Function at 0x14002a9f8
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r12d, r12d
mov rsi, rdx
mov r14, rcx
mov ebx, r12d
mov edi, r12d
mov r15d, r12d
test rdx, rdx
je 0x14002ab23
mov rcx, rdx
call fcn.14001aa34
test eax, eax
je 0x14002aacf
or rcx, 0xffffffffffffffff
mov rdi, rcx
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x14002aa55
add rdi, 0xd
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov rbx, rax
test rax, rax
je 0x14002ab0b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140010dd0
mov esi, eax
mov rcx, rbx
test eax, eax
jns 0x14002aaa6
call fcn.140001454
mov eax, esi
jmp 0x14002accf
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
lea r8, [0x14004e310]
mov rdx, rdi
mov rcx, rbx
call fcn.140010d0c
mov edi, eax
test eax, eax
jns 0x14002ab23
jmp 0x14002acc5
mov rcx, rsi
call fcn.14001ab20
test eax, eax
je 0x14002ab23
or rcx, 0xffffffffffffffff
mov rbp, rcx
inc rbp
cmp word [rsi + rbp*2], r12w
jne 0x14002aae2
inc rbp
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov rbx, rax
test rax, rax
jne 0x14002ab15
mov eax, 0x8007000e
jmp 0x14002accf
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.140010dd0
mov esi, r12d
mov ebp, 0x104
test rbx, rbx
je 0x14002ab48
mov rcx, rbx
call fcn.14001ab20
test eax, eax
jne 0x14002abec
mov rcx, rbx
call fcn.140001454
mov ecx, 0x208
call fcn.1400014a0
mov rbx, rax
test rax, rax
jne 0x14002ab64
mov edi, 0x8007000e
jmp 0x14002ac1c
mov rcx, r14
call fcn.14002b634
test eax, eax
js 0x14002ac17
mov r8, qword [r14 + 0x260]
mov rcx, rbp
mov rdx, rbx
lea rax, [rcx + 0x7ffffefa]
test rax, rax
je 0x14002aba7
movzx eax, word [r8]
test ax, ax
je 0x14002aba7
mov word [rdx], ax
add r8, 2
add rdx, 2
sub rcx, 1
jne 0x14002ab81
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r12w
je 0x14002ac17
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
lea r8, [0x14004e310]
mov rdx, rbp
mov rcx, rbx
call fcn.140010d0c
mov rdx, rbx
mov rcx, r14
call fcn.140026d14
mov edi, eax
mov r15d, 1
test edi, edi
js 0x14002abfd
mov r8, r14
mov rcx, rbx
call fcn.1400412cc
mov edi, eax
cmp edi, 0xc00d1388
jne 0x14002ac1c
test rbx, rbx
je 0x14002ac67
mov rcx, rbx
call fcn.140001454
mov rbx, r12
jmp 0x14002ac67
mov edi, 0x80004005
cmp edi, 0x80040154
jne 0x14002ac80
mov edx, 0x103
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14002ac67
lea r8, str.msxml.dll
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140010d0c
xor r8d, r8d
lea rcx, [rsp + 0x20]
lea edx, [r8 + 1]
call fcn.14001cd58
test eax, eax
jns 0x14002ac73
inc esi
cmp esi, 2
jge 0x14002ac80
jmp 0x14002ab2b
mov r8, r14
mov rcx, rbx
call fcn.1400412cc
mov edi, eax
test rbx, rbx
je 0x14002accd
test r15d, r15d
je 0x14002acc5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x14002acb6
mov word [rax], r12w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140001454
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret