Function at 0x140004b30
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x270
mov rbx, qword [0x14000d488]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rdi, rax
mov qword [rsp + 0x2c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rcx, rsi
mov rbp, rax
call fcn.1400018c0
xor r9d, r9d
lea r12d, [r9 + 0x5c]
test rdi, rdi
je 0x140004c19
test rax, rax
je 0x140004c19
cmp rdi, rax
je 0x140004c19
movzx edx, word [rax]
mov rcx, rdi
test dx, dx
je 0x140004c10
sub rax, rdi
nop dword [rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140004c00
mov word [rcx], r9w
mov rax, rdi
jmp 0x140004c21
mov rax, rdi
test rdi, rdi
je 0x140004c64
cmp word [rdi], r9w
je 0x140004c3a
nop word [rax + rax]
add rax, 2
cmp word [rax], r9w
jne 0x140004c30
lea rdx, [0x14000b718]
movzx ecx, r12w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004c50
mov word [rax], r9w
mov rax, qword [0x14000d460]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call rax
mov qword [rsp + 0x2b8], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005058
mov qword [rsp + 0x2c8], r13
lea r13, [0x14000b730]
nop dword [rax]
test byte [rsp + 0x20], 0x10
je 0x140004e31
lea rdx, [0x14000b724]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140004fa3
lea rdx, [0x14000b728]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140004fa3
mov rcx, rsi
call fcn.1400018c0
test r14, r14
je 0x140004d2c
test rax, rax
je 0x140004d2c
cmp r14, rax
je 0x140004d2c
movzx edx, word [rax]
mov rcx, r14
test dx, dx
je 0x140004d20
sub rax, r14
nop dword [rax]
nop dword [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140004d10
xor r8d, r8d
mov rax, r14
mov word [rcx], r8w
jmp 0x140004d3b
mov rax, r14
test r14, r14
je 0x140004db4
xor r8d, r8d
cmp word [r14], 0
je 0x140004d4c
add rax, 2
cmp word [rax], 0
jne 0x140004d42
mov rdx, r13
movzx ecx, r12w
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004d60
mov word [rax], r8w
mov rax, r14
cmp word [r14], cx
je 0x140004d8a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140004d80
movzx ecx, word [rsp + 0x4c]
test cx, cx
je 0x140004db0
lea rdx, [rsp + 0x4c]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004da0
mov word [rax], r8w
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140004dc0
mov rdi, qword [0x14000d488]
lea rbx, [rsi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
xor edi, edi
mov edx, edi
test rsi, rsi
je 0x140004e10
nop word [rax + rax]
movzx ecx, byte [r14 + rdx*2]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jb 0x140004e00
mov rcx, rax
mov byte [rax + rsi], dil
call fcn.140004b30
mov rsi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2b8]
jmp 0x140004f0c
mov rcx, rsi
call fcn.1400018c0
test rbp, rbp
je 0x140004e7a
test rax, rax
je 0x140004e7a
cmp rbp, rax
je 0x140004e7a
movzx edx, word [rax]
mov rcx, rbp
test dx, dx
je 0x140004e70
sub rax, rbp
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140004e60
xor edi, edi
mov rax, rbp
mov word [rcx], di
jmp 0x140004e84
xor edi, edi
mov rax, rbp
test rbp, rbp
je 0x140004f03
cmp word [rbp], 0
je 0x140004e9a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140004e90
mov rdx, r13
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004eb0
mov word [rax], di
mov rax, rbp
cmp word [rbp], cx
je 0x140004eda
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140004ed0
movzx ecx, word [rsp + 0x4c]
test cx, cx
je 0x140004f00
lea rdx, [rsp + 0x4c]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004ef0
mov word [rax], di
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call fcn.1400018c0
test r15, r15
je 0x140004f58
test rax, rax
je 0x140004f58
cmp r15, rax
je 0x140004f58
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140004f50
sub rax, r15
nop dword [rax]
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140004f40
mov word [rcx], di
mov rax, r15
jmp 0x140004f60
mov rax, r15
test r15, r15
je 0x140004fa3
cmp word [r15], 0
je 0x140004f7a
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140004f70
mov rdx, r13
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140004f90
mov word [rax], di
mov rax, qword [0x14000d448]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rax
test eax, eax
jne 0x140004ca0
mov rcx, rsi
call fcn.1400018c0
mov r8, qword [rsp + 0x2c0]
test r8, r8
je 0x14000500c
test rax, rax
je 0x14000500c
cmp r8, rax
je 0x14000500c
movzx edx, word [rax]
mov rcx, r8
test dx, dx
je 0x140005000
sub rax, r8
nop dword [rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140004ff0
xor r9d, r9d
mov rax, r8
mov word [rcx], r9w
jmp 0x140005017
mov rax, r8
test r8, r8
je 0x140005047
xor r9d, r9d
cmp word [r8], 0
je 0x14000502a
nop
add rax, 2
cmp word [rax], 0
jne 0x140005020
sub r13, rax
nop dword [rax]
mov word [rax], r12w
lea rax, [rax + 2]
movzx r12d, word [rax + r13]
test r12w, r12w
jne 0x140005030
mov word [rax], r9w
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r13, qword [rsp + 0x2c8]
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret