Function at 0x14002b650
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x680
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov r12d, edx
mov r15, rcx
test rcx, rcx
jne 0x14002b69c
xor eax, eax
jmp 0x14002baab
cmp edx, 1
jne 0x14002b6b6
xor r9d, r9d
lea r8, str.DeleteMonitorW2K_Delete_Monitor_Name_
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.140069504
mov rsi, qword [rax + 8]
mov qword [rsp + 0x28], rsi
call fcn.1400696cc
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14002b6e7
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
or rbp, 0xffffffffffffffff
test r15, 0xffffffffffff0000
jne 0x14002b72d
movzx edi, r15w
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14002b751
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140003a40
mov rbx, qword [rsp + 0x20]
jmp 0x14002b751
xor eax, eax
mov rcx, rbp
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140003c40
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsi + 0x650]
test rdx, rdx
jne 0x14002b77d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14002b776
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14002baab
mov r14d, r13d
mov rcx, rdx
xor eax, eax
lea rdi, [0x1400a4510]
mov rsi, qword [rcx]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x14002b79e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x14002ba8e
cmp r12d, 1
jne 0x14002b7c8
xor r9d, r9d
lea r8, str.DeleteMonitorW2K_Search_Monitor_
mov rdx, qword [r13 + rdx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdi, qword [rsp + 0x28]
mov rax, qword [rdi + 0x650]
mov rdx, qword [r13 + rax]
mov rcx, rbx
call fcn.1400807e0
test eax, eax
je 0x14002b800
add r14d, 1
add r13, 0x10
mov rdx, qword [rdi + 0x650]
mov ecx, r14d
shl rcx, 4
add rcx, rdx
jmp 0x14002b783
mov ecx, r14d
add rcx, rcx
mov rax, qword [rdi + 0x650]
lea rdi, [rax + rcx*8 + 8]
mov rax, qword [rdi]
cmp dword [rax - 8], 1
jle 0x14002b826
mov edx, dword [rax - 0x10]
mov rcx, rdi
call fcn.140001a00
mov rdi, qword [rdi]
test rdi, rdi
je 0x14002ba8e
lea rcx, str.SPOOLER
call fcn.140016250
lea rcx, str.SPOOLER
call fcn.140021630
mov r8, r15
xor edx, edx
xor ecx, ecx
call sub.WINSPOOL.DRV_DeleteMonitorW
test eax, eax
jne 0x14002b899
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12d, r12d
je 0x14002b8d0
mov r8d, eax
lea rdx, str.WinAPI_DeleteMonitor__ERROR_n_Error_Code:__d_
lea rcx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteMonitorW2K
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14002b8d0
test r12d, r12d
je 0x14002b8d0
mov r8d, r14d
lea rdx, str.WinAPI_DeleteMonitor__OK_n_Monitor_Point:__d_
lea rcx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteMonitorW2K
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140080d50
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x3e], 0x5c
je 0x14002b927
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x460]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14002b944
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x460]
call qword [sym.imp.USER32.dll_wsprintfW]
test r12d, r12d
je 0x14002b980
lea r8, [rsp + 0x460]
lea rdx, str.Delete_File:__s_
lea rcx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteMonitorW2K
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002b9b0
test r12d, r12d
je 0x14002b9b0
xor r9d, r9d
lea r8, str.DeleteMonitorW2K
lea rdx, str.WinAPI_DeleteFile__ERROR
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140080d50
lea rcx, [rsp + 0x40]
call fcn.140021ee0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x3e], 0x5c
je 0x14002ba01
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x460]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14002ba1e
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x460]
call qword [sym.imp.USER32.dll_wsprintfW]
test r12d, r12d
je 0x14002ba5a
lea r8, [rsp + 0x460]
lea rdx, str.Delete_File:__s_
lea rcx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteMonitorW2K_for_WinNT_Win2000_
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
jne 0x14002ba90
test r12d, r12d
je 0x14002ba90
xor r9d, r9d
lea r8, str.DeleteMonitorW2K
lea rdx, str.WinAPI_DeleteFile_NT_2K___ERROR
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14002ba90
xor edi, edi
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14002baa9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret