Function at 0x1400188a0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rcx
call fcn.140055b68
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x1400188e3
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa8], rax
xor edx, edx
mov dword [rsp + 0xa0], edx
or edi, 0xffffffff
cmp dword [r14 + 0x3b1d8], edx
jle 0x140018b94
mov r12d, 0xd9
mov qword [rsp + 0x20], r12
lea rax, [r14 + 0x1988]
mov rcx, rax
mov qword [rsp + 0x28], rax
nop
nop
cmp dword [rcx + 4], 0
je 0x140018b58
mov dword [rsp + 0x98], 0
xor r15d, r15d
cmp dword [rcx], r15d
jle 0x140018b58
nop
nop
nop
nop
xor r13d, r13d
cmp dword [r14 + 0x3b1d8], r13d
jle 0x140018a7d
mov rbp, rax
cmp dword [rbp + 4], 0
jne 0x140018a65
lea rax, [r12 + r15]
mov rbx, qword [r14 + rax*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1400189a9
cmp rax, qword [rbx - 0x18]
jne 0x1400189a9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x1400189e5
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140018b88
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009b270
lea rbx, [rdi + 0x18]
mov qword [rsp + 0x40], rbx
xor r12d, r12d
xor esi, esi
cmp dword [rbp], esi
jle 0x140018a3a
lea rdi, [rbp - 0x12c0]
nop
test rbx, rbx
je 0x140018a26
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], r12d
jl 0x140018a26
mov rdx, rbx
call fcn.14009b200
test rax, rax
je 0x140018a26
sub rax, qword [rdi]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140018a34
add esi, 1
add rdi, 8
cmp esi, dword [rbp]
jge 0x140018a3a
jmp 0x140018a00
mov r12d, 1
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140018a57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12d, r12d
jne 0x140018b1e
mov r12, qword [rsp + 0x20]
add r13d, 1
add rbp, 0x12c8
cmp r13d, dword [r14 + 0x3b1d8]
jl 0x140018973
lea rsi, [r12 + r15]
mov rbx, qword [r14 + rsi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140018aa9
cmp rax, qword [rbx - 0x18]
jne 0x140018aa9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140018ae5
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140018b8e
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009b270
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140011b10
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140018b25
xor edx, edx
lea r8d, [rax + 4]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
or edi, 0xffffffff
jmp 0x140018b28
mov r12, qword [rsp + 0x20]
jmp 0x140018b28
or edi, 0xffffffff
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
add r15, 1
mov rcx, qword [rsp + 0x28]
cmp eax, dword [rcx]
lea rax, [r14 + 0x1988]
jl 0x140018960
mov edx, dword [rsp + 0xa0]
add edx, 1
mov dword [rsp + 0xa0], edx
add rcx, 0x12c8
mov qword [rsp + 0x28], rcx
add r12, 0x259
mov qword [rsp + 0x20], r12
cmp edx, dword [r14 + 0x3b1d8]
jge 0x140018b94
jmp 0x140018930
call fcn.140003380
int3
call fcn.140003380
int3
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudioHDA
lea rcx, [rsp + 0xa8]
call fcn.140006f20
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudio
lea rcx, [rsp + 0xa8]
call fcn.140006f20
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtek
lea rcx, [rsp + 0xa8]
call fcn.140006f20
xor edx, edx
lea r8d, [rdx + 4]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x140018c3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret