Function at 0x140009380
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x440]
sub rsp, 0x540
xor edi, edi
mov rbx, rcx
mov rcx, qword [rcx + 0x90]
mov r13d, edi
mov qword [rbp + 0x488], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov dword [rbp + 0x470], edi
mov dword [rbp + 0x480], edi
mov qword [rsp + 0x38], rdi
mov esi, edi
test rcx, rcx
jne 0x1400093e9
mov dword [rbx + 0x58], 2
mov eax, edi
add rsp, 0x540
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x538], r12
mov r12d, 0x7fffffff
mov edx, edi
mov eax, r12d
nop dword [rax]
cmp word [rcx], dx
je 0x140009418
add rcx, 2
dec rax
jne 0x140009400
mov edx, 0x80070057
mov r12, rdi
jmp 0x14000942a
test rax, rax
jne 0x140009427
mov edx, 0x80070057
mov r12, rdi
jmp 0x14000942a
sub r12, rax
test edx, edx
jns 0x140009438
mov r12, rdi
mov eax, edi
jmp 0x140009716
lea eax, [r12 + 1]
mov qword [rsp + 0x530], r14
xor edx, edx
lea rcx, [rax + rax]
mov qword [rsp + 0x528], r15
mov r14d, eax
call fcn.14000e210
mov r15, rax
test rax, rax
je 0x140009704
mov r8, qword [rbx + 0x90]
mov edx, r14d
mov rcx, rax
call fcn.140002800
test eax, eax
js 0x1400096d5
lea r9, [rbp + 0x470]
lea r8, [rbp + 0x488]
mov edx, r12d
mov rcx, r15
call fcn.140007160
test eax, eax
jne 0x1400094b1
mov r13, qword [rbp + 0x488]
mov dword [rbx + 0x58], 2
jmp 0x1400096d5
mov r8d, dword [rbp + 0x470]
cmp r8d, 0x24
jae 0x1400094d1
mov r13, qword [rbp + 0x488]
mov dword [rbx + 0x58], 2
jmp 0x1400096d5
mov r12, qword [rbp + 0x488]
mov edx, r8d
mov ecx, dword [r12 + 0x24]
add r12, 4
lea eax, [rcx + rcx]
mov qword [rbp + 0x470], r12
lea r14, [r12 + rcx*2 + 0x24]
sub edx, eax
lea r13, [r12 - 4]
sub edx, 0x28
test ecx, ecx
jne 0x14000950d
mov dword [rbx + 0x58], 2
jmp 0x1400096d5
test edx, edx
jne 0x14000951d
mov dword [rbx + 0x58], 2
jmp 0x1400096d5
mov rax, qword [rbx]
lea rcx, [rbx + 0x548]
sub r8d, edx
mov dword [rsp + 0x20], edx
mov r9, r14
mov rdx, r13
mov qword [rcx], rax
call fcn.140006d80
test eax, eax
jne 0x14000954c
mov dword [rbx + 0x58], 3
jmp 0x1400096d5
xor edx, edx
mov ecx, 0x20a
mov word [r14], di
call fcn.14000e210
mov r14, qword [rbp + 0x478]
mov qword [r14], rax
test rax, rax
jne 0x140009577
mov dword [rbx + 0x58], 6
jmp 0x1400096d5
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, qword [str.9TRI]
lea rdx, [rbp + 0x20]
call fcn.14000deb0
movzx eax, byte [rbp + 0x20]
lea r11, [rbp + 0x20]
lea rdx, [rsp + 0x50]
test al, al
je 0x1400095c6
nop word [rax + rax]
movsx eax, al
inc r11
add rdx, 2
mov word [rdx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x1400095b0
mov rcx, qword [r14]
mov word [rdx], di
lea rdx, [rsp + 0x50]
mov r9, rcx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rdx, qword [r14]
lea rcx, [r12 + 0x24]
mov r8d, 0xc
call fcn.140017020
test eax, eax
jne 0x140009600
mov dword [rbx + 0x58], 4
jmp 0x1400096d5
mov rcx, qword [r14]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call fcn.14000cc90
mov r12, qword [rsp + 0x40]
test eax, eax
jne 0x140009624
mov dword [rbx + 0x58], 5
jmp 0x14000968f
mov edx, dword [rsp + 0x38]
lea r9, [rbp + 0x480]
lea r8, [rsp + 0x30]
mov rcx, r12
mov dword [rsp + 0x20], 0x800c
call fcn.140007000
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x140009656
mov dword [rbx + 0x58], 5
jmp 0x14000968f
cmp dword [rbp + 0x480], 0x20
je 0x140009668
mov dword [rbx + 0x58], 5
jmp 0x14000968f
mov rdx, qword [rbp + 0x470]
mov r8d, 0x20
mov rcx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000968a
mov dword [rbx + 0x58], 5
jmp 0x14000968f
mov esi, 1
test r12, r12
je 0x1400096a1
test esi, esi
jne 0x1400096a1
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
je 0x1400096bb
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
test r12, r12
je 0x1400096d5
mov rcx, qword [0x14001e780]
mov r8, r12
mov edx, 8
call qword [0x14001e798]
mov rcx, qword [0x14001e780]
mov r8, r15
mov edx, 8
call qword [0x14001e798]
test r13, r13
je 0x140009704
mov rcx, qword [0x14001e780]
mov r8, r13
mov edx, 8
call qword [0x14001e798]
mov r14, qword [rsp + 0x530]
mov r15, qword [rsp + 0x528]
mov eax, esi
mov r12, qword [rsp + 0x538]
add rsp, 0x540
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret