Function at 0x140008ce0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xd60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 0xd68], rbx
mov qword [rbp + 0xd70], rsi
mov qword [rbp + 0xd78], rdi
mov rax, qword [0x140030118]
xor rax, rbp
mov qword [rbp + 0xd20], rax
mov byte [rbp], dl
mov r12, rcx
mov qword [rbp + 0x10], rcx
xor r14d, r14d
mov word [rbp + 0x7f0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x7f2]
call fcn.14000fdf0
lea rcx, [rbp + 0x18]
call fcn.14000af00
nop
lea rdx, str.Spooler
lea rcx, [rbp + 0x18]
call fcn.14000af20
movzx edi, al
mov byte [rbp + 8], al
call fcn.14000aea0
test rax, rax
je 0x140008d92
call fcn.14000aea0
mov rcx, rax
lea r8, str.PdfsInstaller.DeleteFiles__Before_stop_spooler...
lea rdx, [0x1400239b8]
call fcn.14000ac50
test dil, dil
je 0x140008daa
mov r8d, 0x4e20
mov dl, 1
lea rcx, [rbp + 0x18]
call fcn.14000af90
jmp 0x140008dad
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0xc], eax
call fcn.14000aea0
test rax, rax
je 0x140008dd5
call fcn.14000aea0
mov rcx, rax
lea r8, str.PdfsInstaller.DeleteFiles__spooler_stoped__start_delete_files
lea rdx, [0x1400239b8]
call fcn.14000ac50
cmp qword [r12 + 0x388], 8
jb 0x140008dea
mov rcx, qword [r12 + 0x370]
jmp 0x140008df2
lea rcx, [r12 + 0x370]
lea rdx, [rbp + 0x7f0]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x140008e00
cmp byte [r12 + 0x2c8], al
je 0x140008e60
cmp dword [r12 + 0x2cc], 0
je 0x140008e60
lea rcx, [r12 + 0x410]
cmp qword [rcx + 0x18], 8
jb 0x140008e37
mov rcx, qword [rcx]
lea rdx, [rbp + 0xb10]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x140008e50
mov byte [rbp + 0xb0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xb1]
call fcn.14000fdf0
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movabs r13, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x140008ea0
mov rax, r14
jmp 0x140008edb
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140008eb5
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000fd90
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
lea rdx, [rbp + 0x7f0]
call fcn.140004000
lea rdx, [rbp + 0xb0]
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rax + rdx], cl
inc rax
test cl, cl
jne 0x140008ef0
mov rcx, r14
movzx eax, byte [rbp + rcx + 0xb0]
mov byte [rbp + rcx + 0x6e0], al
inc rcx
test al, al
jne 0x140008f00
lea rdi, [rbp + 0x6e0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rdx, qword [0x140030030]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140008f30
lea rcx, [rbp + 0x6e0]
call fcn.14000cba0
mov esi, eax
mov ebx, 1
cmp eax, ebx
jl 0x14000918a
nop word [rax + rax]
lea r8, [rbp + 0xa00]
mov edx, ebx
lea rcx, [rbp + 0x6e0]
call fcn.14000cc40
lea rcx, [rbp + 0xa00]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x140008fe6
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140008fa1
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000fd90
sub rsp, rcx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x140008fe6
mov word [rdi], r14w
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
lea r8, [rbp + 0xa00]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rdi, r14
jmp 0x140008fe9
mov rdi, r14
lea rcx, [rbp + 0xb0]
movzx eax, word [rdi]
mov word [rcx], ax
add rdi, 2
add rcx, 2
test ax, ax
jne 0x140008ff0
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x7f0]
mov word [rbp + rcx + 0x2c0], ax
add rcx, 2
test ax, ax
jne 0x140009010
lea rdi, [rbp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
lea rdx, [rbp + 0xb0]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140009050
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000908b
call fcn.14000aea0
test rax, rax
je 0x1400090b6
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x1400090a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.14000aea0
test rax, rax
je 0x1400090b6
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
lea r8, [rbp + 0x2c0]
mov rcx, rax
call fcn.14000ac50
cmp byte [r12 + 0x2c8], 0
je 0x140009180
cmp dword [r12 + 0x2cc], 0
je 0x140009180
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0xb10]
mov word [rbp + rcx + 0x4d0], ax
add rcx, 2
test ax, ax
jne 0x1400090e0
lea rdi, [rbp + 0x4d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
lea rdx, [rbp + 0xb0]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140009120
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000915b
call fcn.14000aea0
test rax, rax
je 0x140009180
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x140009171
call fcn.14000aea0
test rax, rax
je 0x140009180
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
lea r8, [rbp + 0x4d0]
mov rcx, rax
call fcn.14000ac50
inc ebx
cmp ebx, esi
jle 0x140008f60
mov rax, qword [section..data]
mov qword [rbp + 0xb0], rax
mov rax, qword [0x140030008]
mov qword [rbp + 0xb8], rax
lea rax, str.novat7.chm
mov qword [rbp + 0xc0], rax
lea rax, [0x140023c48]
mov qword [rbp + 0xc8], rax
lea rax, [0x140023c60]
mov qword [rbp + 0xd0], rax
mov rbx, qword [0x140030010]
mov qword [rbp + 0xd8], rbx
mov rsi, qword [0x140030018]
mov qword [rbp + 0xe0], rsi
mov r12, qword [0x140030020]
mov qword [rbp + 0xe8], r12
mov r13, qword [0x140030028]
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r14
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp + 0x100]
call fcn.14000fdf0
lea r11, str.novaclt7.exe
mov edx, 8
nop
cmp rdx, 0x1f
jge 0x140009266
mov qword [rbp + rdx*8 + 0xb0], r11
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
lea r11, [r11 + rcx*2]
inc rdx
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
dec rcx
jne 0x140009230
lea r15, [rbp + 0xb0]
mov dword [rbp + 4], r14d
mov r14, qword [rbp + 0xb0]
test r14, r14
je 0x1400095b6
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x7f0]
mov word [rbp + rcx + 0x2c0], ax
add rcx, 2
test ax, ax
jne 0x140009290
lea rdi, [rbp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [r14 + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x1400092c0
mov rax, qword [rbp + 0x10]
cmp byte [rax + 0x2c8], 0
je 0x140009333
cmp dword [rax + 0x2cc], 0
je 0x140009333
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rbp + rcx + 0xb10]
mov word [rbp + rcx + 0x4d0], ax
add rcx, 2
test ax, ax
jne 0x1400092f0
lea rdi, [rbp + 0x4d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [r14 + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140009320
mov rax, r14
sub rbx, r14
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x140009353
add rax, 2
test ecx, ecx
jne 0x140009340
test edx, edx
je 0x140009417
mov rax, r14
sub rsi, r14
movzx edx, word [rax]
movzx ecx, word [rax + rsi]
sub edx, ecx
jne 0x140009374
add rax, 2
test ecx, ecx
jne 0x140009361
test edx, edx
je 0x140009417
mov rax, r14
sub r12, r14
movzx edx, word [rax]
movzx ecx, word [rax + r12]
sub edx, ecx
jne 0x140009396
add rax, 2
test ecx, ecx
jne 0x140009382
test edx, edx
je 0x140009417
mov rax, r14
sub r13, r14
movzx edx, word [rax]
movzx ecx, word [rax + r13]
sub edx, ecx
jne 0x1400093b8
add rax, 2
test ecx, ecx
jne 0x1400093a4
test edx, edx
je 0x140009417
mov rax, r14
lea rdi, [0x140023c60]
sub rdi, r14
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400093e3
add rax, 2
test ecx, ecx
jne 0x1400093d0
test edx, edx
je 0x140009417
mov rax, r14
lea rdi, [0x140023c48]
sub rdi, r14
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140009407
add rax, 2
test ecx, ecx
jne 0x1400093f4
mov esi, dword [rbp + 4]
test edx, edx
jne 0x140009413
cmp esi, 7
jg 0x14000941a
xor bl, bl
jmp 0x140009473
mov esi, dword [rbp + 4]
mov bl, 1
mov edx, 0x104
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdi, [rbp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x14002600c]
mov dword [rdi - 2], eax
lea rdi, [rbp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, word [r14 + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140009460
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400094a5
inc esi
mov dword [rbp + 4], esi
call fcn.14000aea0
test rax, rax
je 0x140009521
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x140009512
cmp byte [rbp], 0
jne 0x1400094f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140009521
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.14000aea0
test rax, rax
je 0x1400094ee
call fcn.14000aea0
mov rcx, rax
lea r8, [rbp + 0x2c0]
lea rdx, str.PdfsInstaller.DeleteFiles__file:___s__will_be_deleted_at_next_system_boot
call fcn.14000ac50
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009521
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.14000aea0
test rax, rax
je 0x140009521
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
lea r8, [rbp + 0x2c0]
mov rcx, rax
call fcn.14000ac50
mov rsi, qword [rbp + 0x10]
cmp byte [rsi + 0x2c8], 0
je 0x140009589
cmp dword [rsi + 0x2cc], 0
je 0x140009589
test bl, bl
jne 0x140009589
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140009564
call fcn.14000aea0
test rax, rax
je 0x140009589
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x14000957a
call fcn.14000aea0
test rax, rax
je 0x140009589
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
lea r8, [rbp + 0x4d0]
mov rcx, rax
call fcn.14000ac50
add r15, 8
mov r14, qword [r15]
test r14, r14
je 0x1400095ba
mov rbx, qword [0x140030010]
mov rsi, qword [0x140030018]
mov r12, qword [0x140030020]
mov r13, qword [0x140030028]
jmp 0x140009281
mov rsi, qword [rbp + 0x10]
mov qword [rbp + 0x48], 7
xor ebx, ebx
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x370]
lea rcx, [rbp + 0x30]
call fcn.140007860
nop
lea r8d, [rbx + 2]
lea rdx, [0x140025878]
lea rcx, [rbp + 0x30]
call fcn.140007990
lea r8d, [rbx + 0xa]
lea rdx, [0x140023c48]
lea rcx, [rbp + 0x30]
call fcn.140007990
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000964a
call fcn.14000aea0
test rax, rax
je 0x140009679
lea rdi, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdi, qword [rbp + 0x30]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_custom_file:___s_
jmp 0x14000966e
call fcn.14000aea0
test rax, rax
je 0x140009679
lea rdi, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdi, qword [rbp + 0x30]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__Custom_file:___s__does_not_exist
mov r8, rdi
mov rcx, rax
call fcn.14000ac50
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], rbx
mov word [rbp + 0x58], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x370]
lea rcx, [rbp + 0x58]
call fcn.140007860
nop
mov r8d, 2
lea rdx, [0x140025878]
lea rcx, [rbp + 0x58]
call fcn.140007990
mov r8d, 0xa
lea rdx, [0x140023c60]
lea rcx, [rbp + 0x58]
call fcn.140007990
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000970b
call fcn.14000aea0
test rax, rax
je 0x14000973a
lea rdi, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdi, qword [rbp + 0x58]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_page_size_file:___s_
jmp 0x14000972f
call fcn.14000aea0
test rax, rax
je 0x14000973a
lea rdi, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdi, qword [rbp + 0x58]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__Page_size_file:___s__does_not_exist
mov r8, rdi
mov rcx, rax
call fcn.14000ac50
cmp byte [rsi + 0x2c8], 0
je 0x1400098b6
cmp dword [rsi + 0x2cc], 0
je 0x1400098b6
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x410]
lea rcx, [rbp + 0x30]
call fcn.140007860
mov r8d, 2
lea rdx, [0x140025878]
lea rcx, [rbp + 0x30]
call fcn.140007990
mov r8d, 0xa
lea rdx, [0x140023c48]
lea rcx, [rbp + 0x30]
call fcn.140007990
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400097d5
call fcn.14000aea0
test rax, rax
je 0x140009804
lea rdi, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdi, qword [rbp + 0x30]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_custom_file:___s_
jmp 0x1400097f9
call fcn.14000aea0
test rax, rax
je 0x140009804
lea rdi, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdi, qword [rbp + 0x30]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__Custom_file:___s__does_not_exist
mov r8, rdi
mov rcx, rax
call fcn.14000ac50
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x410]
lea rcx, [rbp + 0x58]
call fcn.140007860
mov r8d, 2
lea rdx, [0x140025878]
lea rcx, [rbp + 0x58]
call fcn.140007990
mov r8d, 0xa
lea rdx, [0x140023c60]
lea rcx, [rbp + 0x58]
call fcn.140007990
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140009885
call fcn.14000aea0
test rax, rax
je 0x1400098b4
lea rdi, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdi, qword [rbp + 0x58]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_page_size_file:___s_
jmp 0x1400098a9
call fcn.14000aea0
test rax, rax
je 0x1400098b4
lea rdi, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdi, qword [rbp + 0x58]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__Page_size_file:___s__does_not_exist
mov r8, rdi
mov rcx, rax
call fcn.14000ac50
xor ebx, ebx
cmp byte [rbp], 0
jne 0x1400099d8
lea r8, [rsi + 0x140]
lea rdx, str._s.nvp
lea rcx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], rbx
mov word [rbp + 0x80], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x370]
lea rcx, [rbp + 0x80]
call fcn.140007860
nop
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0xb0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x80]
call fcn.140007990
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140009989
call fcn.14000aea0
test rax, rax
je 0x1400099c2
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdi, qword [rbp + 0x80]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__deleted_profiles_file:___s_
jmp 0x1400099b6
call fcn.14000aea0
test rax, rax
je 0x1400099c2
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdi, qword [rbp + 0x80]
call fcn.14000aea0
lea rdx, str.PdfsInstaller.DeleteFiles__profiles_file:___s__does_not_exist
mov r8, rdi
mov rcx, rax
call fcn.14000ac50
nop
cmp qword [rbp + 0x98], 8
jb 0x1400099d8
mov rcx, qword [rbp + 0x80]
call fcn.14000fc5c
call fcn.14000aea0
test rax, rax
je 0x1400099fd
call fcn.14000aea0
mov rcx, rax
lea r8, str.PdfsInstaller.DeleteFiles__Before_start_spooler...
lea rdx, [0x1400239b8]
call fcn.14000ac50
cmp byte [rbp + 8], 0
je 0x140009a12
cmp dword [rbp + 0xc], 0
jne 0x140009a12
lea rcx, [rbp + 0x18]
call fcn.14000b320
lea rcx, [rbp + 0x18]
call fcn.14000b4e0
call fcn.14000aea0
test rax, rax
je 0x140009a41
call fcn.14000aea0
mov rcx, rax
lea r8, str.PdfsInstaller.DeleteFiles__spooler_has_started.
lea rdx, [0x1400239b8]
call fcn.14000ac50
nop
cmp qword [rbp + 0x70], 8
jb 0x140009a51
mov rcx, qword [rbp + 0x58]
call fcn.14000fc5c
mov qword [rbp + 0x70], 7
mov qword [rbp + 0x68], rbx
mov word [rbp + 0x58], bx
cmp qword [rbp + 0x48], 8
jb 0x140009a71
mov rcx, qword [rbp + 0x30]
call fcn.14000fc5c
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
lea rcx, [rbp + 0x18]
call fcn.14000af10
xor eax, eax
mov rcx, qword [rbp + 0xd20]
xor rcx, rbp
call fcn.14000fd60
mov rbx, qword [rbp + 0xd68]
mov rsi, qword [rbp + 0xd70]
mov rdi, qword [rbp + 0xd78]
lea rsp, [rbp + 0xd30]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret