Function at 0x180009428
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rbx, rcx
lea rsi, [0x180001bd8]
mov rcx, qword [0x180029068]
mov rdx, rsi
call fcn.18000c674
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call fcn.18000c674
xor ebx, ebx
mov r13, rax
test rax, rax
jne 0x180009480
lea eax, [rbx - 2]
jmp 0x180009841
call fcn.18000c174
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.18000c400
cmp byte [r13], 8
mov rsi, rax
mov qword [rbp + 0x1b0], rax
jne 0x18000961b
mov eax, dword [r13 + 0x118]
mov r15d, ebx
mov dword [rbp + 0x1a8], eax
test eax, eax
je 0x18000961b
mov rdx, rbx
mov qword [rsp + 0x20], rbx
mov eax, r15d
or eax, 1
bsr ecx, eax
mov rcx, qword [r13 + rcx*8 + 0x10]
mov rsi, qword [rdx + rcx]
lea rdx, [0x180001be0]
mov rcx, rsi
call fcn.18000c674
test rax, rax
je 0x1800094fb
cmp byte [rax], 4
jne 0x1800094fb
mov rax, qword [rax + 0x10]
jmp 0x180009502
lea rax, [0x18000175a]
mov qword [rbp + 0x1b8], rax
cmp byte [rax], bl
je 0x1800095f6
lea rdx, [0x180001bb8]
mov rcx, rsi
call fcn.18000c61c
lea rdx, [0x180001674]
mov rcx, rsi
call fcn.18000c674
test rax, rax
je 0x18000953f
cmp byte [rax], 4
jne 0x18000953f
mov rcx, qword [rax + 0x10]
jmp 0x180009546
lea rcx, [0x18000175a]
cmp byte [rcx], bl
je 0x180009569
mov rcx, rsi
call fcn.18000ca84
mov rsi, qword [rbp + 0x1b0]
mov rdx, rax
mov rcx, rsi
call fcn.18000bd44
jmp 0x1800095fd
test rdi, rdi
je 0x1800095f6
cmp byte [rdi], 8
jne 0x1800095f6
mov r12d, dword [rdi + 0x118]
mov esi, ebx
test r12d, r12d
je 0x1800095f6
mov r14, rbx
mov eax, esi
lea rdx, [0x180001be0]
or eax, 1
bsr ecx, eax
mov rcx, qword [rdi + rcx*8 + 0x10]
mov rax, qword [r14 + rcx]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.18000c674
test rax, rax
je 0x1800095bd
cmp byte [rax], 4
jne 0x1800095bd
mov rcx, qword [rax + 0x10]
jmp 0x1800095c4
lea rcx, [0x18000175a]
mov rax, qword [rbp + 0x1b8]
sub rcx, rax
movzx edx, byte [rax]
movzx r8d, byte [rax + rcx]
sub edx, r8d
jne 0x1800095e3
inc rax
test r8d, r8d
jne 0x1800095ce
test edx, edx
je 0x18000968b
inc esi
add r14, 8
cmp esi, r12d
jb 0x180009588
mov rsi, qword [rbp + 0x1b0]
mov rdx, qword [rsp + 0x20]
inc r15d
add rdx, 8
mov qword [rsp + 0x20], rdx
cmp r15d, dword [rbp + 0x1a8]
jb 0x1800094ca
mov r15d, 0x104
mov byte [rbp + 0x50], bl
mov edx, r15d
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test rdi, rdi
je 0x1800097c0
cmp byte [rdi], 8
jne 0x1800097c0
mov eax, dword [rdi + 0x118]
mov r14d, ebx
mov dword [rbp + 0x1a8], eax
test eax, eax
je 0x1800097c0
mov r12, rbx
mov eax, r14d
lea rdx, [0x180001be0]
or eax, 1
bsr ecx, eax
mov rcx, qword [rdi + rcx*8 + 0x10]
mov rcx, qword [r12 + rcx]
call fcn.18000c674
test rax, rax
je 0x180009695
cmp byte [rax], 4
jne 0x180009695
mov r11, qword [rax + 0x10]
jmp 0x18000969c
mov rcx, qword [rsp + 0x28]
jmp 0x18000954d
lea r11, [0x18000175a]
mov qword [rbp + 0x1b8], r11
test rsi, rsi
je 0x180009736
cmp byte [rsi], 8
jne 0x180009736
mov r13d, dword [rsi + 0x118]
mov esi, ebx
test r13d, r13d
je 0x180009736
mov r15, rbx
mov rcx, qword [rbp + 0x1b0]
lea rdx, [0x180001be0]
mov eax, esi
or eax, 1
bsr eax, eax
mov rcx, qword [rcx + rax*8 + 0x10]
mov rcx, qword [r15 + rcx]
call fcn.18000c674
test rax, rax
je 0x1800096fa
cmp byte [rax], 4
jne 0x1800096fa
mov rax, qword [rax + 0x10]
jmp 0x180009701
lea rax, [0x18000175a]
mov r11, qword [rbp + 0x1b8]
mov r8, r11
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x180009721
inc rax
test edx, edx
jne 0x18000970e
test ecx, ecx
je 0x18000979f
inc esi
add r15, 8
cmp esi, r13d
jb 0x1800096c6
mov r15d, 0x104
mov r8, r15
mov byte [rsp + 0x40], bl
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.1800049c4
lea r9, [rsp + 0x40]
mov r8, r15
lea rdx, [0x180001084]
lea rcx, [rsp + 0x40]
call fcn.1800049fc
lea r9, [rsp + 0x40]
mov r8, r15
mov rdx, r11
lea rcx, [rsp + 0x40]
call fcn.1800049fc
lea r9, [rsp + 0x40]
mov r8, r15
lea rdx, [0x180001be8]
lea rcx, [rsp + 0x40]
call fcn.1800049fc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1800097a5
mov r15d, 0x104
mov rsi, qword [rbp + 0x1b0]
inc r14d
add r12, 8
cmp r14d, dword [rbp + 0x1a8]
jb 0x18000965d
mov r14, qword [rsp + 0x30]
test r14, r14
jne 0x1800097ce
mov edi, ebx
jmp 0x1800097e9
mov rdx, r14
mov dword [rbp + 0x1a8], ebx
lea rcx, [rbp + 0x1a8]
call fcn.18000b948
mov edi, dword [rbp + 0x1a8]
movsxd rdx, edi
test edi, edi
je 0x180009832
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180009832
mov r8d, edi
mov rdx, rax
mov rcx, r14
call fcn.18000c9e8
mov r9d, edi
lea rdx, [0x180001bf0]
mov r8, rsi
lea rcx, [0x180001b88]
call fcn.18001ef98
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180009837
mov ebx, 0xfffffffb
mov rcx, r14
call fcn.18000c1bc
mov eax, ebx
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret