Function at 0x140026370
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x14006f020]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xd0]
call fcn.14002cfe0
xor edx, edx
mov r8d, 0x140
lea rcx, [rbp - 0x70]
call fcn.14002cfe0
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rdx, str.KSafeKClearLogs
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [0x140066390]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x140026816
mov edi, 0x76c
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x44]
lea rcx, [0x140063f70]
call fcn.14004196c
test eax, eax
je 0x1400267f8
lea rdx, [rbp - 0x44]
lea rcx, [0x140066394]
call fcn.14004196c
test eax, eax
je 0x1400267f8
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call fcn.140037eec
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x5c]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140026851
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x140026851
movzx eax, word [rsp + 0x48]
cmp ax, di
jae 0x1400264d8
xor eax, eax
jmp 0x140026579
movzx ecx, word [rsp + 0x54]
movzx edx, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x4e]
movzx r10d, word [rsp + 0x4a]
mov r11d, eax
cmp eax, 0x7b2
jb 0x140026846
lea eax, [r10 - 1]
cmp eax, 0xb
ja 0x140026846
lea eax, [r9 - 1]
cmp eax, 0x1e
ja 0x140026846
cmp r8d, 0x17
ja 0x140026846
cmp edx, 0x3b
ja 0x140026846
cmp ecx, 0x3b
ja 0x140026846
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x5c], edx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x64], r9d
lea eax, [r10 - 1]
mov dword [rsp + 0x68], eax
lea eax, [r11 - 0x76c]
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x78], 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.140038ad8
cmp rax, 0xffffffffffffffff
je 0x14002688e
sub rbx, rax
cmp rbx, 0x93a80
jl 0x1400267f3
call fcn.1400259d0
test rax, rax
je 0x140026883
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
lea rcx, [rsp + 0x28]
cmp rax, 0x10000
jae 0x1400265ce
lea rax, [rbp + 0xd0]
movzx edx, ax
call fcn.140027a60
jmp 0x1400265db
lea rdx, [rbp + 0xd0]
call fcn.140027c90
nop
mov edx, 0x5c
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140038668
test rax, rax
jne 0x1400265f9
mov eax, 0xffffffff
jmp 0x1400265fb
sub eax, edi
xor r14d, r14d
add eax, 1
cmovns r14d, eax
lea rsi, [rdi - 0x18]
mov rcx, qword [rsi]
cmp r14d, dword [rdi - 0x10]
jl 0x14002667d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x14002663b
cmp rax, qword [rsi]
jne 0x14002663b
mov rbx, rsi
lock inc dword [rsi + 0x10]
add rbx, 0x18
mov qword [rsp + 0x30], rbx
jmp 0x1400266f6
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140026872
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov r9d, dword [rsi + 8]
inc r9d
lea r8, [rsi + 0x18]
movsxd rdx, r9d
lea rcx, [rax + 0x18]
call fcn.140027c00
add rbx, 0x18
mov qword [rsp + 0x30], rbx
jmp 0x1400266f6
test rcx, rcx
je 0x140026690
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400266aa
call fcn.1400259d0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140026878
mov rax, qword [rcx]
mov r8d, 1
mov edx, r14d
call qword [rax]
test rax, rax
je 0x140026872
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
test r14d, r14d
js 0x140026867
cmp r14d, dword [rbx - 0xc]
jg 0x140026867
mov dword [rbx - 0x10], r14d
movsxd rdx, r14d
mov byte [rdx + rbx], 0
mov r9d, r14d
mov r8, rdi
mov rcx, rbx
call fcn.140027c00
mov rcx, rbx
lea rdx, [rbp - 0x44]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140026704
lea r13, [rbp - 0x44]
lea r12, [rbp - 0x44]
sub r12, rcx
mov r15d, dword [rbx - 0x10]
test eax, eax
js 0x14002685c
movsxd rdx, eax
lea rcx, [rbp - 0x44]
call fcn.140038eec
mov r14, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r15d
jl 0x14002685c
lea edi, [r15 + rax]
test edi, edi
js 0x14002685c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140026771
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140027df0
mov rbx, qword [rsp + 0x30]
cmp r12, r15
ja 0x14002677a
lea r13, [r12 + rbx]
movsxd rdx, r14d
lea rcx, [r15 + rbx]
mov r9d, r14d
mov r8, r13
call fcn.140027c00
cmp edi, dword [rbx - 0xc]
jg 0x14002685c
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400267b6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400267d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1400267ee
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
mov edi, 0x76c
mov rbx, qword [rsp + 0x20]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140026440
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14002a410
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140025830
int3
mov ecx, 0x80070057
call fcn.140025830
nop
mov ecx, 0x80070057
call fcn.140025830
nop
mov ecx, 0x80070057
call fcn.140025830
int3
call fcn.140027bf0
int3
mov ecx, 0x80004005
call fcn.140025830
nop
mov ecx, 0x80004005
call fcn.140025830
int3
mov ecx, 0x80070057
call fcn.140025830
int3