Function at 0x140002bf0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov qword [rbp - 0x39], 0xfffffffffffffffe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbp - 0x31]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::constructor_void____ptr64]
lea r15, vtable.CUtlX.0
mov qword [rbp - 0x31], r15
lea rcx, [rbp - 0x31]
call qword [sym.imp.SetupXML.dll_public:_long_int___cdecl_CXMLFileManagerInterface::Initialize_void____ptr64]
lea rcx, [rbp - 0x11]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::constructor_void____ptr64]
mov qword [rbp - 0x11], r15
lea rdx, [0x14021e450]
lea rcx, [rbp + 0xf]
call fcn.140005a40
nop
mov byte [rbp + 0x17], 0
mov edx, 4
lea rcx, [rbp - 0x11]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::SetFileIndex_enum_XMLFILENAMES____ptr64]
nop
lea rcx, [rbp - 0x11]
call fcn.140006340
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x11]
call fcn.140005f80
nop
mov rax, qword [rbp + 0x67]
movzx ecx, word [rax]
cmp cx, word [0x14021e450]
jne 0x140002c96
xor eax, eax
jmp 0x140002c9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x140002d1b
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x11]
call fcn.1400061d0
mov rbx, rax
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x11]
call fcn.140006130
mov rbx, qword [rbx]
mov rdi, qword [rax]
mov rsi, qword [rbp + 0x67]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140002d03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140002d1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x31]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::UnInitialize_void____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x11]
call fcn.140006530
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140002d5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x67]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140002d73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140002d8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov qword [rbp - 0x11], r15
lea rcx, [rbp - 0x11]
call qword [sym.imp.SetupXML.dll_public_virtual:_void___cdecl_CXMLFileManagerInterface::destructor_void____ptr64]
nop
mov qword [rbp - 0x31], r15
lea rcx, [rbp - 0x31]
call qword [sym.imp.SetupXML.dll_public_virtual:_void___cdecl_CXMLFileManagerInterface::destructor_void____ptr64]
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret