9
mov edx, r15d
lea rcx, [0x1400609e0]
call fcn.14000ba0c
mov r13d, 8
xor r14d, r14d
mov r15b, r14b
mov rdx, qword [rbp - 0x40]
cmp rdx, r13
jb 0x14000cb0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cecb
call fcn.14003220c
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r14w
test rdi, rdi
je 0x14000cb54
mov rdx, qword [rbp - 0x80]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000cb4c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce89
mov rcx, rdi
call fcn.14003220c
mov al, r15b
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140032320
mov rbx, qword [rsp + 0x208]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
dec eax
cmp eax, r15d
ja 0x14000cabf
mov dword [rdi], 0xa000000c
mov rcx, qword [rsp + 0x40]
lea eax, [rcx + r13]
mov edx, 8
add ax, dx
add ax, ax
mov word [rdi + 4], ax
and dword [rdi + 6], 0
movzx ebx, cx
add bx, bx
mov word [rdi + 0xa], bx
cmp qword [r14 + 0x18], rdx
jb 0x14000cbc1
mov r14, qword [r14]
lea rcx, [rdi + 0x14]
mov rdx, r14
call fcn.140037ab4
add bx, 2
mov word [rdi + 0xc], bx
add r13w, r13w
mov word [rdi + 0xe], r13w
lea rdx, [rbp - 0x58]
mov r13d, 8
cmp qword [rbp - 0x40], r13
cmovae rdx, qword [rbp - 0x58]
mov rax, qword [rsp + 0x40]
add rax, 0xb
lea rcx, [rdi + rax*2]
call fcn.140037ab4
xor r14d, r14d
mov eax, r14d
cmp qword [rsp + 0x48], 0xffffffffffffffff
sete al
mov dword [rdi + 0x10], eax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ccd5
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
lea rdx, [rbp - 0x78]
lea rcx, [0x1400609e0]
call fcn.14000b5a8
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000ccbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ced1
call fcn.14003220c
mov edx, 9
lea rcx, [0x1400609e0]
call fcn.14000ba0c
jmp 0x14000cac8
movzx r9d, word [rdi + 4]
add r9d, r13d
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r8, rdi
mov edx, 0x900a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000cd93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, [0x1400489d4]
mov ecx, 0x15
call fcn.14000bfe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000cd40
cmp eax, 0x522
jne 0x14000cd53
call fcn.14001dce0
test al, al
jne 0x14000cd53
mov ecx, 0x18
call fcn.1400042b0
lea rcx, [0x1400609e0]
call fcn.14000ba50
mov edx, 9
lea rcx, [0x1400609e0]
call fcn.14000ba0c
mov rcx, rsi
cmp byte [r12 + 0x111], r14b
je 0x14000cd88
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000cac8
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000cac8
lea rcx, [rbp + 0x10]
call fcn.140011ff4
nop
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
mov rax, qword [rax + 0x10]
call qword [0x140048518]
mov qword [rbp + 0x18], rbx
mov rbx, qword [rsp + 0x58]
mov eax, dword [rbx + 0x1d8]
lea rcx, [r12 + 0x70]
neg eax
sbb r9, r9
and r9, rcx
mov eax, dword [rbx + 0x1d4]
lea rcx, [r12 + 0x68]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rbx + 0x1d0]
lea rcx, [r12 + 0x60]
neg eax
sbb rdx, rdx
and rdx, rcx
lea rcx, [rbp + 0x10]
call fcn.140012ad0
lea rcx, [rbp + 0x10]
call fcn.1400120d0
cmp byte [rbx + 0xa8], r14b
jne 0x14000ce7b
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rsi
call fcn.14003797c
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14000129c
nop
mov edx, dword [r12 + 0x24]
lea rcx, [rbp - 0x78]
call fcn.140013d34
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, r13
jb 0x14000ce7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ced7
call fcn.14003220c
nop
lea rcx, [rbp + 0x10]
call fcn.14001204c
jmp 0x14000cacb
call fcn.140037904
nop
call fcn.140037904
nop
call fcn.14000704c
nop
call fcn.140037904
nop
call fcn.140037904
int3
call fcn.14000704c
nop
call fcn.140037904
nop
call fcn.140037904
int3
call fcn.140037904
int3
call fcn.140037904
int3
call fcn.140037904
nop
call fcn.140037904
nop
call fcn.140037904
nop
call fcn.140037904
int3