Function at 0x14000e270
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1400ad768]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, qword [rbp + 0x228]
xor ebx, ebx
mov rax, qword [rbp + 0x230]
mov r12, r8
mov r15, qword [0x1400af190]
mov esi, ebx
mov r13, qword [rbp + 0x220]
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x38], edx
mov qword [rbp - 0x78], r8
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
test r8, r8
je 0x140027ecf
test r13, r13
je 0x140027ecf
test r14, r14
je 0x140027ecf
test rax, rax
je 0x140027ecf
test byte [0x1400af180], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xf0003
jne 0x140027d5c
mov dword [rsp + 0x28], 1
lea r8, [rbp - 0x60]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
lea rdx, [rbp - 0x68]
xor ecx, ecx
call fcn.14000eb50
test byte [0x1400af180], 2
mov ebx, eax
jne 0x140027d7e
test ebx, ebx
je 0x14000e47a
lea rcx, [0x1400af060]
mov esi, 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140027eb1
cmp dword [rbx], 0x6060
jne 0x140027eb1
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x140027da0
lea rcx, [0x1400af060]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x140027dba
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rax + 0x118]
call qword [0x14008f7f0]
test eax, eax
je 0x14000e47a
lea rcx, [0x1400af060]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x140027dfe
xor eax, eax
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x50], eax
mov rax, qword [0x1400aeb88]
cmp rax, rbx
je 0x140027e14
test rax, rax
jne 0x140027e24
cmp qword [rbx + 0x18], 0
jne 0x140027e47
lea rcx, [0x1400af060]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x140027e56
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x140027e62
mov r8, qword [rbx + 0x48]
test r8, r8
jne 0x140027e9c
mov rcx, qword [0x1400af198]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edi, edi
mov rbx, qword [r15 + 0x60]
lea r15, [rbx + 8]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
inc dword [rbx + 0x34]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov dword [rbx + 0x30], eax
test edi, edi
js 0x14000e506
mov r14, qword [rsp + 0x60]
xor r9d, r9d
add r14, 0x38
je 0x140027ed9
lea rcx, [r14 + 8]
xor eax, eax
lea edi, [r9 + 1]
test rcx, rcx
je 0x14000e4c2
mov rax, qword [rcx + 0x10]
mov rdx, rax
test rcx, rcx
je 0x14000e4ed
cmp rax, rcx
je 0x14000e5a2
mov eax, dword [rsp + 0x38]
sub eax, dword [rdx + 0x24]
js 0x14000e5a2
test eax, eax
jne 0x14000e599
mov r9, rdx
xor edi, edi
cmp edi, 1
je 0x140027eeb
cmp dword [rsp + 0x58], 0
jne 0x140027eeb
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x40]
test r12, r12
je 0x14000e519
mov rcx, r12
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r13, r13
je 0x14000e526
mov eax, dword [rsp + 0x50]
mov dword [r13], eax
test r14, r14
je 0x14000e532
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
cmp dword [rsp + 0x30], 0
jne 0x140027fce
test rsi, rsi
jne 0x140027ffb
test edi, edi
js 0x140028015
add dword [rbx + 0x34], 0xffffffff
mov eax, dword [rbx + 0x34]
jne 0x14000e55e
mov dword [rbx + 0x30], 0
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14001aad0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [rdx + 0x10]
jmp 0x14000e4c2
test edi, edi
js 0x14000e5f9
lea r9, [rsp + 0x78]
mov r8d, 0x200
lea rdx, [rbp - 0x40]
mov rcx, r12
call sym.spoolsv.exe_PrvSplGetUserSidStringFromToken
mov edi, eax
test eax, eax
jg 0x140027f1c
test edi, edi
js 0x14000e5f9
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x40]
call fcn.140011eb4
mov edi, eax
test eax, eax
js 0x14000e5f7
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x80]
add rcx, 8
lea rdx, [rbp - 0x40]
call fcn.1400196c4
mov edi, eax
test edi, edi
jne 0x14000e7aa
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x78]
mov r8d, esi
mov qword [rsp + 0x48], rcx
call fcn.14001a194
mov r12, qword [rbp - 0x78]
mov edi, eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
test edi, edi
js 0x140027fc1
mov ecx, 0x40
call fcn.14001a74c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140027fb5
mov r8, qword [rsp + 0x48]
lea rcx, [0x140075490]
mov dword [rax + 8], 0x6b6e6c74
lea rsi, [rax + 0x30]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x38]
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
mov dword [rax + 0x20], 0x746e6573
mov dword [rax + 0x24], ecx
lea rcx, [0x1400af054]
mov qword [rax + 0x28], r8
mov dword [rsi], 0x67727473
mov qword [rsi + 8], rcx
cmp qword [rax + 0x28], 0
je 0x140027f4f
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, r8
call fcn.140013dd4
mov edi, eax
test eax, eax
js 0x14000e6f4
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 0
call fcn.14001447c
test eax, eax
je 0x140027f56
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140027f78
mov rdx, rcx
mov rcx, rsi
call fcn.140011eb4
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000e704
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test edi, edi
js 0x140027fc1
xor r9d, r9d
test r14, r14
je 0x140027f82
lea r8, [r14 + 8]
xor ecx, ecx
test r8, r8
je 0x14000e727
mov rcx, qword [r8 + 0x10]
mov r15d, dword [rsp + 0x38]
test r8, r8
je 0x14000e73a
cmp rcx, r8
jne 0x14000e81d
mov rdx, qword [rsp + 0x40]
mov rcx, rdx
call fcn.140011bec
lea r15, [rbx + 8]
mov edi, eax
test eax, eax
js 0x14000e771
test r9, r9
je 0x14000e837
mov rcx, r9
call fcn.140011bec
test eax, eax
js 0x14000e837
call fcn.140011b8c
mov edi, eax
test edi, edi
js 0x140027fc1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbp - 0x70]
inc dword [rax + 0x24]
test rcx, rcx
jne 0x140027f8c
mov r14, qword [rsp + 0x70]
xor esi, esi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x50], 1
jmp 0x14000e50b
cmp edi, 1
jne 0x14000e61a
lea ecx, [rdi + 0x4f]
call fcn.14001a74c
test rax, rax
je 0x140027f3c
mov r9d, esi
lea rdx, [rbp - 0x40]
mov r8, r12
mov rcx, rax
call fcn.140019d50
mov qword [rsp + 0x48], rax
mov r8, rax
test rax, rax
je 0x140027f45
cmp qword [rax + 0x38], 0
je 0x140027f2a
mov rsi, qword [rsp + 0x60]
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x34], edi
xor r12d, r12d
lea rcx, [rsi + 8]
call fcn.140019568
mov edi, eax
test eax, eax
js 0x14000e61a
inc dword [rsi + 0x30]
jmp 0x14000e61a
mov eax, r15d
sub eax, dword [rcx + 0x24]
test eax, eax
jle 0x14000e73a
mov r9, rcx
mov rcx, qword [rcx + 0x10]
jmp 0x14000e72c
mov rcx, r8
jmp 0x14000e76a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r9d, r9d
lea rdx, [0x140092150]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.14005f2ec
nop
jmp 0x14000e349
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
xor r9d, r9d
lea rdx, [0x140092170]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.14005f2ec
nop
jmp 0x14000e376
test byte [rax + 0xc], 2
je 0x14000e3b6
xor edx, edx
mov rcx, rbx
call fcn.140004ecc
nop
jmp 0x14000e3b6
mov rax, qword [0x1400ad2f8]
lea rdx, [0x1400ad2f8]
cmp rax, rdx
je 0x140027dec
test byte [rax + 0x1c], 4
je 0x140027dec
mov rcx, qword [rax + 0x10]
lea r8, [0x140093720]
mov edx, 0x14
call fcn.14002ef94
mov rcx, qword [rbx + 0x60]
call fcn.14000fbe4
mov qword [rbx + 0x60], 0
jmp 0x14000e3d0
mov qword [rax + 8], 0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140027dfe
jmp 0x14000e407
mov rax, qword [rbx + 0x28]
mov qword [0x1400aeb88], rax
jmp 0x14000e428
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, rbx
je 0x140027e3b
test rax, rax
jne 0x140027e24
jmp 0x14000e428
mov rax, qword [rbx + 0x28]
mov qword [rcx], rax
jmp 0x14000e428
lea rcx, [rbx + 0x18]
call fcn.140005150
nop
jmp 0x14000e433
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
jmp 0x14000e44e
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140027e7c
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400af198]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov qword [rbx + 0x40], 0
jmp 0x14000e45b
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop
jmp 0x14000e468
lea rcx, [0x1400af060]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop
jmp 0x14000e47a
mov edi, 0x80070057
jmp 0x14000e47c
mov r14, qword [rsp + 0x70]
mov edi, 0x80070057
mov rsi, r9
jmp 0x14000e50b
test r9, r9
je 0x14000e5a2
lea rdx, [rbp - 0x70]
mov rcx, r9
call fcn.1400697d0
mov edi, eax
mov edx, 1
mov rax, qword [r9]
mov rcx, r9
mov rax, qword [rax]
call qword [0x14008f7f0]
nop
jmp 0x14000e5a2
movzx edi, ax
or edi, 0x80070000
jmp 0x14000e5c7
mov edi, 0x80004005
mov dword [rsp + 0x30], 1
jmp 0x140027fc1
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 1
jmp 0x140027fbc
mov edi, 0x80004005
jmp 0x140027fc1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140027f6b
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14000e6f4
jmp 0x14000e6ce
mov edi, 0x80070057
jmp 0x14000e6ee
mov edi, 0x80070057
jmp 0x14000e771
cmp dword [rcx + 0x24], 0
jne 0x14000e78e
mov rax, qword [rsp + 0x60]
mov edx, 1
dec dword [rax + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x14008f7f0]
nop
jmp 0x14000e78e
xor edx, edx
mov qword [rsp + 0x40], rdx
mov edi, 0x8007000e
mov dword [rsp + 0x34], 0
jmp 0x14000e501
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
dec dword [rax + 0x30]
test rcx, rcx
je 0x14000e53d
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x14008f7f0]
nop
jmp 0x14000e53d
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [0x14008f7f0]
nop
jmp 0x14000e546
mov rcx, qword [0x1400ad2f8]
lea rax, [0x1400ad2f8]
cmp rcx, rax
je 0x14000e54e
test byte [rcx + 0x1c], 0x20
je 0x14000e54e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a2218]
mov edx, 0xc
mov r9d, edi
call fcn.14002efb8
nop
jmp 0x14000e54e