Function at 0x13f48
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x110
mov ebx, edx
mov rdi, rcx
xor r14d, r14d
mov dword [r11 - 0xb8], r14d
xor eax, eax
mov dword [rsp + 0x84], eax
mov qword [r11 - 0xb0], rax
mov dword [r11 - 0x98], r14d
xor edx, edx
lea r8d, [r14 + 0x28]
lea rcx, [r11 - 0x90]
call fcn.0001a360
mov qword [rsp + 0x158], r14
mov rsi, r14
mov r12, r14
mov qword [rsp + 0x90], r14
mov r13, r14
mov qword [rsp + 0x98], r14
mov ecx, 0xc0000001
mov dword [0x0001ce3c], ecx
mov qword [rsp + 0xd8], rdi
lea eax, [rbx - 2]
mov word [rsp + 0xd0], ax
mov word [rsp + 0xd2], bx
lea edx, [r14 + 0x30]
mov dword [rsp + 0xa0], edx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
lea eax, [rdx + 0x10]
mov dword [rsp + 0xb8], eax
mov dword [rsp + 0xa0], edx
mov qword [rsp + 0xa8], r14
mov dword [rsp + 0xb8], eax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], r14
cmp qword [0x0001c878], r14
je 0x141d0
mov rcx, rdi
call fcn.00013168
mov rsi, rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x70], rax
mov edi, 0x800
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
lea ebx, [r14 + 0x60]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov edx, 0x100181
lea rcx, [rsp + 0x150]
call qword [0x0001c878]
mov ecx, eax
mov dword [0x0001ce3c], eax
cmp eax, r14d
je 0x14163
lea rcx, [rsp + 0x90]
call fcn.00013000
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.00012eb8
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov edx, 0x100181
lea rcx, [rsp + 0x150]
call qword [0x0001c878]
mov ecx, eax
mov dword [0x0001ce3c], eax
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x98]
cmp ecx, r14d
je 0x141d5
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov edx, 0x100001
lea rcx, [rsp + 0x150]
call qword [0x0001c878]
mov ecx, eax
mov dword [0x0001ce3c], eax
jmp 0x141d5
mov ebx, 0x60
cmp ecx, r14d
je 0x14211
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov edx, 0x100001
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ecx, eax
mov dword [0x0001ce3c], eax
cmp ecx, r14d
jne 0x1434e
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x158]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, r14d
jne 0x1433a
mov rax, qword [rsp + 0x158]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], r14
mov rax, qword [rsp + 0x158]
mov byte [rax + 0x4c], 1
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [0x0001ce3c], eax
cmp eax, r14d
je 0x1431a
mov dword [rsp + 0xe0], r14d
xor edx, edx
lea r8d, [rdx + 0x24]
lea rcx, [rsp + 0xe4]
call fcn.0001a360
mov ebx, 4
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0x24]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [0x0001ce3c], eax
cmp eax, r14d
jne 0x14306
mov dword [rsp + 0x100], 0x20
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0x24]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [0x0001ce3c], eax
cmp eax, r14d
je 0x1432c
mov rax, qword [rsp + 0x158]
bts dword [rax + 0x50], 0x10
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [0x0001ce3c]
cmp ecx, r14d
je 0x14369
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ecx, eax
mov dword [0x0001ce3c], eax
cmp r12, r14
je 0x14381
lea rcx, [rsp + 0x90]
call fcn.00013000
mov ecx, dword [0x0001ce3c]
cmp r13, r14
je 0x1439c
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.00012eb8
mov ecx, dword [0x0001ce3c]
jmp 0x143a4
mov eax, ecx
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret