Function at 0x1400151d0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rcx
call fcn.14004b0d0
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140015213
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa8], rax
xor edx, edx
mov dword [rsp + 0xa0], edx
or edi, 0xffffffff
cmp dword [r14 + 0x3afd0], edx
jle 0x1400154c4
mov r12d, 0x98
mov qword [rsp + 0x20], r12
lea rax, [r14 + 0x1780]
mov rcx, rax
mov qword [rsp + 0x28], rax
nop
nop
cmp dword [rcx + 4], 0
je 0x140015488
mov dword [rsp + 0x98], 0
xor r15d, r15d
cmp dword [rcx], r15d
jle 0x140015488
nop
nop
nop
nop
xor r13d, r13d
cmp dword [r14 + 0x3afd0], r13d
jle 0x1400153ad
mov rbp, rax
cmp dword [rbp + 4], 0
jne 0x140015395
lea rax, [r12 + r15]
mov rbx, qword [r14 + rax*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1400152d9
cmp rax, qword [rbx - 0x18]
jne 0x1400152d9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140015315
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400154b8
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.1400907e0
lea rbx, [rdi + 0x18]
mov qword [rsp + 0x40], rbx
xor r12d, r12d
xor esi, esi
cmp dword [rbp], esi
jle 0x14001536a
lea rdi, [rbp - 0x12c0]
nop
test rbx, rbx
je 0x140015356
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], r12d
jl 0x140015356
mov rdx, rbx
call fcn.140090770
test rax, rax
je 0x140015356
sub rax, qword [rdi]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140015364
add esi, 1
add rdi, 8
cmp esi, dword [rbp]
jge 0x14001536a
jmp 0x140015330
mov r12d, 1
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140015387
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12d, r12d
jne 0x14001544e
mov r12, qword [rsp + 0x20]
add r13d, 1
add rbp, 0x12c8
cmp r13d, dword [r14 + 0x3afd0]
jl 0x1400152a3
lea rsi, [r12 + r15]
mov rbx, qword [r14 + rsi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1400153d9
cmp rax, qword [rbx - 0x18]
jne 0x1400153d9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140015415
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400154be
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.1400907e0
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14000f960
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015455
xor edx, edx
lea r8d, [rax + 4]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
or edi, 0xffffffff
jmp 0x140015458
mov r12, qword [rsp + 0x20]
jmp 0x140015458
or edi, 0xffffffff
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
add r15, 1
mov rcx, qword [rsp + 0x28]
cmp eax, dword [rcx]
lea rax, [r14 + 0x1780]
jl 0x140015290
mov edx, dword [rsp + 0xa0]
add edx, 1
mov dword [rsp + 0xa0], edx
add rcx, 0x12c8
mov qword [rsp + 0x28], rcx
add r12, 0x259
mov qword [rsp + 0x20], r12
cmp edx, dword [r14 + 0x3afd0]
jge 0x1400154c4
jmp 0x140015260
call fcn.140003370
int3
call fcn.140003370
int3
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudioHDA
lea rcx, [rsp + 0xa8]
call fcn.140006a00
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudio
lea rcx, [rsp + 0xa8]
call fcn.140006a00
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtek
lea rcx, [rsp + 0xa8]
call fcn.140006a00
xor edx, edx
lea r8d, [rdx + 4]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x14001556e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret