Function at 0x14000765d
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
jmp 0x14007bc30
push rbp
push rsi
push rdi
sub rsp, 0x7a0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x150
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140289140]
xor rax, rbp
mov qword [rbp + 0x778], rax
lea rcx, [0x1402ac2b2]
call fcn.140007f72
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.140007973
lea rcx, [rbp + 0x574]
call fcn.140005669
mov qword [rbp + 0x758], rax
lea rdx, str.LastActivityView.exe
lea rcx, [rbp + 0x6b0]
call fcn.1400034d6
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x6d8]
call fcn.1400034d6
nop
lea rdx, str.shellbag_analyzer_cleaner.exe
lea rcx, [rbp + 0x700]
call fcn.1400034d6
nop
lea rdx, str.LastActivityView.cfg
lea rcx, [rbp + 0x728]
call fcn.1400034d6
nop
lea rax, [rbp + 0x750]
mov r8, rax
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x598]
call fcn.140004327
lea rcx, [rbp + 0x5c8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x680]
lea rcx, [rbp + 0x5c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x758]
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 8]
call fcn.1400055e2
nop
lea r9, [fcn.140006e79]
mov r8d, 4
mov edx, 0x28
lea rcx, [rbp + 0x6b0]
call fcn.140002b7b
nop
lea rdx, [rbp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
lea rax, [rbp + 8]
mov qword [rbp + 0x278], rax
mov rcx, qword [rbp + 0x278]
call fcn.1400044f3
mov qword [rbp + 0x298], rax
mov rcx, qword [rbp + 0x278]
call fcn.1400084d6
mov qword [rbp + 0x2b8], rax
jmp 0x14007bdb8
mov rax, qword [rbp + 0x298]
add rax, 0x28
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x2b8]
cmp qword [rbp + 0x298], rax
je 0x14007bf28
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x2d8], rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x5f8]
call fcn.1400034d6
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, [0x14022c6d4]
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x638]
call fcn.140005164
mov qword [rbp + 0x768], rax
mov rax, qword [rbp + 0x768]
mov qword [rbp + 0x770], rax
mov r8, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x770]
lea rcx, [rbp + 0x2f8]
call fcn.140008657
nop
lea rcx, [rbp + 0x638]
call fcn.140006e79
nop
lea rcx, [rbp + 0x5f8]
call fcn.140006e79
nop
lea rcx, [rbp + 0x2f8]
call fcn.14000355d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007bf16
lea rcx, [rbp + 0x2f8]
call fcn.14000355d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14007bed9
lea rdx, [0x14022c6d8]
lea rcx, [0x14028c730]
call fcn.14000485e
lea rdx, [rbp + 0x2f8]
mov rcx, rax
call fcn.140004e71
mov qword [rbp + 0x758], rax
lea rdx, [0x14000452a]
mov rcx, qword [rbp + 0x758]
call fcn.1400066fe
nop
jmp 0x14007bf16
lea rdx, [0x14022c700]
lea rcx, [0x14028c730]
call fcn.14000485e
lea rdx, [rbp + 0x2f8]
mov rcx, rax
call fcn.140004e71
mov qword [rbp + 0x758], rax
lea rdx, [0x14000452a]
mov rcx, qword [rbp + 0x758]
call fcn.1400066fe
nop
lea rcx, [rbp + 0x2f8]
call fcn.140006e79
nop
jmp 0x14007bda6
lea rcx, [rbp + 8]
call fcn.140005bfa
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140223fa0]
call fcn.140006b90
mov rcx, qword [rbp + 0x778]
xor rcx, rbp
call fcn.1400044d0
lea rsp, [rbp + 0x780]
pop rdi
pop rsi
pop rbp
ret