Function at 0x1400b88a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xa20
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0xa10], rax
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3220
call fcn.1400baaf0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x7f0]
call fcn.140141ad0
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0xb0]
add r8, 0x2e10
mov edx, 0x104
lea rcx, [rsp + 0x7f0]
call fcn.140156f18
lea rcx, [rsp + 0x7f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
cmp dword [rcx + 0x8000], r12d
jne 0x1400b8c1f
lea rdx, [rsp + 0x7f0]
lea rcx, [rsp + 0xe0]
call fcn.140022180
nop
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x160]
call fcn.140141ad0
lea rdx, [0x1402138f8]
lea rcx, [rsp + 0x80]
call fcn.140022180
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.140022660
nop
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400230c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400b89d9
mov rax, qword [rax]
lea rdx, [rsp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0xc0]
call fcn.1400091f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400091f0
nop
lea rcx, [rsp + 0x80]
call fcn.1400091f0
or r15, 0xffffffffffffffff
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.1400b71b0
cmp rbx, r15
je 0x1400b8c02
nop word [rax + rax]
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0x80]
call fcn.140022180
nop
lea rdx, [0x140285d2c]
lea rcx, [rsp + 0x120]
call fcn.140022180
nop
or edi, 1
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x80]
call fcn.1400225f0
test al, al
jne 0x1400b8ac5
lea rdx, [0x1402895a4]
lea rcx, [rsp + 0x100]
call fcn.140022180
nop
or edi, 2
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x80]
call fcn.1400225f0
test al, al
jne 0x1400b8ac5
xor r14b, r14b
jmp 0x1400b8ac8
mov r14b, 1
test dil, 2
je 0x1400b8ae3
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x100]
call fcn.1400091f0
nop
test dil, 1
je 0x1400b8afd
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x120]
call fcn.1400091f0
test r14b, r14b
je 0x1400b8b07
jmp 0x1400b8bdc
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0xc0]
call fcn.140022180
nop
lea rdx, [0x1402869a8]
lea rcx, [rsp + 0xa0]
call fcn.140022180
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.140022660
nop
lea r8, [rsp + 0xc0]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140022660
nop
lea rcx, [rsp + 0x140]
call fcn.1400091f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400091f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400091f0
lea rcx, [rsp + 0x60]
call fcn.140022a60
mov rcx, rax
call fcn.1400fafb0
test eax, eax
je 0x1400b8bd1
lea rcx, [rsp + 0x60]
call fcn.140022a60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8bd1
lea rcx, [rsp + 0x60]
call fcn.140022a60
mov rcx, rax
xor edx, edx
call fcn.1400fd640
nop
lea rcx, [rsp + 0x60]
call fcn.1400091f0
nop
lea rcx, [rsp + 0x80]
call fcn.1400091f0
lea rdx, [rsp + 0x160]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400b8a40
lea rcx, [rsp + 0x38]
call fcn.1400b71b0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400091f0
jmp 0x1400b94d2
mov rcx, qword [rsi + 0x38]
call fcn.1400a4e50
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400b7050
nop
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x1400b8c8b
mov rcx, rbx
call fcn.140022a60
mov rcx, rax
call fcn.1400fafb0
test eax, eax
je 0x1400b8c85
mov rcx, rbx
call fcn.140022a60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8c85
mov rcx, rbx
call fcn.140022a60
mov rcx, rax
xor edx, edx
call fcn.1400fd640
add rbx, 0x20
jmp 0x1400b8c40
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2e10
call fcn.1400fafb0
test eax, eax
je 0x1400b8cdb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2e10
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8cdb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2e10
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1428
call fcn.1400fafb0
test eax, eax
je 0x1400b8d2b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1428
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8d2b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1428
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x152c
call fcn.1400fafb0
test eax, eax
je 0x1400b8d7b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x152c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8d7b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x152c
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3428
call fcn.1400fafb0
test eax, eax
je 0x1400b8dcb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3428
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8dcb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3428
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x7f8
call fcn.1400fafb0
test eax, eax
je 0x1400b8e1b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x7f8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8e1b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x7f8
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x8fc
call fcn.1400fafb0
test eax, eax
je 0x1400b8e6b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x8fc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8e6b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x8fc
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa00
call fcn.1400fafb0
test eax, eax
je 0x1400b8ebb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa00
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8ebb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa00
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xb04
call fcn.1400fafb0
test eax, eax
je 0x1400b8f0b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xb04
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8f0b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xb04
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xc08
call fcn.1400fafb0
test eax, eax
je 0x1400b8f5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xc08
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8f5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xc08
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xd0c
call fcn.1400fafb0
test eax, eax
je 0x1400b8fab
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xd0c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8fab
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xd0c
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xe10
call fcn.1400fafb0
test eax, eax
je 0x1400b8ffb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xe10
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b8ffb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xe10
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1324
call fcn.1400fafb0
test eax, eax
je 0x1400b904b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1324
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b904b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1324
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9758
call fcn.1400fafb0
test eax, eax
je 0x1400b909b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9758
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b909b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9758
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3734
call fcn.1400fafb0
test eax, eax
je 0x1400b90eb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3734
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b90eb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3734
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3838
call fcn.1400fafb0
test eax, eax
je 0x1400b913b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3838
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b913b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3838
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x311c
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x311c
call fcn.1400fafb0
test eax, eax
je 0x1400b9187
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x311c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3e8
call fcn.1400fafb0
test eax, eax
je 0x1400b91d7
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3e8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b91d7
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3e8
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3018
call fcn.1400fafb0
test eax, eax
je 0x1400b9227
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3018
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9227
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x3018
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x352c
call fcn.1400fafb0
test eax, eax
je 0x1400b9277
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x352c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9277
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x352c
xor edx, edx
call fcn.1400fd640
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5d0]
call fcn.140141ad0
lea r9, str.clntprxy.dll
lea r8, [rsp + 0x7f0]
lea rdx, [0x140213910]
lea rcx, [rsp + 0x5d0]
call fcn.1400a61e0
lea rcx, [rsp + 0x5d0]
call fcn.1400fafb0
test eax, eax
je 0x1400b92ce
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r9, str.clntprxyio.dll
lea r8, [rsp + 0x7f0]
lea rdx, [0x140213910]
lea rcx, [rsp + 0x5d0]
call fcn.1400a61e0
lea rcx, [rsp + 0x5d0]
call fcn.1400fafb0
test eax, eax
je 0x1400b9310
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa7cc
call fcn.1400fafb0
test eax, eax
je 0x1400b9360
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa7cc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9360
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa7cc
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x5f0
call fcn.1400fafb0
test eax, eax
je 0x1400b93b1
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x5f0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b93b1
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x5f0
xor edx, edx
call fcn.1400fd640
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b94ce
mov rdi, qword [rsp + 0x68]
mov rbx, rcx
mov qword [rsp + 0x50], rcx
nop dword [rax]
cmp rbx, rdi
je 0x1400b945b
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x1400b942a
mov rcx, qword [rbx]
inc rax
cmp rax, 0x1000
jb 0x1400b9425
test cl, 0x1f
je 0x1400b93fb
call fcn.14014b4d8
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400b9409
call fcn.14014b4d8
sub rcx, rax
cmp rcx, 8
jae 0x1400b9417
call fcn.14014b4d8
cmp rcx, 0x27
jbe 0x1400b9422
call fcn.14014b4d8
mov rcx, rax
call fcn.1400dbae0
mov qword [rbx + 0x18], reloc.WSOCK32.dll_ntohs
mov qword [rbx + 0x10], r12
cmp qword [rbx + 0x18], 0x10
jb 0x1400b9442
mov rax, qword [rbx]
jmp 0x1400b9445
mov rax, rbx
mov byte [rax], 0
add rbx, 0x20
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x60]
jmp 0x1400b93d0
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 5
movabs rdx, 0x7ffffffffffffff
cmp rax, rdx
jbe 0x1400b947b
call fcn.14014b4d8
shl rax, 5
cmp rax, 0x1000
jb 0x1400b94bb
test cl, 0x1f
je 0x1400b9491
call fcn.14014b4d8
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400b949f
call fcn.14014b4d8
sub rcx, rax
cmp rcx, 8
jae 0x1400b94ad
call fcn.14014b4d8
cmp rcx, 0x27
jbe 0x1400b94b8
call fcn.14014b4d8
mov rcx, rax
call fcn.1400dbae0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
or r15, 0xffffffffffffffff
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbfc
call fcn.1400fafb0
test eax, eax
je 0x1400b9522
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbfc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9522
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbfc
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcaf8
call fcn.1400fafb0
test eax, eax
je 0x1400b9572
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcaf8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9572
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcaf8
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x311c
mov edx, 0x5c
call fcn.1401421b8
mov rdi, rax
test rax, rax
je 0x1400b9749
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400b95a0
cmp rcx, 5
jb 0x1400b9749
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x247c
mov edx, 0x5c
call fcn.1401421b8
mov rbx, rax
test rax, rax
je 0x1400b9749
nop dword [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x1400b95e0
cmp r15, 5
jb 0x1400b9749
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x160]
call fcn.140141ad0
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rsp + 0x160]
call fcn.1400f7c20
lea rcx, [rsp + 0x160]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400b9640
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400b9650
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x4c0]
call fcn.140141ad0
movzx eax, byte [rsp + r12 + 0x160]
mov byte [rsp + r12 + 0x4c0], al
lea r12, [r12 + 1]
test al, al
jne 0x1400b9675
lea rcx, [rsp + 0x4c0]
call fcn.1400f7c20
lea rcx, [rsp + 0x4c0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400b96a7
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400b96c0
xor edx, edx
lea rcx, [rsp + 0x4c0]
call fcn.1400fd640
lea rcx, [rsp + 0x4c0]
call fcn.1400fafb0
test eax, eax
je 0x1400b96fe
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x4c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x140211378]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x160]
call fcn.1400fd640
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
lea rdx, [rsp + 0x2a0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x1400b9770
mov edx, 0x2e
lea rcx, [rsp + 0x2a0]
call fcn.1401421b8
mov rbx, rax
test rax, rax
je 0x1400b98af
mov ecx, dword [str..hlp]
mov dword [rax], ecx
movzx ecx, byte [0x14020ef4c]
mov byte [rax + 4], cl
lea rcx, [rsp + 0x2a0]
call fcn.1400fafb0
test eax, eax
je 0x1400b97e3
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b97e3
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.1400fd640
mov eax, dword [str..cnt]
mov dword [rbx], eax
movzx eax, byte [0x14020ef54]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.1400fafb0
test eax, eax
je 0x1400b9827
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9827
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.1400fd640
mov eax, dword [str..chm]
mov dword [rbx], eax
movzx eax, byte [0x14020ef5c]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.1400fafb0
test eax, eax
je 0x1400b986b
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b986b
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.1400fd640
mov eax, dword [str..gid]
mov dword [rbx], eax
movzx eax, byte [0x14020ef64]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.1400fafb0
test eax, eax
je 0x1400b98af
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b98af
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
lea rdx, [rsp + 0x6e0]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x1400b98d0
mov edx, 0x5c
lea rcx, [rsp + 0x6e0]
call fcn.1401421b8
test rax, rax
je 0x1400b98fb
mov byte [rax], 0
lea rcx, [rsp + 0x6e0]
call fcn.1400f7c20
lea rcx, [rsp + 0x6e0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400b9913
movsd xmm0, qword [str.SpectorCNE.chm]
movsd qword [rcx], xmm0
mov eax, dword [0x140213930]
mov dword [rcx + 8], eax
movzx eax, word [0x140213934]
mov word [rcx + 0xc], ax
movzx eax, byte [0x140213936]
mov byte [rcx + 0xe], al
lea rcx, [rsp + 0x6e0]
call fcn.1400fafb0
test eax, eax
je 0x1400b9978
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b9978
xor edx, edx
lea rcx, [rsp + 0x6e0]
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
call fcn.1400fafb0
test eax, eax
je 0x1400b99c8
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b99c8
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
xor edx, edx
call fcn.1400fd640
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x8918
cmp byte [rcx], 0
je 0x1400b99e6
xor edx, edx
call fcn.1400fadf0
lea rax, [rsp + 0x900]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsi + 0x10]
call fcn.1400ba380
nop
mov rcx, qword [rax]
lea rdx, [rsp + 0x3b0]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x1400b9a20
lea rcx, [rsp + 0x38]
call fcn.1400f81a0
mov edx, 0x5c
lea rcx, [rsp + 0x3b0]
call fcn.1401421b8
test rax, rax
je 0x1400b9a55
mov byte [rax], 0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
call fcn.140156fb4
test eax, eax
je 0x1400b9ab9
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x140211378]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x3b0]
call fcn.1400fd640
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2f14
lea r8, [rsp + 0x3b0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8], al
lea rcx, [rcx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x1400b9ae0
mov edx, 0x5c
lea rcx, [rsp + 0x3b0]
call fcn.1401421b8
test rax, rax
je 0x1400b9b0c
mov byte [rax], 0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
call fcn.140156fb4
test eax, eax
je 0x1400b9b70
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x140211378]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x3b0]
call fcn.1400fd640
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, 1
mov dword [rsp + 0x34], eax
jmp 0x1400b9b7f
mov rcx, qword [rsp + 0xa10]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0xa20]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret