Function at 0x10002b104
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rsi, [0x1001653b8]
lea r12, [0x100003d08]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b156
test byte [rcx + 0x1c], 1
je 0x10002b156
cmp byte [rcx + 0x19], 4
jb 0x10002b156
mov edx, 0x14f
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
and qword [rsp + 0x90], 0
xor ebp, ebp
mov qword [rsp + 0x80], rbp
xor r13d, r13d
mov qword [rsp + 0x88], r13
cmp qword [rbx + 0x1d8], rbp
jne 0x10002b195
lea r8, [0x100004b40]
mov edx, 0x1b97
lea rcx, [0x1000046e0]
call fcn.100099ad8
cmp qword [rbx + 0x350], rbp
jne 0x10002b1b6
lea r8, [0x100004b60]
mov edx, 0x1b98
lea rcx, [0x1000046e0]
call fcn.100099ad8
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rbx + 0x1d8]
call fcn.1001248bc
mov edi, eax
mov r14, qword [rsp + 0x90]
test eax, eax
js 0x10002b46c
test byte [rbx + 0x150], 4
je 0x10002b2d4
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.10010bcc8
mov edi, eax
test eax, eax
jns 0x10002b25e
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b251
test byte [rcx + 0x1c], 1
je 0x10002b251
cmp byte [rcx + 0x19], 2
jb 0x10002b251
mov edx, 0x150
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001e360
mov rbp, qword [rsp + 0x80]
mov rcx, qword [0x1001653b8]
jmp 0x10002b44c
mov rbp, qword [rsp + 0x80]
jmp 0x10002b44c
mov rbp, qword [rsp + 0x80]
test rbp, rbp
je 0x10002b2d4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002b2d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b44c
test byte [rcx + 0x1c], 1
je 0x10002b44c
cmp byte [rcx + 0x19], 2
jb 0x10002b44c
mov edx, 0x151
mov dword [rsp + 0x20], edi
mov r9, rbp
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
jmp 0x10002b44c
test byte [rbx + 0x150], 1
je 0x10002b2fc
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.10009b4ec
mov edi, eax
test eax, eax
js 0x10002b45b
jmp 0x10002b31c
lea r8, [rsp + 0x88]
mov dl, 1
mov rcx, qword [rbx + 0x1d8]
call fcn.1001248bc
mov edi, eax
test eax, eax
js 0x10002b45b
mov r9, qword [rbx + 0x350]
mov r8d, dword [rbx + 0x14c]
mov r13, qword [rsp + 0x88]
mov rdx, r13
mov rcx, r14
call fcn.10010b3bc
mov edi, eax
test eax, eax
js 0x10002b452
test byte [rbx + 0x150], 0x80
je 0x10002b445
cmp byte [rbx + 0x11c], 0
je 0x10002b445
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x80], rax
test rax, rax
je 0x10002b385
mov rcx, rax
call fcn.100043fcc
mov rsi, rax
jmp 0x10002b387
xor esi, esi
mov rdx, r14
mov rcx, rsi
call fcn.10001ec50
mov edi, eax
test eax, eax
js 0x10002b413
mov rdx, qword [rbx + 0x350]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, rsi
call fcn.10001ef7c
mov edi, eax
test eax, eax
js 0x10002b413
mov r12, qword [rbx + 0x310]
cmp r12, qword [rbx + 0x318]
jb 0x10002b3f0
lea rdx, [r12 + 1]
lea rcx, [rbx + 0x308]
call fcn.100043a28
test al, al
jne 0x10002b3f0
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rbx + 0x308]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x10002b403
mov qword [rcx], rsi
inc qword [rbx + 0x310]
xor esi, esi
lea r12, [0x100003d08]
test rsi, rsi
je 0x10002b435
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
jmp 0x10002b44c
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
jmp 0x10002b44c
mov rcx, qword [0x1001653b8]
test edi, edi
jns 0x10002b49f
jmp 0x10002b473
mov rcx, qword [0x1001653b8]
jmp 0x10002b473
mov r13, qword [rsp + 0x88]
mov rcx, qword [0x1001653b8]
jmp 0x10002b473
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b49f
test byte [rcx + 0x1c], 1
je 0x10002b49f
cmp byte [rcx + 0x19], 2
jb 0x10002b49f
mov edx, 0x152
mov r9d, edi
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
test r14, r14
je 0x10002b4b4
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test r13, r13
je 0x10002b4c9
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test rbp, rbp
je 0x10002b4de
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002b500
test byte [rcx + 0x1c], 1
je 0x10002b500
cmp byte [rcx + 0x19], 4
jb 0x10002b500
mov edx, 0x153
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
mov eax, edi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret