Function at 0x140031820
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [rcx + 0x30]
mov word [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.140080d50
call fcn.1400696cc
mov rdx, rax
xor r12d, r12d
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003189a
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
or rbp, 0xffffffffffffffff
test rbx, rbx
je 0x1400318f3
test rbx, 0xffffffffffff0000
jne 0x1400318df
movzx edi, bx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140031907
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003a40
jmp 0x140031907
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x1400318f6
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140003c40
nop
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x140031930
cmp rax, qword [rsi - 0x18]
jne 0x140031930
lea rbx, [rsi - 0x18]
lock add dword [rsi - 8], 1
jmp 0x14003196e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14003194c
call fcn.1400019f0
int3
mov eax, dword [rsi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rsi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rsi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.140080540
add rbx, 0x18
mov qword [rsp + 0x20], rbx
call fcn.1400696cc
mov rcx, rax
test rax, rax
setne r12b
test r12d, r12d
jne 0x140031996
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
call fcn.140015a10
cmp eax, 6
jne 0x140031be4
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400319d9
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140003180
mov rbx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140084240
test edi, edi
js 0x140031bd9
cmp edi, dword [rbx - 0xc]
jg 0x140031bd9
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], 0
lea r8, str..gid
lea rdx, str..hlp
lea rcx, [rsp + 0x20]
call fcn.1400140f0
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [rdi - 0x10]
mov dx, 0x5c
mov rcx, rdi
call fcn.140080890
test rax, rax
jne 0x140031a3f
mov eax, ebp
jmp 0x140031a45
sub rax, rdi
sar rax, 1
sub ebx, eax
lea r8d, [rbx - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140003710
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140031ab5
cmp dword [rdi + 0x10], 0
jl 0x140031aa6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031aa6
call fcn.1400031e0
mov rbx, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140031a9b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x140031ab5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140031ad5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str..fts
lea rdx, str..gid
lea rcx, [rsp + 0x20]
call fcn.1400140f0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x4e], 0x5c
jne 0x140031b32
lea r9, str.help_
lea r8, [rsp + 0x50]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x28]
call fcn.1400040b0
jmp 0x140031b4f
lea r9, [0x1400a89f8]
lea r8, [rsp + 0x50]
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x28]
call fcn.1400040b0
mov r13, qword [rsp + 0x20]
movsxd r15, dword [r13 - 0x10]
mov r12, r13
mov rdi, qword [rsp + 0x28]
sub r12, rdi
sar r12, 1
mov r14d, dword [rdi - 0x10]
lea ebx, [r14 + r15]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140031b90
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140003180
mov rdi, qword [rsp + 0x28]
cmp r12, r14
ja 0x140031b99
lea r13, [rdi + r12*2]
mov rdx, r15
add rdx, rdx
lea rcx, [rdi + r14*2]
mov r9, rdx
mov r8, r13
call fcn.140080540
test ebx, ebx
js 0x140031bce
cmp ebx, dword [rdi - 0xc]
jg 0x140031bce
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140031be4
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140031c00
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140031c21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rsi - 8], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140031c3b
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret