Function at 0x1400e0b81
Capabilities:
Delete file
Execute command
Get common file path
Self delete

Disassembly:
jmp 0x140273260
push rbp
push rdi
mov eax, 0x11c8
call fcn.1400e0cf8
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x312
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14033f1f8]
xor rax, rbp
mov qword [rbp + 0x1178], rax
mov dword [rbp + 0x1134], 0
lea rcx, [0x1403662c7]
call fcn.1400e47e0
lea rcx, str._Config_
call fcn.1400e28c8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x80
lea rdx, [0x14034aa20]
lea rcx, str.New_Config_Name
call fcn.1400e16da
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xc34]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Create_Config
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x14027336e
lea rdx, [0x14034aa20]
lea rcx, [rbp + 0xc58]
call fcn.1400e20b7
mov qword [rbp + 0x1148], rax
mov rax, qword [rbp + 0x1148]
mov qword [rbp + 0x1150], rax
lea r8, str..config
mov rdx, qword [rbp + 0x1150]
lea rcx, [rbp + 8]
call fcn.1400e41d2
nop
lea rcx, [rbp + 0xc58]
call fcn.1400e0d39
lea rcx, [rbp + 8]
call fcn.1400e2b93
nop
lea rcx, [rbp + 8]
call fcn.1400e0d39
call fcn.1400e4524
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x140273398
jmp 0x140273ef7
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1402733de
jmp 0x140273ef7
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x3a8]
call fcn.1400e20b7
nop
lea r8, str..Aeonix_
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x3e8]
call fcn.1400e38ae
nop
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x14034ad24]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x14034aa18], eax
jle 0x14027347c
lea rcx, [0x14034aa18]
call fcn.1400e4065
cmp dword [0x14034aa18], 0xffffffff
jne 0x14027347c
mov edx, 0x20
lea rcx, [0x14034aaa0]
call fcn.1400e0627
lea rcx, [0x14034aaa0]
call fcn.1400e1c02
lea rcx, [0x1402b00c0]
call fcn.1400e1c20
lea rcx, [0x14034aa18]
call fcn.1400e4222
lea rcx, [0x14034aaa0]
call fcn.1400e288c
xor r8d, r8d
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0xc98]
call fcn.1400e3935
nop
lea rdx, [rbp + 0xc98]
lea rcx, [rbp + 0x448]
call fcn.1400e47b3
nop
lea rax, [rbp + 0x448]
mov qword [rbp + 0x428], rax
lea rcx, [rbp + 0xc98]
call fcn.1400e41aa
mov edx, 0x10
lea rcx, [rbp + 0x478]
call fcn.1400e1955
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xd08], rax
mov rdx, qword [rbp + 0x428]
mov rcx, qword [rbp + 0xd08]
call fcn.1400e20fd
mov qword [rbp + 0x1148], rax
mov rdx, qword [rbp + 0x1148]
lea rcx, [rbp + 0x478]
call fcn.1400e0b72
nop
mov edx, 0x10
lea rcx, [rbp + 0x4a8]
call fcn.1400e1955
lea rax, [rbp + 0xd28]
mov qword [rbp + 0xd58], rax
mov rdx, qword [rbp + 0x428]
mov rcx, qword [rbp + 0xd58]
call fcn.1400e20fd
mov qword [rbp + 0x1148], rax
mov rdx, qword [rbp + 0x1148]
lea rcx, [rbp + 0x4a8]
call fcn.1400e1c43
nop
jmp 0x140273575
lea rcx, [rbp + 0x478]
call fcn.1400e206c
lea rdx, [rbp + 0x4a8]
lea rcx, [rbp + 0x478]
call fcn.1400e4592
movzx eax, al
test eax, eax
je 0x14027374f
lea rcx, [rbp + 0x478]
call fcn.1400e2a0d
mov qword [rbp + 0x4d8], rax
mov rcx, qword [rbp + 0x4d8]
call fcn.1400e425e
movzx eax, al
test eax, eax
je 0x140273645
xor r8d, r8d
lea rdx, str..config
lea rcx, [rbp + 0xd98]
call fcn.1400e0280
nop
mov eax, dword [rbp + 0x1134]
or eax, 1
mov dword [rbp + 0x1134], eax
mov rcx, qword [rbp + 0x4d8]
call fcn.1400e2ba7
mov qword [rbp + 0x1148], rax
lea rdx, [rbp + 0xdd8]
mov rcx, qword [rbp + 0x1148]
call fcn.1400e0b8b
mov qword [rbp + 0x1150], rax
mov eax, dword [rbp + 0x1134]
or eax, 2
mov dword [rbp + 0x1134], eax
lea rdx, [rbp + 0xd98]
mov rcx, qword [rbp + 0x1150]
call fcn.1400e0519
movzx eax, al
test eax, eax
je 0x140273645
mov dword [rbp + 0x1158], 1
jmp 0x14027364f
mov dword [rbp + 0x1158], 0
movzx eax, byte [rbp + 0x1158]
mov byte [rbp + 0xd74], al
mov eax, dword [rbp + 0x1134]
and eax, 2
test eax, eax
je 0x14027367d
and dword [rbp + 0x1134], 0xfffffffd
lea rcx, [rbp + 0xdd8]
call fcn.1400e41aa
nop
mov eax, dword [rbp + 0x1134]
and eax, 1
test eax, eax
je 0x14027369d
and dword [rbp + 0x1134], 0xfffffffe
lea rcx, [rbp + 0xd98]
call fcn.1400e41aa
movzx eax, byte [rbp + 0xd74]
test eax, eax
je 0x14027374a
mov rcx, qword [rbp + 0x4d8]
call fcn.1400e2ba7
mov qword [rbp + 0x1148], rax
lea rdx, [rbp + 0xe18]
mov rcx, qword [rbp + 0x1148]
call fcn.1400e2111
mov qword [rbp + 0x1150], rax
mov rax, qword [rbp + 0x1150]
mov qword [rbp + 0x1158], rax
mov rax, qword [rbp + 0x1158]
mov qword [rbp + 0x1160], rax
lea rdx, [rbp + 0xe58]
mov rcx, qword [rbp + 0x1160]
call fcn.1400e0be5
mov qword [rbp + 0x1168], rax
mov rax, qword [rbp + 0x1168]
mov qword [rbp + 0x1170], rax
mov rdx, qword [rbp + 0x1170]
lea rcx, [0x14034aaa0]
call fcn.1400e190a
nop
lea rcx, [rbp + 0xe58]
call fcn.1400e0d39
nop
lea rcx, [rbp + 0xe18]
call fcn.1400e41aa
jmp 0x140273569
lea rcx, [rbp + 0x4a8]
call fcn.1400e0663
nop
lea rcx, [rbp + 0x478]
call fcn.1400e0663
nop
lea rcx, [rbp + 0x448]
call fcn.1400e0663
mov dword [rbp + 0x4f4], 0
jmp 0x14027378f
mov eax, dword [rbp + 0x4f4]
inc eax
mov dword [rbp + 0x4f4], eax
movsxd rax, dword [rbp + 0x4f4]
mov qword [rbp + 0x1148], rax
lea rcx, [0x14034aaa0]
call fcn.1400e19b9
mov rcx, qword [rbp + 0x1148]
cmp rcx, rax
jae 0x14027384a
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xe94]
call fcn.1400e2db9
mov qword [rbp + 0x1148], rax
mov eax, dword [rbp + 0x4f4]
cmp dword [0x14033f1d4], eax
jne 0x1402737e9
mov byte [rbp + 0x1150], 1
jmp 0x1402737f0
mov byte [rbp + 0x1150], 0
movsxd rax, dword [rbp + 0x4f4]
mov rdx, rax
lea rcx, [0x14034aaa0]
call fcn.1400e1419
mov rcx, rax
call fcn.1400e06a9
mov qword [rbp + 0x1158], rax
mov r9, qword [rbp + 0x1148]
xor r8d, r8d
movzx edx, byte [rbp + 0x1150]
mov rcx, qword [rbp + 0x1158]
call fcn.1400e404c
movzx eax, al
test eax, eax
je 0x140273845
mov eax, dword [rbp + 0x4f4]
mov dword [0x14033f1d4], eax
jmp 0x140273781
cmp dword [0x14033f1d4], 0xffffffff
je 0x140273880
movsxd rax, dword [0x14033f1d4]
mov rdx, rax
lea rcx, [0x14034aaa0]
call fcn.1400e1419
mov rcx, rax
call fcn.1400e06a9
mov rdx, rax
lea rcx, str.Selected:__s
call fcn.1400e28c8
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xeb4]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Load_Selected
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273916
cmp dword [0x14033f1d4], 0
jl 0x140273916
movsxd rax, dword [0x14033f1d4]
mov qword [rbp + 0x1148], rax
lea rcx, [0x14034aaa0]
call fcn.1400e19b9
mov rcx, qword [rbp + 0x1148]
cmp rcx, rax
jae 0x140273916
movsxd rax, dword [0x14033f1d4]
mov rdx, rax
lea rcx, [0x14034aaa0]
call fcn.1400e1419
mov rdx, rax
lea rcx, [rbp + 0x518]
call fcn.1400e0997
nop
lea rcx, [rbp + 0x518]
call fcn.1400e294a
nop
lea rcx, [rbp + 0x518]
call fcn.1400e0d39
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xed4]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Save_Selected
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x14027398b
cmp dword [0x14033f1d4], 0
jl 0x14027398b
movsxd rax, dword [0x14033f1d4]
mov qword [rbp + 0x1148], rax
lea rcx, [0x14034aaa0]
call fcn.1400e19b9
mov rcx, qword [rbp + 0x1148]
cmp rcx, rax
jae 0x14027398b
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e3d8b
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e0910
movzx eax, al
test eax, eax
je 0x140273a72
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e25f3
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0xef4]
call fcn.1400e2db9
lea rdx, [rbp + 0xef4]
lea rcx, [0x1402e1730]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x1402739e8
call fcn.1400e2f3f
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0xf14]
call fcn.1400e2db9
lea rdx, [rbp + 0xf14]
lea rcx, [0x1402e172c]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273a6d
movsxd rax, dword [0x14033f1d4]
mov rdx, rax
lea rcx, [0x14034aaa0]
call fcn.1400e1419
mov rdx, rax
lea rcx, [rbp + 0x558]
call fcn.1400e0997
nop
lea rcx, [rbp + 0x558]
call fcn.1400e2b93
call fcn.1400e2f3f
nop
lea rcx, [rbp + 0x558]
call fcn.1400e0d39
call fcn.1400e18ab
call fcn.1400e4524
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xf34]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Delete_Selected
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273adc
cmp dword [0x14033f1d4], 0
jl 0x140273adc
movsxd rax, dword [0x14033f1d4]
mov qword [rbp + 0x1148], rax
lea rcx, [0x14034aaa0]
call fcn.1400e19b9
mov rcx, qword [rbp + 0x1148]
cmp rcx, rax
jae 0x140273adc
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e3d8b
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e0910
movzx eax, al
test eax, eax
je 0x140273d02
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e25f3
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0xf54]
call fcn.1400e2db9
lea rdx, [rbp + 0xf54]
lea rcx, [0x1402e1730]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273b39
call fcn.1400e2f3f
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0xf74]
call fcn.1400e2db9
lea rdx, [rbp + 0xf74]
lea rcx, [0x1402e172c]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273cfd
movsxd rax, dword [0x14033f1d4]
mov rdx, rax
lea rcx, [0x14034aaa0]
call fcn.1400e1419
mov rdx, rax
lea rcx, [rbp + 0x598]
call fcn.1400e0997
nop
lea r8, [0x140309efc]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0xf98]
call fcn.1400e38ae
mov qword [rbp + 0x1148], rax
mov rax, qword [rbp + 0x1148]
mov qword [rbp + 0x1150], rax
lea r8, [rbp + 0x598]
mov rdx, qword [rbp + 0x1150]
lea rcx, [rbp + 0x5d8]
call fcn.1400e187e
nop
lea rcx, [rbp + 0xf98]
call fcn.1400e0d39
lea rcx, [rbp + 0x5d8]
call fcn.1400e06a9
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
jne 0x140273cde
lea rax, [rbp + 0xfd8]
mov qword [rbp + 0x1008], rax
lea rdx, [rbp + 0x1028]
lea rcx, [0x14034aaa0]
call fcn.1400e125c
mov qword [rbp + 0x1148], rax
mov rax, qword [rbp + 0x1148]
mov qword [rbp + 0x1150], rax
movsxd rax, dword [0x14033f1d4]
mov qword [rbp + 0x1158], rax
mov r8, qword [rbp + 0x1158]
lea rdx, [rbp + 0x1058]
mov rcx, qword [rbp + 0x1150]
call fcn.1400e2c15
mov qword [rbp + 0x1160], rax
mov rdx, qword [rbp + 0x1160]
mov rcx, qword [rbp + 0x1008]
call fcn.1400e0fb9
mov qword [rbp + 0x1168], rax
mov r8, qword [rbp + 0x1168]
lea rdx, [rbp + 0x1088]
lea rcx, [0x14034aaa0]
call fcn.1400e3a70
lea rcx, [rbp + 0x1088]
call fcn.1400e0555
lea rcx, [rbp + 0x1058]
call fcn.1400e0555
lea rcx, [rbp + 0x1028]
call fcn.1400e0555
mov dword [0x14033f1d4], 0xffffffff
call fcn.1400e2f3f
nop
lea rcx, [rbp + 0x5d8]
call fcn.1400e0d39
nop
lea rcx, [rbp + 0x598]
call fcn.1400e0d39
call fcn.1400e18ab
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x10b4]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Reset_Config
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273d48
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e3d8b
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e0910
movzx eax, al
test eax, eax
je 0x140273df5
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e25f3
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0x10d4]
call fcn.1400e2db9
lea rdx, [rbp + 0x10d4]
lea rcx, [0x1402e1730]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273da5
call fcn.1400e2f3f
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
movss xmm1, dword [0x140303a40]
lea rcx, [rbp + 0x10f4]
call fcn.1400e2db9
lea rdx, [rbp + 0x10f4]
lea rcx, [0x1402e172c]
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273df0
call fcn.1400e2b70
call fcn.1400e2f3f
call fcn.1400e18ab
movss xmm1, dword [0x1402cb518]
xorps xmm0, xmm0
call fcn.1400e2f76
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x1114]
call fcn.1400e2db9
mov rdx, rax
lea rcx, str.Open_Directory
call fcn.1400e17ca
movzx eax, al
test eax, eax
je 0x140273ede
xor r8d, r8d
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x618]
call fcn.1400e3935
nop
lea rcx, [rbp + 0x618]
call fcn.1400e20a8
movzx eax, al
test eax, eax
je 0x140273ed1
lea rcx, [rbp + 0x618]
call fcn.1400e05cd
movzx eax, al
test eax, eax
je 0x140273ed1
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x618]
call fcn.1400e0be5
nop
lea r8, [rbp + 0x658]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x698]
call fcn.1400e0311
lea rcx, [rbp + 0x698]
call fcn.1400e06a9
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x6d4], eax
lea rcx, [rbp + 0x698]
call fcn.1400e0d39
nop
lea rcx, [rbp + 0x658]
call fcn.1400e0d39
nop
lea rcx, [rbp + 0x618]
call fcn.1400e41aa
nop
lea rcx, [rbp + 0x3e8]
call fcn.1400e0d39
nop
lea rcx, [rbp + 0x3a8]
call fcn.1400e0d39
lea rcx, [rbp - 0x40]
lea rdx, [0x1403091b0]
call fcn.1400e3bce
mov rcx, qword [rbp + 0x1178]
xor rcx, rbp
call fcn.1400e22b5
lea rsp, [rbp + 0x1188]
pop rdi
pop rbp
ret