Function at 0x14002696c
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r12d, r12d
mov rsi, rdx
mov r14, rcx
mov ebx, r12d
mov edi, r12d
mov r15d, r12d
test rdx, rdx
je 0x140026a8c
mov rcx, rdx
call fcn.140019df8
test eax, eax
je 0x140026a38
or rcx, 0xffffffffffffffff
mov rdi, rcx
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x1400269c5
add rdi, 0xd
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000130c
mov rbx, rax
test rax, rax
je 0x140026a74
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1400104bc
mov esi, eax
mov rcx, rbx
test eax, eax
jns 0x140026a16
call fcn.1400012c0
mov eax, esi
jmp 0x140026bfc
call fcn.14001937c
lea r8, [0x140046790]
mov rdx, rdi
mov rcx, rbx
call fcn.140010470
mov edi, eax
test eax, eax
jns 0x140026a8c
jmp 0x140026bf2
mov rcx, rsi
call fcn.140019eb0
test eax, eax
je 0x140026a8c
or rcx, 0xffffffffffffffff
mov rbp, rcx
inc rbp
cmp word [rsi + rbp*2], r12w
jne 0x140026a4b
inc rbp
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.14000130c
mov rbx, rax
test rax, rax
jne 0x140026a7e
mov eax, 0x8007000e
jmp 0x140026bfc
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1400104bc
mov esi, r12d
mov ebp, 0x104
cmp esi, 2
jge 0x140026bad
test rbx, rbx
je 0x140026ab6
mov rcx, rbx
call fcn.140019eb0
test eax, eax
jne 0x140026b1e
mov rcx, rbx
call fcn.1400012c0
mov ecx, 0x208
call fcn.14000130c
mov rbx, rax
test rax, rax
jne 0x140026acf
mov edi, 0x8007000e
jmp 0x140026b4e
mov rcx, r14
call fcn.1400273f4
test eax, eax
js 0x140026b49
mov r8, qword [r14 + 0x260]
mov rdx, rbp
mov rcx, rbx
call fcn.1400104bc
test eax, eax
js 0x140026b49
mov rcx, rbx
call fcn.14001937c
lea r8, [0x140046790]
mov rdx, rbp
mov rcx, rbx
call fcn.140010470
mov rdx, rbx
mov rcx, r14
call fcn.140024068
mov edi, eax
mov r15d, 1
test edi, edi
js 0x140026b2f
mov r8, r14
mov rcx, rbx
call fcn.140039ea4
mov edi, eax
cmp edi, 0xc00d1388
jne 0x140026b4e
test rbx, rbx
je 0x140026b99
mov rcx, rbx
call fcn.1400012c0
mov rbx, r12
jmp 0x140026b99
mov edi, 0x80004005
cmp edi, 0x80040154
jne 0x140026bad
mov edx, 0x103
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140026b99
lea r8, str.msxml.dll
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140010470
xor r8d, r8d
lea rcx, [rsp + 0x20]
lea edx, [r8 + 1]
call fcn.14001c05c
test eax, eax
jns 0x140026ba0
inc esi
jmp 0x140026a94
mov r8, r14
mov rcx, rbx
call fcn.140039ea4
mov edi, eax
test rbx, rbx
je 0x140026bfa
test r15d, r15d
je 0x140026bf2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x140026be3
mov word [rax], r12w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400012c0
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret