Function at 0x1400047df
Capabilities:
Delete directory
Get common file path

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140008ea4
mov qword [rsp + 0x28], rax
push 0
pop rcx
call sub.KERNEL32.dll_GetModuleHandleA
mov qword [0x14001ba64], rax
push qword [0x14001c4e0]
push qword [0x14001c4e0]
push qword [rsp + 0x38]
pop rcx
sub rsp, 0x20
call fcn.140002c94
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400132d0
call fcn.140004c39
call fcn.14000448c
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push 0
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008e38
add rsp, 0x28
inc qword [0x14001c4e0]
mov rcx, qword [0x14001ba94]
pop rdx
mov qword [0x14001c4e0], rdx
add rdx, qword [0x14001c4f0]
call fcn.140013400
or rax, rax
je 0x14000489b
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x14000489b
mov rax, 1
jmp 0x14000489e
xor rax, rax
and rax, rax
je 0x1400048a8
call fcn.140002eb4
mov rcx, qword [0x14001bb1c]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
mov rcx, qword [0x14001baf4]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
mov rcx, qword [0x14001ba8c]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
lea rcx, [0x14001ba8c]
pop rdx
call fcn.1400132d0
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140005bd0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.1400132d0
push qword [0x14001c4e0]
sub rsp, 8
push qword [rsp + 0x48]
push 0
movabs rax, 0x14001a01e
push rax
mov rcx, qword [0x14001bb1c]
push qword [0x14001c4e0]
sub rsp, 0x20
call fcn.140013490
add rsp, 0x20
mov rcx, qword [0x14001baf4]
sub rsp, 0x20
call fcn.140013490
add rsp, 0x20
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_GetTempFileNameA
add rsp, 0x28
pop qword [0x14001c4e0]
push qword [rsp + 0x38]
pop rcx
call fcn.14000f894
movabs rax, 0x14001a025
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov rcx, qword [rsp + 0x38]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
lea rcx, [0x14001ba8c]
pop rdx
call fcn.1400132d0
call fcn.140003063
mov rcx, qword [0x14001b9ec]
xor rdx, rdx
call fcn.140013400
or rax, rax
jne 0x140004a00
push qword [0x14001b9ec]
pop rcx
call fcn.1400033da
call fcn.140003cc0
push qword [0x14001ba8c]
pop rcx
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140005bd0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.1400132d0
push 0x800
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryA
push qword [rsp + 0x40]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashA
push qword [0x14001c4e0]
sub rsp, 8
push 0x45
push qword [0x14001ba7c]
mov rcx, qword [0x14001ba8c]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
movabs rcx, str.__
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
mov rcx, qword [rsp + 0x58]
sub rsp, 0x28
call fcn.140013490
add rsp, 0x28
inc qword [0x14001c4e0]
mov rcx, qword [rsp + 0x68]
push qword [0x14001c4e0]
sub rsp, 0x20
call fcn.140013490
add rsp, 0x20
mov rcx, qword [0x14001ba04]
sub rsp, 0x20
call fcn.140013490
add rsp, 0x20
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
mov rdx, qword [0x14001c4f0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140009584
add rsp, 0x28
pop qword [0x14001c4e0]
mov qword [0x14001baac], rax
push qword [0x14001baac]
pop rcx
call fcn.1400095d4
mov qword [rsp + 0x48], rax
push qword [0x14001baac]
pop rcx
call fcn.1400095f8
push 0
lea rax, [0x1400030f7]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.140004392
push qword [0x14001ba8c]
pop rcx
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push qword [0x14001ba8c]
pop rcx
call fcn.14000f894
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push qword [0x14001c4e0]
push qword [0x14001c4e0]
pop rcx
sub rsp, 0x20
call fcn.140008ec0
add rsp, 0x20
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000f7c4
add rsp, 0x28
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14000f7a8
add rsp, 0x28
pop qword [0x14001c4e0]
push qword [0x14001bb1c]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, qword [rsp + 0x48]
mov qword [0x14001b99c], rax
jmp fcn.1400019a8