Function at 0x140003c10
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14005b060]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0x7c], 0
xor edi, edi
mov word [rsp + 0x64], di
xor bl, bl
mov byte [rsp + 0x60], bl
mov dword [rsp + 0x68], edi
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.140003080
nop
call fcn.1400038d0
mov r9d, eax
add eax, 0xffffffe2
lea rcx, [rsp + 0x80]
test eax, 0xfffffffd
je 0x140003e14
cmp r9d, 0x2b
je 0x140003d94
cmp r9d, 0x32
je 0x140003d0e
mov rsi, qword [0x14005eb48]
lea r8d, [rdi + 1]
lea rdx, str.Unable_to_stop_service____d
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003e8f
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048a4
jmp 0x140003e8a
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Service_already_marked_for_deletion__reboot_required
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003d89
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048aa
call fcn.14001c70c
mov bl, 1
mov byte [rsp + 0x60], bl
jmp 0x140003e8f
mov rsi, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Service_does_not_appear_to_be_installed__proceeding_to_clean_up
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003e8f
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048b0
jmp 0x140003e8a
mov rsi, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Stopped_service_successfully
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003e8f
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048b6
call fcn.14001c70c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r8d, r8d
lea rdx, str.DefaultUninstall.ntamd64.Services
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SETUPAPI.dll_SetupInstallServicesFromInfSectionW]
test eax, eax
jne 0x140003ec6
lea rdx, [rsp + 0x68]
lea rcx, str.Service_uninstallation_from_INF_failed
call fcn.140003b20
jmp 0x140003fda
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
lea rcx, [rsp + 0x80]
cmp eax, 0xbc2
jne 0x140003f62
mov rbx, qword [0x14005eb48]
lea rdx, str.Service_uninstallation_from_INF_succeeded__requires_reboot
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003f5a
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048bc
call fcn.14001c70c
mov bl, 1
mov byte [rsp + 0x60], bl
jmp 0x140003fda
mov rsi, qword [0x14005eb48]
lea rdx, str.Service_uninstallation_from_INF_succeeded
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140003fda
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048c2
call fcn.14001c70c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x64]
mov qword [rsp + 0x40], rax
lea rax, [0x1400033a0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x7ff
lea r8, str.DefaultUninstall.ntamd64
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
test eax, eax
jne 0x140004040
lea rdx, [rsp + 0x68]
lea rcx, str.File_uninstallation_from_INF_failed
call fcn.140003b20
jmp 0x1400041c0
mov rsi, qword [0x14005eb48]
xor r8d, r8d
lea rcx, [rsp + 0x80]
cmp byte [rsp + 0x64], r8b
je 0x1400040d2
lea rdx, str.File_uninstallation_from_INF_aborted_due_to_failed_file_operation
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400041c0
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048c8
jmp 0x1400041bb
cmp byte [rsp + 0x65], 0
je 0x14000414f
lea rdx, str.File_uninstallation_from_INF_succeeded__requires_reboot
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400041c0
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048ce
jmp 0x1400041bb
lea rdx, str.File_uninstallation_from_INF_succeeded
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400041c0
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048d4
call fcn.14001c70c
lea rcx, [rsp + 0xa0]
call fcn.1400021b0
nop
cmp qword [rsp + 0xb0], 0
je 0x140004524
mov r8d, 0x23
lea rdx, str._system32driversPiaWfpCallout.sys
lea rcx, [rsp + 0xa0]
call fcn.140006800
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400042aa
mov rsi, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Deleted_driver_file
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140004524
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000433b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048da
jmp 0x14000433b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140004345
mov rsi, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Driver_file_was_deleted_by_INF_uninstallation
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140004524
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000433b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048e0
call fcn.14001c70c
jmp 0x140004524
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6c], eax
mov rsi, qword [0x14005eb48]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x6c]
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x140004373
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 2
lea rdx, str.Driver_file_couldnt_be_deleted__queue_for_next_boot__0x_X_:__s
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400043fc
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048e6
call fcn.14001c70c
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0xf
mov byte [rsp + 0x80], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000445b
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004456
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048ec
call fcn.14001c70c
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000449b
lea rdx, [rsp + 0x68]
lea rcx, str.Couldnt_queue_driver_file_removal_for_next_boot
call fcn.140003b20
jmp 0x140004524
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Queued_driver_file_removal_for_next_boot
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x14000451e
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048f2
call fcn.14001c70c
mov bl, 1
mov byte [rsp + 0x60], bl
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x14000456c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048f8
call fcn.14001c70c
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], 7
mov word [rsp + 0xa0], di
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
nop
jmp 0x14000459d
cmp dword [rsp + 0x68], 0
je 0x1400046bc
mov rbx, qword [0x14005eb48]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.140001820
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400045cc
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8d, 2
lea rdx, str.Callout_uninstallation_failed__0x_X_:__s
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140004655
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004650
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048fe
call fcn.14001c70c
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0xf
mov byte [rsp + 0x80], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000474b
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004745
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004904
jmp 0x140004745
cmp byte [rsp + 0x64], 0
je 0x140004755
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Callout_uninstallation_aborted_due_to_failed_file_operation
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x14000474b
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004745
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000490a
call fcn.14001c70c
nop
mov eax, 0x1f
jmp 0x14000487f
cmp byte [rsp + 0x65], 0
jne 0x1400047f6
test bl, bl
jne 0x1400047f6
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Callout_uninstallation_succeeded
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400047ec
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004910
call fcn.14001c70c
nop
mov eax, 0x1e
jmp 0x14000487f
mov rbx, qword [0x14005eb48]
xor r8d, r8d
lea rdx, str.Callout_uninstallation_succeeded__requires_reboot
lea rcx, [rsp + 0x80]
call fcn.14000edc0
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.14000f340
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x14000487a
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004874
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004916
call fcn.14001c70c
nop
mov eax, 0x21
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.14001c460
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140025138
nop
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
nop
call fcn.140025138
int3
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
int3
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
nop
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3
call fcn.140025138
int3