Function at 0x14000473d
Capabilities:
Delete directory
Get common file path

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140008ea4
mov qword [rsp + 0x28], rax
push 0
pop rcx
call sub.KERNEL32.dll_GetModuleHandleA
mov qword [0x14001ba3c], rax
push qword [0x14001c4e0]
push qword [0x14001c4e0]
push qword [rsp + 0x38]
pop rcx
sub rsp, 0x20
call fcn.140002c94
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400131e0
call fcn.140004b36
call fcn.1400043ea
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push 0
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008e38
add rsp, 0x28
inc qword [0x14001c4e0]
mov rcx, qword [0x14001ba6c]
pop rdx
mov qword [0x14001c4e0], rdx
add rdx, qword [0x14001c4f0]
call fcn.140013470
or rax, rax
je 0x1400047f9
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x1400047f9
mov rax, 1
jmp 0x1400047fc
xor rax, rax
and rax, rax
je 0x140004806
call fcn.140002ea6
mov rcx, qword [0x14001bafc]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
mov rcx, qword [0x14001bad4]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
mov rcx, qword [0x14001ba64]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
lea rcx, [0x14001ba64]
pop rdx
call fcn.1400131e0
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140005bd0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.1400131e0
push qword [0x14001c4e0]
sub rsp, 8
push qword [rsp + 0x48]
push 0
movabs rax, 0x14001a01e
push rax
mov rcx, qword [0x14001bafc]
push qword [0x14001c4e0]
sub rsp, 0x20
call fcn.140013390
add rsp, 0x20
mov rcx, qword [0x14001bad4]
sub rsp, 0x20
call fcn.140013390
add rsp, 0x20
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_GetTempFileNameA
add rsp, 0x28
pop qword [0x14001c4e0]
push qword [rsp + 0x38]
pop rcx
call fcn.14000f894
movabs rax, str..ps1
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov rcx, qword [rsp + 0x38]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
lea rcx, [0x14001ba64]
pop rdx
call fcn.1400131e0
call fcn.140004bba
mov rcx, qword [0x14001b9d4]
xor rdx, rdx
call fcn.140013470
or rax, rax
jne 0x14000495e
push qword [0x14001b9d4]
pop rcx
call fcn.140003338
call fcn.140003c1e
push qword [0x14001ba64]
pop rcx
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push qword [0x14001c4e0]
sub rsp, 8
push 0x45
push qword [0x14001ba54]
mov rcx, qword [0x14001b994]
push qword [0x14001c4e0]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
movabs rcx, str.__BFINOPS
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
mov rcx, qword [0x14001ba64]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
movabs rcx, str.__BFINOPS
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
mov rcx, qword [rsp + 0x58]
sub rsp, 0x28
call fcn.140013390
add rsp, 0x28
inc qword [0x14001c4e0]
push qword [0x14001ba2c]
mov rdx, qword [0x14001c4f0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140009584
add rsp, 0x28
pop qword [0x14001c4e0]
mov qword [0x14001ba84], rax
push qword [0x14001ba84]
pop rcx
call fcn.1400095d4
mov qword [rsp + 0x40], rax
push qword [0x14001ba84]
pop rcx
call fcn.1400095f8
push 0
lea rax, [0x140003055]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.1400042f0
push qword [0x14001ba64]
pop rcx
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push qword [0x14001ba64]
pop rcx
call fcn.14000f894
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
sub rsp, 8
push qword [0x14001c4e0]
push qword [0x14001c4e0]
push qword [0x14001c4e0]
pop rcx
sub rsp, 0x20
call fcn.140008ec0
add rsp, 0x20
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000f7c4
add rsp, 0x28
mov rdx, qword [0x14001c4f0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14000f7a8
add rsp, 0x28
pop qword [0x14001c4e0]
push qword [0x14001bafc]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, qword [rsp + 0x40]
mov qword [0x14001b974], rax
jmp fcn.140001b05