Function at 0x14000d3fc
Capabilities:
Check if file exists
Delete file
Delete registry key
Get common file path
Read file on windows
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5e8]
sub rsp, 0x6e0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
lea rcx, [rbp + 0x1b0]
call fcn.140026c00
mov r14d, 1
test eax, eax
js 0x14000d52c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rcx, [rbp + 0x1b0]
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d486
call fcn.14001215c
test eax, eax
js 0x14000d52c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x44]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000d4ad
xor edi, edi
jmp 0x14000d4b4
call fcn.14001215c
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x14000d52c
cmp dword [rsp + 0x40], 4
jne 0x14000d4d2
cmp dword [rsp + 0x44], 0x4020000
je 0x14000d52c
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000d4ec
call fcn.14001215c
test eax, eax
js 0x14000d52c
lea rcx, [rbp - 0x60]
mov edx, 0x100
call fcn.140026c74
test eax, eax
js 0x14000d52c
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
call fcn.1400233f8
test eax, eax
js 0x14000d52c
mov rcx, qword [rsp + 0x48]
call fcn.14002389c
mov edi, 2
xor ecx, ecx
mov edx, edi
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000d828
mov rcx, qword [0x140004e18]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call fcn.140010470
mov ebx, dword [rsp + 0x40]
test ebx, ebx
je 0x14000d56b
xor r8d, r8d
mov edx, 0xffefffff
jmp 0x14000d579
call fcn.14000c628
mov r8d, 0x100000
or edx, 0xffffffff
call fcn.14000c49c
xor ecx, ecx
call fcn.14000b5bc
mov ecx, 0x10
call fcn.14000b5bc
lea rdx, [rbp + 0x1b0]
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000d668
call fcn.14000eaa0
test al, al
jne 0x14000d61c
lea rdx, [0x140002d90]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test ebx, ebx
je 0x14000d5ef
lea rcx, [rbp + 0x1b0]
call fcn.14000ce54
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rdx, [0x1400025e0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, [rbp + 0x1b0]
mov r9d, r14d
mov r8d, ebx
mov edx, 3
call fcn.14000c2bc
jmp 0x14000d668
mov r9, qword [0x1400030c8]
lea r8, [rbp + 0x1b0]
lea rcx, [rbp - 0x60]
mov edx, 0x104
call fcn.140011294
lea rcx, [rbp - 0x60]
call fcn.140010cec
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000d668
lea rcx, [rbp - 0x60]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp - 0x60]
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000d68f
lea rcx, [rbp - 0x60]
mov r9d, r14d
mov r8d, ebx
xor edx, edx
call fcn.14000c2bc
test ebx, ebx
je 0x14000d69c
call fcn.14000cae0
test al, al
je 0x14000d6a3
mov edx, ebx
call fcn.14000cb58
test ebx, ebx
jne 0x14000d760
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov r8d, edi
mov ecx, edi
mov dword [rsp + 0x48], 0x10
mov dword [rsp + 0x4c], 0x19
call fcn.14000c7c4
mov ebx, 0x17
lea rdx, [rsp + 0x48]
lea r8d, [rbx - 0x14]
mov r9d, r14d
mov ecx, edi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x50], 6
call fcn.14000c7c4
lea rdx, [rsp + 0x44]
lea ecx, [rbx - 0x13]
mov r9d, r14d
mov r8d, r14d
mov dword [rsp + 0x44], ebx
call fcn.14000c7c4
lea rdx, [rsp + 0x58]
xor r9d, r9d
movups xmm0, xmmword [0x140003bd8]
mov r8d, r14d
movdqu xmmword [rsp + 0x58], xmm0
call fcn.14000c854
lea rdx, [rsp + 0x78]
movups xmm0, xmmword [0x140003bb8]
movups xmm1, xmmword [0x140003bf8]
mov r9d, r14d
mov r8d, edi
movdqu xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
call fcn.14000c854
mov ecx, edi
call fcn.14000c8c8
mov ecx, ebx
call fcn.14000c8c8
xor r8d, r8d
lea r9, [0x140002e50]
mov ecx, 0xffff
lea ebx, [r8 + 0x1a]
mov edx, ebx
call qword [sym.imp.USER32.dll_PostMessageW]
call fcn.14000eaa0
test al, al
je 0x14000d7ba
lea rax, [0x1400027e0]
lea rcx, [rsp + 0x58]
mov r9b, r14b
mov qword [rsp + 0x68], rax
xor eax, eax
mov r8b, r14b
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x70], rax
call fcn.140011bd8
call fcn.14000b268
call fcn.14000b354
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.iertutil.dll_Ordinal_281]
test eax, eax
jne 0x14000d7e8
test byte [rsp + 0x48], r14b
je 0x14000d7e8
mov r8, r14
xor edx, edx
mov ecx, r14d
call qword [sym.imp.iertutil.dll_Ordinal_282]
lea rcx, [rbp + 0x3c0]
mov r8d, 0x26
call fcn.14000eec4
test al, al
je 0x14000d80a
lea rcx, [rbp + 0x3c0]
call fcn.14000d328
lea rcx, [0x140003510]
call fcn.14000cc08
lea rcx, [0x140003130]
call fcn.14000cc08
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret