Function at 0x1400cf500
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x878]
sub rsp, 0x970
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x860], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x20]
call fcn.140289490
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x650]
call fcn.140289490
lea r8, str.HaloSearch.exe
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x650]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x650]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400cf5a5
xor eax, eax
jmp 0x1400cf9b5
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x440]
call fcn.140289490
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
lea rcx, [rbp + 0x440]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x230]
call fcn.140289490
lea r8, [0x140305c58]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
test eax, eax
je 0x1400cf66e
mov qword [rsp + 0x70], 3
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x76], xmm0
mov dword [rbp - 0x66], edi
mov word [rbp - 0x62], di
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x230]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rdi
mov eax, 0x614
mov word [rbp - 0x78], ax
lea rcx, [rsp + 0x68]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rdx, [0x140305c70]
lea rcx, [rsp + 0x68]
call fcn.14000dc30
nop
lea rdx, [0x1402ec198]
lea rcx, [rsp + 0x48]
call fcn.14000dc30
nop
lea rdx, str.___entryrun_taskbar
lea rcx, [rbp]
call fcn.14000dc30
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.14000dc30
nop
lea rdx, [rbp + 0x230]
lea rcx, [rbp - 0x40]
call fcn.14000dc30
nop
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x60]
call fcn.14000dc30
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400cfa10
test al, al
sete bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400cf745
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9df
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400cf796
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf791
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9e5
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400cf7e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf7e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9eb
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], di
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x1400cf838
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf833
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9f1
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], di
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400cf88b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9f7
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400cf8df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf8da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9fd
call fcn.140171af0
test bl, bl
jne 0x1400cf59e
lea rdx, [0x140305c58]
lea rcx, [rsp + 0x68]
call fcn.14000dc30
nop
lea rdx, [rbp + 0x440]
lea rcx, [rsp + 0x48]
call fcn.14000dc30
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov ecx, 0x150a
call fcn.1400d2860
mov ebx, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400cf963
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf95e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cfa03
call fcn.140171af0
movdqa xmm0, xmmword [0x1402ecd10]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400cf9b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cf9ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cf9d9
call fcn.140171af0
mov eax, ebx
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
int3