Function at 0x14002a190
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbp
push rdi
sub rsp, 0x280
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r12
xor r12d, r12d
lea rcx, str.ResetVTP_here_n
or edi, 0xffffffff
mov rbp, r12
mov rsi, r12
call fcn.1400154e0
lea rcx, str.mfevtp
xor edx, edx
call fcn.140010c50
test al, al
jne 0x14002a1f1
lea rcx, str.Unable_to_stop_mfevtp_service_n
call fcn.1400154e0
jmp 0x14002a1fd
lea rcx, str.mfevtps_service_stopped_n
call fcn.1400154e0
lea r8, [rsp + 0x60]
lea rdx, str.vtp_catcache
mov r9d, 0x104
xor ecx, ecx
call fcn.14003d050
test al, al
jne 0x14002a22b
lea rcx, str.Unable_to_get_system_core_location_from_registry__n
call fcn.1400154e0
jmp 0x14002a89f
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov qword [rsp + 0x290], rbx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a2a4
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a2a4
mov rbx, r12
jmp 0x14002a2dc
test rbx, rbx
je 0x14002a2dc
cmp rbx, 0xffffffffffffffff
je 0x14002a2dc
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002a301
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Warning:_unable_to_delete_vtp_catcache__it_may_not_have_existed_however__last_error__u_n
mov edx, eax
call fcn.1400154e0
jmp 0x14002a312
lea rdx, [rsp + 0x60]
lea rcx, str.Deleted__S_n
call fcn.1400154e0
test rbx, rbx
je 0x14002a326
cmp rbx, 0xffffffffffffffff
je 0x14002a326
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a397
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a397
mov rbx, r12
jmp 0x14002a3cf
test rbx, rbx
je 0x14002a3cf
cmp rbx, 0xffffffffffffffff
je 0x14002a3cf
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.SYSTEMCurrentControlSetServices
mov rcx, 0xffffffff80000002
call fcn.1400393b0
test rax, rax
mov rbp, rax
je 0x14002a3fc
lea rdx, str.mfeavfk
mov rcx, rax
call fcn.1400393b0
mov rsi, rax
test rbx, rbx
je 0x14002a410
cmp rbx, 0xffffffffffffffff
je 0x14002a410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14002a888
lea r8, [rsp + 0x60]
lea rdx, str.mfehida.dll
mov r9d, 0x104
xor ecx, ecx
mov dword [rsp + 0x44], r12d
call fcn.14003d050
test al, al
jne 0x14002a449
lea rcx, str.Unable_to_get_system_core_location_from_registry__n
call fcn.1400154e0
jmp 0x14002a48e
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
jne 0x14002a47d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x60]
lea rcx, str.Unable_to_load__S_last_error__u_n
mov r8d, eax
call fcn.1400154e0
jmp 0x14002a897
lea rdx, [rsp + 0x60]
lea rcx, str.Loaded__S_for_cache_reset_n
call fcn.1400154e0
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a4ff
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a4ff
mov rbx, r12
jmp 0x14002a537
test rbx, rbx
je 0x14002a537
cmp rbx, 0xffffffffffffffff
je 0x14002a537
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, [rsp + 0x44]
lea rdx, str.VTPOptions
mov rcx, rsi
call fcn.14003b440
test al, al
jne 0x14002a562
lea rcx, str.VTPOptions_is_not_set_presently_n
call fcn.1400154e0
mov dword [rsp + 0x44], r12d
jmp 0x14002a572
mov edx, dword [rsp + 0x44]
lea rcx, str.VTPOptions_is_presently__x_n
call fcn.1400154e0
lea rdx, str.VTPOptions
mov r8d, 2
mov rcx, rsi
call fcn.14003b350
test al, al
jne 0x14002a597
lea rcx, str.Warning:_failed_to_set_VTPOptions_to_2_n
call fcn.1400154e0
test rbx, rbx
je 0x14002a5ab
cmp rbx, 0xffffffffffffffff
je 0x14002a5ab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x48]
lea rdx, str.HidLinkLoadAsync
lea rcx, str.mfehida.dll
xor r9d, r9d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
call fcn.140029f90
test eax, eax
jne 0x14002a5f8
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.mfeavfk.sys
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a60c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_create_HidLinkLoadAsync_interface__last_error__u_n
mov edx, eax
call fcn.1400154e0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002a665
mov r9d, 4
mov dword [rsp + 0x40], FDIDestroy
mov rax, qword [rcx]
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x65]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x18]
mov edx, dword [rsp + 0x40]
lea rcx, str.FileCacheReset:_MCFILTER_IOCTL_CACHERESET_for_attribute__u_returned__u_n
mov r8d, eax
call fcn.1400154e0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a787
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_load_mfeavfk.sys_last_error__u__perhaps_in_safe_mode___n
mov edx, eax
call fcn.1400154e0
call fcn.140006600
test rax, rax
mov rbx, rax
je 0x14002a6b9
cmp rax, 0xffffffffffffffff
je 0x14002a6b9
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.mfeavfk
mov rcx, rbp
call fcn.1400393b0
test rbx, rbx
mov rdi, rax
je 0x14002a6df
cmp rbx, 0xffffffffffffffff
je 0x14002a6df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14002a77b
call fcn.140006600
test rax, rax
mov rbx, rax
je 0x14002a728
cmp rax, 0xffffffffffffffff
je 0x14002a728
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.FileCache
mov rcx, rdi
call fcn.140039810
test al, al
jne 0x14002a751
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Warning:_unable_to_delete_FileCache_value__it_may_not_have_existed_however__last_error__u_n
mov edx, eax
call fcn.1400154e0
jmp 0x14002a75d
lea rcx, str.Deleted_FileCache_value_n
call fcn.1400154e0
test rbx, rbx
je 0x14002a771
cmp rbx, 0xffffffffffffffff
je 0x14002a771
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140039380
jmp 0x14002a787
lea rcx, str.Error:_unable_to_open_mfeavfk_key_n
call fcn.1400154e0
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a7f8
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14002a7f8
mov rbx, r12
jmp 0x14002a830
test rbx, rbx
je 0x14002a830
cmp rbx, 0xffffffffffffffff
je 0x14002a830
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r8d, dword [rsp + 0x44]
lea rdx, str.VTPOptions
mov rcx, rsi
call fcn.14003b350
test al, al
jne 0x14002a85a
mov edx, dword [rsp + 0x44]
lea rcx, str.Warning:_unable_to_reset_vtpOptions_value_to__x_n
call fcn.1400154e0
jmp 0x14002a86a
mov edx, dword [rsp + 0x44]
lea rcx, str.Reset_vtpOptions_value_to__x_n
call fcn.1400154e0
test rbx, rbx
je 0x14002a87e
cmp rbx, 0xffffffffffffffff
je 0x14002a87e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140039380
jmp 0x14002a894
lea rcx, str.Warning:_unable_to_open_mfeavfk_key_n
call fcn.1400154e0
mov edi, r12d
mov rbx, qword [rsp + 0x290]
lea rcx, str.mfevtp
mov dl, 1
call fcn.140011230
mov r12, qword [rsp + 0x2a0]
test al, al
jne 0x14002a8ca
lea rcx, str.Warning_unable_to_start_mfevtps_service__We_need_to_reboot._n
call fcn.1400154e0
mov edi, 1
test rsi, rsi
je 0x14002a8d8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
mov rsi, qword [rsp + 0x298]
je 0x14002a8ee
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ResetVTP_returning__u_n
mov edx, edi
call fcn.1400154e0
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14004c890
mov rbp, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret