Function at 0x14023fecc
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
call fcn.14023f6fc
xor r15d, r15d
mov r13d, r15d
lea rdx, [rsi + 0x48]
lea r8, str.ccleaner.ini
lea rcx, [rbp + 0x7f]
call fcn.14001c3e0
nop
lea rdx, [0x14034ee68]
lea rcx, [rsp + 0x38]
call fcn.14000cb18
nop
lea rdx, [0x14035cc68]
lea rcx, [rsp + 0x30]
call fcn.14000cb18
nop
lea rdx, str.SoftwarePiriform_
lea rcx, [rbp + 0x77]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x77]
call fcn.14000c0c4
or r14d, 0xffffffff
test ebx, ebx
je 0x14024015f
cmp qword [rsi + 0x38], r15
jne 0x140240487
lea ecx, [r15 + 0x20]
call fcn.1400be454
mov qword [rbp + 0x67], rax
test rax, rax
je 0x14023ff89
mov rcx, rax
call fcn.1402c3964
jmp 0x14023ff8c
mov rax, r15
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140063354
mov r11, rax
mov rax, qword [rax]
mov qword [rbp + 0x17], rax
mov rcx, qword [r11 + 8]
mov qword [r11 + 8], r15
mov qword [r11], r15
mov qword [rsi + 0x38], rax
mov rbx, qword [rsi + 0x40]
mov qword [rsi + 0x40], rcx
test rbx, rbx
je 0x14023ffeb
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x14023ffeb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x14023ffeb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x140240020
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140240020
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140240020
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x30]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x7f]
call qword [rax + 0x30]
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140240487
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x38]
call qword [rax + 0x20]
mov rbx, qword [rbp + 0x7f]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, r15d
cmp eax, 0xffffffff
setne bl
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test ebx, ebx
je 0x140240111
mov qword [rsi + 0x28], r15
mov rbx, qword [rsi + 0x30]
mov qword [rsi + 0x30], r15
test rbx, rbx
je 0x1402400c4
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1402400c4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1402400c4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov qword [rbp - 0x59], r15
mov dword [rbp - 0x51], r15d
mov qword [rbp - 0x49], r15
lea rax, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rbp - 0x61], rax
or dword [rbp - 0x41], 0xffffffff
or dword [rbp - 0x3d], 0xffffffff
mov dword [rbp - 0x39], r15d
mov dword [rbp + 0x6f], r15d
xor r9d, r9d
lea r8, [rbp + 0x6f]
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffff80000001
call fcn.1402246a8
mov r13d, 1
lea rcx, [rbp - 0x61]
jmp 0x140240482
mov qword [rsi + 0x38], r15
mov rbx, qword [rsi + 0x40]
mov qword [rsi + 0x40], r15
test rbx, rbx
je 0x140240487
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140240487
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140240487
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x140240487
cmp qword [rsi + 0x28], r15
jne 0x140240487
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x38]
test eax, eax
je 0x140240255
cmp qword [rsi + 0x38], r15
jne 0x140240255
mov ecx, 0x20
call fcn.1400be454
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1402401a1
mov rcx, rax
call fcn.1402c3964
jmp 0x1402401a4
mov rax, r15
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140063354
mov r11, rax
mov rax, qword [rax]
mov qword [rbp + 7], rax
mov rcx, qword [r11 + 8]
mov qword [r11 + 8], r15
mov qword [r11], r15
mov qword [rsi + 0x38], rax
mov rbx, qword [rsi + 0x40]
mov qword [rsi + 0x40], rcx
test rbx, rbx
je 0x140240203
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140240203
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140240203
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x140240238
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140240238
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140240238
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x30]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x7f]
call qword [rax + 0x30]
mov ecx, 0x80
call fcn.1400be454
test rax, rax
je 0x140240271
mov rcx, rax
call fcn.1402c353c
mov rdi, rax
jmp 0x140240274
mov rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], r15
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400634f4
mov r11, rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [r11], rcx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1402402d4
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1402402d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1402402d4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rdi
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400020a0
nop
mov rax, qword [rsp + 0x20]
mov qword [rbp - 9], rax
mov rcx, qword [rsp + 0x28]
mov rbx, r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
mov qword [rsi + 0x28], rax
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], rcx
test rdi, rdi
je 0x140240342
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x14024033d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x14024033d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140240373
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x140240373
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x140240373
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx]
mov rdi, 0xffffffff80000001
mov rdx, rdi
call qword [rax + 0x30]
mov rcx, qword [rsi + 0x28]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x77]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x140240487
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x28]
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140240402
mov qword [rsi + 0x38], r15
mov rbx, qword [rsi + 0x40]
mov qword [rsi + 0x40], r15
test rbx, rbx
je 0x1402403f7
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1402403f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1402403f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r13d, 1
jmp 0x140240487
mov qword [rsi + 0x28], r15
mov rbx, qword [rsi + 0x30]
mov qword [rsi + 0x30], r15
test rbx, rbx
je 0x14024043f
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x14024043f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x14024043f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
mov qword [rbp - 0x79], r15
lea rax, vtable.Piriform::Registry::CRegKeyEx.0
mov qword [rsp + 0x48], rax
or dword [rbp - 0x71], 0xffffffff
or dword [rbp - 0x6d], 0xffffffff
mov dword [rbp - 0x69], r15d
mov dword [rbp + 0x67], r15d
xor r9d, r9d
lea r8, [rbp + 0x67]
mov rdx, qword [rbp + 0x77]
mov rcx, rdi
call fcn.1402246a8
nop
lea rcx, [rsp + 0x48]
call fcn.140224148
mov rcx, rsi
call fcn.14023f3cc
mov rcx, rsi
call fcn.14023fd5c
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402404b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402404db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402404fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x14024051e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r13d
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret