Function at 0x140020640
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x438]
sub rsp, 0x510
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov r15, rcx
xor r8d, r8d
lea rdx, str.DeleteDriverFileStd
lea rcx, [rsp + 0x78]
call fcn.140017fc0
nop
mov esi, 1
mov dword [rsp + 0x44], esi
call fcn.14000c310
test r15, r15
jne 0x1400206d3
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rsi + 1]
lea rcx, [rsp + 0x78]
call fcn.140017c80
nop
lea rcx, [rsp + 0x78]
call fcn.140018150
xor eax, eax
jmp 0x140020f1d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1f0]
call fcn.140192cb0
lea rdx, [rbp + 0x1f0]
mov rcx, qword [r15 + 0x10]
call fcn.14001ade0
lea rcx, [rsp + 0x50]
call fcn.1400538bc
nop
or r12, 0xffffffffffffffff
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400539cc
mov rdi, qword [r15 + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x140020760
nop word [rax + rax]
mov r8, rdi
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053fa4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140020730
call fcn.140051e58
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140020783
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, qword [r15 + 0x28]
test rdx, rdx
jne 0x1400207a3
mov ecx, r13d
jmp 0x1400207b4
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.140001c20
mov edx, 0x5c
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140193dc0
test rax, rax
jne 0x1400207dd
mov eax, r12d
jmp 0x1400207e3
sub rax, rdi
sar rax, 1
inc eax
mov r8d, dword [rdi - 0x10]
sub r8d, eax
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x30]
call fcn.140017e80
nop
mov r8, rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053ecc
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002082d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x20]
test rdx, rdx
jne 0x14002083b
mov ecx, r13d
jmp 0x14002084c
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.140001c20
mov edx, 0x5c
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140193dc0
test rax, rax
jne 0x140020875
mov eax, r12d
jmp 0x14002087b
sub rax, rdi
sar rax, 1
inc eax
mov r8d, dword [rdi - 0x10]
sub r8d, eax
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x30]
call fcn.140017e80
nop
mov r8, rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053ecc
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400208c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x30]
test rdx, rdx
jne 0x1400208d3
mov ecx, r13d
jmp 0x1400208e4
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.140001c20
mov edx, 0x5c
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140193dc0
test rax, rax
jne 0x14002090d
mov eax, r12d
jmp 0x140020913
sub rax, rdi
sar rax, 1
inc eax
mov r8d, dword [rdi - 0x10]
sub r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call fcn.140017e80
nop
mov r8, rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053ecc
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14002095d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [r15 + 0x18]
test rdx, rdx
jne 0x14002096b
mov ecx, r13d
jmp 0x14002097c
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.140001c20
mov edx, 0x5c
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140193dc0
test rax, rax
jne 0x1400209a5
mov eax, r12d
jmp 0x1400209ab
sub rax, rdi
sar rax, 1
inc eax
mov r8d, dword [rdi - 0x10]
sub r8d, eax
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x30]
call fcn.140017e80
nop
mov r8, rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140053ecc
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400209f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, r13d
mov dword [rsp + 0x40], ebx
mov r14, r13
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jle 0x140020ecb
nop dword [rax]
test r14, r14
js 0x140020ec5
cmp r14, rcx
jge 0x140020ec5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.140001950
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
mov edx, 0x5c
mov rcx, rdi
call fcn.140193dc0
mov rsi, rax
test rax, rax
jne 0x140020a57
mov esi, r12d
jmp 0x140020a5d
sub rsi, rdi
sar rsi, 1
inc esi
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, dword [rdi - 0x10]
sub r8d, esi
cmp word [rbp + rcx*2 + 0x1ee], 0x5c
lea rcx, [rsp + 0x48]
jne 0x140020ab0
lea rdx, [rbp - 0x78]
call fcn.140017e80
mov r9, qword [rax]
lea r8, [rbp + 0x1f0]
lea rdx, [0x1401c9460]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x78]
jmp 0x140020ad8
lea rdx, [rbp - 0x48]
call fcn.140017e80
mov r9, qword [rax]
lea r8, [rbp + 0x1f0]
lea rdx, str._s_s
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020af3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, r15
mov rcx, qword [rsp + 0x48]
call fcn.14001af50
test eax, eax
jne 0x140020e58
lea edx, [rax + 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x140020b49
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140020b49
cmp eax, 3
jbe 0x140020b41
cmp eax, 5
je 0x140020b41
cmp eax, 0x20
jne 0x140020b49
mov dword [rsp + 0x44], 1
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov ebx, dword [r15]
mov r8d, dword [rdi - 0x10]
cmp word [rbp + rcx*2 + 0x1ee], 0x5c
lea rcx, [rsp + 0x48]
je 0x140020baf
cmp ebx, 0x400
cmove ebx, r13d
sub r8d, esi
lea rdx, [rbp - 0x50]
call fcn.140017e80
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x1f0]
lea rdx, str._s_d_s
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x50]
jmp 0x140020bec
cmp ebx, 0x400
cmove ebx, r13d
sub r8d, esi
lea rdx, [rbp - 0x60]
call fcn.140017e80
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0x1f0]
lea rdx, [0x1401ce600]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020c07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x20
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140051e58
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x140020eb4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
test rax, 0xffffffffffff0000
jne 0x140020c8b
movzx edi, cx
mov ecx, edi
call fcn.140051c2c
test rax, rax
je 0x140020d76
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001b00
mov rbx, qword [rsp + 0x38]
jmp 0x140020d76
xor eax, eax
mov rcx, r12
lea rdi, [rbp - 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140020cfa
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140020d76
cmp dword [rdx + 0x10], eax
jge 0x140020ccf
cmp dword [rbx - 0xc], eax
jl 0x140020e93
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140020d76
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020ce6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140020d76
mov r13d, dword [rbx - 0x10]
lea rsi, [rbp - 0x20]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
js 0x140020ea9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140020d32
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.1400018f0
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x140020d56
lea r8, [rbx + rsi*2]
call fcn.140192c44
jmp 0x140020d5f
lea r8, [rbp - 0x20]
call fcn.140192bbc
cmp edi, dword [rbx - 0xc]
jg 0x140020e9e
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r13 + rbx], ax
xor r13d, r13d
mov r8d, 3
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x38]
call fcn.140017e80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140020de5
cmp dword [rbx + 0x10], 0
jl 0x140020dd6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140020dd6
call fcn.140001950
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140020dcb
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140020de5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140001c20
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020e04
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x1401ce5f8]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.1401936c8
test eax, eax
je 0x140020e2f
lea rdx, [0x1401ce5f0]
mov rcx, rdi
call fcn.1401936c8
test eax, eax
jne 0x140020e39
lea rcx, [rbp - 0x20]
call fcn.14001a2a0
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020e54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020e78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc ebx
mov dword [rsp + 0x40], ebx
inc r14
movsxd rax, ebx
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x140020ebf
jmp 0x140020a10
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, 0x80070057
call fcn.140001010
int3
mov ecx, 0x80070057
call fcn.140001010
nop
mov ecx, 0x80004005
call fcn.140001010
nop
mov esi, dword [rsp + 0x44]
jmp 0x140020ecb
call fcn.140050fc8
int3
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x78]
call fcn.140017c80
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140020f06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140053d58
nop
lea rcx, [rsp + 0x78]
call fcn.140018150
mov eax, esi
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1401945b0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret