Function at 0x1400081f4
Capabilities:
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x58], 0
lea r9, [rbp + 0x58]
xor r14d, r14d
mov r15, rcx
and dword [rbp - 0x10], r14d
lea rcx, [0x14003ed70]
and dword [rbp - 0xc], r14d
xor r8d, r8d
and qword [rbp - 8], r14
xor edx, edx
and qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140008464
mov rcx, qword [rbp + 0x58]
lea r9, [rbp + 0x50]
call fcn.140007968
mov edi, eax
test eax, eax
jns 0x14000826e
mov ecx, eax
call fcn.140009900
mov r14, qword [rbp + 0x50]
jmp 0x14000846b
mov r14, qword [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
or r13d, 0xffffffff
mov ebx, eax
cmp eax, r13d
je 0x140008294
shr ebx, 4
and ebx, 1
jmp 0x140008296
xor ebx, ebx
xor ecx, ecx
call fcn.140004884
xor ecx, ecx
call fcn.140004884
test ebx, ebx
jne 0x1400082ba
mov rcx, r14
call fcn.140007a9c
mov edi, eax
test eax, eax
js 0x140008464
xor esi, esi
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400082f5
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004884
and qword [rbp + 0x48], 0
inc esi
lea r9, str.RUXIMLog
mov r8, r14
mov dword [rsp + 0x20], esi
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.140007dac
mov edi, eax
test eax, eax
js 0x140008464
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.1400080bc
mov edi, eax
test eax, eax
js 0x140008464
cmp esi, 0x32
jb 0x1400082bc
mov rsi, qword [rbp - 8]
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008363
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008365
xor ebx, ebx
xor ecx, ecx
call fcn.140004884
xor ecx, ecx
call fcn.140004884
test ebx, ebx
je 0x1400083ba
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400083ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400083a5
mov edi, 0x80004005
jmp 0x1400083b3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x140008466
mov edi, 0x188
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x1400083e1
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400083e3
xor ebx, ebx
xor ecx, ecx
call fcn.140004884
xor ecx, ecx
call fcn.140004884
test ebx, ebx
je 0x14000840e
mov rdx, qword [rsi + rdi]
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14000838e
sub rdi, 8
jne 0x1400083bf
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008434
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008436
xor ebx, ebx
xor ecx, ecx
call fcn.140004884
xor ecx, ecx
call fcn.140004884
xor edi, edi
test ebx, ebx
je 0x140008459
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rax, qword [rsi]
and qword [rsi], rdi
mov qword [r15], rax
jmp 0x14000846b
mov ecx, eax
call fcn.140009900
mov ecx, edi
call fcn.140004884
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400084a6
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004884
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140007dec
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x1400084da
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x140008507
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004884
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000851c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret