Function at 0x140023f00
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rsi, rcx
lea rbx, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rbx
lea r14, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], r14
lea r15, str.WRTDELET
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x107
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
xor r13d, r13d
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [r13 + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.14001cce0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp - 8], r13
lea rax, [0x1400f83c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], 0x20019
mov edi, r13d
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140055440
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400f9ec0]
bt eax, 0x16
jae 0x140055448
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400554a1
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [0x1400f9ec0]
mov r14d, 0x7530
bt eax, 0x18
jae 0x1400554a9
mov ebx, 1
mov r12d, r14d
mov r15d, 0xc350
lea r8, [0x140100020]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.1400179f0
test al, al
je 0x1400240c5
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x20]
test ebx, ebx
je 0x1400554b7
lea rdx, str.MaxDeletionTimeOptimized
call fcn.1400180a4
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400554c3
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeFilespec
lea rcx, [rbp - 0x20]
call fcn.1400180a4
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400554cf
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeGlobal
lea rcx, [rbp - 0x20]
call fcn.1400180a4
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400554db
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9b, 1
lea r8, [rbp]
movzx edx, r9b
mov rcx, rsi
call fcn.140023300
mov r8, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [fcn.140017050]
mov rdx, qword [rbp + 0x10]
call fcn.14002a370
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov r14, rax
mov rbx, qword [rbp + 8]
add rbx, 0x10
lea r15, str.base_stor_vssmoduleswritersdeletewriter.cpp
lea rax, [rbx - 0x10]
cmp rax, qword [rbp + 0x10]
je 0x140024241
mov al, 1
test al, al
je 0x140024248
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp edi, ecx
je 0x140024229
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x1400fd5a8]
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call fcn.140027130
mov esi, eax
mov dword [rbp + 0x38], eax
test eax, eax
js 0x1400554e7
xor al, al
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
test al, al
jne 0x1400554ee
lea rsi, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x171
call sub.msvcrt.dll_memset
lea r9, [rbp + 0xa0]
lea r8, str.deleting_file__s
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.14001cc70
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
je 0x140055531
add rbx, 0x48
inc edi
jmp 0x140024130
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
lea rcx, [r12 + r14]
cmp rax, rcx
jbe 0x140024166
jmp 0x1400555a2
xor al, al
jmp 0x140024140
lea rcx, [rbp - 0x20]
call fcn.1400181d0
lea rcx, [rbp - 0x10]
call fcn.140014130
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140024276
mov rdx, qword [rbp + 0x10]
call fcn.140024c30
mov rcx, qword [rbp + 8]
call fcn.140031d4c
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
lea rcx, [rbp + 0x30]
call fcn.14001ce00
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400321c0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, r13d
jmp 0x140023fee
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], VarUI4FromDisp
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.skipping_file_deletion_since_autorecovery_isnt_enabled
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.14001cc70
nop
jmp 0x140024248
mov eax, r13d
jmp 0x140024012
mov ebx, r13d
mov r12d, 0x2710
jmp 0x14002402a
lea rdx, str.MaxDeletionTime
jmp 0x140024068
imul r12d, eax, 0x3e8
jmp 0x140024079
imul r14d, eax, 0x3e8
jmp 0x14002409f
imul r15d, eax, 0x3e8
jmp 0x1400240c5
mov al, 1
jmp 0x140024199
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x16c
call sub.msvcrt.dll_memset
mov r9d, esi
lea r8, str.StringCchPrintf_failed_with_0x_08lx
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.14001cc70
nop
jmp 0x14002421e
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x175
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0xa0]
lea r8, str.failed_to_delete_file__s_from_snapshot.__Error__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.14001cc70
nop
jmp 0x14002421e
mov qword [rsp + 0x38], r15
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x15c
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, 4
lea r8, [rsp + 0x38]
mov edx, 0x201c
lea rcx, [rbp + 0x30]
call fcn.1400db328
nop
jmp 0x140024248