Function at 0x140009b00
Capabilities:
Delete file
Enumerate files on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x600
mov rax, qword [0x14008d140]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x20], r13d
mov r8d, 0x104
lea rdx, [rsp + 0x3e0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140009ca5
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x168], r13
mov r8d, 9
lea rdx, [0x14007c708]
lea rcx, [rsp + 0x150]
call fcn.140024160
nop
lea r8, [0x14007bb90]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xc0]
call fcn.140021e50
cmp qword [rax + 0x18], 7
jbe 0x140009bbd
mov rax, qword [rax]
lea rdx, [rsp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xd8]
cmp rdx, 7
jbe 0x140009c1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a773
call fcn.140042790
movdqa xmm0, xmmword [0x1400802d0]
movdqu xmmword [rsp + 0xd0], xmm0
mov word [rsp + 0xc0], r13w
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140009cd7
lea rdx, str.Error_finding_user_directories
lea rcx, [0x14008f140]
call fcn.140021fe0
mov rcx, rax
call fcn.1400222a0
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140009ca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a76d
call fcn.140042790
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.140042770
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
movabs rdx, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
mov r9d, 0xa
test byte [rsp + 0x190], 0x10
je 0x14000a6e1
movzx ecx, word [rsp + 0x1bc]
movzx eax, word [rsp + 0x1be]
cmp cx, 0x2e
jne 0x140009d37
test ax, ax
je 0x14000a6e1
cmp cx, cx
jne 0x140009d37
cmp ax, cx
jne 0x140009d37
cmp word [rsp + 0x1c0], 0
je 0x14000a6e1
lea rax, [rsp + 0x1bc]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140009d46
mov rax, rdx
sub rax, qword [rsp + 0x160]
cmp rax, rdi
jb 0x14000a779
lea r12, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova r12, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r15, qword [rsp + 0x160]
add r15, rdi
mov ebx, 7
lea rsi, [rsp + 0x60]
cmp r15, rbx
jbe 0x140009e1e
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x140009df2
mov rbx, rdx
lea rcx, [r8 + r8]
cmp rcx, 0x1000
jb 0x140009e11
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a78b
mov rcx, rax
call fcn.140042a38
test rax, rax
je 0x14000a77f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140009e19
cmp rbx, 0xa
cmovb rbx, r9
lea rcx, [rbx + 1]
cmp rcx, r8
ja 0x14000a78b
add rcx, rcx
jne 0x140009dbd
mov rsi, r13
jmp 0x140009e19
call fcn.140042a38
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
mov rax, qword [rsp + 0x160]
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.1400692b0
lea rcx, [rsi + rbx]
lea r8, [rdi + rdi]
lea rdx, [rsp + 0x1bc]
call fcn.1400692b0
mov word [rsi + r15*2], r13w
bts r14d, 0xb
mov r8d, 8
lea rdx, str.Desktop
lea rcx, [rsp + 0x60]
call fcn.14001efc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts r14d, 0xc
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140009f01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a785
call fcn.140042790
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 7
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, qword [rsp + 0x120]
lea rcx, [rsp + 0x28]
call fcn.140024160
or r14d, 0x6000
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xe8]
call fcn.1400055a0
movsd xmm0, qword [rax]
movsd qword [rsp + 0xb0], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x90], ecx
lea rax, [0x14008ddc0]
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x180], xmm0
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x140009ff8
cmp eax, 1
setne bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a009
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a004
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a791
jmp 0x14000a004
xor bl, bl
test ecx, ecx
jne 0x14000a797
jmp 0x140009fb9
call fcn.140042790
test bl, bl
je 0x14000a699
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 7
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, qword [rsp + 0x120]
lea rcx, [rsp + 0x28]
call fcn.140024160
or r14d, 0x18000
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x100]
call fcn.1400217c0
test eax, eax
jne 0x14000a7b1
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a0c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7c5
call fcn.140042790
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov r15, qword [rsp + 0x108]
test r15, r15
je 0x14000a0ed
lock inc dword [r15 + 8]
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x170], xmm0
test r15, r15
je 0x14000a115
lock inc dword [r15 + 8]
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x180], xmm1
test r15, r15
je 0x14000a175
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14000a168
mov rbx, qword [rsp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a168
mov r15, qword [rsp + 0x108]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000a170
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
mov r12, qword [rsp + 0x180]
nop dword [rax]
mov rsi, qword [rsp + 0x170]
cmp rsi, r12
je 0x14000a5f2
mov r8d, 3
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140004e20
mov edx, dword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
test edx, edx
je 0x14000a1c9
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x14000a7cb
cmp eax, 2
jne 0x14000a356
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], r13
mov r8d, 4
lea rdx, [0x14007c778]
lea rcx, [rsp + 0x130]
call fcn.140024160
or r14d, 0x600
or r14d, 1
mov dword [rsp + 0x20], r14d
lea rcx, [rsi + 0x20]
cmp qword [rsi + 0x38], 7
jbe 0x14000a226
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsi + 0x30]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.140003c20
cmp rax, rdx
je 0x14000a27c
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000a24f
cmp cx, 0x2f
jne 0x14000a258
add rax, 2
cmp rax, rdx
jne 0x14000a240
cmp rax, rdx
je 0x14000a27c
nop dword [rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000a27c
cmp cx, 0x2f
je 0x14000a27c
mov rbx, r8
cmp rax, r8
jne 0x14000a260
mov r8d, 0x3a
mov rcx, rbx
call fcn.140041490
cmp rbx, rax
je 0x14000a2c7
lea rdx, [rax - 2]
cmp rbx, rdx
je 0x14000a2c7
cmp word [rdx], 0x2e
jne 0x14000a2af
lea rcx, [rdx - 2]
cmp rbx, rcx
jne 0x14000a2ca
cmp word [rcx], 0x2e
jne 0x14000a2ca
jmp 0x14000a2c7
sub rdx, 2
cmp rbx, rdx
je 0x14000a2c7
cmp word [rdx], 0x2e
je 0x14000a2ca
sub rdx, 2
cmp rbx, rdx
jne 0x14000a2b8
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, rax
lea rcx, [rsp + 0x28]
call fcn.140024160
or r14d, 0x1c2
mov dword [rsp + 0x20], r14d
lea rax, [rsp + 0x130]
mov rbx, qword [rsp + 0x148]
cmp rbx, 7
cmova rax, qword [rsp + 0x130]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140004050
test eax, eax
jne 0x14000a35e
mov dil, 1
jmp 0x14000a361
mov rbx, qword [rsp + 0x148]
xor dil, dil
test r14b, 2
je 0x14000a3ce
and r14d, 0xfffffffd
mov dword [rsp + 0x20], r14d
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a3ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a3ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7dc
call fcn.140042790
mov rbx, qword [rsp + 0x148]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r13w
test r14b, 1
je 0x14000a41d
and r14d, 0xfffffffe
mov dword [rsp + 0x20], r14d
cmp rbx, 7
jbe 0x14000a41d
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a418
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7e2
call fcn.140042790
test dil, dil
je 0x14000a5d8
add rsi, 0x20
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000a437
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.140003c20
cmp rax, rdi
je 0x14000a48b
nop
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000a45f
cmp cx, 0x2f
jne 0x14000a468
add rax, 2
cmp rax, rdi
jne 0x14000a450
cmp rax, rdi
je 0x14000a48b
nop dword [rax]
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000a48b
cmp cx, 0x2f
je 0x14000a48b
mov rbx, rdx
cmp rax, rdx
jne 0x14000a470
sub rdi, rbx
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140024160
or r14d, 0x1c
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x130]
call fcn.14001f080
or r14d, 0x20
mov dword [rsp + 0x20], r14d
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a519
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a514
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7e8
call fcn.140042790
lea rcx, [rsp + 0x130]
call fcn.140009830
test al, al
je 0x14000a590
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000a537
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000a569
lea rdx, str.Deleted:
lea rcx, [0x14008ee80]
call fcn.140021fe0
mov rdx, rsi
mov rcx, rax
call fcn.140022330
mov rcx, rax
call fcn.1400222a0
jmp 0x14000a590
lea rdx, str.Failed_to_delete:
lea rcx, [0x14008f140]
call fcn.140021fe0
mov rdx, rsi
mov rcx, rax
call fcn.140022330
mov rcx, rax
call fcn.1400222a0
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x14000a5d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7ee
call fcn.140042790
lea rcx, [rsp + 0x170]
call fcn.140004f80
test eax, eax
jne 0x14000a7f4
jmp 0x14000a180
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x14000a648
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a63b
mov rbx, qword [rsp + 0x178]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a63b
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rsp + 0x20]
mov r15, qword [rsp + 0x108]
test r15, r15
je 0x14000a68f
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14000a68a
mov rbx, qword [rsp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a68a
mov rcx, qword [rsp + 0x108]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rsp + 0x20]
jmp 0x14000a699
mov rdx, qword [rsp + 0x128]
cmp rdx, 7
jbe 0x14000a6e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a6dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a7fc
call fcn.140042790
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
movabs rdx, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
mov r9d, 0xa
jne 0x140009cf1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140009ca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ca0
call fcn.14004cd30
nop
call fcn.14004cd30
int3
call fcn.140002410
int3
call fcn.14004cd30
nop
call fcn.14004cd30
nop
call fcn.140002370
nop
call fcn.14004cd30
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x180]
lea rcx, str.exists
call fcn.140004dc0
nop
lea r8, [rsp + 0x28]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140004d50
nop
call fcn.14004cd30
nop
lea r8, [rsi + 0x20]
lea rcx, str.directory_entry::status
call fcn.140004d50
nop
call fcn.14004cd30
nop
call fcn.14004cd30
nop
call fcn.14004cd30
nop
call fcn.14004cd30
int3
mov edx, eax
call fcn.140004c60
nop
call fcn.14004cd30
int3