Function at 0x140001c80
Capabilities:
Check if file exists
Delete file
Encode data using xor
Get common file path
Move file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140046620]
xor rax, rsp
mov qword [rsp + 0xd30], rax
mov rdi, rdx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov rcx, r12
mov rdx, r12
test r8d, r8d
jle 0x140001cfd
movsxd rsi, r8d
lea r8, str.GUANGSU
nop
nop
movzx eax, byte [rdx + r8]
xor byte [rcx + rdi], al
add rdx, 1
cmp rdx, 7
cmovge rdx, r12
add rcx, 1
cmp rcx, rsi
jl 0x140001ce0
lea rcx, [rsp + 0x40]
call fcn.140027730
nop
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002aa40
lea rdx, str.TheQueryInfo
lea rcx, [rsp + 0x40]
call fcn.140026b00
mov rbx, rax
test rax, rax
jne 0x140001d7b
test rdi, rdi
je 0x140001d45
mov rcx, rdi
call fcn.14000bf00
nop
lea rax, [0x1400355f8]
mov qword [rsp + 0x40], rax
lea rax, [0x140049428]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x140001d6a
call fcn.14000bb00
lea rcx, [rsp + 0x40]
call fcn.140027360
xor eax, eax
jmp 0x140002a92
mov ecx, 0x5190
call fcn.14000b980
mov rbp, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140001dd9
mov esi, 0x13
lea rdi, [rax + 0x20c]
nop
mov dword [rdi - 0x20c], r12d
lea rcx, [rdi - 0x208]
xor edx, edx
mov r8d, 0x208
call fcn.14000bf20
xor edx, edx
mov r8d, 0x208
mov rcx, rdi
call fcn.14000bf20
add rdi, 0x414
sub esi, 1
jns 0x140001da0
jmp 0x140001de1
mov rbp, r12
mov qword [rsp + 0x20], r12
mov word [rsp + 0x550], 0
xor edx, edx
mov r8d, 0x3e6
lea rcx, [rsp + 0x552]
call fcn.14000bf20
lea rdx, str.PushList
mov rcx, rbx
call fcn.140026b00
mov r13d, r12d
test rax, rax
je 0x140001f82
mov rcx, rax
call fcn.140026ac0
mov rbx, rax
test rax, rax
je 0x140001f82
mov r12, rbp
mov rbp, r12
add r13d, 1
add r12, 0x414
lea rdx, str.InstallRunExe
mov rcx, rbx
call fcn.140026b00
test rax, rax
je 0x140001eb1
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140001eb1
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x140001eb1
mov rcx, qword [rax + 0x38]
add rcx, 0x10
lea rdx, [rsp + 0x550]
call fcn.140009fe0
lea rdx, [rsp + 0x550]
lea rax, [rsp + 0x550]
mov rcx, rbp
sub rcx, rax
nop
nop
nop
nop
movzx eax, word [rdx]
mov word [rcx + rdx + 4], ax
add rdx, 2
test ax, ax
jne 0x140001ea0
lea rdx, str.InstallRunParam
mov rcx, rbx
call fcn.140026b00
test rax, rax
je 0x140001f24
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140001f24
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x140001f24
mov rcx, qword [rax + 0x38]
add rcx, 0x10
lea rdx, [rsp + 0x550]
call fcn.140009fe0
lea rdx, [rsp + 0x550]
lea rax, [rsp + 0x550]
mov rcx, rbp
sub rcx, rax
nop
nop
nop
movzx eax, word [rdx]
mov word [rcx + rdx + 0x20c], ax
add rdx, 2
test ax, ax
jne 0x140001f10
lea rdx, str.InstallRunFullPath
mov rcx, rbx
call fcn.140026b00
test rax, rax
je 0x140001f6b
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140001f6b
mov rax, qword [rcx]
call qword [rax + 0x60]
test rax, rax
je 0x140001f6b
mov rsi, qword [rax + 0x38]
add rsi, 0x10
lea rdi, str.true
mov ecx, 5
repe cmpsb byte [rsi], byte [rdi]
jne 0x140001f6b
mov dword [rbp], 1
mov rcx, rbx
call fcn.140026be0
mov rbx, rax
test rax, rax
jne 0x140001e32
xor r12d, r12d
mov word [rsp + 0x130], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x132]
call fcn.14000bf20
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x5c
lea rcx, [rsp + 0x130]
call fcn.14000bad0
mov word [rax + 2], 0
lea rdx, [rsp + 0x130]
lea rcx, str.szModuleName::_s
call fcn.14000a320
mov word [rsp + 0x340], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x342]
call fcn.14000bf20
lea rdx, [rsp + 0x340]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x340]
lea rcx, str.szTempPath::_s
call fcn.14000a320
mov r14, r12
test r13d, r13d
jle 0x140002a5e
movsxd r15, r13d
movabs rdx, 0x7ffffffffffffffe
mov r13, r14
imul r13, r13, 0x414
add r13, qword [rsp + 0x20]
mov esi, 7
mov qword [rsp + 0xd0], rsi
mov r8, r12
mov qword [rsp + 0xc8], r12
mov word [rsp + 0xb8], 0
cmp dword [r13], 0
je 0x1400021b9
lea rbx, [r13 + 4]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
lea rax, [rsp + 0xb8]
cmp rbx, rax
jb 0x1400020e7
lea rax, [rsp + 0xb8]
cmp rax, rbx
jbe 0x1400020e7
lea rax, [rsp + 0xb8]
mov r8, rbx
sub r8, rax
sar r8, 1
mov r9, rcx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.1400016a0
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
cmp rcx, rdx
jbe 0x140002101
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x140002120
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.1400014c0
mov rsi, qword [rsp + 0xd0]
jmp 0x140002152
test rbp, rbp
jne 0x140002152
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bp
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
test rbp, rbp
je 0x14000260a
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
lea rdi, [rbp + rbp]
lea rdx, [rsi + rsi]
mov r9, rdi
mov r8, rbx
call fcn.14000bb10
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rdi], 0
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
lea rcx, [rsp + 0x130]
lea rax, [rsp + 0xb8]
cmp rcx, rax
jb 0x14000223e
lea rcx, [rsp + 0xb8]
lea rax, [rsp + 0x130]
cmp rcx, rax
jbe 0x14000223e
lea r8, [rsp + 0x130]
lea rax, [rsp + 0xb8]
sub r8, rax
sar r8, 1
mov r9, rbx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.1400016a0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x140002320
cmp rbx, rdx
jbe 0x140002258
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbx
jae 0x14000227f
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.1400014c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x1400022b6
test rbx, rbx
jne 0x1400022b6
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bx
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x140002320
test rbx, rbx
je 0x140002320
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
lea rdi, [rbx + rbx]
lea rdx, [rsi + rsi]
mov r9, rdi
lea r8, [rsp + 0x130]
call fcn.14000bb10
mov qword [rsp + 0xc8], rbx
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rdi], 0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
lea rbx, [r13 + 4]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
lea rax, [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
cmp rbx, rax
jb 0x1400024ee
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
lea rax, [rax + r8*2]
cmp rax, rbx
jbe 0x1400024ee
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
mov r12, rbx
sub r12, rax
sar r12, 1
cmp r8, r12
jae 0x1400023a8
call fcn.14000b8b0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
mov rax, r8
sub rax, r12
cmp rax, rdi
cmovb rdi, rax
or rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x1400023ca
lea rax, [r8 + rdi]
cmp rax, r8
jae 0x1400023df
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
test rdi, rdi
je 0x140002607
lea rbp, [r8 + rdi]
movabs rax, 0x7ffffffffffffffe
cmp rbp, rax
jbe 0x140002410
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x140002437
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.1400014c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x14000246d
test rbp, rbp
jne 0x14000246d
xor r12d, r12d
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], r12w
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
test rbp, rbp
je 0x140002602
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
cmp rsi, 8
cmovae rdx, rcx
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, rcx
sub rsi, r8
lea rcx, [rax + r8*2]
lea r9, [rdi + rdi]
lea r8, [rdx + r12*2]
lea rdx, [rsi + rsi]
call fcn.14000bb10
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rbp*2], 0
mov rsi, qword [rsp + 0xd0]
xor r12d, r12d
jmp 0x14000260a
or rax, 0xffffffffffffffff
sub rax, r8
cmp rax, rdi
jbe 0x140002503
lea rax, [r8 + rdi]
cmp rax, r8
jae 0x140002518
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
test rdi, rdi
je 0x14000260a
lea rbp, [r8 + rdi]
movabs rax, 0x7ffffffffffffffe
cmp rbp, rax
jbe 0x140002549
call fcn.14000b7e0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
cmp rsi, rbp
jae 0x140002570
mov rdx, rbp
lea rcx, [rsp + 0xb0]
call fcn.1400014c0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x14000259f
test rbp, rbp
jne 0x14000259f
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax], bp
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
test rbp, rbp
je 0x14000260a
lea rax, [rsp + 0xb8]
cmp rsi, 8
cmovae rax, qword [rsp + 0xb8]
sub rsi, r8
lea rcx, [rax + r8*2]
lea r9, [rdi + rdi]
lea rdx, [rsi + rsi]
mov r8, rbx
call fcn.14000bb10
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rax, qword [rsp + 0xb8]
mov word [rax + rbp*2], 0
mov rsi, qword [rsp + 0xd0]
jmp 0x14000260a
xor r12d, r12d
jmp 0x14000260a
xor r12d, r12d
lea rcx, [rsp + 0xb8]
cmp rsi, 8
cmovae rcx, qword [rsp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140002a2f
mov edx, 7
mov qword [rsp + 0xf8], rdx
mov r8, r12
mov qword [rsp + 0xf0], r12
mov word [rsp + 0xe0], 0
cmp dword [r13], 0
je 0x140002782
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
lea rax, [rsp + 0xe0]
cmp rbx, rax
jb 0x1400026b8
lea rax, [rsp + 0xe0]
cmp rax, rbx
jbe 0x1400026b8
lea rax, [rsp + 0xe0]
sub rbx, rax
sar rbx, 1
mov r9, rcx
mov r8, rbx
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xd8]
call fcn.1400016a0
jmp 0x14000282b
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x1400026dc
call fcn.14000b7e0
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0xf0]
cmp rdx, rsi
jae 0x1400026fb
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call fcn.1400014c0
mov rdx, qword [rsp + 0xf8]
jmp 0x140002725
test rsi, rsi
jne 0x140002725
mov qword [rsp + 0xf0], r12
lea rax, [rsp + 0xe0]
cmp rdx, 8
cmovae rax, qword [rsp + 0xe0]
mov word [rax], si
jmp 0x14000282b
test rsi, rsi
je 0x14000282b
lea rcx, [rsp + 0xe0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xe0]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, rbx
call fcn.14000bb10
mov qword [rsp + 0xf0], rsi
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rax, qword [rsp + 0xe0]
mov word [rax + rdi], 0
jmp 0x14000282b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x340]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0xd8]
call fcn.140001b50
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.1400019f0
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
call fcn.14000a120
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], r12
mov word [rsp + 0x108], 0
xor r8d, r8d
lea rdx, [0x1400356f4]
lea rcx, [rsp + 0x100]
call fcn.140001b50
nop
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [r13 + 0x20c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jne 0x14000289d
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x100]
call fcn.1400018a0
jmp 0x140002936
mov r8d, 1
lea rdx, [0x1400356f0]
lea rcx, [rsp + 0x100]
call fcn.1400019f0
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x100]
call fcn.1400019f0
mov r8d, 2
lea rdx, [0x1400356e8]
lea rcx, [rsp + 0x100]
call fcn.1400019f0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [r13 + 0x20c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [r13 + 0x20c]
lea rcx, [rsp + 0x100]
call fcn.1400019f0
mov word [rsp + 0x940], 0
xor edx, edx
mov r8d, 0x3e6
lea rcx, [rsp + 0x942]
call fcn.14000bf20
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x940]
nop
nop
nop
movzx eax, word [rdx]
mov word [rcx], ax
add rdx, 2
add rcx, 2
test ax, ax
jne 0x140002980
lea rdx, [rsp + 0x940]
mov rcx, qword [rsp + 0x28]
call fcn.1400010c0
lea rdx, [rsp + 0x940]
lea rcx, str.szValue::_s
call fcn.14000a320
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
xor edx, edx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
cmp qword [rsp + 0x120], 8
jb 0x1400029f8
mov rcx, qword [rsp + 0x108]
call fcn.14000bf00
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], r12
mov word [rsp + 0x108], 0
cmp qword [rsp + 0xf8], 8
jb 0x140002a2f
mov rcx, qword [rsp + 0xe0]
call fcn.14000bf00
nop
cmp qword [rsp + 0xd0], 8
jb 0x140002a47
mov rcx, qword [rsp + 0xb8]
call fcn.14000bf00
add r14, 1
cmp r14, r15
movabs rdx, 0x7ffffffffffffffe
jl 0x140002041
lea rax, [0x1400355f8]
mov qword [rsp + 0x40], rax
lea rax, [0x140049428]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x140002a83
call fcn.14000bb00
lea rcx, [rsp + 0x40]
call fcn.140027360
mov eax, 1
mov rcx, qword [rsp + 0xd30]
xor rcx, rsp
call fcn.14000c100
lea r11, [rsp + 0xd40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret