Function at 0x1400969d4
Capabilities:
Delete directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rbx, rcx
lea rcx, [rax - 0x80]
call fcn.140063620
lea rcx, [rsp + 0xe8]
xor esi, esi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
call fcn.14005b154
lea edx, [rsi + 5]
lea rcx, [rsp + 0x48]
call fcn.140063694
lea edx, [rsi + 0x14]
lea rcx, [rsp + 0x40]
call fcn.140063694
lea r8d, [rsi + 2]
lea rdx, [rsp + 0xe8]
lea rcx, [0x140128064]
mov r12d, esi
mov dword [rsp + 0xf8], esi
call fcn.1400660ac
lea ebx, [rsi + 0x2c]
lea ebp, [rsi + 1]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov r8d, ebx
mov r9b, bpl
movzx r15d, al
call fcn.14007f6e4
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov rcx, rax
call fcn.1400675b8
mov rax, qword [rsp + 0xe8]
mov r14d, esi
cmp bx, word [rax]
jne 0x140096ad4
add rax, 2
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov r8d, ebx
mov r9b, bpl
mov qword [rsp + 0xe8], rax
call fcn.14007f6e4
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
call fcn.1400675b8
mov rax, qword [rsp + 0xe8]
mov ecx, 0x3f
cmp bx, word [rax]
jne 0x140096b41
add rax, 2
mov qword [rsp + 0xe8], rax
cmp cx, word [rax]
sete r14b
cmp r14d, esi
je 0x140096b0d
add rax, 2
mov dword [rsp + 0xf8], 0x10
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov r8d, ebx
mov r9b, bpl
call fcn.14007f6e4
lea rdx, [rsp + 0xf8]
movzx r8d, bx
mov rcx, rax
call fcn.1400679b0
mov r12d, dword [rsp + 0xf8]
mov rbx, qword [rsp + 0x48]
cmp word [rbx], si
jne 0x140096b75
lea rcx, [rsp + 0x40]
call fcn.14005b104
lea rcx, [rsp + 0x48]
call fcn.14005b104
lea rcx, [rsp + 0x58]
call fcn.14005b104
mov rax, 0xffffffff80070057
jmp 0x140096f66
mov rcx, qword [rsp + 0x40]
cmp r12d, esi
jne 0x140096b89
cmp r15d, esi
jne 0x140096b89
cmp word [rcx], si
je 0x140096b4b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
mov edi, eax
add eax, 0x214
movsxd rdx, eax
call fcn.140063720
mov rcx, qword [rsp + 0x40]
lea eax, [rdi + 4]
cdqe
mov qword [rsp + 0x70], rsi
lea rdi, [rcx + rax*2]
call fcn.14001be14
mov rcx, rbx
mov r13, rax
call fcn.14001be14
mov rbx, rax
cmp word [rax], si
je 0x140096b4b
cmp r14d, esi
jne 0x140096bf5
cmp r15d, esi
jne 0x140096bf5
cmp r12d, esi
jne 0x140096bf5
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x140096ebc
cmp r12d, 2
je 0x140096eef
cmp r15d, esi
jne 0x140096eef
cmp r14d, esi
je 0x140096e69
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x24]
call fcn.140102a90
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
bt dword [rsp + 0x78], 0xa
mov qword [rsp + 0x50], rsi
lea r12, [0x14011c638]
jae 0x140096e4a
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xe8]
mov r9d, 7
mov r8d, 0xc0000000
mov rdx, rbx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0x20], rsi
call fcn.140003864
mov rbx, qword [rsp + 0xe8]
cmp rbx, rsi
je 0x140096e4a
lea r9, [0x14013cfd0]
lea r8, [0x14013d780]
lea rcx, str.GetFinalPathNameByHandleW
xor edx, edx
call fcn.14005c828
cmp qword [0x14013d780], rsi
je 0x140096e3b
mov r14d, 0xa000
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.140063720
mov r12, qword [rsp + 0x50]
mov edi, 8
mov r9d, edi
mov r8d, r14d
mov rcx, rbx
mov rdx, r12
mov word [r12], si
call qword [0x14013d780]
mov ebp, eax
cmp eax, esi
jne 0x140096e23
lea r9d, [rdi + 2]
mov r8d, r14d
mov rdx, r12
mov rcx, rbx
call qword [0x14013d780]
mov rcx, r12
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
mov r14d, eax
jl 0x140096e23
lea rdx, [0x14011cfb0]
mov r8d, edi
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
cmp eax, esi
jne 0x140096e23
lea rax, [r12 + 0x10]
lea edx, [rdi + 0x54]
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0xf8], rax
call fcn.1400f5c6c
mov rcx, qword [rsp + 0xf8]
movzx edi, word [rcx]
cmp di, si
je 0x140096d73
mov word [rcx], si
lea rcx, [rsp + 0xe8]
mov edx, 0x64
call fcn.140063694
mov rax, qword [rsp + 0xe8]
lea rcx, [rsp + 0xe8]
mov r9, r12
mov rdx, 0xfffffffffffffffb
mov r8d, 0x48fffb
mov word [rax], si
call fcn.140006aa0
cmp di, si
je 0x140096dbd
mov rax, qword [rsp + 0xf8]
mov word [rax], di
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, 1
cmp eax, esi
je 0x140096e14
mov rdx, qword [rsp + 0xf8]
cdqe
lea rdi, [rax + rax]
mov rax, rdx
sub rax, r12
lea rcx, [rdi + r12]
sar rax, 1
sub r14d, eax
add r14d, r15d
movsxd r8, r14d
add r8, r8
call fcn.14001d744
mov rdx, qword [rsp + 0xe8]
mov r8, rdi
mov rcx, r12
call fcn.14001d78c
lea rcx, [rsp + 0xe8]
call fcn.14005b104
jmp 0x140096e29
mov r15d, 1
cmp ebp, esi
jg 0x140096e3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, esi
cmove ebp, r15d
cmp rbx, 0xffffffffffffffff
je 0x140096e4a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
mov r8, r12
mov rdx, r13
call fcn.1400629b8
lea rcx, [rsp + 0x50]
call fcn.14005b104
jmp 0x140096ecc
test r12b, 0x10
mov edi, esi
mov rcx, rax
cmovne edi, ebp
mov r15d, ebp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov edx, 0x5c
cmp dx, word [rbx + rcx*2 - 2]
jne 0x140096e94
mov edi, ebp
mov word [rbx + rcx*2 - 2], si
cmp edi, esi
jne 0x140096eae
cmp r12d, 3
jne 0x140096eae
mov rcx, r13
call fcn.140101d34
mov edi, esi
cmp eax, esi
setne dil
mov r8d, edi
mov rdx, r13
mov rcx, rbx
call fcn.140060600
cmp eax, esi
je 0x140096ec4
mov ebp, esi
jmp 0x140096ecc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rcx, [rsp + 0x40]
call fcn.14005b104
lea rcx, [rsp + 0x48]
call fcn.14005b104
lea rcx, [rsp + 0x58]
call fcn.14005b104
movsxd rax, ebp
jmp 0x140096f66
cmp word [r13], si
jne 0x140096f01
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140096f39
lea r8, [rdi + 8]
lea r9, [rsp + 0x70]
mov edx, 0x208
mov rcx, r13
call fcn.14006459c
mov edx, 0x5c
mov rcx, rbx
lea eax, [rdx - 0x1d]
mov word [rdi], dx
mov word [rdi + 6], dx
mov rdx, rdi
mov word [rdi + 2], ax
mov word [rdi + 4], ax
call fcn.1400604b0
cmp eax, esi
jne 0x140096f45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rcx, [rsp + 0x40]
call fcn.14005b104
lea rcx, [rsp + 0x48]
call fcn.14005b104
lea rcx, [rsp + 0x58]
call fcn.14005b104
movsxd rax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret