Function at 0x180048ff0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15, rcx
xor ebx, ebx
xor ecx, ecx
mov r12d, ebx
mov esi, ebx
mov edi, edx
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
test r15, r15
jne 0x180049057
lea ecx, [rbx + 0x57]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x180049247
mov rcx, r15
call sym.KERNEL32.dll_GlobalLock
mov r14, rax
test edi, edi
je 0x18004906d
mov edi, ebx
jmp 0x1800491eb
test r14, r14
je 0x180049050
mov rcx, qword [rax + 0x30]
call sym.KERNEL32.dll_GlobalLock
mov r12, rax
test rax, rax
jne 0x18004908a
mov ecx, 0x54f
jmp 0x180049044
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov r8, r12
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.18000b120
test eax, eax
jns 0x1800490b4
movzx esi, ax
mov edi, esi
jmp 0x1800491d2
mov rax, qword [rsp + 0x30]
mov edi, 0x5c
sub rax, 2
cmp word [rax], di
je 0x1800490d1
lea rcx, [rsp + 0x40]
cmp rax, rcx
jae 0x1800490be
lea r9, [rsp + 0x40]
mov word [rax + 2], bx
xor r8d, r8d
lea rdx, [0x180089068]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
test eax, eax
jne 0x1800491aa
mov ecx, 0x104
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x180049124
mov dword [rsp + 0x40], 0x5c002e
mov word [rsp + 0x44], bx
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x180089068]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x180049158
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x1800491d2
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1800489b4
lea rcx, [rsp + 0x40]
mov edi, eax
test eax, eax
jne 0x1800491a6
mov rdx, r12
mov r8d, 3
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800491d2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov edi, eax
test eax, eax
jne 0x1800491c1
mov edi, 0x54f
mov esi, edi
jmp 0x1800491c1
mov esi, eax
jmp 0x1800491c6
mov rcx, r15
call fcn.1800489b4
mov edi, eax
test eax, eax
jne 0x1800491bf
lea rcx, [rsp + 0x40]
jmp 0x180049170
mov esi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, qword [r14 + 0x30]
call sym.KERNEL32.dll_GlobalUnlock
mov rcx, qword [r14 + 0x30]
call qword [sym.imp.KERNELBASE.dll_GlobalFree]
nop dword [rax + rax]
test r14, r14
je 0x180049223
test r12, r12
jne 0x180049213
mov rcx, qword [r14 + 0x30]
call sym.KERNEL32.dll_GlobalLock
test rax, rax
je 0x18004921b
mov rcx, qword [r14 + 0x30]
call qword [sym.imp.KERNELBASE.dll_GlobalFree]
nop dword [rax + rax]
mov rcx, r14
call fcn.180047864
mov rcx, r15
call sym.KERNEL32.dll_GlobalUnlock
mov rcx, r15
call qword [sym.imp.KERNELBASE.dll_GlobalFree]
nop dword [rax + rax]
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret