Function at 0x1401fb984
Capabilities:
Check if file exists
Empty the recycle bin
Get disk information
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov r12, rcx
xor r15d, r15d
cmp qword [rcx + 0x20], r15
je 0x1401fc478
call fcn.14023ddcc
test al, al
je 0x1401fba2f
mov byte [r12 + 0x70], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r15b
mov r9b, 1
lea r15, [0x14034fa44]
mov r8, r15
lea rdx, str.C:Recycled
mov rcx, r12
call fcn.14020f850
test al, al
je 0x1401fc46c
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8, r15
lea rdx, str.C:Recycler
mov rcx, r12
call fcn.14020f850
jmp 0x1401fc46c
mov rax, qword [r12 + 0x30]
cmp qword [rax + 0x80], r15
je 0x1401fba4c
mov rax, qword [rax + 0x80]
mov cl, byte [rax + 0x21]
mov byte [r12 + 0x70], cl
mov rdi, r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
movabs rax, 0x5c003a0041
mov qword [rbp + 0x90], rax
call sub.KERNEL32.dll_GetLogicalDrives
test eax, eax
je 0x1401fba8c
mov r8d, eax
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x50]
call fcn.1401f6da4
mov rdi, qword [rbp - 0x50]
mov r14, r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov rsi, qword [rbp - 0x48]
sub rsi, rdi
sar rsi, 3
test rsi, rsi
je 0x1401fbb1c
mov rbx, rdi
mov rcx, rbx
call fcn.1402c7118
test al, al
je 0x1401fbb0f
mov rcx, rbx
call fcn.1402c7148
test al, al
je 0x1401fbb03
xor eax, eax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov dword [rbp + 0x78], 0x18
lea rdx, [rbp + 0x78]
mov rcx, qword [rbx]
call fcn.140234f1c
test eax, eax
js 0x1401fbb0f
cmp qword [rbp + 0x80], r15
jg 0x1401fbb03
cmp qword [rbp + 0x88], r15
jle 0x1401fbb0f
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140038190
add rbx, 8
dec rsi
jne 0x1401fbaae
mov r14, qword [rbp - 0x70]
mov qword [rsp + 0x60], r15
and dword [rsp + 0x40], 0
cmp byte [r12 + 0x70], 0
jne 0x1401fbbd4
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x60], 0x18
lea rdx, [rbp + 0x60]
xor ecx, ecx
call fcn.140234f1c
test eax, eax
js 0x1401fbb68
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x60], rax
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x40], eax
jmp 0x1401fbbd4
cmp eax, 0x80070057
jne 0x1401fbbd4
mov rbx, qword [rbp - 0x68]
sub rbx, r14
sar rbx, 3
test rbx, rbx
je 0x1401fbbd4
mov rsi, r14
mov edi, dword [rsp + 0x40]
mov rcx, rsi
call fcn.1402c7118
test al, al
je 0x1401fbbbe
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x60], 0x18
lea rdx, [rbp + 0x60]
mov rcx, qword [rsi]
call fcn.140234f1c
test eax, eax
js 0x1401fbbbe
add r15, qword [rbp + 0x68]
add edi, dword [rbp + 0x70]
add rsi, 8
dec rbx
jne 0x1401fbb86
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x60], r15
mov rdi, qword [rbp - 0x50]
mov sil, 1
mov byte [rsp + 0x30], sil
mov rax, qword [r12 + 0x30]
xor r15d, r15d
test rax, rax
je 0x1401fbc02
cmp qword [rax + 0x80], r15
je 0x1401fbc02
mov rax, qword [rax + 0x80]
cmp byte [rax + 0x25], r15b
mov bl, sil
jne 0x1401fbc05
mov bl, r15b
mov rax, qword [r12 + 0x20]
cmp byte [rax + 1], r15b
jne 0x1401fbc14
test bl, bl
jne 0x1401fbc1f
cmp byte [r12 + 0x70], r15b
je 0x1401fc23b
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rcx, qword [r12 + 0x20]
cmp qword [rcx + 0x90], r15
je 0x1401fbc68
mov rcx, qword [rcx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
sar rcx, 4
cmp rcx, 1
ja 0x1401fbc81
mov rax, qword [r12 + 0x30]
mov rcx, qword [rax]
cmp dword [rcx - 0x10], r15d
je 0x1401fbc9a
test bl, bl
jne 0x1401fbc81
cmp byte [r12 + 0x70], r15b
je 0x1401fbc9a
mov r8, qword [r12 + 0x30]
mov r8, qword [r8]
lea rdx, [0x140368998]
lea rcx, [rsp + 0x58]
call fcn.14000d9c8
mov qword [rbp], r15
mov rbx, qword [rbp - 0x68]
sub rbx, r14
sar rbx, 3
mov qword [rbp - 8], rbx
test rbx, rbx
je 0x1401fc213
lea r15, [0x14034fa44]
xor edi, edi
test sil, sil
je 0x1401fc210
mov rcx, r14
call fcn.1402c7118
test al, al
je 0x1401fc1f8
lea rcx, [r12 + 0x78]
call fcn.1400080f8
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0x68], eax
mov rcx, qword [r14]
call fcn.140111538
mov dil, al
mov byte [rsp + 0x31], al
test al, al
je 0x1401fbd13
mov rcx, qword [r12 + 0x20]
cmp byte [rcx + 0x78], 0
je 0x1401fc1ec
mov rdx, qword [r14]
lea rcx, [rsp + 0x38]
call fcn.14000cb18
nop
lea rax, str.Recycled
lea rdx, str.Recycler
test dil, dil
cmovne rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000f884
test dil, dil
jne 0x1401fbd54
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14000f884
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.14000c4d8
nop
lea rdx, str.INFO2
lea rcx, [rsp + 0x50]
call fcn.14000f884
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
cmp eax, 0xffffffff
setne dil
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test edi, edi
je 0x1401fc0c1
mov sil, 1
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.1401bc3bc
mov rbx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x48], rbx
cmp rbx, qword [rbp + 0x20]
je 0x1401fbff0
mov rax, qword [r12 + 0x20]
cmp byte [rax + 1], dil
je 0x1401fbf1d
mov sil, dil
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x20]
cmp dword [rax - 0x10], edi
jle 0x1401fbfe5
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x1401fbe4a
cmp qword [rax + 0x80], rdi
je 0x1401fbe4a
mov rax, qword [rax + 0x80]
cmp byte [rax + 0x24], dil
je 0x1401fbe4a
mov rax, qword [rcx + 0x18]
mov rcx, rax
shr rcx, 0x20
mov dword [rbp - 0xc], ecx
mov dword [rbp - 0x10], eax
mov edx, 1
lea rcx, [rbp - 0x10]
call fcn.1401ef324
test al, al
je 0x1401fbfe5
mov ecx, 0x88
call fcn.1400be454
mov qword [rbp + 0x30], rax
test rax, rax
je 0x1401fbe6c
mov rdx, qword [r12 + 0x10]
mov rcx, rax
call fcn.14006de38
jmp 0x1401fbe6f
mov rax, rdi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400186f8
nop
mov rdx, qword [rbx]
add rdx, 0x20
mov rcx, qword [rsp + 0x70]
add rcx, 0x20
call fcn.14000c244
mov r11, qword [rbx]
mov rcx, qword [r11 + 0x10]
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x30], 1
mov rax, qword [r12 + 8]
lea rdx, [rsp + 0x70]
lea rcx, [r12 + 8]
call qword [rax + 0x58]
mov r11, qword [r12 + 0x20]
mov rax, qword [r12 + 8]
lea rdx, [rsp + 0x70]
lea rcx, [r12 + 8]
cmp byte [r11 + 1], 0
je 0x1401fbee0
call qword [rax + 0x60]
jmp 0x1401fbee4
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
nop
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x1401fbfe5
lock dec dword [rdi + 8]
jne 0x1401fbfe0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rdi + 0xc]
jne 0x1401fbfe0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x1401fbfe0
mov rax, qword [rbx]
mov rcx, qword [rax + 0x20]
cmp dword [rcx - 0x10], edi
jle 0x1401fbfe5
mov rdx, rbx
lea rcx, [rbp + 0x28]
call fcn.1401bcc3c
nop
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14000c4d8
mov r11, qword [rbx]
mov qword [rbp + 0x10], r11
mov rax, qword [rbx + 8]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x1401fbf5e
lock inc dword [rax + 8]
lea rcx, [r12 + 0x98]
lea r8, [rbp + 8]
lea rdx, [rbp + 0x50]
call fcn.1400734a8
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1401fbfa1
lock dec dword [rcx + 8]
jne 0x1401fbfa1
mov rbx, qword [rbp + 0x18]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401fbfa1
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fbfc1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fbfe0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
add rbx, 0x10
xor edi, edi
jmp 0x1401fbdd2
test sil, sil
je 0x1401fc016
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], dil
mov r9b, 1
mov r8, r15
mov rdx, qword [rsp + 0x38]
mov rcx, r12
call fcn.14020f850
mov byte [rsp + 0x30], al
mov rcx, qword [r12 + 0x20]
mov rbx, qword [rsp + 0x50]
cmp byte [rcx + 1], dil
jne 0x1401fc06a
lea rcx, [r12 + 8]
mov rdx, qword [rcx]
call qword [rdx + 0x30]
test al, al
je 0x1401fc06a
mov rcx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
cmp rcx, rsi
je 0x1401fc072
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x1401fc072
cmp qword [rax + 0x80], rdi
je 0x1401fc072
mov rax, qword [rax + 0x80]
cmp byte [rax + 0x24], dil
jne 0x1401fc072
mov rcx, rbx
call fcn.1401bc12c
mov rcx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
test rcx, rcx
je 0x1401fc0c1
cmp rcx, rsi
je 0x1401fc0bc
lea rdi, [rcx + 8]
mov rbx, qword [rdi]
test rbx, rbx
je 0x1401fc0a6
lock dec dword [rbx + 8]
jne 0x1401fc0a6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401fc0a6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
add rdi, 0x10
lea rax, [rdi - 8]
cmp rax, rsi
jne 0x1401fc080
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x30]
call fcn.1400be0f4
mov sil, byte [rsp + 0x30]
xor edi, edi
test sil, sil
je 0x1401fc1a9
call fcn.14023e03c
test al, al
je 0x1401fc1a9
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14000c244
lea rdx, [0x1403689d0]
lea rcx, [rsp + 0x38]
call fcn.14000f884
cmp byte [rsp + 0x31], dil
jne 0x1401fc112
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14000f884
lea rcx, [r12 + 0xd8]
lea rdx, [rsp + 0x38]
call fcn.14000c244
lea rcx, [r12 + 0xb8]
call fcn.140003c14
mov r11, qword [r12 + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, r12
cmp byte [r11 + 1], dil
je 0x1401fc15a
mov byte [r12 + 0x71], dil
mov byte [rsp + 0x28], dil
xor r9d, r9d
lea r8, [0x1403689f0]
jmp 0x1401fc198
mov byte [r12 + 0x71], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], dil
mov r9b, 1
mov r8, r15
call fcn.14020f850
mov sil, al
mov byte [rsp + 0x30], al
mov byte [r12 + 0x71], dil
test al, al
je 0x1401fc1a9
mov byte [rsp + 0x28], 1
mov r9b, 1
mov r8, r15
mov rdx, qword [rsp + 0x38]
mov rcx, r12
mov byte [rsp + 0x20], dil
call fcn.14020f850
mov byte [rsp + 0x30], al
mov sil, al
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401fc1c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401fc1e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 8]
jmp 0x1401fc1ee
xor edi, edi
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [rbp]
inc rax
mov qword [rbp], rax
add r14, 8
cmp rax, rbx
jb 0x1401fbcbf
xor r15d, r15d
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fc233
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x50]
mov rax, qword [r12 + 0x20]
cmp byte [rax + 1], r15b
jne 0x1401fc316
cmp byte [rax + 0x78], r15b
je 0x1401fc316
test sil, sil
je 0x1401fc316
lea rcx, [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0x30]
test al, al
je 0x1401fc316
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x1401fc311
cmp byte [rax + 0x18], r15b
je 0x1401fc311
test rax, rax
je 0x1401fc311
cmp qword [rax + 0x80], r15
je 0x1401fc311
mov rax, qword [rax + 0x80]
cmp byte [rax + 0x24], r15b
jne 0x1401fc311
lea rax, vtable.Piriform::CEventLocker.0
mov qword [rbp + 0x40], rax
lea r9, str.CCLEANER_UI_LOCKING_EVENT
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov qword [rbp + 0x48], rax
call fcn.1400046d0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
cmp dword [rax + 0x10], 1
ja 0x1401fc2f3
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
jmp 0x1401fc2fa
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
test rbx, rbx
je 0x1401fc311
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140234edc
mov rax, qword [r12 + 0x20]
cmp byte [rax + 1], r15b
jne 0x1401fc346
cmp byte [r12 + 0x70], r15b
je 0x1401fc346
call fcn.14023e03c
test al, al
jne 0x1401fc346
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1401fc346
cmp byte [rcx + 0x18], r15b
jne 0x1401fc346
call fcn.1401bcd9c
mov ebx, dword [rsp + 0x40]
test ebx, ebx
jle 0x1401fc419
mov ecx, 0x88
call fcn.1400be454
mov qword [rbp + 0x30], rax
test rax, rax
je 0x1401fc374
mov rdx, qword [r12 + 0x10]
mov rcx, rax
call fcn.14006de38
jmp 0x1401fc377
mov rax, r15
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400186f8
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
cmovs rcx, r15
mov rax, qword [rbp - 0x80]
mov qword [rax + 0x28], rcx
mov rax, qword [rbp - 0x80]
mov dword [rax + 0x30], ebx
mov rax, qword [rbp - 0x80]
mov dword [rax + 0x18], 4
mov rax, qword [r12 + 0x20]
cmp byte [rax + 1], r15b
sete cl
mov rax, qword [rbp - 0x80]
mov byte [rax + 0x70], cl
mov rax, qword [r12 + 0x20]
lea rcx, [r12 + 8]
lea rdx, [rbp - 0x80]
cmp byte [rax + 1], r15b
mov rax, qword [rcx]
je 0x1401fc3d9
call qword [rax + 0x60]
jmp 0x1401fc3dd
call qword [rax + reloc.OLEAUT32.dll_VarBstrFromCy]
nop
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x1401fc419
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1401fc411
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x1401fc411
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r14, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x50]
test r14, r14
je 0x1401fc442
mov rbx, r14
cmp r14, qword [rbp - 0x68]
je 0x1401fc439
mov rcx, rbx
call fcn.140082b80
add rbx, 8
cmp rbx, qword [rbp - 0x68]
jne 0x1401fc427
mov rcx, r14
call fcn.1400be0f4
nop
test rdi, rdi
je 0x1401fc46f
mov rbx, rdi
cmp rdi, qword [rbp - 0x48]
je 0x1401fc462
mov rcx, rbx
call fcn.140082b80
add rbx, 8
cmp rbx, qword [rbp - 0x48]
jne 0x1401fc450
mov rcx, rdi
call fcn.1400be0f4
jmp 0x1401fc46f
xor r15d, r15d
mov rax, qword [r12 + 0x20]
mov byte [rax + 0x78], r15b
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.1400be110
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret