Function at 0x140027320
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r14, rdx
mov rsi, rcx
xor ebp, ebp
movzx edi, bp
cmp bp, word [0x140041cba]
jae 0x1400273c6
nop dword [rax]
nop dword [rax + rax]
movzx eax, di
imul rbx, rax, 0x58
add rbx, qword [0x140041cc8]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140027381
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30], rbp
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140027394
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x28], rbp
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400273a7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x48], rbp
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400273ba
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x40], rbp
inc di
cmp di, word [0x140041cba]
jb 0x140027360
mov rcx, qword [0x140041cc8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r12, [0x140030680]
mov edi, operator
mov rbx, qword [0x140041ca8]
test rbx, rbx
je 0x140027434
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140027412
mov qword [rbx], rbp
mov rcx, rbx
call fcn.14002a160
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
jmp 0x140027434
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140027425
mov eax, eax
mov ecx, dword [r12 + rax*4]
jmp 0x140027427
mov ecx, edi
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], bpl
lea r15, [0x140042660]
test rsi, rsi
je 0x1400274d0
mov rcx, r15
sub rsi, r15
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140027450
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400274a7
mov word [rax], bp
mov qword [rax + 8], rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1400274aa
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc140u.dll_operator_1]
mov qword [rbx + 8], rax
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1400274aa
mov rbx, rbp
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400274c3
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
mov rbx, qword [0x140041cb0]
test rbx, rbx
je 0x140027521
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140027503
mov qword [rbx], rbp
mov rcx, rbx
call fcn.14002a160
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
jmp 0x140027521
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140027514
mov eax, eax
mov edi, dword [r12 + rax*4]
mov dword [0x140042de8], edi
mov byte [0x1400433b0], 0
test r14, r14
je 0x1400275b1
mov rcx, r15
sub r14, r15
movzx eax, byte [r14 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140027530
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140027588
mov word [rax], bp
mov qword [rax + 8], rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14002758b
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc140u.dll_operator_1]
mov qword [rbx + 8], rax
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14002758b
mov rbx, rbp
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400275a4
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
mov rcx, qword [0x140041cc0]
test rcx, rcx
je 0x1400275c3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret