Function at 0x140020f90
Capabilities:
Delete file

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x3b0
mov qword [rsp + 0x2c0], 0xfffffffffffffffe
mov r15d, ecx
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400218bd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov dl, 1
movzx ecx, dl
call fcn.140062cc0
mov ecx, r15d
call fcn.140014ea0
call fcn.140061970
movzx edi, al
mov byte [rsp + 0x3e8], dil
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x388], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x390], rax
lea rdx, [0x140099334]
lea rcx, [rsp + 0xa0]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Is_Window_7_machine
lea rcx, [rsp + 0xa8]
call fcn.14000c6f0
nop
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
test dil, dil
jne 0x140021886
call fcn.14000d980
mov rcx, rax
mov qword [rsp + 0x200], rax
test rax, rax
je 0x1400218c8
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0x208], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x210], rax
lea rdx, str.sc_config_WSearch_startdemand
lea rcx, [rsp + 0xb0]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.14005e3e0
mov qword [rsp + 0x218], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x220], rcx
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0xb8], rbx
cmp rcx, rbx
je 0x140021154
cmp dword [rbx + 0x10], 0
jl 0x140021136
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140021136
call fcn.14000d070
mov qword [rsp + 0xc0], rax
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140021123
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140021159
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x98], r8d
mov qword [rsp + 0x228], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d160
mov esi, 0xffffffff
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14002118a
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x230], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x238], rax
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x240], rbx
mov rcx, rbx
call fcn.14000d070
mov qword [rsp + 0x248], rax
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.cDriveGettingFull_KB_11360_Congifure_WSearch_to_mannual
lea rcx, [rsp + 0xd8]
call fcn.14000c6f0
nop
mov r8d, esi
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x250], rax
lea rdx, str.net_stop_WSearch
lea rcx, [rsp + 0xe0]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.14005e3e0
mov qword [rsp + 0x258], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x260], rcx
mov qword [rsp + 0xe8], rbx
cmp rcx, rbx
je 0x1400212bc
cmp dword [rbx + 0x10], 0
jl 0x14002129d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002129d
call fcn.14000d070
mov qword [rsp + 0xf0], rax
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14002128a
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0xf0]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x1400212bc
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1f0], r8d
mov qword [rsp + 0x268], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0xf8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x100], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400212ed
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x278], rax
mov r14, qword [rsp + 0x20]
add r14, 0xffffffffffffffe8
mov qword [rsp + 0x280], r14
mov rcx, r14
call fcn.14000d070
mov qword [rsp + 0x288], rax
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.cDriveGettingFull_KB_11360_stop_WSearch
lea rcx, [rsp + 0x108]
call fcn.14000c6f0
nop
mov r8d, esi
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14005c670
lea rdx, [0x14009d4a0]
lea rcx, [rsp + 0x48]
call fcn.14000c6f0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x298], rcx
call fcn.14000d070
mov qword [rsp + 0x2a0], rax
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.140061a50
mov byte [rsp + 0x3f0], al
test al, al
je 0x1400214da
lea rcx, str.C:ProgramDataMicrosoftSearchDataApplicationsWindowsWindows.edb
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
mov byte [rsp + 0x3f8], dil
test eax, eax
jne 0x14002155e
lea rdx, str.Failed_to_delete_the_Windows.edb_file
lea rcx, [rsp + 0x28]
call fcn.14000c480
lea rax, [rsp + 0x70]
mov qword [rsp + 0x2a8], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x2b0], rax
mov rbx, qword [rsp + 0x28]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2b8], rbx
mov rcx, rbx
call fcn.14000d070
mov qword [rsp + 0x330], rax
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.cDriveGettingFull_KB_11360
lea rcx, [rsp + 0x110]
call fcn.14000c6f0
nop
movzx r8d, dil
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x118]
mov qword [rsp + 0x2c8], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x2d8], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x118]
call fcn.14000c6f0
mov rdi, rax
mov qword [rsp + 0x2e0], rbx
mov rcx, rbx
call fcn.14000d070
mov qword [rsp + 0x2e8], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x78], rcx
lea rdx, str.Failure
lea rcx, [rsp + 0x120]
call fcn.14000c6f0
nop
lea r8, [rsp + 0x78]
jmp 0x140021550
lea rax, [rsp + 0x128]
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x2f8], rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x300], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x128]
call fcn.14000c6f0
mov rdi, rax
lea rdx, str.System_restart_is_needed_to_fix_the_issue_completely.
lea rcx, [rsp + 0x130]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0x138]
call fcn.14000c6f0
nop
mov r8, rbx
mov r9, rdi
mov rdx, rax
mov ecx, r15d
call fcn.14005d170
lea rax, [rsp + 0x140]
mov qword [rsp + 0x308], rax
lea rdx, str.sc_config_WSearch_startauto
lea rcx, [rsp + 0x140]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.14005e3e0
mov qword [rsp + 0x310], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x148], r14
cmp rcx, r14
je 0x140021626
cmp dword [r14 + 0x10], 0
jl 0x140021607
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x140021607
call fcn.14000d070
mov qword [rsp + 0x150], rax
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1400215f4
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x150]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140021626
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1f4], r8d
mov qword [rsp + 0x320], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x158]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x160], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140021657
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x328], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x3a0], rax
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x338], rbx
mov rcx, rbx
call fcn.14000d070
mov qword [rsp + 0x340], rax
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rdx, str.cDriveGettingFull_KB_11360_Congifure_WSearch_to_auto
lea rcx, [rsp + 0x168]
call fcn.14000c6f0
nop
mov r8d, esi
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x170]
mov qword [rsp + 0x348], rax
lea rdx, str.net_start_WSearch
lea rcx, [rsp + 0x170]
call fcn.14000c6f0
nop
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.14005e3e0
mov qword [rsp + 0x350], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x358], rcx
mov qword [rsp + 0x178], rbx
cmp rcx, rbx
je 0x140021792
cmp dword [rbx + 0x10], 0
jl 0x140021773
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140021773
call fcn.14000d070
mov qword [rsp + 0x180], rax
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140021760
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x180]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x140021792
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1f8], r8d
mov qword [rsp + 0x360], rdx
lea rcx, [rsp + 0x20]
call fcn.14000d160
nop
mov rcx, qword [rsp + 0x188]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x190], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400217c3
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x368], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x370], rax
mov rbx, qword [rsp + 0x20]
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x378], rbx
mov rcx, rbx
call fcn.14000d070
mov qword [rsp + 0x380], rax
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.cDriveGettingFull_KB_11360_start_WSearch
lea rcx, [rsp + 0x198]
call fcn.14000c6f0
nop
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14005c670
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14002185f
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov qword [rsp + 0x1a8], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14002188b
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14002188b
mov esi, 0xffffffff
jmp 0x140021892
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400218ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x3b0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3