Function at 0x14001c150
Capabilities:
Check if file exists
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Query or enumerate registry value
Set file attributes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1520
call fcn.1400a28a0
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1550], rbx
mov qword [rsp + 0x1558], rbp
mov qword [rsp + 0x1560], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x1510], rax
call fcn.140069504
mov rsi, qword [rax + 8]
xor ebp, ebp
mov r13d, ebp
mov dword [rsp + 0x50], ebp
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x290]
call fcn.140080d50
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c1f4
lea eax, [rbp + 1]
jmp 0x14001d001
mov dword [rsp + 0x44], 0x208
mov r14d, 1
mov dword [rsp + 0x40], r14d
mov rdx, qword [rsi + 0x2f8]
cmp dword [rdx - 0x10], ebp
jne 0x14001c246
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsi + 0x5b8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x14001c270
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsi + 0x5c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rsi + 0x2f8]
cmp dword [rdx - 0x10], ebp
jne 0x14001c2ce
mov rdx, qword [rsi + 0x5b8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14001c2d9
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rsi + 0x5c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x6c], 0x100
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x1310]
call fcn.140080d50
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x1310]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, ebp
cmp eax, 0x103
cmove edi, r14d
mov rdx, qword [rsi + 0x2f8]
cmp dword [rdx - 0x10], ebp
jne 0x14001c374
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, qword [rsi + 0x5b8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x14001c392
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c3a9
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r14d
jmp 0x14001d001
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rsi + 0x2f8]
cmp dword [rdx - 0x10], ebp
jne 0x14001c456
mov rdx, qword [rsi + 0x5b8]
mov rcx, qword [rsp + 0x48]
call fcn.1400222b0
mov rdx, qword [rsi + 0x5b8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001c472
mov rcx, qword [rsp + 0x48]
call fcn.1400222b0
mov rdx, qword [rsi + 0x2f8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.1400223e0
test eax, eax
je 0x14001c4d1
cmp edi, r14d
jne 0x14001c4d1
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14001c4d1
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.1400223e0
test eax, eax
je 0x14001c4d1
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsi + 0x5c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c612
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.exePath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.IcnPath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rsi + 0x5c0]
mov rcx, qword [rsp + 0x48]
call fcn.1400222b0
mov rdx, qword [rsi + 0x5c0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call fcn.1400223e0
test eax, eax
je 0x14001c607
cmp edi, r14d
jne 0x14001c607
lea rdx, str.SOFTWARECanonPrnUninst
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14001c607
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call fcn.1400223e0
test eax, eax
je 0x14001c607
lea rdx, str.SOFTWARECANON_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x68], r14d
call fcn.140015a10
mov r15d, eax
call fcn.140017200
or r12, 0xffffffffffffffff
test eax, eax
jne 0x14001cab4
cmp r15d, 5
je 0x14001c652
cmp r15d, 6
je 0x14001c652
cmp r15d, 0xa
je 0x14001c652
lea edi, [rax + 2]
jmp 0x14001c657
mov edi, 0x17
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.140080d50
mov ecx, edi
call fcn.1400163f0
mov rdi, rax
lea r9, str.Canon_Printer_Uninstaller
mov r8, rax
lea rdx, [0x1400a3e08]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
test rdi, rdi
je 0x14001c7b7
mov rcx, qword [rsi + 0x2f8]
cmp dword [rcx - 0x10], ebp
jne 0x14001c6de
lea rbx, str..LNK
mov qword [rsp + 0x28], rbx
lea rbp, str.Uninstaller
mov qword [rsp + 0x20], rbp
mov r9, qword [rsi + 0x5b8]
mov r8, rdi
lea rdx, str._s_s__s_s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14001c711
lea rbx, str..LNK
mov qword [rsp + 0x28], rbx
lea rbp, str.Uninstaller
mov qword [rsp + 0x20], rbp
mov r9, rcx
mov r8, rdi
lea rdx, str._s_s__s_s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001c748
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001c750
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r13d, r14d
mov dword [rsp + 0x50], r14d
jmp 0x14001c750
mov r13d, r14d
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
mov r9, qword [rsi + 0x5c0]
mov r8, rdi
lea rdx, str._s_s__s_s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001c7b5
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001c7aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ebp, ebp
jmp 0x14001c7b7
xor ebp, ebp
mov r13d, ebp
mov dword [rsp + 0x50], ebp
jmp 0x14001c7b7
xor ebp, ebp
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.140080d50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xce0]
call fcn.140080d50
lea rdx, [rsp + 0xad0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.1400696cc
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14001c81f
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x80]
lea rax, [rsp + 0x80]
test rax, 0xffffffffffff0000
jne 0x14001c876
movzx edi, cx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14001c982
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003a40
mov rbx, qword [rsp + 0x58]
jmp 0x14001c982
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001c8f3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001c982
cmp dword [rdx + 0x10], eax
jge 0x14001c8c4
cmp dword [rbx - 0xc], eax
jge 0x14001c8b9
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], ebp
mov word [rbx], ax
jmp 0x14001c982
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001c8dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
jmp 0x14001c982
mov ebp, dword [rbx - 0x10]
lea r13, [rsp + 0x80]
sub r13, rbx
sar r13, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001c924
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140003180
mov rbx, qword [rsp + 0x58]
cmp r13, rbp
ja 0x14001c944
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140081c40
jmp 0x14001c961
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x80]
mov rdx, rbp
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x14001caa9
cmp edi, dword [rbx - 0xc]
jg 0x14001caa9
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
mov r13d, dword [rsp + 0x50]
xor ebp, ebp
mov dx, 0x5c
mov rcx, rbx
call fcn.140080890
test rax, rax
jne 0x14001c998
mov eax, r12d
jmp 0x14001c99e
sub rax, rbx
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.1400038a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14001ca0c
cmp dword [rbx + 0x10], 0
jl 0x14001c9fd
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001c9fd
call fcn.1400031e0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001c9f2
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14001ca0c
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ca2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x68], r13d
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001ca8b
cmp word [rsp + 0x80], 0
je 0x14001ca8b
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001ca87
lea rcx, [rsp + 0xce0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14001ca8b
mov dword [rsp + 0x68], ebp
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001cab4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001cab4
mov ecx, 0x80070057
call fcn.140001000
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x6b0]
call fcn.140080d50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x8c0]
call fcn.140080d50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x4a0]
call fcn.140080d50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x1100]
call fcn.140080d50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xef0]
call fcn.140080d50
mov r8d, 0x104
lea rdx, [rsp + 0xef0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001cba6
cmp dword [rsi + 0xb78], 0
jne 0x14001cba6
mov dx, 0x5c
lea rcx, [rsp + 0xef0]
call fcn.140080890
mov rdi, rax
test rax, rax
je 0x14001cb80
mov r9, rax
lea r8, [rsp + 0x290]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov word [rdi], 0
jmp 0x14001cbca
mov r9, qword [0x1400e92f8]
lea r8, [rsp + 0x290]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14001cbca
mov r9, qword [0x1400e92f8]
lea r8, [rsp + 0x290]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9, qword [0x1400e9300]
lea r8, [rsp + 0x290]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14001d001
cmp r15d, 5
je 0x14001ccdf
cmp r15d, 6
je 0x14001ccdf
cmp r15d, 0xa
je 0x14001ccdf
lea r9, str.WININIT.INI
lea r8, [rsp + 0x4a0]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14001cc99
xor eax, eax
jmp 0x14001d001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rsp + 0x1100]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rdx, [rsp + 0x1100]
lea rcx, [0x1400a4158]
call fcn.1400164a0
test eax, eax
jne 0x14001cd93
jmp 0x14001d001
lea r9, str.UNINSTAL.tmp
lea r8, [rsp + 0x4a0]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001cd93
cmp dword [rsi + 0xb78], 0
je 0x14001cd56
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001cd93
jmp 0x14001d001
mov r8d, 2
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14001cd8c
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14001cd93
xor eax, eax
jmp 0x14001d001
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001cdb8
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r15d, eax
jmp 0x14001cdbb
mov r15d, r14d
call fcn.1400696cc
mov rdx, rax
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x14001cdda
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x290]
lea rax, [rsp + 0x290]
test rax, 0xffffffffffff0000
jne 0x14001ce31
movzx edi, cx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14001cf36
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003a40
mov rbx, qword [rsp + 0x50]
jmp 0x14001cf36
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001ceae
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14001cf36
cmp dword [rdx + 0x10], eax
jge 0x14001ce7f
cmp dword [rbx - 0xc], eax
jge 0x14001ce74
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], ebp
mov word [rbx], ax
jmp 0x14001cf36
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001ce97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
jmp 0x14001cf36
mov ebp, dword [rbx - 0x10]
lea r13, [rsp + 0x290]
sub r13, rbx
sar r13, 1
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001cedf
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140003180
mov rbx, qword [rsp + 0x50]
cmp r13, rbp
ja 0x14001ceff
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140081c40
jmp 0x14001cf1c
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x290]
mov rdx, rbp
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x14001cff6
cmp edi, dword [rbx - 0xc]
jg 0x14001cff6
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
lea rbp, [rbx - 0x18]
mov rdi, qword [rsi + 0x618]
sub rdi, 0x18
cmp rbp, rdi
je 0x14001cfa0
cmp dword [rdi + 0x10], 0
jl 0x14001cf8c
mov rax, qword [rdi]
cmp qword [rbp], rax
jne 0x14001cf8c
mov rcx, rbp
call fcn.1400031e0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001cf7f
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsi + 0x618], rax
jmp 0x14001cfa0
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsi + 0x618]
call fcn.140003c40
nop
lock xadd dword [rbp + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x14001cfbc
mov rcx, qword [rbp]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp r15d, 1
jne 0x14001cff1
lea r9, [rsi + 0x768]
lea rcx, [rsi + 0x970]
lea r8, [rsp + 0x290]
lea rdx, [0x1400a3e08]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsi + 0x764], r14d
mov r15d, dword [rsp + 0x68]
mov eax, r15d
jmp 0x14001d001
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rsp + 0x1510]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x1520]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret