Function at 0x140032a5c
Capabilities:
Check if file exists
Delete file

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5b0
mov qword [r11 - 0x448], 0xfffffffffffffffe
mov rax, qword [0x14007c478]
xor rax, rsp
mov qword [rsp + 0x5a8], rax
mov rsi, r8
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rax, str.base_stor_vss_tools_vssagent_vshw_agent.cpp
mov qword [r11 - 0x428], rax
lea rax, str.CVssHwSupport::HwDiagMonitor
mov qword [r11 - 0x420], rax
lea r13, str.TST__
mov qword [r11 - 0x418], r13
mov dword [rsp + 0x1d8], SetErrorInfo
mov r14d, 9
mov dword [r11 - 0x40c], r14d
mov dword [rsp + 0x1e0], 0xdc
xor edi, edi
mov dword [rsp + 0x260], 0x1000000
lea ebx, [rdi + 0x78]
mov r8d, ebx
xor edx, edx
lea rcx, [r11 - 0x400]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x130]
call fcn.14004058c
nop
mov qword [rsp + 0x50], rdi
lea rax, str.base_stor_vss_tools_vssagent_vshw_mon.h
mov qword [rsp + 0x78], rax
lea rax, str.CVssHwDiagMutex::CVssHwDiagMutex
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x90], 0xd1
mov dword [rsp + 0x94], r14d
mov dword [rsp + 0x98], 0xdc
mov dword [rsp + 0x118], 0x1000000
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0xa0]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x1c0]
call fcn.14004058c
nop
lea r8, str.HwDiag_Monitor_Window
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r14d, eax
test rbx, rbx
je 0x140033088
cmp eax, 0xb7
jne 0x140032c17
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, edi
mov qword [rsp + 0x58], rbx
lea rdx, str.Vss_PnP_Monitor_is_running__only_one_instance_is_allowed_._n
lea rcx, [rsp + 0x1c0]
call fcn.140041860
test rbx, rbx
je 0x140033088
lea rcx, [rsp + 0x1c0]
call fcn.1400406a0
nop
call fcn.14002a620
mov r14, rax
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.14002a148
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
lea rcx, [rsp + 0x300]
call fcn.140006414
nop
mov rdx, rsi
lea rcx, [rsp + 0x300]
call fcn.14001efa0
lea rcx, [rsp + 0x300]
call fcn.140008864
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x140032c9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
je 0x14003303d
mov rdx, rsi
lea rcx, [rsp + 0x300]
call fcn.14001f6f0
mov r9, rsi
mov rdx, r15
lea rcx, [rsp + 0x300]
call fcn.140030af0
mov r8, rsi
lea rdx, str.Initial_Disk_Devices
lea rcx, [rsp + 0x300]
call fcn.14000b0dc
mov r8, rsi
lea rdx, str.Initial_Volume_Devices
lea rcx, [rsp + 0x300]
call fcn.14000eb4c
mov r8, rsi
lea rdx, str.Initial_Volumes_and_Shadow_Copies
lea rcx, [rsp + 0x300]
call fcn.140010494
mov r9, r14
lea r8, [rsp + 0x300]
mov rdx, rsi
lea rcx, [rsp + 0x288]
call fcn.14002aa50
nop
mov r9, r14
lea r8, [rsp + 0x300]
mov rdx, rsi
lea rcx, [rsp + 0x2a8]
call fcn.14002b4a8
nop
lea rcx, [rsp + 0x2a8]
call fcn.14002b854
mov r9, r14
lea r8, [rsp + 0x300]
mov rdx, rsi
lea rcx, [rsp + 0x2e0]
call fcn.14002babc
test r15, r15
je 0x140032dac
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.14003310c
call fcn.140033898
test al, al
jne 0x140032dac
mov r8, r15
lea rdx, str._nWarning:_you_need_to_stop_VSS_in_order_to_diagnose_provider__s.
lea rcx, [rsp + 0x130]
call fcn.140041860
lea rdx, str.Do_not_quit_this_progam__please_run_net_stop_vss_in_another_console.
lea rcx, [rsp + 0x130]
call fcn.140041860
movzx r13d, dil
mov byte [rsp + 0x128], r13b
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
nop dword [rax + rax]
mov r12, rax
mov qword [rsp + 0x120], rax
cmp rax, 0xffffffffffffffff
je 0x140032e24
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
nop dword [rax + rax]
test eax, eax
je 0x140032e24
mov edx, dword [rsp + 0x40]
test dl, 0x40
je 0x140032e24
and edx, 0xffffffbf
mov dword [rsp + 0x40], edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
nop dword [rax + rax]
test eax, eax
mov eax, 1
cmovne r13d, eax
mov byte [rsp + 0x128], r13b
lea rdx, str._nPress_CtrlC_or_CtrlBreak_to_exit._n
lea rcx, [rsp + 0x130]
call fcn.140041860
lea rdx, str.The_monitor_is_running._n
lea rcx, [rsp + 0x130]
call fcn.140041860
mov ecx, 1
call fcn.1400444b8
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fflush]
nop dword [rax + rax]
call fcn.14002a49c
test r15, r15
je 0x140032ebf
mov rdx, r15
call fcn.14003358c
call fcn.140033898
test al, al
jne 0x140032ebf
mov rdx, qword [0x14009d7d0]
lea rcx, [rsp + 0x1a8]
call fcn.140029ca4
nop
mov r8, rsi
lea rdx, [rsp + 0x300]
call fcn.14003938c
mov rcx, qword [0x14007cd30]
call fcn.140038ec4
nop
lea rcx, [rsp + 0x1a8]
call fcn.1400299c8
mov r8, rsi
lea rdx, str.Final_Disk_Devices
lea rcx, [rsp + 0x300]
call fcn.14000b0dc
mov r8, rsi
lea rdx, str.Final_Volume_Devices
lea rcx, [rsp + 0x300]
call fcn.14000eb4c
mov r8, rsi
lea rdx, str.Final_Volumes_and_Shadow_Copies
lea rcx, [rsp + 0x300]
call fcn.140010494
lea rdx, str._nMonitoring_is_done.
lea rcx, [rsp + 0x130]
call fcn.140041860
nop
test r13b, r13b
je 0x140032f51
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
nop dword [rax + rax]
test eax, eax
je 0x140032f51
mov edx, dword [rsp + 0x40]
or edx, 0x40
mov dword [rsp + 0x40], edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x2a8]
call fcn.14002b740
nop
lea rcx, [rsp + 0x288]
call fcn.14002ad4c
nop
lea rcx, [rsp + 0x300]
call fcn.140007684
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
nop
mov rax, qword [rsp + 0x48]
jmp 0x140032fb2
mov r8d, dword [rsp + 0x138]
test r8d, r8d
jns 0x140032ff6
test r15, r15
je 0x140032fe2
cmp byte [rax + 0x539], dil
je 0x140032fe2
mov rdx, r15
call fcn.14003358c
call fcn.140033898
mov r8d, dword [rsp + 0x138]
lea rdx, str.Error_catched_0x_08lx_n
lea rcx, [rsp + 0x130]
call fcn.140041860
test r14, r14
je 0x14003300c
mov rcx, r14
call fcn.140029f54
mov rcx, r14
call fcn.1400434b8
nop
lea rcx, [rsp + 0x130]
call fcn.1400406a0
mov rcx, qword [rsp + 0x5a8]
xor rcx, rsp
call fcn.1400438c0
add rsp, 0x5b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x30], 0xdc
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], 0xdb
lea r9, str.CVssHwSupport::HwDiagMonitor
mov r8, r13
lea rdx, str.base_stor_vss_tools_vssagent_vshw_agent.cpp
lea rcx, [rsp + 0x78]
call fcn.1400400dc
lea r8, str.DeleteFile
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140041e40
nop
movzx edx, r14w
or edx, 0x80070000
test r14d, r14d
cmovle edx, r14d
lea rcx, [rsp + 0x1c0]
call fcn.1400046d4
mov dword [rsp + 0x30], 0xdc
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], 0xe2
lea r9, str.CVssHwDiagMutex::CVssHwDiagMutex
mov r8, r13
lea rdx, str.base_stor_vss_tools_vssagent_vshw_mon.h
lea rcx, [rsp + 0x78]
call fcn.1400400dc
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.1400046e0
mov dword [rsp + 0x20], eax
lea r9, str.Throwing_0x_08lx
mov r8d, eax
lea rcx, [rsp + 0x1c0]
call fcn.140041508
int3