Function at 0x1400060d4
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file
Get common file path
Get comspec environment variable
Get file attributes
Move file
Query environment variable
Self delete
Set current directory
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
mov eax, 0x39d0
call fcn.140012530
sub rsp, rax
mov rax, qword [0x140018280]
xor rax, rsp
mov qword [rsp + 0x39c0], rax
mov r15d, 0x400
lea rdx, [rsp + 0x9c0]
xor ecx, ecx
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x9c0]
lea rcx, [rsp + 0x11c0]
call fcn.140006ee8
lea rcx, [rsp + 0x11c0]
mov edx, 0x5c
call fcn.140007e24
xor r12d, r12d
cmp rax, r12
je 0x1400067ce
lea rcx, [rsp + 0x11c0]
cmp rax, rcx
jbe 0x140006171
cmp byte [rax - 1], 0x3a
jne 0x140006171
mov byte [rax + 1], r12b
jmp 0x140006174
mov byte [rax], r12b
lea rcx, [rsp + 0x11c0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x11c0]
call fcn.140003f08
cmp byte [0x14001bfb0], r12b
jne 0x1400061cc
mov ecx, 0x13f0
call fcn.14000547c
mov ecx, 0x13f3
mov rbx, rax
call fcn.14000547c
mov r9d, 0x10024
mov r8, rbx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1400067ce
lea rdx, [0x140014290]
lea rcx, str.Uninstall.lst
call fcn.140007d7c
mov rdi, rax
cmp rax, r12
jne 0x140006230
mov ecx, 0x13f4
call fcn.14000547c
lea r8, str.Uninstall.lst
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.140007180
mov ecx, 0x13f0
call fcn.14000547c
lea rdx, [rsp + 0xf0]
mov r9d, 0x10010
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400067ce
call fcn.140005b20
lea rcx, [0x14001aa24]
call fcn.140005318
cmp byte [0x14001bfb1], r12b
jne 0x1400067ce
mov esi, 2
lea rbx, str.winrar.gid
lea r13d, [rsi - 1]
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 8
sub rsi, r13
jne 0x14000625e
mov bpl, r12b
lea rcx, [rsp + 0x21c0]
mov r8, rdi
mov edx, 0x800
mov esi, r12d
call fcn.140008aa0
cmp rax, r12
je 0x1400064ef
lea rcx, [rsp + 0x21c0]
call fcn.1400056b0
cmp byte [rsp + 0x21c0], r12b
je 0x1400064ba
lea r9, [rsp + 0x21c0]
lea r8, [rsp + 0x11c0]
lea rdx, str._s_s
lea rcx, [rsp + 0x5c0]
call fcn.140007180
lea rcx, [rsp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0x5c0]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp ebx, 0xffffffff
je 0x14000631d
test bl, 0x10
je 0x14000631d
lea rcx, [rsp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esi, eax
jmp 0x1400064ba
lea rcx, [rsp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, eax
cmp eax, r12d
jne 0x1400064ba
cmp ebx, 0xffffffff
je 0x1400064ba
lea rdx, [rsp + 0x35c0]
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x5c0]
call fcn.140003e30
lea rcx, [rsp + 0x35c0]
mov rbx, rax
call fcn.140003e30
mov rcx, rbx
mov rdx, rax
call fcn.140005680
cmp eax, r12d
je 0x1400064ba
lea rdx, str.Uninstall.lst
mov rcx, rbx
call fcn.140005680
cmp eax, r12d
je 0x1400064ba
mov bpl, r13b
mov ebx, r12d
lea r8, [rsp + 0x5c0]
lea rdx, str._s._d.tmp
lea rcx, [rsp + 0xdc0]
mov r9d, ebx
call fcn.140007180
lea rcx, [rsp + 0xdc0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400063de
add ebx, r13d
cmp ebx, 0x3e8
jl 0x1400063a1
lea rdx, [rsp + 0xdc0]
lea rcx, [rsp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, r12d
jne 0x14000640e
lea rdx, [rsp + 0x5c0]
lea rcx, [rsp + 0xdc0]
call fcn.140006ee8
call fcn.140003dbc
cmp eax, r12d
je 0x140006431
xor edx, edx
lea rcx, [rsp + 0xdc0]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x1400064ba
lea rcx, [rsp + 0x19c0]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x19c0]
call fcn.140003f08
lea rdx, str.wininit.ini
lea rcx, [rsp + 0x19c0]
call fcn.140006ec4
lea rdx, [rsp + 0x29c0]
lea rcx, [rsp + 0xdc0]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, r12d
jne 0x140006496
lea rdx, [rsp + 0xdc0]
lea rcx, [rsp + 0x29c0]
call fcn.140006ee8
lea r9, [rsp + 0x19c0]
lea r8, [rsp + 0x29c0]
lea rdx, [0x140014254]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea rcx, [rsp + 0x21c0]
mov r8, rdi
mov edx, 0x800
call fcn.140008aa0
cmp rax, r12
jne 0x14000629f
cmp esi, r12d
je 0x1400064ef
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400089f0
jmp 0x14000627e
mov rcx, rdi
call fcn.14000798c
lea rcx, str.Uninstall.lst
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp bpl, r12b
je 0x140006534
mov ecx, 0x13f0
call fcn.14000547c
mov ecx, 0x13fa
mov rbx, rax
call fcn.14000547c
mov r9d, 0x10040
mov r8, rbx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [rsp + 0x15c0]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.Uninstall_Rar.Bat
lea rcx, [rsp + 0x15c0]
call fcn.140006ec4
lea rdx, [0x140013e10]
lea rcx, [rsp + 0x15c0]
call fcn.140007d7c
mov rbx, rax
cmp rax, r12
je 0x1400067ce
call fcn.140003dbc
lea r8, [rsp + 0x9c0]
lea rcx, [rsp + 0x1c0]
lea rdx, str.__s___wait_r_n
cmp eax, r12d
jne 0x1400065a1
lea rdx, str.start__wait___s___wait_r_n
call fcn.140007180
lea rcx, [rsp + 0x1c0]
call fcn.14000702c
lea rcx, [rsp + 0x1c0]
mov r9, rbx
mov r8, rax
mov rdx, r13
call fcn.140007ba0
lea rdx, [rsp + 0x2dc0]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea r11, [rsp + 0x9c0]
lea r9, [rsp + 0x2dc0]
lea r8, [rsp + 0x9c0]
lea rdx, str.del___s__r_nrd___s__r_nif_not_exist___s__goto_done_r_n
lea rcx, [rsp + 0x1c0]
mov qword [rsp + 0x20], r11
call fcn.140007180
mov edi, 5
lea rcx, [rsp + 0x1c0]
call fcn.14000702c
lea rcx, [rsp + 0x1c0]
mov r9, rbx
mov r8, rax
mov rdx, r13
call fcn.140007ba0
sub rdi, r13
jne 0x140006610
lea rax, [rsp + 0x15c0]
lea r9, [rsp + 0x9c0]
lea r8, [rsp + 0x9c0]
lea rdx, str.:done_r_nif_exist___s____s___warning_r_ndel___s_
lea rcx, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
call fcn.140007180
lea rcx, [rsp + 0x1c0]
call fcn.14000702c
lea rcx, [rsp + 0x1c0]
mov r9, rbx
mov r8, rax
mov rdx, r13
call fcn.140007ba0
mov rcx, rbx
call fcn.14000798c
lea rdx, [rsp + 0x1dc0]
lea rcx, str.COMSPEC
mov r8d, r15d
mov byte [rsp + 0x1dc0], r12b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rsp + 0x15c0]
lea r8, [rsp + 0x1dc0]
lea rdx, str._s__c___s_
lea rcx, [rsp + 0x31c0]
call fcn.140007180
lea ebx, [rdi + 0x68]
lea rcx, [rsp + 0x60]
mov r8, rbx
xor edx, edx
call fcn.1400078dc
mov dword [rsp + 0x60], ebx
call fcn.140003dbc
cmp eax, r12d
je 0x140006710
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x9c], r13d
mov word [rsp + 0xa0], r12w
jmp 0x140006760
mov qword [rsp + 0x30], r12
lea rcx, [0x140014254]
xor r9d, r9d
mov r8d, r13d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x9c], 0x100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
lea rcx, [0x1400135a8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.140003dbc
lea rdx, [rsp + 0x31c0]
neg eax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
sbb ecx, ecx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
not ecx
mov qword [rsp + 0x38], r12
and ecx, 8
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], ecx
xor ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.140003dbc
cmp eax, r12d
jne 0x1400067ce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x39c0]
xor rcx, rsp
call fcn.140007160
lea r11, [rsp + 0x39d0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret