Function at 0x1400290c0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rbx, rcx
lea rsi, str.base_stor_vssmoduleswritersdeletewriter.cpp
mov qword [rsp + 0x38], rsi
lea r14, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], r14
lea r15, str.WRTDELET
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x107
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
xor r13d, r13d
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [r13 + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140010990
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp - 8], r13
lea rax, [0x1400f1e90]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], 0x20019
mov edi, r13d
mov rcx, rbx
call fcn.140027e74
bt eax, 0x16
jae 0x14004beb4
mov rcx, rbx
call fcn.140027e74
mov r14d, 0x7530
bt eax, 0x18
jae 0x14004bf0d
lea esi, [r13 + 1]
mov eax, r14d
mov r12d, eax
mov r15d, 0xc350
lea r8, [0x1400edf70]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.14000d850
test al, al
je 0x140029263
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x20]
test esi, esi
je 0x14004bf1a
lea rdx, str.MaxDeletionTimeOptimized
call fcn.14000df04
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14004bf26
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeFilespec
lea rcx, [rbp - 0x20]
call fcn.14000df04
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14004bf32
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea rdx, str.MaxScanningTimeGlobal
lea rcx, [rbp - 0x20]
call fcn.14000df04
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14004bf3e
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9b, 1
lea r8, [rbp]
movzx edx, r9b
mov rcx, rbx
call fcn.14000a5f0
mov r8, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
sub r8, rcx
movabs rax, 0xe38e38e38e38e39
imul r8
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea r9, [fcn.14002f2c0]
mov rdx, qword [rbp + 0x10]
call fcn.14002f188
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount64]
mov r14, rax
mov rbx, qword [rbp + 8]
add rbx, 0x10
lea r15, str.base_stor_vssmoduleswritersdeletewriter.cpp
nop
lea rax, [rbx - 0x10]
cmp rax, qword [rbp + 0x10]
je 0x1400293cd
mov eax, 1
test al, al
je 0x1400293ed
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp edi, ecx
je 0x1400293d5
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
lea r8, [0x1400f2128]
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call fcn.140008be0
mov esi, eax
mov dword [rbp + 0x38], eax
test eax, eax
js 0x14004bf4a
mov eax, r13d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
test al, al
jne 0x14004bf54
lea rsi, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x171
call sub.msvcrt.dll_memset
lea r9, [rbp + 0xa0]
lea r8, str.deleting_file__s
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140010920
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
test eax, eax
je 0x14004bf97
add rbx, 0x48
inc edi
jmp 0x1400292d0
mov eax, r13d
jmp 0x1400292e3
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount64]
lea rcx, [r12 + r14]
cmp rax, rcx
jbe 0x140029309
jmp 0x14004c008
lea rcx, [rbp - 0x20]
call fcn.14000d804
nop
lea rcx, [rbp]
call fcn.14000c400
nop
lea rcx, [rbp + 0x30]
call fcn.140010ab0
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400305f0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], VarUI4FromDisp
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
lea r8, str.skipping_file_deletion_since_autorecovery_isnt_enabled
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140010920
nop
jmp 0x1400293ed
mov esi, r13d
mov eax, 0x2710
jmp 0x1400291c5
lea rdx, str.MaxDeletionTime
jmp 0x140029206
imul r12d, eax, 0x3e8
jmp 0x140029217
imul r14d, eax, 0x3e8
jmp 0x14002923d
imul r15d, eax, 0x3e8
jmp 0x140029263
mov eax, 1
jmp 0x14002933d
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x16c
call sub.msvcrt.dll_memset
mov r9d, esi
lea r8, str.StringCchPrintf_failed_with_0x_08lx
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140010920
nop
jmp 0x1400293c2
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rsi
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x175
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0xa0]
lea r8, str.failed_to_delete_file__s_from_snapshot.__Error__d
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140010920
nop
jmp 0x1400293c2
mov qword [rsp + 0x38], r15
lea rax, str.CVssDeletingWriter::DeleteFilesFromSnapshot
mov qword [rsp + 0x40], rax
lea rax, str.WRTDELET
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x15c
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xff
mov dword [rbp - 0x28], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, 4
lea r8, [rsp + 0x38]
mov edx, 0x201c
lea rcx, [rbp + 0x30]
call fcn.140010bcc
nop
jmp 0x1400293ed