Function at 0x1000bb1c8
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xad0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0xac0], rax
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
mov dword [rsp + 0x40], ebx
xor r14d, r14d
mov word [rsp + 0x280], r14w
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x282]
call sub.msvcrt.dll_memset
mov word [rsp + 0x70], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov word [rsp + 0x490], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x492]
call sub.msvcrt.dll_memset
mov word [rsp + 0x8b0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x8b2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x6a0], r14w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x6a2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x50], r14d
cmp ebx, dword [rbp + 0xa8]
jne 0x1000bb2b2
lea edi, [r14 + 1]
mov ebx, edi
jmp 0x1000bba83
cmp dword [rbp + 0xa8], r14d
jne 0x1000bb326
xor r9d, r9d
lea r8, [rbp + 0xa8]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000b235c
cmp eax, r14d
jne 0x1000bb326
mov r9d, dword [rsp + 0x40]
cmp r9d, dword [rbp + 0xa8]
jne 0x1000bb326
mov edi, 1
mov ebx, edi
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba83
test byte [rcx + 0x1c], 4
je 0x1000bba83
lea edx, [rdi + 0x6c]
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba83
mov qword [rsp + 0x20], r12
lea r9, [0x10001a510]
lea r8, [0x10001a760]
mov esi, 0x104
mov rdx, rsi
lea rcx, [rsp + 0x8b0]
call fcn.100058674
mov ebx, eax
mov edi, 1
cmp eax, r14d
jge 0x1000bb396
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
lea edx, [rdi + 0x6d]
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
lea r9, [rsp + 0x44]
lea r8, [0x10001b0b8]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000aa3f4
cmp eax, r14d
jne 0x1000bb3fe
cmp dword [rsp + 0x44], edi
jne 0x1000bb3fe
mov ebx, edi
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba83
test byte [rcx + 0x1c], 4
je 0x1000bba83
mov edx, 0x6f
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
jmp 0x1000bba83
mov r9, r12
lea r8, [0x10001ab70]
mov rdx, rsi
lea rcx, [rsp + 0x6a0]
call fcn.100058674
mov ebx, eax
cmp eax, r14d
jge 0x1000bb45d
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x70
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
lea r9, [rsp + 0x280]
lea r8, [rsp + 0x40]
mov edx, dword [rbp + 0x2bc]
mov rcx, r12
call fcn.1000b235c
cmp eax, r14d
je 0x1000bb4ca
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x71
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x490]
lea r8, [0x10001b0e8]
lea rdx, [rsp + 0x8b0]
mov rcx, 0xffffffff80000002
call fcn.1000aa038
cmp eax, r14d
je 0x1000bb55d
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x10001b110]
mov rdx, rsi
lea rcx, [rsp + 0x490]
call fcn.100058674
mov ebx, eax
cmp eax, r14d
jge 0x1000bb55d
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x72
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
mov rdx, rsi
lea rcx, [rsp + 0x70]
mov ebx, r14d
lea r8, [rsp + 0x280]
lea rax, [rsp + 0x70]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r14
je 0x1000bb59b
movzx eax, word [rcx + r8]
cmp ax, r14w
je 0x1000bb59b
mov word [rcx], ax
add rcx, 2
sub rdx, rdi
jne 0x1000bb578
cmp rdx, r14
jne 0x1000bb5a9
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x1000bb5f0
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x73
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [rsp + rcx*2 + 0x70]
lea rax, [rsp + 0x70]
cmp rdx, rax
jbe 0x1000bb635
sub rdx, 2
cmp word [rdx], 0x5c
je 0x1000bb62f
cmp word [rdx], 0x2f
je 0x1000bb62f
cmp word [rdx], 0x3a
je 0x1000bb62f
lea rax, [rsp + 0x70]
cmp rdx, rax
ja 0x1000bb60d
jmp 0x1000bb635
mov word [rdx], r14w
jmp 0x1000bb639
sub rdx, 2
mov eax, r14d
lea rcx, [rsp + 0x70]
cmp rdx, rcx
setne al
cmp eax, r14d
jne 0x1000bb691
mov ebx, 0x80004005
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba40
test byte [rcx + 0x1c], dil
je 0x1000bba40
mov edx, 0x74
lea r9, [rsp + 0x70]
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020614
jmp 0x1000bba40
lea rdx, [0x10001a8e0]
lea rcx, [rsp + 0x70]
call fcn.1000abbc8
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x490]
mov rcx, qword [rbp + 0x90]
call fcn.1000af710
mov ebx, eax
cmp eax, r14d
jge 0x1000bb710
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x75
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
mov rax, qword [rbp + 0x90]
mov r9d, dword [rax + 0x340]
cmp r9d, 0xc8
je 0x1000bb75f
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bb755
test byte [rcx + 0x1c], dil
je 0x1000bb755
mov edx, 0x76
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
mov ebx, 0x80004005
jmp 0x1000bba40
mov rcx, qword [rax + 0x348]
mov r8d, dword [rax + 0x350]
cmp rcx, r14
je 0x1000bba08
cmp r8d, r14d
je 0x1000bba08
cmp dword [rcx], 0x434d5153
je 0x1000bb7bf
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bb7b5
test byte [rcx + 0x1c], dil
je 0x1000bb7b5
mov edx, 0x78
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
mov ebx, 0x10000a0b
jmp 0x1000bba83
lea r11d, [r8 - 0x10]
mov r9d, r11d
mov edx, r14d
lea r10, [rcx + 0x10]
cmp r11d, r14d
jbe 0x1000bb7e6
dec r9d
imul edx, edx, 0x65
movzx eax, byte [r10]
add edx, eax
add r10, rdi
cmp r9d, r14d
ja 0x1000bb7d2
cmp dword [rcx + 8], edx
je 0x1000bb823
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bb819
test byte [rcx + 0x1c], dil
je 0x1000bb819
mov edx, 0x79
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
mov ebx, 0x10000a0b
jmp 0x1000bba83
cmp dword [rcx + 4], r8d
je 0x1000bb861
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bb857
test byte [rcx + 0x1c], dil
je 0x1000bb857
mov edx, 0x7a
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
mov ebx, 0x10000a0b
jmp 0x1000bba83
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r11d
lea r8, [rcx + 0x10]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.1000bc9d8
mov ebx, eax
cmp eax, r14d
jl 0x1000bba40
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [0x10001ac10]
xor r8d, r8d
lea rdx, [rsp + 0x6a0]
call fcn.1000aa598
cmp eax, r14d
je 0x1000bb914
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x7b
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
lea rcx, [rbp + 0xb0]
mov ebx, r14d
lea rdx, [rsp + 0x280]
sub rdx, rcx
lea rax, [rsi + 0x7ffffefa]
cmp rax, r14
je 0x1000bb94b
movzx eax, word [rcx + rdx]
cmp ax, r14w
je 0x1000bb94b
mov word [rcx], ax
add rcx, 2
sub rsi, rdi
jne 0x1000bb929
cmp rsi, r14
jne 0x1000bb959
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r14w
cmp ebx, r14d
jge 0x1000bb9a0
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba3b
test byte [rcx + 0x1c], dil
je 0x1000bba3b
mov edx, 0x7c
mov r9d, ebx
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
jmp 0x1000bba3b
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bb9f9
test byte [rcx + 0x1c], 4
je 0x1000bb9f9
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax + 0x350]
mov edx, 0x7d
mov dword [rsp + 0x30], r8d
lea rax, [rsp + 0x490]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.1000b7af0
mov eax, dword [rsp + 0x40]
mov dword [rbp + 0xa8], eax
mov ebx, r14d
jmp 0x1000bba83
lea rax, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rax
je 0x1000bba36
test byte [rcx + 0x1c], dil
je 0x1000bba36
mov edx, 0x77
lea r8, [0x100002ed8]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
mov ebx, 0x80004005
cmp ebx, r14d
jge 0x1000bba83
cmp word [rsp + 0x6a0], r14w
je 0x1000bba74
mov eax, dword [rbp + 0x2bc]
neg eax
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
lea r8, [0x10001ac10]
lea rdx, [rsp + 0x6a0]
call fcn.1000aaa68
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1000ac4f8
mov eax, ebx
mov rcx, qword [rsp + 0xac0]
xor rcx, rsp
call fcn.1000cd7d0
add rsp, 0xad0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret