Function at 0x140009940
Capabilities:
Check if file exists
Delete file
Disable driver code integrity
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1990]
mov eax, 0x1a90
call fcn.140029ba0
sub rsp, rax
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rbp + 0x1980], rax
cmp qword [0x140056b18], 0
mov edi, edx
mov rsi, rcx
jne 0x140009d1b
xor r15d, r15d
test rcx, rcx
je 0x140009b3d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400099a6
test al, 0x10
lea eax, [r15 + 1]
je 0x1400099a9
mov eax, r15d
test eax, eax
je 0x140009b3d
call fcn.140009e70
mov rdx, rax
lea rcx, str.___Systems_ci.dll_file_version_is:__s_n
mov rbx, rax
call fcn.140001010
lea r8, [0x14003caac]
mov qword [rsp + 0x30], r15
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140018ff8
mov r8, qword [rsp + 0x30]
test r8, r8
jne 0x1400099fc
lea rcx, str.____Ci_offsets_CSV_file_not_found___invalid._A_valid_offset_file_must_be_specifed_
call fcn.140018be0
jmp 0x140009b31
mov edx, 0x800
lea rcx, [rbp + 0x980]
call fcn.140019640
test rax, rax
je 0x140009b12
nop word [rax + rax]
lea rcx, [rbp + 0x980]
call fcn.140012548
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], r15
lea rdx, [0x14003cb50]
mov rcx, rax
call fcn.140019534
mov r8, rax
lea rcx, [rbp + 0x780]
mov edx, 0x100
call fcn.140018848
lea r8, [rbp + 0x780]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140009a84
add rax, 2
test ecx, ecx
jne 0x140009a70
test edx, edx
je 0x140009aa9
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x980]
mov edx, 0x800
call fcn.140019640
test rax, rax
jne 0x140009a20
jmp 0x140009b12
mov rdx, rbx
lea rcx, str.___Offsets_are_available_for_this_version_of_ci.dll___s__
call fcn.140001010
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x14003cb50]
call fcn.140019534
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8d, 0x10
call fcn.14001920c
lea r8, [rsp + 0x38]
mov qword [0x140056b18], rax
lea rdx, [0x14003cb50]
xor ecx, ecx
call fcn.140019534
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8d, 0x10
call fcn.14001920c
mov qword [0x140056b20], rax
mov rcx, qword [rsp + 0x30]
call fcn.140019174
mov eax, r15d
cmp qword [0x140056b18], rax
setne al
test eax, eax
jne 0x140009d1b
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ci_in_use.
call fcn.140018be0
test edi, edi
je 0x140009db9
lea rcx, str.___Downloading_ci_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
mov qword [rsp + 0x1ab8], r14
call fcn.140018be0
call fcn.140009dc0
mov rcx, rax
call fcn.1400045b0
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14000a470
mov rcx, rax
mov rdi, rax
call fcn.14000b490
mov rcx, qword [rdi + 0x80]
mov rbx, rax
test rcx, rcx
je 0x140009b99
call fcn.140018ae4
mov qword [rdi + 0x80], r15
mov rcx, rdi
call fcn.140018ae4
mov rcx, r14
call fcn.140018ae4
mov r14, qword [rsp + 0x1ab8]
test rbx, rbx
je 0x140009dad
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x830
call fcn.14000f000
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_CiOptions
mov dword [rsp + 0x50], 0x58
mov dword [rbp - 0x60], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140009c03
mov rax, qword [rbp - 0x78]
sub rax, qword [rbx + 8]
jmp 0x140009c06
mov rax, r15
xor edx, edx
mov qword [0x140056b18], rax
mov r8d, 0x830
lea rcx, [rbp + 0x980]
call fcn.14000f000
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x980]
mov rcx, qword [rbx + 0x10]
lea r8, str.CiValidateImageHeader
mov dword [rbp + 0x980], 0x58
mov dword [rbp + 0x9d0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140009c62
mov rax, qword [rbp + 0x9b8]
sub rax, qword [rbx + 8]
jmp 0x140009c65
mov rax, r15
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov qword [0x140056b20], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
call fcn.140018ae4
mov rcx, rbx
mov qword [rbx], r15
call fcn.140018ae4
mov eax, r15d
cmp qword [0x140056b18], rax
setne al
test eax, eax
je 0x140009dad
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140018be0
test rsi, rsi
je 0x140009d1b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009d1b
test al, 0x10
jne 0x140009d1b
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140018be0
call fcn.140009e70
lea r8, [0x14003cbe0]
mov qword [rsp + 0x30], r15
mov rdx, rsi
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.140018ff8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140009d47
lea rcx, str.____CI_offsets_CSV_file_cannot_be_opened
call fcn.140018be0
mov eax, 1
mov rcx, qword [rbp + 0x1980]
xor rcx, rsp
call fcn.14000dc70
lea r11, [rsp + 0x1a90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov r8, rbx
lea rdx, [0x140037454]
call fcn.1400046a0
lea rbx, [0x140056b18]
lea rdi, [0x140056b28]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x30]
call fcn.1400046a0
add rbx, 8
cmp rbx, rdi
jl 0x140009d70
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140038738]
call fcn.1400046a0
mov rcx, qword [rsp + 0x30]
call fcn.140019174
jmp 0x140009d1b
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140018be0
xor eax, eax
jmp 0x140009d20