Function at 0x140013364
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb80
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0xb70], rax
mov rdx, qword [0x140067fb0]
xor r13d, r13d
cmp rdx, r13
je 0x1400133bf
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov qword [0x140067fb0], r13
mov ebx, 0x9c
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x270]
call fcn.1400208e0
mov dword [rsp + 0x270], ebx
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, r13d
je 0x140013436
cmp dword [rsp + 0x278], r13d
jne 0x140013419
lea r9, [0x14000fda8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, eax
mov qword [0x140067fb0], rcx
jmp 0x140013436
lea r9, [0x14000fda8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, eax
mov qword [0x140067fb0], rcx
mov r14d, 1
mov ebx, r14d
mov edi, 0x228
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x310]
call fcn.1400208e0
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x140053ac0]
lea r12d, [r14 + 0x14]
mov r8d, r12d
xor edx, edx
lea rcx, [0x140053b20]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x328], 5
lea rdx, str.FirstInstallVista
lea rcx, [rsp + 0x32c]
call fcn.140020ec0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x310]
mov edx, edi
call qword [rax + 0xe8]
cmp eax, r13d
jge 0x140013505
mov dword [rsp + 0x534], r13d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x310]
mov edx, edi
call qword [rax + 0xf0]
mov ebx, dword [rsp + 0x534]
mov dword [rsp + 0x534], r14d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x310]
mov edx, edi
call qword [rax + 0xf0]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x30], r13
mov edi, 0x3c
mov rcx, rdi
call fcn.14001ec90
mov rsi, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1400208e0
mov ebp, 0x104
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x760]
call fcn.1400208e0
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x540]
call fcn.1400208e0
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x650]
call fcn.1400208e0
xor edx, edx
lea r8d, [rdi - 0x39]
lea rcx, [rsp + 0x50]
call fcn.1400208e0
lea edi, [rbp - 4]
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xa70]
call fcn.1400208e0
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x870]
call fcn.1400208e0
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x970]
call fcn.1400208e0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
lea r9, [0x140053b10]
mov r8d, r12d
xor edx, edx
lea rcx, [0x140053b70]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea r15, [0x140054af8]
cmp eax, r13d
jl 0x1400139f5
mov rcx, qword [rsp + 0x30]
cmp rcx, r13
je 0x1400139f5
cmp ebx, r13d
jne 0x1400139ea
mov rax, qword [0x1400680f8]
mov qword [rsp + 0x20], rax
mov r9d, ebp
lea r8, [rsp + 0x650]
mov edx, 0x24f3
xor ecx, ecx
call sub.hccutils.DLL_LoadSTRING
lea rdx, str.Cant_find_requested_string.
lea rcx, [rsp + 0x650]
call fcn.140024630
cmp eax, r13d
je 0x14001365a
lea rdx, [0x140054406]
lea rcx, [rsp + 0x650]
call fcn.140024630
cmp eax, r13d
jne 0x14001366e
lea rdx, str.Intel_R__Graphics_and_Media_Control_Panel
lea rcx, [rsp + 0x650]
call fcn.140020e00
mov edx, ebp
lea rcx, [rsp + 0x760]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, r13d
jne 0x1400136aa
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x17cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.LastError___ld._n
lea rcx, [rsp + 0x40]
call fcn.140002484
lea rax, [rsp + 0x970]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x870]
lea r8, [rsp + 0xa70]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x760]
call fcn.140024b80
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x540]
call fcn.140020e00
lea rdx, [0x140054818]
lea rcx, [rsp + 0x540]
call fcn.140020d60
lea rdx, str.IntelExtremeGraphicsCUIResource
lea rcx, [rsp + 0x540]
call fcn.140020d60
lea rdx, [0x140054818]
lea rcx, [rsp + 0x540]
call fcn.140020d60
lea r8, [rsp + 0x650]
mov rdx, rbp
lea rcx, [rsp + 0x540]
call fcn.140023830
lea rdx, str..lnk
lea rcx, [rsp + 0x540]
call fcn.140020d60
lea rdx, [0x140055638]
lea rcx, [rsp + 0x540]
call fcn.140020520
cmp rax, r13
je 0x1400137ae
mov rcx, rax
call fcn.140020550
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, r13d
je 0x1400137ae
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x17dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.LastError:Could_not_delete_the_file___ld._n
lea rcx, [rsp + 0x40]
call fcn.140002484
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x3c], r13d
mov dword [rsp + 0x38], r13d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x68]
call qword [rax + 0xc0]
cmp eax, r13d
jl 0x1400139e5
cmp dword [rsp + 0x68], r13d
jne 0x140013828
cmp dword [rsp + 0x70], 0x32
jne 0x140013828
cmp dword [rsp + 0x78], 0x64
jne 0x140013828
cmp dword [rsp + 0x3c], r13d
jne 0x140013828
cmp dword [rsp + 0x38], r13d
je 0x1400139e5
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140053ad0]
mov r8d, r12d
xor edx, edx
lea rcx, [0x140053b30]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r13d
jl 0x1400138d7
cmp qword [rsp + 0x58], r13
je 0x1400138d7
mov ebx, 0x178
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0xf0]
call fcn.1400208e0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r8, [rsp + 0xf0]
mov edx, ebx
call qword [rax + 0x20]
cmp eax, r13d
jl 0x1400138c7
cmp byte [rsp + 0xf0], r13b
jne 0x1400138c7
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x154]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x58], r13
mov eax, dword [rsp + 0x3c]
mov byte [rsi + 0x2c], al
mov byte [rsi + 0x28], al
mov byte [rsi + 0x24], al
mov eax, dword [rsp + 0x38]
mov byte [rsi + 0x30], al
cmp eax, 0xff
jle 0x1400138f8
mov byte [rsi + 0x31], 0xff
jmp 0x1400138fc
mov byte [rsi + 0x31], r13b
mov dword [rsp + 0x74], r13d
mov dword [rsp + 0x6c], r13d
mov r12, r13
mov ebp, dword [rsp + r12*4 + 0x40]
cmp ebp, r13d
je 0x1400139e5
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x74]
mov edx, ebp
call qword [rax + reloc.OLEAUT32.dll_SetErrorInfo]
cmp dword [rsp + 0x74], r13d
je 0x14001395d
movzx r8d, byte [rsi + 0x30]
mov al, byte [rsi + 0x31]
cmp al, r13b
je 0x140013948
movzx eax, al
lea r8d, [r8 + rax + 1]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
movzx r9d, byte [rsi + 0x24]
mov edx, ebp
call qword [rax + 0xd8]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x6c]
mov edx, ebp
call qword [rax + 0xf0]
cmp dword [rsp + 0x6c], r13d
je 0x1400139d8
test byte [rsi + 0x34], 0x80
mov edi, r13d
cmovne edi, r14d
movzx ebx, byte [rsi + 0x34]
and ebx, 0x7f
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x90]
call fcn.1400208e0
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xa8], ebp
mov dword [rsp + 0xb4], ebx
mov dword [rsp + 0x7c], r13d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x90]
mov edx, 0x58
call qword [rax + pe_nt_image_headers64]
add r12, r14
cmp r12, 3
jl 0x140013909
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r13
call fcn.14001006c
mov ecx, 0x30
call fcn.14001fe80
mov qword [rsp + 0x58], rax
cmp rax, r13
je 0x140013a18
mov rcx, rax
call fcn.140003d00
jmp 0x140013a1b
mov rax, r13
mov qword [0x140067f80], rax
cmp rax, r13
je 0x140013a63
mov rcx, rax
call fcn.14000ac94
cmp al, r13b
jne 0x140013a63
mov rcx, qword [0x140067f80]
call fcn.140002554
mov rbx, qword [0x140067f80]
cmp rbx, r13
je 0x140013a5c
mov rcx, rbx
call fcn.14000105c
mov rcx, rbx
call fcn.14001f3d0
mov qword [0x140067f80], r13
call fcn.14000dc48
call fcn.14000e0a8
call fcn.140010d48
cmp al, r13b
jne 0x140013a95
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x185c
lea rdx, str.ICC_Not_Supported___Error_while_Create_call__n
lea rcx, [rsp + 0x40]
call fcn.140002484
mov rcx, qword [rsp + 0xb70]
xor rcx, rsp
call fcn.1400209e0
lea r11, [rsp + 0xb80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret