Function at 0x140048110
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x910]
sub rsp, 0xa10
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xa60], rbx
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rbp + 0x900], rax
mov edi, edx
mov r12, rcx
mov qword [rsp + 0x50], rcx
mov ebx, 1
mov dword [rsp + 0x44], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.140193010
lea rdx, [rbp + 0x6f0]
mov ecx, edi
call fcn.1400145f0
mov dword [rsp + 0x40], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4e0]
call fcn.140193010
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x3d0]
call fcn.140193010
lea rdx, [0x1402145dc]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edi, edi
mov dword [rsp + 0x4c], edi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x3d0]
mov r8d, ebx
lea rdx, [rbp + 0x6f0]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
cmp eax, ebx
jne 0x140048211
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140048219
test eax, eax
je 0x140048905
mov r13d, edi
mov dword [rsp + 0x48], edi
mov r15, rdi
cmp qword [r12 + 0x220], rdi
jle 0x140048905
test r15, r15
js 0x1400488ff
cmp r15, qword [r12 + 0x220]
jge 0x1400488ff
mov rax, qword [r12 + 0x218]
mov rdi, qword [rax + r15*8]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140048277
cmp rax, qword [rdi - 0x18]
jne 0x140048277
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x1400482b2
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x1400488f9
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14018e7d0
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x30], rdi
mov edx, 0x5c
mov rcx, rdi
call fcn.14018f7cc
mov r14, rax
test rax, rax
jne 0x1400482d6
or r14d, 0xffffffff
jmp 0x1400482dc
sub r14, rdi
sar r14, 1
inc r14d
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rdi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x140048330
lea rdx, [rbp - 0x68]
call fcn.1400166b0
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140212328]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x68]
jmp 0x14004835a
lea rdx, [rsp + 0x60]
call fcn.1400166b0
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140048375
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x103
or eax, ecx
jge 0x1400483a2
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.1400015c0
mov rsi, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, r12
call fcn.140047fb0
test eax, eax
jne 0x140048864
lea edx, [rax + 0x20]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x1400483f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400483f6
cmp eax, 3
jbe 0x1400483ee
cmp eax, 5
je 0x1400483ee
cmp eax, 0x20
jne 0x1400483f6
mov dword [rsp + 0x44], 1
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x140048451
lea rdx, [rbp - 0x78]
call fcn.1400166b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_d_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x78]
jmp 0x140048485
lea rdx, [rsp + 0x70]
call fcn.1400166b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140214f50]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400484a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x20
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.14004cde4
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400488dd
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x50]
lea rax, [rbp - 0x50]
test rax, 0xffffffffffff0000
jne 0x140048523
movzx edi, cx
mov ecx, edi
call fcn.14004cbb8
test rax, rax
je 0x140048617
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400012a0
mov rbx, qword [rsp + 0x38]
jmp 0x140048617
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140048594
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140048617
cmp dword [rdx + 0x10], eax
jge 0x140048566
cmp dword [rbx - 0xc], eax
jl 0x1400488bc
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140048617
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004857d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140048617
mov r13d, dword [rbx - 0x10]
lea r12, [rbp - 0x50]
sub r12, rbx
sar r12, 1
test ecx, ecx
js 0x1400488d2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400485cc
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.1400015c0
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r12, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x1400485f0
lea r8, [rbx + r12*2]
call fcn.14018e5f0
jmp 0x1400485f9
lea r8, [rbp - 0x50]
call fcn.14018e7d0
cmp edi, dword [rbx - 0xc]
jg 0x1400488c7
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r13 + rbx], ax
mov r12, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x48]
mov r8d, 3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400166b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140048686
cmp dword [rbx + 0x10], 0
jl 0x140048677
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140048677
call fcn.140001620
mov rdi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14004866c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140048686
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400014d0
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400486a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x1402142b8]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.14018ea5c
test eax, eax
je 0x1400486d4
lea rdx, [0x1402142c0]
mov rcx, rdi
call fcn.14018ea5c
test eax, eax
jne 0x140048844
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x14004872f
lea rdx, [rbp - 0x70]
call fcn.1400166b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140218d50]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x70]
jmp 0x140048763
lea rdx, [rsp + 0x78]
call fcn.1400166b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_dCOLOR_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004877e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rsi - 0x10]
sub r8d, r14d
cmp word [rbp + rcx*2 + 0x1be], 0x5c
lea rcx, [rsp + 0x30]
jne 0x1400487e1
lea rdx, [rsp + 0x58]
call fcn.1400166b0
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, [0x140218d90]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x58]
jmp 0x14004880b
lea rdx, [rsp + 0x68]
call fcn.1400166b0
mov r9, qword [rax]
lea r8, [rbp + 0x1c0]
lea rdx, str._sCOLOR_s
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140048826
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x50]
call fcn.14001ab00
mov rdi, qword [rsp + 0x38]
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004885f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x30]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.14018f24c
test eax, eax
js 0x1400488ee
cmp eax, dword [rsi - 0xc]
jg 0x1400488ee
mov dword [rsi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rsi + rax*2], cx
lea rdx, [rsi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004889f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
mov dword [rsp + 0x48], r13d
inc r15
movsxd rax, r13d
cmp rax, qword [r12 + 0x220]
jge 0x1400488e8
jmp 0x140048231
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov ebx, dword [rsp + 0x44]
jmp 0x140048905
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.1400016b0
int3
call fcn.14004d690
int3
mov eax, ebx
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.14018e5d0
mov rbx, qword [rsp + 0xa60]
add rsp, 0xa10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret