Function at 0x401cf0
Capabilities:
Check if file exists
Delete file
Encode data using xor
Get common file path
Move file

Disassembly:
mov rax, rsp
sub rsp, 0xd78
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0xd30], rax
mov rdi, rdx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov rcx, r12
mov rdx, r12
test r8d, r8d
jle 0x401d7d
movsxd rsi, r8d
lea r8, str.GUANGSU
nop
nop
nop
movzx eax, byte [rdx + r8]
xor byte [rcx + rdi], al
add rdx, 1
cmp rdx, 7
cmovge rdx, r12
add rcx, 1
cmp rcx, rsi
jl 0x401d60
lea rcx, [rsp + 0x40]
call fcn.00421300
nop
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00424620
lea rdx, str.TheQueryInfo
lea rcx, [rsp + 0x40]
call fcn.004206d0
mov rbx, rax
test rax, rax
jne 0x401dfb
test rdi, rdi
je 0x401dc5
mov rcx, rdi
call fcn.0040bb10
nop
lea rax, [0x0042b518]
mov qword [rsp + 0x40], rax
lea rax, [0x00439148]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x401dea
call fcn.0040b6e0
lea rcx, [rsp + 0x40]
call fcn.00420f30
xor eax, eax
jmp 0x402b32
mov ecx, 0x5190
call fcn.0040b560
mov rbp, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x401e59
mov esi, 0x13
lea rdi, [rax + 0x20c]
nop
mov dword [rdi - 0x20c], r12d
lea rcx, [rdi - 0x208]
xor edx, edx
mov r8d, 0x208
call fcn.0040bb30
xor edx, edx
mov r8d, 0x208
mov rcx, rdi
call fcn.0040bb30
add rdi, 0x414
sub esi, 1
jns 0x401e20
jmp 0x401e61
mov rbp, r12
mov qword [rsp + 0x20], r12
mov word [rsp + 0x550], 0
xor edx, edx
mov r8d, 0x3e6
lea rcx, [rsp + 0x552]
call fcn.0040bb30
lea rdx, str.PushList
mov rcx, rbx
call fcn.004206d0
mov r13d, r12d
test rax, rax
je 0x402002
mov rcx, rax
call fcn.00420690
mov rbx, rax
test rax, rax
je 0x402002
mov r12, rbp
mov rbp, r12
add r13d, 1
add r12, 0x414
lea rdx, str.InstallRunExe
mov rcx, rbx
call fcn.004206d0
test rax, rax
je 0x401f31
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x401f31
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x401f31
mov rcx, qword [rax + 0x38]
add rcx, 0x10
lea rdx, [rsp + 0x550]
call fcn.00409d70
lea rdx, [rsp + 0x550]
lea rax, [rsp + 0x550]
mov rcx, rbp
sub rcx, rax
nop
nop
nop
nop
movzx eax, word [rdx]
mov word [rcx + rdx + 4], ax
add rdx, 2
test ax, ax
jne 0x401f20
lea rdx, str.InstallRunParam
mov rcx, rbx
call fcn.004206d0
test rax, rax
je 0x401fa4
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x401fa4
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x401fa4
mov rcx, qword [rax + 0x38]
add rcx, 0x10
lea rdx, [rsp + 0x550]
call fcn.00409d70
lea rdx, [rsp + 0x550]
lea rax, [rsp + 0x550]
mov rcx, rbp
sub rcx, rax
nop
nop
nop
movzx eax, word [rdx]
mov word [rcx + rdx + 0x20c], ax
add rdx, 2
test ax, ax
jne 0x401f90
lea rdx, str.InstallRunFullPath
mov rcx, rbx
call fcn.004206d0
test rax, rax
je 0x401feb
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x401feb
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x401feb
mov rsi, qword [rax + 0x38]
add rsi, 0x10
lea rdi, str.true
mov ecx, 5
repe cmpsb byte [rsi], byte [rdi]
jne 0x401feb
mov dword [rbp], 1
mov rcx, rbx
call fcn.004207b0
mov rbx, rax
test rax, rax
jne 0x401eb2
xor r12d, r12d
mov word [rsp + 0x130], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x132]
call fcn.0040bb30
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x5c
lea rcx, [rsp + 0x130]
call fcn.0040b6b0
mov word [rax + 2], 0
lea rdx, [rsp + 0x130]
lea rcx, str.szModuleName::_s
call fcn.0040a0c0
mov word [rsp + 0x340], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x342]
call fcn.0040bb30
lea rdx, [rsp + 0x340]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x340]
lea rcx, str.szTempPath::_s
call fcn.0040a0c0
mov r14, r12
test r13d, r13d
jle 0x402afe
movsxd r15, r13d
movabs rdx, 0x7ffffffffffffffe
mov r13, r14
imul r13, r13, 0x414
add r13, qword [rsp + 0x20]
mov esi, 7
mov qword [rsp + 0xd0], rsi
mov r8, r12
mov qword [rsp + 0xc8], r12
mov word [rsp + 0xb8], 0
cmp dword [r13], 0
je 0x40223c
lea rbx, [r13 + 4]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
lea rax, [rsp + 0xb8]
cmp rbx, rax
jb 0x40216a
lea rax, [rsp + 0xb8]
cmp rax, rbx
jbe 0x40216a
lea rax, [rsp + 0xb8]
mov r8, rbx
sub r8, rax
sar r8, 1
mov r9, rcx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.004016f0
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
cmp rcx, rdx
jbe 0x402184
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x4021a3
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.004014f0
mov rsi, qword [rsp + 0xd0]
jmp 0x4021d5
test rbp, rbp
jne 0x4021d5
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bp
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
test rbp, rbp
je 0x402699
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
lea rdi, [rbp + rbp]
lea rdx, [rsi + rsi]
mov r9, rdi
mov r8, rbx
call fcn.0040b6f0
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rdi], 0
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
lea rcx, [rsp + 0x130]
lea rax, [rsp + 0xb8]
cmp rcx, rax
jb 0x4022c4
lea rcx, [rsp + 0xb8]
lea rax, [rsp + 0x130]
cmp rcx, rax
jbe 0x4022c4
lea r8, [rsp + 0x130]
lea rax, [rsp + 0xb8]
sub r8, rax
sar r8, 1
mov r9, rbx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.004016f0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x4023a6
cmp rbx, rdx
jbe 0x4022de
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbx
jae 0x402305
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.004014f0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x40233c
test rbx, rbx
jne 0x40233c
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bx
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x4023a6
test rbx, rbx
je 0x4023a6
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
lea rdi, [rbx + rbx]
lea rdx, [rsi + rsi]
mov r9, rdi
lea r8, [rsp + 0x130]
call fcn.0040b6f0
mov qword [rsp + 0xc8], rbx
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rdi], 0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
lea rbx, [r13 + 4]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
lea rax, [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
cmp rbx, rax
jb 0x40257a
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
lea rax, [rax + r8*2]
cmp rax, rbx
jbe 0x40257a
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
mov r12, rbx
sub r12, rax
sar r12, 1
cmp r8, r12
jae 0x402431
call fcn.0040b490
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
mov rax, r8
sub rax, r12
cmp rax, rdi
cmovb rdi, rax
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x402456
lea rax, [r8 + rdi]
cmp rax, r8
jae 0x40246b
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
test rdi, rdi
je 0x402696
lea rbp, [r8 + rdi]
movabs rax, 0x7ffffffffffffffe
cmp rbp, rax
jbe 0x40249c
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x4024c3
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.004014f0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x4024f9
test rbp, rbp
jne 0x4024f9
xor r12d, r12d
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], r12w
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
test rbp, rbp
je 0x402691
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
cmp rsi, 8
cmovae rdx, rcx
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
sub rsi, r8
lea rcx, [rax + r8*2]
lea r9, [rdi + rdi]
lea r8, [rdx + r12*2]
lea rdx, [rsi + rsi]
call fcn.0040b6f0
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rbp*2], 0
mov rsi, qword [rsp + 0xd0]
xor r12d, r12d
jmp 0x402699
mov rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x402592
lea rax, [r8 + rdi]
cmp rax, r8
jae 0x4025a7
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
test rdi, rdi
je 0x402699
lea rbp, [r8 + rdi]
movabs rax, 0x7ffffffffffffffe
cmp rbp, rax
jbe 0x4025d8
call fcn.0040b3c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x4025ff
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.004014f0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x40262e
test rbp, rbp
jne 0x40262e
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bp
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
test rbp, rbp
je 0x402699
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
sub rsi, r8
lea rcx, [rax + r8*2]
lea r9, [rdi + rdi]
lea rdx, [rsi + rsi]
mov r8, rbx
call fcn.0040b6f0
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rbp*2], 0
mov rsi, qword [rsp + 0xd0]
jmp 0x402699
xor r12d, r12d
jmp 0x402699
xor r12d, r12d
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402acf
mov edx, 7
mov qword [rsp + 0xf8], rdx
mov r8, r12
mov qword [rsp + 0xf0], r12
mov word [rsp + 0xe0], 0
cmp dword [r13], 0
je 0x402814
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
lea rax, [rsp + 0xe0]
cmp rbx, rax
jb 0x40274a
lea rax, [rsp + 0xe0]
cmp rax, rbx
jbe 0x40274a
lea rax, [rsp + 0xe0]
sub rbx, rax
sar rbx, 1
mov r9, rcx
mov r8, rbx
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xd8]
call fcn.004016f0
jmp 0x4028c3
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x40276e
call fcn.0040b3c0
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0xf0]
cmp rdx, rsi
jae 0x40278d
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call fcn.004014f0
mov rdx, qword [rsp + 0xf8]
jmp 0x4027b7
test rsi, rsi
jne 0x4027b7
mov qword [rsp + 0xf0], r12
lea rax, [rsp + 0xe0]
cmp rdx, 8
cmovae rax, qword [rsp + 0xe0]
mov word [rax], si
jmp 0x4028c3
test rsi, rsi
je 0x4028c3
lea rcx, [rsp + 0xe0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xe0]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, rbx
call fcn.0040b6f0
mov qword [rsp + 0xf0], rsi
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rax, qword [rsp + 0xe0]
mov word [rax + rdi], 0
jmp 0x4028c3
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x340]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0xd8]
call fcn.00401bc0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.00401a50
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
call fcn.00409ec0
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], r12
mov word [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x0042b614]
lea rcx, [rsp + 0x100]
call fcn.00401bc0
nop
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [r13 + 0x20c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jne 0x402938
lea r9, [rax - 1]
xor r8d, r8d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x100]
call fcn.00401900
jmp 0x4029d7
mov r8d, 1
lea rdx, [0x0042b610]
lea rcx, [rsp + 0x100]
call fcn.00401a50
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x100]
call fcn.00401a50
mov r8d, 2
lea rdx, [0x0042b608]
lea rcx, [rsp + 0x100]
call fcn.00401a50
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [r13 + 0x20c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [r13 + 0x20c]
lea rcx, [rsp + 0x100]
call fcn.00401a50
mov word [rsp + 0x940], 0
xor edx, edx
mov r8d, 0x3e6
lea rcx, [rsp + 0x942]
call fcn.0040bb30
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x940]
nop
nop
movzx eax, word [rdx]
mov word [rcx], ax
add rdx, 2
add rcx, 2
test ax, ax
jne 0x402a20
lea rdx, [rsp + 0x940]
mov rcx, qword [rsp + 0x28]
call fcn.004010d0
lea rdx, [rsp + 0x940]
lea rcx, str.szValue::_s
call fcn.0040a0c0
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
xor edx, edx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
cmp qword [rsp + 0x120], 8
jb 0x402a98
mov rcx, qword [rsp + 0x108]
call fcn.0040bb10
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], r12
mov word [rsp + 0x108], 0
cmp qword [rsp + 0xf8], 8
jb 0x402acf
mov rcx, qword [rsp + 0xe0]
call fcn.0040bb10
nop
cmp qword [rsp + 0xd0], 8
jb 0x402ae7
mov rcx, qword [rsp + 0xb8]
call fcn.0040bb10
add r14, 1
cmp r14, r15
movabs rdx, 0x7ffffffffffffffe
jl 0x4020c1
lea rax, [0x0042b518]
mov qword [rsp + 0x40], rax
lea rax, [0x00439148]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x402b23
call fcn.0040b6e0
lea rcx, [rsp + 0x40]
call fcn.00420f30
mov eax, 1
mov rcx, qword [rsp + 0xd30]
xor rcx, rsp
call fcn.0040bd10
mov rbx, qword [rsp + 0xd98]
mov rbp, qword [rsp + 0xd70]
mov rsi, qword [rsp + 0xd68]
mov rdi, qword [rsp + 0xd60]
mov r12, qword [rsp + 0xd58]
mov r13, qword [rsp + 0xd50]
mov r14, qword [rsp + 0xd48]
mov r15, qword [rsp + 0xd40]
add rsp, 0xd78
ret