Function at 0x140015400
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rcx
call fcn.14004b378
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140015443
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa8], rax
xor edx, edx
mov dword [rsp + 0xa0], edx
or edi, 0xffffffff
cmp dword [r14 + 0x3afd0], edx
jle 0x1400156f4
mov r12d, 0x98
mov qword [rsp + 0x20], r12
lea rax, [r14 + 0x1780]
mov rcx, rax
mov qword [rsp + 0x28], rax
nop
nop
cmp dword [rcx + 4], 0
je 0x1400156b8
mov dword [rsp + 0x98], 0
xor r15d, r15d
cmp dword [rcx], r15d
jle 0x1400156b8
nop
nop
nop
nop
xor r13d, r13d
cmp dword [r14 + 0x3afd0], r13d
jle 0x1400155dd
mov rbp, rax
cmp dword [rbp + 4], 0
jne 0x1400155c5
lea rax, [r12 + r15]
mov rbx, qword [r14 + rax*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140015509
cmp rax, qword [rbx - 0x18]
jne 0x140015509
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140015545
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400156e8
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140090a80
lea rbx, [rdi + 0x18]
mov qword [rsp + 0x40], rbx
xor r12d, r12d
xor esi, esi
cmp dword [rbp], esi
jle 0x14001559a
lea rdi, [rbp - 0x12c0]
nop
test rbx, rbx
je 0x140015586
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], r12d
jl 0x140015586
mov rdx, rbx
call fcn.140090a10
test rax, rax
je 0x140015586
sub rax, qword [rdi]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140015594
add esi, 1
add rdi, 8
cmp esi, dword [rbp]
jge 0x14001559a
jmp 0x140015560
mov r12d, 1
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1400155b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12d, r12d
jne 0x14001567e
mov r12, qword [rsp + 0x20]
add r13d, 1
add rbp, 0x12c8
cmp r13d, dword [r14 + 0x3afd0]
jl 0x1400154d3
lea rsi, [r12 + r15]
mov rbx, qword [r14 + rsi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140015609
cmp rax, qword [rbx - 0x18]
jne 0x140015609
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140015645
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400156ee
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140090a80
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14000f9f0
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015685
xor edx, edx
lea r8d, [rax + 4]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
or edi, 0xffffffff
jmp 0x140015688
mov r12, qword [rsp + 0x20]
jmp 0x140015688
or edi, 0xffffffff
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
add r15, 1
mov rcx, qword [rsp + 0x28]
cmp eax, dword [rcx]
lea rax, [r14 + 0x1780]
jl 0x1400154c0
mov edx, dword [rsp + 0xa0]
add edx, 1
mov dword [rsp + 0xa0], edx
add rcx, 0x12c8
mov qword [rsp + 0x28], rcx
add r12, 0x259
mov qword [rsp + 0x20], r12
cmp edx, dword [r14 + 0x3afd0]
jge 0x1400156f4
jmp 0x140015490
call fcn.140003370
int3
call fcn.140003370
int3
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudioHDA
lea rcx, [rsp + 0xa8]
call fcn.140006a90
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtekAudio
lea rcx, [rsp + 0xa8]
call fcn.140006a90
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x2b4]
lea rdx, str._sRealtek
lea rcx, [rsp + 0xa8]
call fcn.140006a90
xor edx, edx
lea r8d, [rdx + 4]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x14001579e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret