Function at 0x140005170
Capabilities:
Delete file
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rdi, rcx
mov rax, qword [rcx]
dec rax
xor r14d, r14d
cmp rax, 0xfffffffffffffffd
ja 0x140005b9f
mov qword [r11 - 0x388], r14
movabs rsi, 0x24b73e163c8ff833
mov qword [rsp + 0x1f0], rsi
movabs rbx, 0xf315c9c31bcd6fe4
mov qword [rsp + 0x1f8], rbx
movabs rax, 0x6fd95b6673e89d61
mov qword [r11 - 0x2f8], rax
movabs rax, 0xf315c99463881681
mov qword [r11 - 0x2f0], rax
vmovdqu xmm0, xmmword [rsp + 0x1d0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x1d0], xmm1
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rbx
movabs r15, 0x168457665df99c52
mov qword [r11 - 0x378], r15
movabs r12, 0xf315c9c377a10bca
mov qword [r11 - 0x370], r12
vmovdqu xmm0, xmmword [rsp + 0x150]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x150], xmm1
lea rcx, [r11 - 0x378]
call fcn.140002490
lea rdx, [rsp + 0x1d0]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], rbx
movabs r13, 0xa30c32200ae4a645
mov qword [rsp + 0x220], r13
movabs rcx, 0xfe1b07fd93e380be
mov qword [rsp + 0x228], rcx
movabs rcx, 0x7b405e22e4e6e657
mov qword [rsp + 0x230], rcx
movabs rcx, 0x1247326fa7705a78
mov qword [rsp + 0x238], rcx
movabs rcx, 0x8c917bfc3c9a2269
mov qword [rsp + 0x240], rcx
movabs rcx, 0xd9ac56d9840d7bd2
mov qword [rsp + 0x248], rcx
movabs rcx, 0x7f952dae42a5ab3b
mov qword [rsp + 0x250], rcx
movabs rdx, 0x7268869b6e76476c
mov qword [rsp + 0x258], rdx
movabs rcx, 0x24e33e453cd6f860
mov qword [rsp + 0x180], rcx
movabs rcx, 0xf356c99f1b806fa1
mov qword [rsp + 0x188], rcx
movabs rcx, 0xa36932520a96a630
mov qword [rsp + 0x190], rcx
movabs rcx, 0xfe7407be939780d0
mov qword [rsp + 0x198], rcx
movabs rcx, 0x7b2f5e50e492e639
mov qword [rsp + 0x1a0], rcx
movabs rcx, 0x1233320aa7235a14
mov qword [rsp + 0x1a8], rcx
movabs rcx, 0x8ce37b993cc92235
mov qword [rsp + 0x1b0], rcx
movabs rcx, 0xd9c956ba84647ba4
mov qword [rsp + 0x1b8], rcx
movabs rcx, 0x7f952dae42a5ab48
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1c8], rdx
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x210]
vmovdqu xmmword [rsp + 0x180], xmm1
vmovdqu xmm2, xmmword [rsp + 0x220]
vpxor xmm0, xmm2, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x190], xmm0
vmovdqu xmm1, xmmword [rsp + 0x230]
vpxor xmm2, xmm1, xmmword [rsp + 0x1a0]
vmovdqu xmmword [rsp + 0x1a0], xmm2
vmovdqu xmm0, xmmword [rsp + 0x240]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x1b0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x250]
vpxor xmm0, xmm2, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x1c0], xmm0
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x180]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x140005ae9
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x220], r13
movabs rax, 0xfe1b07fd93e380be
mov qword [rsp + 0x228], rax
movabs rax, 0x7b405e22e4e6e657
mov qword [rsp + 0x230], rax
movabs rax, 0x1247326fa7705a78
mov qword [rsp + 0x238], rax
movabs rax, 0x8c917bfc3c9a2269
mov qword [rsp + 0x240], rax
movabs rax, 0xd9ac56d9840d7bd2
mov qword [rsp + 0x248], rax
movabs rax, 0x7f952dae42a5ab3b
mov qword [rsp + 0x250], rax
movabs rax, 0x7268869b6e76476c
mov qword [rsp + 0x258], rax
movabs rax, 0x8eb2ca9891d1d16d
mov qword [rsp + 0x260], rax
movabs rax, 0xa468cdd5fc4fab46
mov qword [rsp + 0x268], rax
movabs rax, 0xa08591fa6e722d7f
mov qword [rsp + 0x270], rax
movabs rax, 0xc22648672c1bee80
mov qword [rsp + 0x278], rax
movabs rax, 0x24d03e733cddf86f
mov qword [rsp + 0x60], rax
movabs rax, 0xf367c9b71bbe6f8d
mov qword [rsp + 0x68], rax
movabs rax, 0xa36d326d0ab8a63c
mov qword [rsp + 0x70], rax
movabs rax, 0xfe750794938b80dd
mov qword [rsp + 0x78], rax
movabs rax, 0x7b195e71e4bae632
mov qword [rsp + 0x80], rax
movabs rax, 0x120a322aa7245a2b
mov qword [rsp + 0x88], rax
movabs rax, 0x8ce37b893cd92235
mov qword [rsp + 0x90], rax
movabs rax, 0xd9d856b784687ba0
mov qword [rsp + 0x98], rax
movabs rax, 0x7fe12dc042caab78
mov qword [rsp + 0xa0], rax
movabs rax, 0x723b86f76e19471e
mov qword [rsp + 0xa8], rax
movabs rax, 0x8ee1cac491a5d108
mov qword [rsp + 0xb0], rax
movabs rax, 0xa401cda3fc3dab23
mov qword [rsp + 0xb8], rax
movabs rax, 0xa0d991896e172d1c
mov qword [rsp + 0xc0], rax
movabs rax, 0xc226480b2c7aeece
mov qword [rsp + 0xc8], rax
vmovups ymm1, ymmword [rsp + 0x60]
vmovups ymmword [rsp + 0xd0], ymm1
vmovups ymm3, ymmword [rsp + 0x80]
vmovups ymmword [rsp + 0xf0], ymm3
vmovups ymm4, ymmword [rsp + 0xa0]
vmovups ymmword [rsp + 0x110], ymm4
vpxor xmm1, xmm1, xmmword [rsp + 0x210]
vmovdqu xmmword [rsp + 0xd0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x220]
vpxor xmm0, xmm2, xmmword [rsp + 0xe0]
vmovdqu xmmword [rsp + 0xe0], xmm0
vpxor xmm1, xmm3, xmmword [rsp + 0x230]
vmovdqu xmmword [rsp + 0xf0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x240]
vpxor xmm0, xmm2, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0x100], xmm0
vpxor xmm1, xmm4, xmmword [rsp + 0x250]
vmovdqu xmmword [rsp + 0x110], xmm1
vmovdqu xmm2, xmmword [rsp + 0x260]
vpxor xmm0, xmm2, xmmword [rsp + 0x120]
vmovdqu xmmword [rsp + 0x120], xmm0
vmovdqu xmm1, xmmword [rsp + 0x270]
vpxor xmm2, xmm1, xmmword [rsp + 0xc0]
vmovdqu xmmword [rsp + 0x130], xmm2
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x200]
vzeroupper
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rbx
movabs rax, 0x40d6517a52da8c7d
mov qword [rsp + 0x150], rax
movabs rax, 0xf315bba66da41da0
mov qword [rsp + 0x158], rax
vmovdqu xmm0, xmmword [rsp + 0x150]
vpxor xmm1, xmm0, xmmword [rsp + 0x1d0]
vmovdqu xmmword [rsp + 0x150], xmm1
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
movabs rax, 0x48d3107a50eb8c5d
mov qword [rsp + 0x1d0], rax
movabs rax, 0xf315c9c31bcd6f88
mov qword [rsp + 0x1d8], rax
vmovdqu xmm0, xmmword [rsp + 0x1d0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1e0]
vmovdqu xmmword [rsp + 0x1d0], xmm1
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x150]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005814
mov eax, dword [rax + 4]
jmp 0x140005819
mov eax, 0xffffffff
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x200]
call fcn.1400101f0
test eax, eax
jns 0x14000593a
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x220], r13
movabs rcx, 0xfe1b07fd93e380be
mov qword [rsp + 0x228], rcx
movabs rcx, 0x7b405e22e4e6e657
mov qword [rsp + 0x230], rcx
movabs rcx, 0x1247326fa7705a78
mov qword [rsp + 0x238], rcx
movabs rcx, 0x4ae24a581cb58b16
mov qword [rsp + 0x30], rcx
movabs rcx, 0x857cbb877fac0088
mov qword [rsp + 0x38], rcx
movabs rcx, 0x83221c0e2accd420
mov qword [rsp + 0x40], rcx
movabs rcx, 0xdf69688fe186a097
mov qword [rsp + 0x48], rcx
movabs rcx, 0x23786e079cd6ce77
mov qword [rsp + 0x50], rcx
movabs rcx, 0x1247326fa7705a51
mov qword [rsp + 0x58], rcx
vmovdqu xmm0, xmmword [rsp + 0x210]
vpxor xmm1, xmm0, xmmword [rsp + 0x30]
vmovdqu xmmword [rsp + 0x30], xmm1
vmovdqu xmm2, xmmword [rsp + 0x220]
vpxor xmm0, xmm2, xmmword [rsp + 0x40]
vmovdqu xmmword [rsp + 0x40], xmm0
vmovdqu xmm1, xmmword [rsp + 0x230]
vpxor xmm2, xmm1, xmmword [rsp + 0x50]
vmovdqu xmmword [rsp + 0x50], xmm2
mov r8d, eax
lea rdx, str.NtSystem::Destroy
lea rcx, [rsp + 0x30]
call fcn.140010140
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
movabs rax, 0x50d2527378e89d61
mov qword [rsp + 0x150], rax
movabs rax, 0xf315c99462a82481
mov qword [rsp + 0x158], rax
vmovdqu xmm0, xmmword [rsp + 0x1e0]
vpxor xmm1, xmm0, xmmword [rsp + 0x150]
vmovdqu xmmword [rsp + 0x150], xmm1
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x1d8], r12
vmovdqu xmm0, xmmword [rsp + 0x1e0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1d0]
vmovdqu xmmword [rsp + 0x1d0], xmm1
lea rcx, [rsp + 0x1d0]
call fcn.140002490
lea rdx, [rsp + 0x150]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
movabs rcx, 0x24b73e7a3ceef87d
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rbx
vmovdqu xmm0, xmmword [rsp + 0x1e0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x1f0], xmm1
lea rdx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x140]
call rax
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
movabs rax, 0x41c4517a7fe89d61
mov qword [rsp + 0x150], rax
movabs rax, 0xf315c9c31bb40aaf
mov qword [rsp + 0x158], rax
vmovdqu xmm0, xmmword [rsp + 0x1e0]
vpxor xmm1, xmm0, xmmword [rsp + 0x150]
vmovdqu xmmword [rsp + 0x150], xmm1
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x1d8], r12
vmovdqu xmm0, xmmword [rsp + 0x1e0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1d0]
vmovdqu xmmword [rsp + 0x1d0], xmm1
lea rcx, [rsp + 0x1d0]
call fcn.140002490
lea rdx, [rsp + 0x150]
mov rcx, rax
call fcn.140002540
mov rcx, qword [rsp + 0x140]
call rax
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rbx
movabs rax, 0x4ad676734fe09470
mov qword [rsp + 0x1d0], rax
movabs rax, 0xf315c9c31ba80380
mov qword [rsp + 0x1d8], rax
vmovdqu xmm0, xmmword [rsp + 0x200]
vpxor xmm1, xmm0, xmmword [rsp + 0x1d0]
vmovdqu xmmword [rsp + 0x1d0], xmm1
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rbx
movabs rax, 0x1684527352fd9d58
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], rbx
vmovdqu xmm0, xmmword [rsp + 0x200]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x1f0], xmm1
lea rcx, [rsp + 0x1f0]
call fcn.140002490
lea rdx, [rsp + 0x1d0]
mov rcx, rax
call fcn.140002540
mov rcx, qword [rdi]
call rax
lea rdx, [rsp + 0x280]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0x170], r14
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], r14w
lea rax, [rsp + 0x280]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140005be1
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x160]
call fcn.140006a80
nop
lea rdx, [rdi + 8]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140005c05
mov r8, rbx
lea rcx, [rsp + 0x160]
call fcn.1400065c0
lea rcx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rdi], r14
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x140005c8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010864
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140010840
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret