Function at 0x140018ae0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rcx
call fcn.14003c3f0
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140018b23
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xa8], rax
xor edx, edx
mov dword [rsp + 0xa0], edx
or edi, 0xffffffff
cmp dword [r14 + 0x3b0e0], edx
jle 0x140018dd4
mov r12d, 0xba
mov qword [rsp + 0x20], r12
lea rax, [r14 + 0x1890]
mov rcx, rax
mov qword [rsp + 0x28], rax
nop
nop
cmp dword [rcx + 4], 0
je 0x140018d98
mov dword [rsp + 0x98], 0
xor r15d, r15d
cmp dword [rcx], r15d
jle 0x140018d98
nop
nop
nop
nop
xor r13d, r13d
cmp dword [r14 + 0x3b0e0], r13d
jle 0x140018cbd
mov rbp, rax
cmp dword [rbp + 4], 0
jne 0x140018ca5
lea rax, [r12 + r15]
mov rbx, qword [r14 + rax*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140018be9
cmp rax, qword [rbx - 0x18]
jne 0x140018be9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140018c25
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140018dc8
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009f640
lea rbx, [rdi + 0x18]
mov qword [rsp + 0x40], rbx
xor r12d, r12d
xor esi, esi
cmp dword [rbp], esi
jle 0x140018c7a
lea rdi, [rbp - 0x12c0]
nop
test rbx, rbx
je 0x140018c66
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], r12d
jl 0x140018c66
mov rdx, rbx
call fcn.14009f5d0
test rax, rax
je 0x140018c66
sub rax, qword [rdi]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140018c74
add esi, 1
add rdi, 8
cmp esi, dword [rbp]
jge 0x140018c7a
jmp 0x140018c40
mov r12d, 1
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140018c97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12d, r12d
jne 0x140018d5e
mov r12, qword [rsp + 0x20]
add r13d, 1
add rbp, 0x12c8
cmp r13d, dword [r14 + 0x3b0e0]
jl 0x140018bb3
lea rsi, [r12 + r15]
mov rbx, qword [r14 + rsi*8]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140018ce9
cmp rax, qword [rbx - 0x18]
jne 0x140018ce9
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x140018d25
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140018dce
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009f640
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1400116f0
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140018d65
xor edx, edx
lea r8d, [rax + 4]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
or edi, 0xffffffff
jmp 0x140018d68
mov r12, qword [rsp + 0x20]
jmp 0x140018d68
or edi, 0xffffffff
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
add r15, 1
mov rcx, qword [rsp + 0x28]
cmp eax, dword [rcx]
lea rax, [r14 + 0x1890]
jl 0x140018ba0
mov edx, dword [rsp + 0xa0]
add edx, 1
mov dword [rsp + 0xa0], edx
add rcx, 0x12c8
mov qword [rsp + 0x28], rcx
add r12, 0x259
mov qword [rsp + 0x20], r12
cmp edx, dword [r14 + 0x3b0e0]
jge 0x140018dd4
jmp 0x140018b70
call fcn.140002f80
int3
call fcn.140002f80
int3
lea r8, [r14 + 0x1bc]
lea rdx, str._sRealtekAudioHDA
lea rcx, [rsp + 0xa8]
call fcn.140006f70
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x1bc]
lea rdx, str._sRealtekAudio
lea rcx, [rsp + 0xa8]
call fcn.140006f70
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r8, [r14 + 0x1bc]
lea rdx, str._sRealtek
lea rcx, [rsp + 0xa8]
call fcn.140006f70
xor edx, edx
lea r8d, [rdx + 4]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x140018e7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret