Function at 0x140014a10
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rbp + 0x370], rax
movzx ebx, cl
mov cl, 1
call fcn.140014e50
test bl, bl
jne 0x140014e2a
mov qword [rsp + 0x4a0], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x4a8], rdi
xor edx, edx
mov qword [rsp + 0x4b0], r14
mov r8d, 0x104
mov qword [rsp + 0x480], r15
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov edi, r15d
mov qword [rsp + 0x38], r15
call fcn.140068930
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x40]
mov edx, 0x22d0
lea rcx, [0x1400d69b0]
xor r14b, r14b
call fcn.140016cc0
mov rsi, qword [rsp + 0x40]
test al, al
je 0x140014ba5
xor r9d, r9d
lea r8, [rsp + 0x38]
mov edx, 0x1457
lea rcx, [0x1400d69b0]
call fcn.140016cc0
test al, al
je 0x140014ba0
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140014ba0
mov rdi, qword [rsp + 0x38]
lea r9, [rbp + 0x60]
lea r8, str._s_s.ps1
mov qword [rsp + 0x20], rdi
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14000f3f0
lea r8, [0x1400a62d4]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14006aa10
mov r9, qword [rsp + 0x30]
test r9, r9
je 0x140014bb9
mov r8, qword [rsp + 0x48]
lea edx, [r15 + 1]
mov rcx, rsi
call fcn.14006a7a0
cmp rax, qword [rsp + 0x48]
jne 0x140014ba5
mov rcx, qword [rsp + 0x30]
call fcn.140069e78
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 1]
lea rax, [rsp + 0x50]
mov edx, 0x200
lea r8, str.set__1_d_r_nset_PSExecutionPolicyPreferenceUnrestricted_r_npowershell__File___s__r_ndel___s_
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x170]
call fcn.14000f3f0
lea rcx, [rbp + 0x170]
call fcn.140015f60
movzx r14d, al
jmp 0x140014ba5
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140014bb4
call fcn.140069e78
test r14b, r14b
jne 0x140014bc4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test rdi, rdi
je 0x140014bd1
mov rcx, rdi
call fcn.14006ac0c
test rsi, rsi
je 0x140014bde
mov rcx, rsi
call fcn.14006ac0c
xor edx, edx
mov qword [rsp + 0x40], r15
mov r8d, 0x104
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x50]
mov rdi, r15
call fcn.140068930
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x40]
mov edx, 0x21cb
lea rcx, [0x1400d69b0]
xor r14b, r14b
call fcn.140016cc0
mov rsi, qword [rsp + 0x40]
test al, al
je 0x140014d0f
xor r9d, r9d
lea r8, [rsp + 0x38]
mov edx, 0x203d
lea rcx, [0x1400d69b0]
call fcn.140016cc0
test al, al
je 0x140014d0a
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140014d0a
mov rdi, qword [rsp + 0x38]
lea r9, [rbp + 0x60]
lea r8, str._s_s.ps1
mov qword [rsp + 0x20], rdi
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14000f3f0
lea r8, [0x1400a62d4]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14006aa10
mov r9, qword [rsp + 0x30]
test r9, r9
je 0x140014d23
mov r8, qword [rsp + 0x48]
mov edx, 1
mov rcx, rsi
call fcn.14006a7a0
cmp rax, qword [rsp + 0x48]
jne 0x140014d0f
mov rcx, qword [rsp + 0x30]
call fcn.140069e78
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, str.set__10_r_nset_PSExecutionPolicyPreferenceUnrestricted_r_npowershell__File___s__r_ndel___s_
mov edx, 0x200
lea rcx, [rbp + 0x170]
call fcn.14000f3f0
lea rcx, [rbp + 0x170]
call fcn.140015f60
movzx r14d, al
jmp 0x140014d0f
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140014d1e
call fcn.140069e78
test r14b, r14b
jne 0x140014d2e
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r14, qword [rsp + 0x4b0]
test rdi, rdi
je 0x140014d43
mov rcx, rdi
call fcn.14006ac0c
mov rdi, qword [rsp + 0x4a8]
test rsi, rsi
je 0x140014d58
mov rcx, rsi
call fcn.14006ac0c
lea r8, [rsp + 0x30]
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.140016b00
mov r15, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x4a0]
test al, al
je 0x140014dd4
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x140014dd4
mov r9, qword [rsp + 0x38]
lea r8, str.schtasks__delete__tn___ls___f
mov edx, 0x104
lea rcx, [rbp + 0x60]
call fcn.14000f3f0
lea rcx, [rbp + 0x60]
call fcn.140015f60
test al, al
je 0x140014dd4
call fcn.1400163b0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140014de4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140014df4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140014e04
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140014e14
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
cmp byte [0x1400d69b0], 0
je 0x140014e2a
lea rcx, [0x1400d69b1]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0x488
pop rbx
pop rbp
ret