Function at 0x140046270
Capabilities:
Delete file
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x140299b00]
test rdi, rdi
je 0x1400462c0
lea rbx, [0x140268253]
mov rcx, rdi
mov rdx, rbx
call fcn.1401599b0
test al, al
jne 0x1400462e9
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1401599b0
test al, al
jne 0x1400462e9
mov eax, dword [rsi]
mov dword [0x140288f38], eax
test al, 1
jne 0x1400463a2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401756e0
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.vmodule
lea r8, [rsp + 0x48]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea r14, [rsp + 0x58]
mov rcx, rdi
mov rdx, r14
call fcn.14001a570
lea r8, [rsp + 0x20]
mov qword [r8], rbx
mov qword [r8 + 8], 1
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.14001a570
mov ecx, 0x20
call fcn.140172a4c
mov rdi, rax
lea r9, [0x140299b30]
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.1401deff0
cmp byte [rbx + 0x17], 0
jns 0x140046362
mov rcx, qword [rsp + 0x30]
call fcn.140172a44
cmp byte [rsp + 0x6f], 0
jns 0x140046373
mov rcx, qword [rsp + 0x58]
call fcn.140172a44
test rdi, rdi
je 0x1400462c0
xor eax, eax
lock cmpxchg qword [0x140299b40], rdi
je 0x1400462c0
mov rcx, rdi
call fcn.1401df0a0
mov rcx, rdi
call fcn.140172a44
jmp 0x1400462c0
mov rcx, qword [0x140299b38]
test rcx, rcx
jne 0x1400463bc
mov rcx, qword [0x140299b28]
test rcx, rcx
je 0x1400463e0
jmp 0x140046402
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140299b38], 0
mov rcx, qword [0x140299b28]
test rcx, rcx
jne 0x140046402
and byte [0x140288f38], 0xfe
mov ecx, 0x18
call fcn.140172a4c
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140299b28], rax
mov rdx, qword [rsi + 8]
call fcn.140071510
cmp dword [rsi + 0x14], 0
jne 0x140046427
mov rcx, qword [0x140299b28]
cmp byte [rcx + 0x17], 0
jns 0x140046421
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401756e0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1401d1fe0
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140299b38], 0
je 0x1401d2026
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x140299b28]
test rdi, rdi
je 0x1401d20c7
test byte [0x140288f38], 1
je 0x1401d2009
cmp byte [rdi + 0x17], 0
jns 0x1401d2048
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140299b38], rax
inc rax
cmp rax, 1
ja 0x1401d2009
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140177800
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401d2192
xor esi, esi
jmp 0x1401d2009
mov ecx, 0x18
call fcn.140172a4c
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140177800
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140261350]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1401b1c40
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1401d212e
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
jmp 0x1401d2134
and eax, 0x7f
mov rcx, rdi
test rax, rax
jne 0x1401d215a
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.1400154c0
mov qword [0x140299b28], rdi
jmp 0x1401d2036
lea r8, [rax + rax]
test r8, r8
je 0x1401d2139
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x1401d215e
cmp rdx, 0xfffffffffffffffe
je 0x1401d2139
sar rdx, 1
inc rdx
cmp rax, rdx
jb 0x1401d2256
mov rcx, rdi
call fcn.1401b0d30
jmp 0x1401d2139
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140173694
mov rcx, qword [0x140299b28]
mov rdx, rdi
mov r8, rax
call fcn.14001be40
mov rcx, qword [0x140299b28]
call fcn.1400b8230
cmp word [rax], 0x5c
je 0x1401d21dc
mov rcx, qword [0x140299b28]
lea rdx, [0x1402650ca]
mov r8d, 1
call fcn.1400154c0
mov rcx, qword [0x140299b28]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1400154c0
mov rcx, qword [0x140299b28]
cmp byte [rcx + 0x17], 0
jns 0x1401d2205
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140299b38], rax
inc rax
cmp rax, 1
ja 0x1401d2009
mov qword [0x140299b38], 0
jmp 0x1401d20c0
call fcn.14018c460
int3