Function at 0x140008c80
Capabilities:
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x58], 0
lea r9, [rbp + 0x58]
xor r14d, r14d
mov r15, rcx
and dword [rbp - 0x10], r14d
lea rcx, [0x140053f00]
and dword [rbp - 0xc], r14d
xor r8d, r8d
and qword [rbp - 8], r14
xor edx, edx
and qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
call qword [sym.imp.api_ms_win_shell_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140008ef0
mov rcx, qword [rbp + 0x58]
lea r9, [rbp + 0x50]
call fcn.1400083f4
mov edi, eax
test eax, eax
jns 0x140008cfa
mov ecx, eax
call fcn.14000a2bc
mov r14, qword [rbp + 0x50]
jmp 0x140008ef7
mov r14, qword [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
or r13d, 0xffffffff
mov ebx, eax
cmp eax, r13d
je 0x140008d20
shr ebx, 4
and ebx, 1
jmp 0x140008d22
xor ebx, ebx
xor ecx, ecx
call fcn.140004854
xor ecx, ecx
call fcn.140004854
test ebx, ebx
jne 0x140008d46
mov rcx, r14
call fcn.140008528
mov edi, eax
test eax, eax
js 0x140008ef0
xor esi, esi
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140008d81
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004854
and qword [rbp + 0x48], 0
inc esi
lea r9, str.RUXIMLog
mov r8, r14
mov dword [rsp + 0x20], esi
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.140008838
mov edi, eax
test eax, eax
js 0x140008ef0
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.140008b48
mov edi, eax
test eax, eax
js 0x140008ef0
cmp esi, 0x32
jb 0x140008d48
mov rsi, qword [rbp - 8]
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008def
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008df1
xor ebx, ebx
xor ecx, ecx
call fcn.140004854
xor ecx, ecx
call fcn.140004854
test ebx, ebx
je 0x140008e46
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140008e46
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140008e31
mov edi, 0x80004005
jmp 0x140008e3f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x140008ef2
mov edi, 0x188
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008e6d
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008e6f
xor ebx, ebx
xor ecx, ecx
call fcn.140004854
xor ecx, ecx
call fcn.140004854
test ebx, ebx
je 0x140008e9a
mov rdx, qword [rsi + rdi]
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x140008e1a
sub rdi, 8
jne 0x140008e4b
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008ec0
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008ec2
xor ebx, ebx
xor ecx, ecx
call fcn.140004854
xor ecx, ecx
call fcn.140004854
xor edi, edi
test ebx, ebx
je 0x140008ee5
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rax, qword [rsi]
and qword [rsi], rdi
mov qword [r15], rax
jmp 0x140008ef7
mov ecx, eax
call fcn.14000a2bc
mov ecx, edi
call fcn.140004854
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140008f32
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004854
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140008878
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x140008f66
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x140008f93
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004854
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140008fa8
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret