Function at 0x435880
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x43632c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
mov dl, 1
mov cl, dl
call fcn.00465840
mov ecx, ebx
call fcn.00409af0
lea ecx, [ebp - 0x14]
call fcn.00402820
mov byte [ebp - 4], 3
mov bl, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.powercfg.exe__h_off
call fcn.0045d100
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov dl, bl
lea ecx, [ebp - 0x28]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 5
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
cmp ecx, esi
je 0x43596e
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x435962
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x435962
call fcn.00403060
mov dword [ebp - 0x24], eax
or edi, 0xffffffff
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x43595a
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x24]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x435971
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.004030c0
or edi, 0xffffffff
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435993
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x4359bc
cmp ecx, dword [esi - 0x10]
jne 0x4359bc
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x4359e6
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x436336
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp_disable_hybernation_command_result
call fcn.0045d100
mov byte [ebp - 4], 9
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push str.C:hiberfil.sys
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb esi, esi
neg esi
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.adminRequiredCleanUp_deleting_hyberfil.sys_file_result
call fcn.0045d100
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0045f800
mov bl, 1
add esp, 4
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.sc_config_WSearch_startdemand
call fcn.0045d100
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 3
mov dl, bl
lea ecx, [ebp - 0x24]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0xd
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
cmp ecx, esi
je 0x435ad9
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x435acd
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x435acd
call fcn.00403060
mov dword [ebp - 0x28], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x435ac5
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x435ad9
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.004030c0
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435afb
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435b24
cmp ecx, dword [esi - 0x10]
jne 0x435b24
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435b4e
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x43633b
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp_Congifure_WSearch_to_mannual
call fcn.0045d100
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.0045f800
mov bl, 1
add esp, 4
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.net_stop_WSearch
call fcn.0045d100
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 3
mov dl, bl
lea ecx, [ebp - 0x24]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x13
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
cmp ecx, esi
je 0x435bfa
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x435bee
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x435bee
call fcn.00403060
mov dword [ebp - 0x28], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x435be6
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x435bfa
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.004030c0
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435c1c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435c45
cmp ecx, dword [esi - 0x10]
jne 0x435c45
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435c6f
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x436340
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp_stop_WSearch
call fcn.0045d100
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push 0x48ac80
lea ecx, [ebp - 0x20]
call fcn.0045d100
mov byte [ebp - 4], 0x18
push ecx
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435cdc
cmp ecx, dword [esi - 0x10]
jne 0x435cdc
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435d06
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x436345
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x18
call fcn.00464350
add esp, 4
test al, al
je 0x435e64
push str.C:ProgramDataMicrosoftSearchDataApplicationsWindowsWindows.edb
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x435eaf
push str.Failed_to_delete_the_Windows.edb_file
lea ecx, [ebp - 0x18]
call fcn.0045d070
movzx eax, bl
mov dword [ebp - 0x24], eax
push ecx
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435d7e
cmp ecx, dword [esi - 0x10]
jne 0x435d7e
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435da8
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x43634a
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp
call fcn.0045d100
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x24]
call fcn.0045f800
add esp, 4
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x1e
push ecx
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esp
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435e14
cmp ecx, dword [esi - 0x10]
jne 0x435e14
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435e3e
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x43634f
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.Failure
call fcn.0045d100
mov byte [ebp - 4], 0x21
jmp 0x435ea0
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x22
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.System_restart_is_needed_to_fix_the_issue_completely.
call fcn.0045d100
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1c]
call fcn.0045fd10
add esp, 0xc
mov bl, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.sc_config_WSearch_startauto
call fcn.0045d100
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x18
mov dl, bl
lea ecx, [ebp - 0x24]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x26
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
cmp ecx, esi
je 0x435f29
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x435f1d
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x435f1d
call fcn.00403060
mov dword [ebp - 0x28], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x435f15
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x435f29
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.004030c0
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435f4b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x435f74
cmp ecx, dword [esi - 0x10]
jne 0x435f74
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x435f9e
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x436354
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp_Congifure_WSearch_to_auto
call fcn.0045d100
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x18
or ecx, 0xffffffff
call fcn.0045f800
mov bl, 1
add esp, 4
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.net_start_WSearch
call fcn.0045d100
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x18
mov dl, bl
lea ecx, [ebp - 0x24]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x2c
mov edx, dword [eax]
lea ecx, [edx - 0x10]
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
cmp ecx, esi
je 0x43604a
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x43603e
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x43603e
call fcn.00403060
mov dword [ebp - 0x28], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x436036
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov dword [ebp - 0x14], eax
jmp 0x43604a
push dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.004030c0
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43606c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x28], esp
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x436095
cmp ecx, dword [esi - 0x10]
jne 0x436095
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x4360bf
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x436359
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.adminRequiredCleanUp_start_WSearch
call fcn.0045d100
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x18
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436114
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436136
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 1
jmp 0x436223
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x436242
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
int3