Function at 0x14001ce30
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140092690]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov edi, r9d
mov rsi, r8
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x50], 0xffffffffffffffff
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], r13d
test rdx, rdx
je 0x14001d246
test r8, r8
je 0x14001d246
mov byte [rsp + 0x2d8], r13b
xor edx, edx
mov r8d, 0x224
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
nop
lea edx, [r13 + 0x14]
lea rcx, [rsp + 0x2e0]
call fcn.14000a6cc
lea r9d, [r13 + 0x29]
lea r8d, [r13 + 0x14]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x2e0]
call fcn.1400396c0
lea r9, [rsp + 0x80]
lea r8d, [r13 + 0x29]
lea rdx, [rsp + 0x2b0]
mov rcx, r15
call fcn.14001b870
mov dword [rsp + 0x284], edi
mov dword [rsp + 0x80], 0x64
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14001cf5a
mov eax, 0x800432a8
jmp 0x14001d24b
mov edx, 0x41
lea rcx, str.__xml_version_1.0___
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str.__xml_version_1.0___
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d238
cmp r14d, dword [rsp + 0x40]
jne 0x14001d238
mov edx, 0x41
lea rcx, str._ExportedProfiles_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str._ExportedProfiles_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d231
cmp r14d, dword [rsp + 0x40]
jne 0x14001d231
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d22a
cmp dword [rsp + 0x40], edi
jne 0x14001d22a
mov edx, 0x41
lea rcx, str.__ExportedProfiles_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdi, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str.__ExportedProfiles_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d223
cmp edi, dword [rsp + 0x40]
jne 0x14001d223
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0xffffffffffffffff
lea rdx, str.temp.txt
mov rcx, r15
call fcn.140019130
mov dword [rsp + 0x2a0], eax
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x58]
call fcn.140008d08
nop
lea r8, str.temp.enc
lea rdx, str.temp.txt
lea rcx, [rsp + 0x58]
call fcn.14000a05c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14001d0f1
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001d24b
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14001d14b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001d24b
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, 0x224
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d212
cmp dword [rsp + 0x40], 0x224
jne 0x14001d212
nop
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov r8d, 0x200
lea rdx, [rsp + 0x300]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001d1d3
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x300]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d1d3
cmp dword [rsp + 0x44], 0x200
je 0x14001d180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
nop
mov eax, 0x43297
jmp 0x14001d24b
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14001d24b
mov eax, 0x800432a9
jmp 0x14001d24b
mov eax, 0x800432aa
jmp 0x14001d24b
mov eax, 0x800432a9
jmp 0x14001d24b
mov eax, 0x800432a9
jmp 0x14001d24b
mov eax, 0x800432b1
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140059ef0
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret