Function at 0x140008c90
Capabilities:
Check if file exists
Delete file
Disable driver code integrity
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1990]
mov eax, 0x1a90
call fcn.1400294a0
sub rsp, rax
mov rax, qword [0x140051018]
xor rax, rsp
mov qword [rbp + 0x1980], rax
cmp qword [0x1400536a8], 0
mov edi, edx
mov rsi, rcx
jne 0x14000906b
xor r15d, r15d
test rcx, rcx
je 0x140008e8d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140008cf6
test al, 0x10
lea eax, [r15 + 1]
je 0x140008cf9
mov eax, r15d
test eax, eax
je 0x140008e8d
call fcn.1400091c0
mov rdx, rax
lea rcx, str.___Systems_ci.dll_file_version_is:__s_n
mov rbx, rax
call fcn.140001010
lea r8, [0x14003eb8c]
mov qword [rsp + 0x30], r15
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140019108
mov r8, qword [rsp + 0x30]
test r8, r8
jne 0x140008d4c
lea rcx, str.____Ci_offsets_CSV_file_not_found___invalid._A_valid_offset_file_must_be_specifed_
call fcn.1400184e0
jmp 0x140008e81
mov edx, 0x800
lea rcx, [rbp + 0x980]
call fcn.140019750
test rax, rax
je 0x140008e62
nop word [rax + rax]
lea rcx, [rbp + 0x980]
call fcn.140011e48
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], r15
lea rdx, [0x14003ec30]
mov rcx, rax
call fcn.140019644
mov r8, rax
lea rcx, [rbp + 0x780]
mov edx, 0x100
call fcn.140018148
lea r8, [rbp + 0x780]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140008dd4
add rax, 2
test ecx, ecx
jne 0x140008dc0
test edx, edx
je 0x140008df9
mov r8, qword [rsp + 0x30]
lea rcx, [rbp + 0x980]
mov edx, 0x800
call fcn.140019750
test rax, rax
jne 0x140008d70
jmp 0x140008e62
mov rdx, rbx
lea rcx, str.___Offsets_are_available_for_this_version_of_ci.dll___s__
call fcn.140001010
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x14003ec30]
call fcn.140019644
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8d, 0x10
call fcn.14001931c
lea r8, [rsp + 0x38]
mov qword [0x1400536a8], rax
lea rdx, [0x14003ec30]
xor ecx, ecx
call fcn.140019644
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8d, 0x10
call fcn.14001931c
mov qword [0x1400536b0], rax
mov rcx, qword [rsp + 0x30]
call fcn.140019284
mov eax, r15d
cmp qword [0x1400536a8], rax
setne al
test eax, eax
jne 0x14000906b
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ci_in_use.
call fcn.1400184e0
test edi, edi
je 0x140009109
lea rcx, str.___Downloading_ci_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
mov qword [rsp + 0x1ab8], r14
call fcn.1400184e0
call fcn.140009110
mov rcx, rax
call fcn.140004410
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.1400097c0
mov rcx, rax
mov rdi, rax
call fcn.14000b280
mov rcx, qword [rdi + 0x80]
mov rbx, rax
test rcx, rcx
je 0x140008ee9
call fcn.1400183e4
mov qword [rdi + 0x80], r15
mov rcx, rdi
call fcn.1400183e4
mov rcx, r14
call fcn.1400183e4
mov r14, qword [rsp + 0x1ab8]
test rbx, rbx
je 0x1400090fd
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x830
call fcn.14000e900
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_CiOptions
mov dword [rsp + 0x50], 0x58
mov dword [rbp - 0x60], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140008f53
mov rax, qword [rbp - 0x78]
sub rax, qword [rbx + 8]
jmp 0x140008f56
mov rax, r15
xor edx, edx
mov qword [0x1400536a8], rax
mov r8d, 0x830
lea rcx, [rbp + 0x980]
call fcn.14000e900
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x980]
mov rcx, qword [rbx + 0x10]
lea r8, str.CiValidateImageHeader
mov dword [rbp + 0x980], 0x58
mov dword [rbp + 0x9d0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140008fb2
mov rax, qword [rbp + 0x9b8]
sub rax, qword [rbx + 8]
jmp 0x140008fb5
mov rax, r15
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov qword [0x1400536b0], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
call fcn.1400183e4
mov rcx, rbx
mov qword [rbx], r15
call fcn.1400183e4
mov eax, r15d
cmp qword [0x1400536a8], rax
setne al
test eax, eax
je 0x1400090fd
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.1400184e0
test rsi, rsi
je 0x14000906b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000906b
test al, 0x10
jne 0x14000906b
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.1400184e0
call fcn.1400091c0
lea r8, [0x14003ecc4]
mov qword [rsp + 0x30], r15
mov rdx, rsi
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.140019108
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140009097
lea rcx, str.____CI_offsets_CSV_file_cannot_be_opened
call fcn.1400184e0
mov eax, 1
mov rcx, qword [rbp + 0x1980]
xor rcx, rsp
call fcn.14000d570
lea r11, [rsp + 0x1a90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov r8, rbx
lea rdx, [0x14003627c]
call fcn.140005740
lea rbx, [0x1400536a8]
lea rdi, [0x1400536b8]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x30]
call fcn.140005740
add rbx, 8
cmp rbx, rdi
jl 0x1400090c0
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140037548]
call fcn.140005740
mov rcx, qword [rsp + 0x30]
call fcn.140019284
jmp 0x14000906b
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.1400184e0
xor eax, eax
jmp 0x140009070