Function at 0x1400516a0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x910]
sub rsp, 0xa10
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xa60], rbx
mov rax, qword [0x14026fdb0]
xor rax, rsp
mov qword [rbp + 0x900], rax
mov edi, edx
mov r12, rcx
mov qword [rsp + 0x50], rcx
mov ebx, 1
mov dword [rsp + 0x44], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.14019d7c0
lea rdx, [rbp + 0x6f0]
mov ecx, edi
call fcn.14001e330
mov dword [rsp + 0x40], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4e0]
call fcn.14019d7c0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x3d0]
call fcn.14019d7c0
lea rdx, [0x1402209ac]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edi, edi
mov dword [rsp + 0x4c], edi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x3d0]
mov r8d, ebx
lea rdx, [rbp + 0x6f0]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
cmp eax, ebx
jne 0x1400517a1
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400517a9
test eax, eax
je 0x140051e95
mov r13d, edi
mov dword [rsp + 0x48], edi
mov r15, rdi
cmp qword [r12 + 0x220], rdi
jle 0x140051e95
test r15, r15
js 0x140051e8f
cmp r15, qword [r12 + 0x220]
jge 0x140051e8f
mov rax, qword [r12 + 0x218]
mov rdi, qword [rax + r15*8]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140051807
cmp rax, qword [rdi - 0x18]
jne 0x140051807
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x140051842
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140051e89
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140199918
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x30], rdi
mov edx, 0x5c
mov rcx, rdi
call fcn.14019a074
mov r14, rax
test rax, rax
jne 0x140051866
or r14d, 0xffffffff
jmp 0x14005186c
sub r14, rdi
sar r14, 1
inc r14d
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rdi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x1400518c0
lea rdx, [rbp - 0x68]
call fcn.140012140
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, [0x14021c280]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x68]
jmp 0x1400518ea
lea rdx, [rsp + 0x60]
call fcn.140012140
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051905
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x103
or eax, ecx
jge 0x140051932
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.140005ae0
mov rsi, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, r12
call fcn.140051540
test eax, eax
jne 0x140051df4
lea edx, [rax + 0x20]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x140051986
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140051986
cmp eax, 3
jbe 0x14005197e
cmp eax, 5
je 0x14005197e
cmp eax, 0x20
jne 0x140051986
mov dword [rsp + 0x44], 1
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x1400519e1
lea rdx, [rbp - 0x78]
call fcn.140012140
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_d_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x78]
jmp 0x140051a15
lea rdx, [rsp + 0x70]
call fcn.140012140
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140221320]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051a30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x20
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140056384
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140051e6d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x50]
lea rax, [rbp - 0x50]
test rax, 0xffffffffffff0000
jne 0x140051ab3
movzx edi, cx
mov ecx, edi
call fcn.140056158
test rax, rax
je 0x140051ba7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140005730
mov rbx, qword [rsp + 0x38]
jmp 0x140051ba7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140051b24
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140051ba7
cmp dword [rdx + 0x10], eax
jge 0x140051af6
cmp dword [rbx - 0xc], eax
jl 0x140051e4c
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140051ba7
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051b0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140051ba7
mov r13d, dword [rbx - 0x10]
lea r12, [rbp - 0x50]
sub r12, rbx
sar r12, 1
test ecx, ecx
js 0x140051e62
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140051b5c
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140005ae0
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r12, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x140051b80
lea r8, [rbx + r12*2]
call fcn.140199418
jmp 0x140051b89
lea r8, [rbp - 0x50]
call fcn.140199918
cmp edi, dword [rbx - 0xc]
jg 0x140051e57
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r13 + rbx], ax
mov r12, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x48]
mov r8d, 3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.140012140
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140051c16
cmp dword [rbx + 0x10], 0
jl 0x140051c07
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140051c07
call fcn.140006db0
mov rdi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140051bfc
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140051c16
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400059f0
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051c35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x140220678]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140199570
test eax, eax
je 0x140051c64
lea rdx, [0x140220680]
mov rcx, rdi
call fcn.140199570
test eax, eax
jne 0x140051dd4
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x140051cbf
lea rdx, [rbp - 0x70]
call fcn.140012140
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140224d60]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x70]
jmp 0x140051cf3
lea rdx, [rsp + 0x78]
call fcn.140012140
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_dCOLOR_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051d0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x140051d71
lea rdx, [rsp + 0x58]
call fcn.140012140
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140224da0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x58]
jmp 0x140051d9b
lea rdx, [rsp + 0x68]
call fcn.140012140
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, str._sCOLOR_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051db6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x50]
call fcn.1400249d0
mov rdi, qword [rsp + 0x38]
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051def
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.140199d34
test eax, eax
js 0x140051e7e
cmp eax, dword [rsi - 0xc]
jg 0x140051e7e
mov dword [rsi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rsi + rax*2], cx
lea rdx, [rsi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140051e2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
mov dword [rsp + 0x48], r13d
inc r15
movsxd rax, r13d
cmp rax, qword [r12 + 0x220]
jge 0x140051e78
jmp 0x1400517c1
mov ecx, 0x80070057
call fcn.140004550
int3
mov ecx, 0x80070057
call fcn.140004550
int3
mov ecx, 0x80070057
call fcn.140004550
nop
mov ecx, 0x80004005
call fcn.140004550
nop
mov ebx, dword [rsp + 0x44]
jmp 0x140051e95
mov ecx, 0x80070057
call fcn.140004550
nop
call fcn.140005c40
int3
call fcn.14005694c
int3
mov eax, ebx
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.140198b40
mov rbx, qword [rsp + 0xa60]
add rsp, 0xa10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret