Function at 0x140039024
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, edx
mov rdi, rcx
mov r14d, 1
mov rcx, qword [0x14009b020]
lea rbx, [0x14009b020]
mov r12b, 4
cmp rcx, rbx
je 0x140039082
test byte [rcx + 0x1c], r12b
je 0x140039082
cmp byte [rcx + 0x19], 5
jb 0x140039082
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x72]
lea r8, [0x14008cd68]
call fcn.1400042fc
mov rcx, qword [rdi + 0x198]
xor ebp, ebp
test rcx, rcx
je 0x1400390d4
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400390d4
mov rcx, qword [0x14009b020]
cmp rcx, rbx
je 0x1400390f6
test byte [rcx + 0x1c], r12b
je 0x1400390f6
lea ebp, [rax + 2]
cmp byte [rcx + 0x19], bpl
jb 0x1400390f6
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008cd68]
call fcn.1400046fc
jmp 0x1400390f6
mov rcx, rdi
call fcn.140038b88
lea r15d, [rax + 0x678]
mov ecx, r15d
mov ebx, r15d
call fcn.140069c6c
mov rsi, rax
test rax, rax
jne 0x1400390fd
xor eax, eax
jmp 0x1400397d3
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov eax, 0x678
lea rcx, [rsi + 0x470]
mov qword [rsp + 0x70], rax
mov r9, rdi
mov dword [rsi], eax
mov r8d, 0x100
mov rax, qword [rdi + 0x10]
sub r9, rcx
mov qword [rsi + 8], rax
mov edx, r8d
mov rax, qword [rdi + 0x18]
mov ebp, 2
mov qword [rsi + 0x10], rax
xor ebx, ebx
mov rax, qword [rdi + 0x1a0]
mov qword [rsi + 0x180], rax
mov rax, qword [rdi + 0x1a8]
mov qword [rsi + 0x188], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x18], eax
mov eax, dword [rdi + 0x734]
mov dword [rsi + 0x28], eax
mov eax, dword [rdi + 0x698]
mov dword [rsi + 0x670], eax
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x14003919f
movzx eax, word [r9 + rcx + 0x498]
test ax, ax
je 0x14003919f
mov word [rcx], ax
add rcx, rbp
sub rdx, r14
jne 0x14003917a
test rdx, rdx
lea rax, [rcx - 2]
mov r10d, 0x8007007a
cmovne rax, rcx
mov word [rax], bx
mov rax, rdx
neg rax
sbb r9d, r9d
not r9d
and r9d, r10d
test rdx, rdx
jne 0x140039203
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400391fb
test byte [rcx + 0x1c], r12b
je 0x1400391fb
cmp byte [rcx + 0x19], bpl
jb 0x1400391fb
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008cd68]
call fcn.140004328
mov r14d, ebx
jmp 0x1400397c8
lea rcx, [rsi + 0x22c]
mov rdx, rdi
sub rdx, rcx
lea rax, [r8 + 0x7ffffefe]
test rax, rax
je 0x140039234
movzx eax, word [rdx + rcx + 0x288]
test ax, ax
je 0x140039234
mov word [rcx], ax
add rcx, rbp
sub r8, r14
jne 0x140039210
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
mov rax, r8
neg rax
sbb r9d, r9d
not r9d
and r9d, r10d
test r8, r8
jne 0x14003927e
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400391fb
test byte [rcx + 0x1c], r12b
je 0x1400391fb
cmp byte [rcx + 0x19], bpl
jb 0x1400391fb
lea edx, [r8 + 0x76]
jmp 0x1400391eb
mov eax, dword [rdi + 0x40]
mov dword [rsi + 0x2c], eax
mov eax, dword [rdi + 0xe8]
mov dword [rsi + 0xc0], eax
mov eax, dword [rdi + 0x17c]
mov dword [rsi + 0x154], eax
mov eax, dword [rdi + 0x178]
mov dword [rsi + 0x150], eax
mov eax, dword [rdi + 0x184]
mov dword [rsi + 0x158], eax
cmp dword [rdi + 0x24], ebp
jne 0x1400392cb
mov rax, qword [rdi + 0x248]
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x220], rcx
mov eax, dword [rdi + 0x250]
mov dword [rsi + 0x228], eax
mov rax, qword [rdi + 0x488]
mov qword [rsi + 0x460], rax
mov rax, qword [rdi + 0x490]
mov qword [rsi + 0x468], rax
mov rcx, qword [rdi + 0x198]
test rcx, rcx
je 0x14003933a
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
mov qword [rsi + 0x178], 0x678
lea rcx, [rsi + 0x678]
mov rdx, qword [rdi + 0x198]
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rax, [rbx + 0x678]
mov qword [rsp + 0x70], rax
mov rcx, qword [rdi + 0x1b8]
lea rdx, [rsi + 0x190]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006b698
xorps xmm0, xmm0
mov dword [rsp + 0x20], r15d
movups xmmword [rsi + 0x450], xmm0
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x70]
mov r8, rsi
lea rdx, [rsi + 0x20]
call fcn.14006b698
cmp dword [rdi + 0x24], 0x20
je 0x14003938a
cmp dword [rdi + 0x24], 8
jne 0x1400393a4
mov rcx, qword [rdi + 0x48]
lea rdx, [rsi + 0x30]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006b698
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0x50]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003b5f8
test eax, eax
jne 0x14003940d
lea r14d, [rax + 0x7a]
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400397c8
test byte [rcx + 0x1c], r12b
je 0x1400397c8
cmp byte [rcx + 0x19], bpl
jb 0x1400397c8
lea edx, [rax + 0x77]
mov r9d, dword [rdi + 0x20]
lea r8, [0x14008cd68]
mov rcx, qword [rcx + 0x10]
call fcn.1400046fc
jmp 0x1400397c8
lea rdx, [rsi + 0x98]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0xb0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.140039c44
test eax, eax
jne 0x140039465
lea r14d, [rax + 0x7a]
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400397c8
test byte [rcx + 0x1c], r12b
je 0x1400397c8
cmp byte [rcx + 0x19], bpl
jb 0x1400397c8
lea edx, [rax + 0x78]
jmp 0x1400393f4
lea rdx, [rsi + 0xc8]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0xf0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003c640
test eax, eax
jne 0x1400394c0
lea r14d, [rax + 0x7a]
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400397c8
test byte [rcx + 0x1c], r12b
je 0x1400397c8
cmp byte [rcx + 0x19], bpl
jb 0x1400397c8
lea edx, [rax + 0x79]
jmp 0x1400393f4
mov rcx, qword [rdi + 0x190]
lea rdx, [rsi + 0x170]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r15d
mov r8, rsi
call fcn.14006b698
lea rdx, [rsi + 0x198]
mov dword [rsp + 0x20], r15d
lea rcx, [rdi + 0x1c0]
mov r8, rsi
lea r9, [rsp + 0x70]
call fcn.14003c640
test eax, eax
jne 0x14003953b
lea r14d, [rax + 0x7a]
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400397c8
test byte [rcx + 0x1c], r12b
je 0x1400397c8
cmp byte [rcx + 0x19], bpl
jb 0x1400397c8
mov edx, r14d
jmp 0x1400393f4
cmp dword [rdi + 0x24], 8
jne 0x1400395ba
mov r9d, r15d
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rdi
call fcn.1400403cc
mov r14d, eax
test eax, eax
jne 0x1400395ba
mov rax, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rax, r15
je 0x1400397c8
test byte [rax + 0x1c], r12b
je 0x1400397c8
cmp byte [rax + 0x19], bpl
jb 0x1400397c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
lea edx, [r14 + 0x7b]
mov r9d, dword [rdi + 0x20]
lea r8, [0x14008cd68]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400238a8
jmp 0x1400397c8
mov rcx, qword [rdi + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 0x80000080
mov edx, 0x40000000
mov dword [rsp + 0x20], ebp
call fcn.14006b8bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140039627
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x14003961f
test byte [rcx + 0x1c], r12b
je 0x14003961f
cmp byte [rcx + 0x19], bpl
jb 0x14003961f
mov r9d, dword [rdi + 0x20]
lea edx, [rax + 0x7d]
mov rax, qword [rdi + 0x38]
lea r8, [0x14008cd68]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.14000c6bc
xor r14d, r14d
jmp 0x1400397c8
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.140038db4
test eax, eax
je 0x140039778
test r13d, r13d
je 0x140039728
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x14003968b
test byte [rcx + 0x1c], r12b
je 0x14003968b
cmp byte [rcx + 0x19], bpl
jb 0x14003968b
mov r9d, dword [rdi + 0x20]
lea r8, [0x14008cd68]
mov rcx, qword [rcx + 0x10]
mov edx, 0x7d
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140037428
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x1400396de
mov rax, qword [0x14009b020]
cmp rax, r15
je 0x1400396de
test byte [rax + 0x1c], r12b
je 0x1400396de
cmp byte [rax + 0x19], bpl
jb 0x1400396de
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
mov r9, qword [rsi + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400413b4
mov rcx, qword [rdi + 0x38]
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14003976d
mov rax, qword [0x14009b020]
cmp rax, r15
je 0x14003976d
test byte [rax + 0x1c], r12b
je 0x14003976d
cmp byte [rax + 0x19], bpl
jb 0x14003976d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b020]
mov edx, 0x7f
jmp 0x14003974c
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x14003976d
test byte [rcx + 0x1c], r12b
je 0x14003976d
cmp byte [rcx + 0x19], bpl
jb 0x14003976d
mov edx, 0x80
mov r9d, dword [rdi + 0x20]
lea r8, [0x14008cd68]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140037428
xor r14d, r14d
cmp rbx, 0xffffffffffffffff
je 0x1400397c8
jmp 0x1400397b9
mov rcx, qword [0x14009b020]
lea r15, [0x14009b020]
cmp rcx, r15
je 0x1400397b9
test byte [rcx + 0x1c], r12b
je 0x1400397b9
cmp byte [rcx + 0x19], 5
jb 0x1400397b9
mov rax, qword [rdi + 0x38]
lea r8, [0x14008cd68]
mov r9d, dword [rdi + 0x20]
mov edx, 0x81
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.14000c6bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rsi
call fcn.140069d30
mov eax, r14d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret