Function at 0x14000bef0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
lea rcx, [0x1400bff68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
test rbx, rbx
je 0x14001c922
cmp dword [rbx], 0x6060
jne 0x14001c922
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x30], rdi
test rax, rax
jne 0x14001c81a
lea rcx, [0x1400bff68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x60]
xor esi, esi
test rcx, rcx
jne 0x14001c834
mov rax, qword [rbx + 8]
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbx + 0x10]
mov rax, qword [rax + 0x118]
call qword [case.0x140007f48.0]
test eax, eax
je 0x14000c045
lea rcx, [0x1400bff68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x14001c874
mov rax, qword [0x1400bfdf0]
mov dword [rbx + 0x30], esi
mov dword [rbx + 0x50], esi
cmp rax, rbx
je 0x14001c886
test rax, rax
jne 0x14001c896
cmp qword [rbx + 0x18], rsi
jne 0x14001c8b9
lea rcx, [0x1400bff68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x14001c8c8
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x14001c8da
mov r8, qword [rbx + 0x48]
test r8, r8
je 0x14000c017
mov rcx, qword [0x1400c02b8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [0x1400c02b8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14000c034
test byte [rax + 0xc], 2
je 0x14000bf39
mov edx, esi
mov rcx, rbx
call fcn.140008828
nop
jmp 0x14000bf39
mov rax, qword [0x1400be2f8]
lea rdx, [0x1400be2f8]
cmp rax, rdx
je 0x14001c866
test byte [rax + 0x44], 4
je 0x14001c866
mov rcx, qword [rax + 0x38]
lea r8, [0x1400a4150]
mov edx, 0x16
call fcn.14002c20c
mov rcx, qword [rbx + 0x60]
call fcn.14000a390
mov qword [rbx + 0x60], rsi
jmp 0x14000bf5b
mov qword [rax + 8], rsi
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001c874
jmp 0x14000bfa2
mov rax, qword [rbx + 0x28]
mov qword [0x1400bfdf0], rax
jmp 0x14000bfc1
lea rcx, [rax + 0x28]
mov rax, qword [rax + 0x28]
cmp rax, rbx
je 0x14001c8ad
test rax, rax
jne 0x14001c896
jmp 0x14000bfc1
mov rax, qword [rbx + 0x28]
mov qword [rcx], rax
jmp 0x14000bfc1
lea rcx, [rbx + 0x18]
call fcn.140008970
nop
jmp 0x14000bfcb
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000bfec
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14001c900
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400c02b8]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov qword [rbx + 0x40], rsi
jmp 0x14000bff9
lea rcx, [0x1400bff68]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000c039