Function at 0x140117774
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.140001080
sub rsp, rax
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1178], rbx
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rbp + 0x1010], rax
mov qword [rsp + 0x68], r8
mov r12, rdx
mov r14, rcx
xor edi, edi
mov word [rbp + 0x5c0], di
mov ebx, 0x206
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x5c2]
call sub.msvcrt.dll_memset
mov word [rbp + 0x7d0], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x7d2]
call sub.msvcrt.dll_memset
mov word [rbp + 0x9e0], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x9e2]
call sub.msvcrt.dll_memset
mov word [rbp + 0xe00], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xe02]
call sub.msvcrt.dll_memset
mov word [rbp + 0xbf0], di
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xbf2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x64], edi
lea rcx, [rbp + 0x30]
call fcn.140109a60
nop
xor eax, eax
mov qword [rbp + 0x5b0], rax
mov dword [rsp + 0x60], edi
lea rcx, [rbp + 0xf0]
call fcn.1400de9b0
nop
lea rcx, [rbp + 0x48]
call fcn.1400e0db0
nop
mov qword [rbp - 0x80], rdi
mov qword [rsp + 0x78], rdi
lea rcx, [rbp - 0x70]
call fcn.140109a60
nop
lea rcx, [rbp - 0x50]
call fcn.1400e1400
nop
lea rcx, [rbp + 0x80]
call fcn.1400e1c54
nop
lea rcx, [rbp + 0x230]
call fcn.140109934
nop
lea r13, [r14 + 0xd0]
cmp dword [r13], edi
je 0x1401178bd
lea ebx, [rdi + 1]
jmp 0x140118380
xor r9d, r9d
mov r8, r13
mov edx, dword [r14 + 0x2f8]
mov rcx, r12
call fcn.140109e20
test eax, eax
je 0x1401178da
mov dword [r13], edi
mov eax, dword [r13]
mov dword [rbp - 0x78], eax
mov qword [rsp + 0x20], r12
lea r9, [0x1400012b8]
lea r8, [0x1400014f0]
mov r15d, 0x104
mov edx, r15d
lea rcx, [rbp + 0xe00]
call fcn.1400780b0
mov ebx, eax
test eax, eax
jns 0x140117950
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
mov esi, 1
test byte [rcx + 0x1c], sil
je 0x14011833e
lea edx, [rsi + 0x39]
mov r9d, ebx
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
jmp 0x14011833e
lea r9, [rsp + 0x64]
lea r8, [0x140118428]
lea rdx, [rbp + 0xe00]
mov rcx, 0xffffffff80000002
call fcn.1401152e0
mov esi, 1
test eax, eax
jne 0x1401179b9
cmp dword [rsp + 0x64], esi
jne 0x1401179b9
mov ebx, esi
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118380
test byte [rcx + 0x1c], 4
je 0x140118380
lea edx, [rsi + 0x3a]
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
jmp 0x140118380
mov r9, r12
lea r8, [0x140001510]
mov rdx, r15
lea rcx, [rbp + 0xbf0]
call fcn.1400780b0
mov ebx, eax
test eax, eax
jns 0x140117a03
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x3c
jmp 0x140117938
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xf0]
call fcn.1400e07e0
mov ebx, eax
test eax, eax
js 0x140118342
mov ecx, DispGetParam
call fcn.140105a40
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140117a42
mov rcx, rax
call fcn.14011fcb4
mov r15, rax
jmp 0x140117a45
mov r15, rdi
test r15, r15
jne 0x140117a54
mov ebx, 0x8007000e
jmp 0x140118342
mov rdx, r15
mov rcx, qword [rsp + 0x70]
call fcn.1400de1fc
mov rdi, qword [rsp + 0x70]
mov rax, qword [rdi + 0x10]
mov rbx, qword [rax + 0x40]
mov rcx, rbx
call qword [fcn.140015690]
mov r9, qword [rsp + 0x68]
mov r8, r12
lea rdx, [0x1400016a0]
lea rcx, [rdi + 0x10]
call rbx
mov ebx, eax
xor edi, edi
test eax, eax
js 0x140118342
mov rdi, qword [rsp + 0x70]
mov rax, qword [rdi + 0x10]
mov rbx, qword [rax + 0x48]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [0x140118458]
lea rcx, [rdi + 0x10]
call rbx
mov rax, qword [r15]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [0x140118468]
mov rcx, r15
call rbx
mov ebx, eax
xor edi, edi
test eax, eax
js 0x140118342
mov rcx, r12
call fcn.140113250
test al, 0x10
mov edx, edi
cmovne edx, esi
lea rcx, [rbp + 0xf0]
call fcn.1400e09cc
mov edx, dword [r14 + 0x2e8]
mov ecx, dword [r14 + 0x2e4]
call fcn.140114288
test eax, eax
jne 0x140117b40
mov ebx, esi
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118380
test byte [rcx + 0x1c], 4
je 0x140118380
lea edx, [rdi + 0x3d]
jmp 0x1401179a4
lea rax, [0x140001808]
lea rdx, [0x140001818]
cmp dword [r14 + 0x2f8], edi
cmovne rdx, rax
lea rcx, [rbp + 0x80]
call fcn.1400e1fa4
lea rax, [0x140118480]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [r14 + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov rax, qword [r14 + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [r14 + 0x2ec]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea r9, [0x140148078]
lea r8, [rbp + 0x48]
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.1400e2c80
mov ebx, eax
test eax, eax
js 0x140118342
lea rcx, [rbp + 0x48]
call fcn.1400ddd3c
mov ebx, eax
lea rcx, [rbp + 0xf0]
call fcn.1400ddd3c
cmp eax, ebx
je 0x140117bef
mov ebx, 0x8007003a
jmp 0x140118342
lea r8, [rbp - 0x80]
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1400e0ffc
mov ebx, eax
test eax, eax
js 0x140118342
mov rcx, qword [rbp - 0x80]
call fcn.1400de624
cmp eax, esi
jne 0x140117be5
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call fcn.1400de5a0
mov ebx, eax
test eax, eax
js 0x140118342
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, rdi
call rbx
mov rcx, rax
lea rdx, [0x140001828]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor edi, edi
test eax, eax
jne 0x140117be5
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [rbp + 0x5b0]
mov rcx, rdi
call rbx
movzx eax, word [rbp + 0x5b0]
mov dword [rsp + 0x60], eax
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, rdi
call rbx
mov qword [rsp + 0x68], rax
mov eax, dword [rbp - 0x78]
cmp dword [rsp + 0x60], eax
jne 0x140117cb5
mov ebx, esi
jmp 0x140118380
lea r9, [rbp + 0x5c0]
lea r8, [rsp + 0x60]
mov edx, dword [r14 + 0x2f8]
mov rcx, r12
call fcn.140109e20
xor edi, edi
test eax, eax
je 0x140117d0d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
lea edx, [rdi + 0x3e]
jmp 0x140117938
lea r8, [rbp + 0x5c0]
mov r12d, 0x104
mov edx, r12d
lea rcx, [rbp + 0x7d0]
call fcn.140044bb0
mov ebx, eax
test eax, eax
jns 0x140117d5a
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x3f
jmp 0x140117938
lea rcx, [rbp + 0x7d0]
call fcn.1401159a8
test eax, eax
jne 0x140117db1
mov ebx, 0x80004005
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118342
test byte [rcx + 0x1c], sil
je 0x140118342
mov edx, 0x40
lea r9, [rbp + 0x7d0]
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcd0
jmp 0x140118342
mov edx, dword [r14 + 0x2e8]
mov ecx, dword [r14 + 0x2e4]
call fcn.140114288
test eax, eax
jne 0x140117df5
mov ebx, esi
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118380
test byte [rcx + 0x1c], 4
je 0x140118380
mov edx, 0x41
jmp 0x1401179a4
lea rdx, [0x140118418]
lea rcx, [rbp + 0x7d0]
call fcn.140112c0c
lea rcx, [rbp - 0x50]
call fcn.1400e14f8
lea rcx, [rbp - 0x50]
call fcn.1400e1c50
neg eax
sbb r15d, r15d
and r15d, 0x20
or r15d, 2
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x9e0]
lea r8, [0x140118498]
lea rdx, [rbp + 0xe00]
mov rcx, 0xffffffff80000002
call fcn.140115470
test eax, eax
je 0x1401180db
lea rcx, [rbp - 0x50]
call fcn.1400dd150
test rax, rax
je 0x140117ea9
cmp word [rax], di
je 0x140117ea9
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14010bed8
mov ebx, eax
test eax, eax
jns 0x140117f0f
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x42
jmp 0x140117938
lea rcx, [rbp - 0x50]
call fcn.1400dd160
test rax, rax
je 0x14011809b
cmp word [rax], di
je 0x14011809b
mov r9, rax
lea r8, [0x1400016a0]
lea rdx, [0x140118408]
lea rcx, [rbp - 0x70]
call fcn.14011016c
mov ebx, eax
test eax, eax
jns 0x140117f0f
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x44
jmp 0x140117938
lea rcx, [rbp - 0x50]
cmp qword [r14 + 0xa0], rdi
je 0x140117fa2
call fcn.1400dd170
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.140109d20
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.1400e1c38
lea rcx, [0x140009098]
lea r9, [0x140009088]
test eax, eax
cmovne r9, rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r9
mov r9, qword [r14 + 0xa0]
lea r8, [0x1401184b8]
mov rdx, r12
lea rcx, [rbp + 0x9e0]
call fcn.1400780b0
mov ebx, eax
lea rcx, [rbp - 0x50]
call fcn.1400e1c38
xor edi, edi
mov r15d, edi
test eax, eax
setne r15b
jmp 0x14011806c
call fcn.1400e1c40
lea rcx, [rbp - 0x50]
test ax, ax
je 0x140117fbb
call fcn.1400e1c40
movzx r12d, ax
jmp 0x140117fd0
call fcn.1400e1c38
neg eax
sbb r12d, r12d
and r12d, 0x16b
add r12d, 0x50
lea rcx, [rbp - 0x50]
call fcn.1400dd170
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.140109d20
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.1400e1c38
lea rcx, [0x140009098]
lea r9, [0x140009088]
test eax, eax
cmovne r9, rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
lea r8, [0x1401184f0]
mov r12d, 0x104
mov edx, r12d
lea rcx, [rbp + 0x9e0]
call fcn.1400780b0
mov ebx, eax
lea rcx, [rbp - 0x50]
call fcn.1400e1c38
xor edi, edi
test eax, eax
je 0x14011806c
or r15d, esi
lea rcx, [rbp - 0x50]
call fcn.1400e1c3c
test eax, eax
jne 0x140118067
test byte [r14 + 0x2ec], sil
lea eax, [rdi + 0x40]
je 0x140118069
mov eax, edi
or r15d, eax
test ebx, ebx
jns 0x1401180db
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x45
jmp 0x140117938
mov ebx, 0x80070035
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118342
test byte [rcx + 0x1c], sil
je 0x140118342
mov edx, 0x43
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
jmp 0x140118342
mov rdx, qword [r14 + 0x70]
lea rcx, [rbp + 0x230]
call fcn.14010e9c8
mov ebx, eax
test eax, eax
js 0x140118342
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, r15d
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x230]
call fcn.14010d9fc
mov ebx, eax
test eax, eax
js 0x140118342
lea rcx, [rbp + 0x230]
call fcn.14010e660
cmp eax, 0xc8
jne 0x140117be5
lea rcx, [rbp + 0x230]
call fcn.14010dea8
mov ebx, eax
lea rcx, [rbp + 0x230]
call fcn.14010dea0
mov rdx, rax
mov ecx, dword [rsp + 0x60]
mov dword [r13], ecx
test rax, rax
je 0x14011830b
cmp ebx, 0x10
jbe 0x14011830b
cmp dword [rax], 0x434d5153
je 0x1401181b5
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x1401181ab
test byte [rcx + 0x1c], sil
je 0x1401181ab
mov edx, 0x47
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov ebx, 0x10000a0b
jmp 0x140118380
lea r10d, [rbx - 0x10]
mov ecx, edi
lea r9, [rax + 0x10]
mov r8d, r10d
test r10d, r10d
je 0x1401181d8
imul ecx, ecx, 0x65
movzx eax, byte [r9]
add ecx, eax
add r9, rsi
dec r8d
jne 0x1401181c7
cmp dword [rdx + 8], ecx
je 0x1401181fd
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x1401181ab
test byte [rcx + 0x1c], sil
je 0x1401181ab
mov edx, 0x48
jmp 0x14011819b
cmp dword [rdx + 4], ebx
je 0x140118225
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x1401181ab
test byte [rcx + 0x1c], sil
je 0x1401181ab
mov edx, 0x49
jmp 0x14011819b
mov rax, qword [r14 + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, r10d
lea r8, [rdx + 0x10]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x30]
call fcn.140118510
mov ebx, eax
test eax, eax
js 0x140118342
mov eax, dword [r14 + 0x2f8]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
lea r9, [0x140001588]
xor r8d, r8d
lea rdx, [rbp + 0xbf0]
call fcn.140115600
test eax, eax
je 0x1401182c0
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x4a
jmp 0x140117938
lea rcx, [r14 + 0xd8]
lea r8, [rbp + 0x5c0]
mov rdx, r12
call fcn.140044bb0
mov ebx, eax
test eax, eax
jns 0x1401182ff
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x14011833e
test byte [rcx + 0x1c], sil
je 0x14011833e
mov edx, 0x4b
jmp 0x140117938
mov eax, dword [rsp + 0x60]
mov dword [r13], eax
mov ebx, edi
jmp 0x140118380
lea rax, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rax
je 0x140118339
test byte [rcx + 0x1c], sil
je 0x140118339
mov edx, 0x46
lea r8, [0x1400016a8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov ebx, 0x10000a0b
test ebx, ebx
jns 0x140118380
cmp word [rbp + 0xbf0], di
je 0x140118374
mov eax, dword [r14 + 0x2f8]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
lea r8, [0x140001588]
lea rdx, [rbp + 0xbf0]
call fcn.140115204
lea rcx, [rbp + 0x5c0]
call sub.KERNEL32.dll_DeleteFileW
lea rcx, [rbp + 0x80]
call fcn.1400e2340
nop
lea rcx, [rbp + 0x230]
call fcn.140109b4c
nop
lea rcx, [rbp + 0x80]
call fcn.1400e1ee0
nop
lea rcx, [rbp - 0x50]
call fcn.1400e14a0
nop
lea rcx, [rbp - 0x70]
call fcn.140109cb0
nop
lea rcx, [rbp + 0x48]
call fcn.1400e0e10
nop
lea rcx, [rbp + 0xf0]
call fcn.1400deb00
nop
lea rcx, [rbp + 0x30]
call fcn.140109cb0
mov eax, ebx
mov rcx, qword [rbp + 0x1010]
xor rcx, rsp
call fcn.140001000
mov rbx, qword [rsp + 0x1178]
add rsp, 0x1120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret