Function at 0x18000f590
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b8
mov qword [rsp + 0x188], 0xfffffffffffffffe
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov dword [rsp + 0xc8], 0
mov r9, qword [rsp + 0x210]
mov r8, qword [rsp + 0x208]
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0xc0]
call fcn.18000f110
nop
mov dword [rsp + 0xd8], 0
lea rax, [rsp + 0xdc]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x178], rax
lea r8, [rsp + 0xd8]
xor edx, edx
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x18000f9b3
xor eax, eax
mov word [rsp + 0x100], ax
lea rax, [rsp + 0x102]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_ntohl
rep stosb byte [rdi], al
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x18000f9b1
xor eax, eax
mov word [rsp + 0x130], ax
lea rax, [rsp + 0x132]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_ntohl
rep stosb byte [rdi], al
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x18000f86d
xor eax, eax
mov word [rsp + 0x150], ax
lea rax, [rsp + 0x152]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_ntohl
rep stosb byte [rdi], al
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x160]
call fcn.1800e7690
nop
movzx eax, word [rsp + 0x15c]
movzx ecx, word [rsp + 0x15a]
movzx edx, word [rsp + 0x158]
movzx edi, word [rsp + 0x156]
movzx r8d, word [rsp + 0x152]
movzx r9d, word [rsp + 0x150]
movzx r10d, word [rsp + 0x13c]
movzx r11d, word [rsp + 0x13a]
movzx ebx, word [rsp + 0x138]
movzx esi, word [rsp + 0x136]
movzx ebp, word [rsp + 0x132]
movzx r12d, word [rsp + 0x130]
movzx r13d, word [rsp + 0x10c]
movzx r14d, word [rsp + 0x10a]
movzx r15d, word [rsp + 0x108]
mov dword [rsp + 0x190], r15d
movzx r15d, word [rsp + 0x106]
mov dword [rsp + 0x194], r15d
movzx r15d, word [rsp + 0x102]
mov dword [rsp + 0x198], r15d
movzx r15d, word [rsp + 0x100]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xa8], ecx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x90], r8d
mov dword [rsp + 0x88], r9d
mov dword [rsp + 0x80], r10d
mov dword [rsp + 0x78], r11d
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r14d
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x194]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::CleanupRegBackupFile___s__SystemTime_reg__d__02d__02d__02d:_02d:_02d__current__d__02d__02d__02d:_02d:_02d__LocalTime__d__02d__02d__02d:_02d:_02d_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x160]
call fcn.1800e76c0
movzx eax, word [rsp + 0x106]
movzx ecx, word [rsp + 0x102]
movzx edx, word [rsp + 0x100]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, eax
mov r8d, ecx
lea rcx, [rsp + 0x120]
call fcn.1800f7700
movzx eax, word [rsp + 0x136]
movzx ecx, word [rsp + 0x132]
movzx edx, word [rsp + 0x130]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, eax
mov r8d, ecx
lea rcx, [rsp + 0x110]
call fcn.1800f7700
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x110]
call fcn.1800f8000
lea rcx, [rsp + 0x140]
call fcn.1800f7410
cmp eax, dword [reloc.WS2_32.dll_getsockopt]
jle 0x18000f9b1
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0xc8], eax
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x18000f9b1
lea rcx, [rsp + 0x164]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::CleanupRegBackupFile___s__DeleteFileW__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x164]
call fcn.1800e76c0
jmp 0x18000fa23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x168], eax
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x18000fa23
lea rcx, [rsp + 0x16c]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::CleanupRegBackupFile___s__GetFileAttributesExW_fail_dwErr__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x16c]
call fcn.1800e76c0
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x18000fa86
lea rcx, [rsp + 0x170]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::CleanupRegBackupFile___s__bRet__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x170]
call fcn.1800e76c0
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x174], eax
lea rcx, [rsp + 0xc0]
call fcn.1800e8250
mov eax, dword [rsp + 0x174]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret