Function at 0x1400025a0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rcx
mov qword [rbp - 9], rcx
cmp qword [rcx + 0x18], 8
jb 0x1400025e3
mov r8, qword [rcx]
jmp 0x1400025e6
mov r8, rsi
lea rdx, str.task_5_begin_to_check_maintenance_condition._WorkPath___s
lea rcx, [0x140010748]
call fcn.1400018a0
lea r8, str.LenovoBatteryGaugePackage.dll
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.140006110
nop
lea rbx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rbx, qword [rbp - 1]
call fcn.140002bd0
movabs r14, 0x7fffffffffffffff
test al, al
jne 0x1400028f1
lea rdx, str.task_6_case_1:_Not_install_files_exist__:_run_script_to_install__pop_up_toast_to_let_user_enable_BG
lea rcx, [0x140010748]
call fcn.1400018a0
mov qword [rbp + 0x37], 7
xor edi, edi
mov qword [rbp + 0x2f], rdi
mov word [rbp + 0x1f], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x1f]
call fcn.1400059b0
nop
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x49]
call fcn.1400059b0
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x49]
call fcn.140005380
movzx eax, word [str.Install.ps1]
neg ax
sbb r8, r8
and r8d, 0xb
lea rdx, str.Install.ps1
lea rcx, [rbp + 0x1f]
call fcn.140005c30
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rcx, qword [rbp + 0x1f]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
lea rcx, [0x140010748]
test eax, eax
jne 0x140002843
lea rdx, str.task_7______InstallBatteryGauge
call fcn.1400018a0
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x49]
call fcn.1400059b0
lea rcx, [rbp - 0x49]
call fcn.1400039f0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x49]
call fcn.1400059b0
lea rcx, [rbp - 0x49]
call fcn.140003830
test al, al
je 0x14000287e
mov qword [rbp - 0x11], rdi
lea rcx, [rbp - 0x11]
call fcn.140003250
test eax, eax
je 0x14000287e
call fcn.140002d20
lea rcx, [0x140010748]
test al, al
je 0x1400027fc
lea rdx, str.task_8______show_BG_directly_because_its_Registry_status_is_shown
call fcn.1400018a0
lea rax, [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
movzx eax, word [str.ShowBatteryGauge]
neg ax
sbb r8, r8
and r8d, 0x10
lea rdx, str.ShowBatteryGauge
lea rcx, [rbp - 0x49]
call fcn.140005860
nop
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], rdi
mov word [rbp - 0x69], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x69]
call fcn.1400059b0
nop
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x69]
mov rcx, qword [rbp - 0x11]
call fcn.140003de0
jmp 0x140002838
lea rdx, str.task_8______show_toast_to_let_user_enable_BG
call fcn.1400018a0
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], rdi
mov word [rbp - 0x69], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x69]
call fcn.1400059b0
lea rdx, [rbp - 0x69]
mov rcx, qword [rbp - 0x11]
call fcn.1400043c0
mov rcx, qword [rbp - 0x11]
call fcn.1400033e0
jmp 0x14000287e
lea rdx, str.task_9______no_install.ps1__but_only_dll_exist__Try_to_delete_dll_to_force_VS_download_new_Addin
call fcn.1400018a0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
jne 0x14000287e
mov r8, rbx
lea rdx, str.task_10_______delete_dll_file:___s_
lea rcx, [0x140010748]
call fcn.1400018a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rax, qword [rbp + 0x37]
cmp rax, 8
jb 0x140002b23
inc rax
mov rcx, qword [rbp + 0x1f]
cmp rax, r14
jbe 0x14000289f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400028e7
test byte [rbp + 0x1f], 0x1f
je 0x1400028b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400028c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400028d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1400028e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1400073b0
jmp 0x140002b23
xor edi, edi
mov qword [rbp - 0x11], rdi
lea rcx, [rbp - 0x11]
call fcn.140003250
test eax, eax
jne 0x14000297c
mov rax, qword [rbp + 0x17]
cmp rax, 8
jb 0x140002b8d
inc rax
mov rcx, qword [rbp - 1]
movabs r14, 0x7fffffffffffffff
cmp rax, r14
jbe 0x14000292f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x140002b88
test byte [rbp - 1], 0x1f
je 0x14000294b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000295b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000296b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x140002b85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, qword [rbp - 0x11]
lea rdx, str.task_12_BG_has_already_been_installed..._hImpersonationToken0x_X
lea rcx, [0x140010748]
call fcn.1400018a0
call fcn.140002d20
movzx ebx, al
call fcn.140002e20
lea rcx, [0x140010748]
test bl, bl
je 0x140002a6b
test al, al
je 0x1400029c9
lea rdx, str.task_15__case_2:_Install__display_:_exit_for_Win10_because_its_correct._But_for_Win11__need_to_show_toast
call fcn.1400018a0
call fcn.140002f20
jmp 0x140002ac0
lea rdx, str.task_16__case_3:_Install__display_status_error_:_show_BG_icon_for_Win10._Show_toast_for_Win11
call fcn.1400018a0
call fcn.140002f20
test al, al
je 0x1400029f7
call fcn.140003000
test al, al
je 0x140002ac4
xor ecx, ecx
call fcn.140003140
jmp 0x140002ac4
lea rax, [rbp - 0x69]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], rdi
mov word [rbp - 0x69], di
movzx eax, word [str.ShowBatteryGauge_updatestatus]
neg ax
sbb r8, r8
and r8d, 0x1d
lea rdx, str.ShowBatteryGauge_updatestatus
lea rcx, [rbp - 0x69]
call fcn.140005860
nop
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], rdi
mov word [rbp - 0x49], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x49]
call fcn.1400059b0
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x49]
mov rcx, qword [rbp - 0x11]
call fcn.140003de0
jmp 0x140002af4
test al, al
je 0x140002a87
lea rdx, str.task_18___case_4:_Install__display_status_error_:_update_registry
call fcn.1400018a0
mov ecx, 1
call fcn.140003140
jmp 0x140002af4
lea rdx, str.task_18__case_5:_Install__not_display_:_pop_up_toast_to_let_user_enable_BG
call fcn.1400018a0
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], rdi
mov word [rbp - 0x69], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x69]
call fcn.1400059b0
lea rcx, [rbp - 0x69]
call fcn.140003830
test al, al
je 0x140002af4
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], rdi
mov word [rbp - 0x69], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x69]
call fcn.1400059b0
lea rdx, [rbp - 0x69]
mov rcx, qword [rbp - 0x11]
call fcn.1400043c0
mov rbx, qword [rbp - 0x11]
mov r8, rbx
lea rdx, str.ImpersonateLoggedOnUserEnd_1_hImpersonationToken_d
lea rcx, [0x140010748]
call fcn.1400018a0
test rbx, rbx
je 0x140002b23
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x17]
cmp rax, 8
jb 0x140002b8d
inc rax
mov rcx, qword [rbp - 1]
cmp rax, r14
jbe 0x140002b40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x140002b88
test byte [rbp - 1], 0x1f
je 0x140002b58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140002b68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140002b78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x140002b85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1400073b0
mov word [rbp - 1], di
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], 7
mov rcx, rsi
call fcn.140005600
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140007350
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret