Function at 0x100023170
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor edi, edi
mov r14, rcx
xor ecx, ecx
or rbp, 0xffffffffffffffff
mov rax, r9
mov r15, r8
mov dword [r11 + 0xc], ecx
mov ebx, edi
mov dword [r11 + 8], edi
mov rsi, rdi
mov r13d, edi
cmp r14, rdi
je 0x1000233f1
cmp rdx, rdi
je 0x1000233f1
cmp r8, rbp
je 0x1000233f1
cmp rax, rdi
je 0x1000233f1
mov r12, qword [rsp + 0xf0]
cmp r12, rdi
je 0x1000233f1
cmp qword [r12], 0x40
jle 0x1000233a5
lea r8d, [rdi + 0x20]
lea rcx, [r11 - 0x64]
xor edx, edx
mov dword [rsp + 0x60], edi
call fcn.100039740
xor eax, eax
lea r9, [rsp + 0x40]
lea r8d, [rdi + 0x24]
lea rdx, [rsp + 0x60]
mov rcx, r15
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], edi
call fcn.100024dec
cmp eax, edi
je 0x10002324f
cmp dword [rsp + 0x60], 0x4643534d
jne 0x10002324f
mov eax, 0x103
cmp ax, word [rsp + 0x78]
je 0x1000233a5
mov rcx, r14
call fcn.100019360
mov rcx, rax
call fcn.100026324
mov rsi, rax
cmp rax, rdi
je 0x1000233a5
cmp word [rax], di
je 0x1000233a5
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0xc0010000
lea r8d, [r9 + 7]
mov rcx, rax
mov dword [rsp + 0x28], 0x4c000100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1000233a5
mov rdi, qword [r14 + 0xc8]
test rdi, rdi
jne 0x10002333b
mov eax, dword [rsp + 0xf8]
sub eax, 1
je 0x1000232d6
cmp eax, 1
jne 0x10002332f
call fcn.100024360
mov rdi, rax
jmp 0x10002332f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x10002332f
lea rax, [0x1000246c0]
lea r8, [0x100024590]
mov r9d, 4
xor edx, edx
mov ecx, 0x8000
mov qword [rdi + 0x18], rax
call fcn.100029310
mov qword [rdi + 0x28], rax
test rax, rax
je 0x10002332b
lea rax, [0x1000245ec]
mov qword [rdi + 0x10], rax
and qword [rdi + 0x20], rbx
mov qword [r14 + 0xc8], rdi
test rdi, rdi
je 0x1000233a3
lea rax, [rsp + 0xd0]
mov r9, rbp
mov r8, r15
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.100024734
xor edi, edi
mov ebx, eax
cmp eax, edi
je 0x1000233a5
mov rcx, qword [rsp + 0xd0]
mov ebx, edi
cmp rcx, qword [r12]
jge 0x100023384
mov rax, qword [r12]
sub rax, rcx
imul rax, rax, 0x64
cqo
idiv qword [r12]
jmp 0x100023387
mov rax, rdi
cmp rax, 3
jl 0x1000233a5
mov rax, qword [rsp + 0xe8]
mov qword [r12], rcx
mov ebx, 1
mov qword [rax], rbp
jmp 0x1000233cb
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp rbp, 0xffffffffffffffff
je 0x1000233bd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
je 0x1000233df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, edi
je 0x1000233ed
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x1000233fe
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret