Function at 0x140012ff4
Capabilities:
Create process on windows
Delete file
Move file
Self delete
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x50], r13d
lea rcx, [rbp + 0xd0]
call fcn.14000aa88
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.1400071f8
nop
lea rcx, [rbp + 0xb0]
call fcn.14000a4ec
lea rcx, [rbp + 0xb0]
call fcn.140006984
test al, al
jne 0x140013987
lea rcx, [rbp + 0xb0]
call fcn.14000ab84
lea rcx, [rbp + 0xb0]
call fcn.14000a3e8
mov ecx, 0x13f6
call fcn.14000dbcc
mov rbx, rax
mov ecx, 0x13f5
call fcn.14000dbcc
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140001b9c
nop
lea r8, str._r_n_r_n
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006c50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140006c50
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x170]
call fcn.140002050
mov esi, 0x13f2
cmp byte [0x140046772], r13b
jne 0x14001315a
mov ecx, esi
call fcn.14000dbcc
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140001b9c
nop
mov dword [rsp + 0x50], 1
lea rcx, [rbp + 0x1d0]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140001b9c
nop
lea edi, [r13 + 3]
mov dword [rsp + 0x50], edi
mov r9d, 0x10024
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011d10
cmp eax, 6
mov bl, 1
jne 0x14001315d
mov bl, r13b
test dil, 2
je 0x140013174
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
test dil, 1
je 0x14001318a
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x30]
call fcn.140002050
test bl, bl
jne 0x14001397a
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
lea rdx, [0x14003d7f4]
lea rcx, [rbp + 0x110]
call fcn.140008880
mov r15, rax
lea rcx, [rbp + 0x110]
call fcn.140002050
test r15, r15
jne 0x140013231
mov ecx, 0x1400
call fcn.14000dbcc
mov rdx, rax
lea r8, str.Uninstall.lst
lea rcx, [rbp - 0x10]
call fcn.14000e34c
nop
mov ecx, esi
call fcn.14000dbcc
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
mov r9d, 0x10010
lea r8, [rbp + 0x110]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011d10
nop
lea rcx, [rbp + 0x110]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
jmp 0x140013974
mov ecx, 0x1406
call fcn.14000dbcc
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140001b9c
nop
mov ecx, esi
call fcn.14000dbcc
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140001b9c
nop
call fcn.1400139d0
lea rcx, [0x140046771]
call fcn.14000d960
cmp byte [0x140046773], r13b
jne 0x140013960
mov r12b, r13b
mov r14d, r13d
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a7c
test rax, rax
je 0x14001356f
lea rcx, [rbp - 0x30]
call fcn.1400024c0
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x170]
call fcn.14000e988
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x170]
call fcn.14000edf0
nop
lea rcx, [rbp + 0x170]
call fcn.14000d828
lea rcx, [rbp - 0x30]
call fcn.14000df68
lea rcx, [rbp - 0x30]
call fcn.140006984
test al, al
jne 0x140013532
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.14000af18
nop
lea rcx, [rbp + 0x50]
call fcn.140008650
mov ebx, eax
lea rcx, [rbp + 0x50]
call fcn.1400086d8
cmp ebx, 0xffffffff
je 0x14001333f
test bl, 0x10
je 0x14001333f
lea rcx, [rbp + 0x50]
call fcn.1400087f4
movzx eax, al
add r14d, eax
jmp 0x140013528
lea rcx, [rbp + 0x50]
call fcn.140008768
movzx ecx, al
add r14d, ecx
test al, al
jne 0x140013528
cmp ebx, 0xffffffff
je 0x140013528
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000a27c
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1f0]
call fcn.14000a27c
nop
or edi, 4
mov dword [rsp + 0x50], edi
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007088
test eax, eax
je 0x1400133c3
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
or edi, 8
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140007088
test eax, eax
mov bl, 1
jne 0x1400133c6
mov bl, r13b
test dil, 8
je 0x1400133dd
and edi, 0xfffffff7
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
test dil, 4
je 0x1400133f6
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x1f0]
call fcn.140002050
test bl, bl
je 0x14001351e
mov r12b, 1
lea rcx, [rbp + 0x90]
call fcn.1400024c0
nop
mov esi, r13d
mov edx, esi
lea rcx, [rbp + 0x30]
call fcn.140008fac
mov rbx, rax
lea r8, [0x14003c260]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140006bd4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.1400089b4
nop
lea r8, str..tmp
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140006c50
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140006a5c
nop
lea rcx, [rbp + 0x210]
call fcn.140002050
nop
lea rcx, [rbp + 0x230]
call fcn.140002050
nop
lea rcx, [rbp + 0x250]
call fcn.140002050
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x90]
call fcn.140008650
cmp eax, 0xffffffff
je 0x1400134c0
inc esi
cmp esi, 0x3e8
jb 0x140013411
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1400018c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400134f5
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.1400070b0
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbp + 0x90]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x50]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.140002050
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a7c
test rax, rax
jne 0x1400132a3
test r14d, r14d
je 0x14001356f
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140020cf4
jmp 0x140013283
mov rcx, r15
call fcn.14001fa48
lea rcx, str.Uninstall.lst
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x150]
call fcn.1400024c0
nop
lea rcx, [rbp + 0x150]
call fcn.140013e44
lea rcx, [rbp + 0x150]
call fcn.140008620
test al, al
je 0x1400135b9
lea rcx, [rbp + 0x150]
call fcn.14000623c
lea rcx, [rbp + 0xf0]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xf0]
call fcn.14000aba0
test r12b, r12b
je 0x140013661
cmp byte [0x140046772], r13b
jne 0x140013661
mov r9d, 0x10040
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call fcn.140011d10
lea rdx, [0x14003b400]
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x30]
call fcn.14000a27c
nop
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.140007088
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.140002050
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
test ebx, ebx
jne 0x140013661
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rbp + 0x30]
call fcn.140011410
nop
lea r8, str.Uninstall_Rar.Bat
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140006c50
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x70]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rdx, str.__s___wait_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e34c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a54
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
mov ebx, 5
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov qword [rsp + 0x20], r8
mov r9, rax
lea rdx, str.del___s__r_nrd___s__r_nif_not_exist___s__goto_done_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e34c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a54
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
sub rbx, 1
jne 0x1400136d0
lea rdx, str.:done_r_n
lea rcx, [rbp + 0x70]
call fcn.140006a4c
cmp byte [0x140046772], r13b
jne 0x140013772
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r9, rax
mov r8, rax
lea rdx, str.if_exist___s____s___warning_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e34c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a54
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r8, rax
lea rdx, str.del___s__r_n
lea rcx, [rbp + 0x30]
call fcn.14000e34c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a54
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x270]
call fcn.1400075e4
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x270]
call fcn.1400078c4
test al, al
je 0x140013922
lea rcx, [rbp + 0x270]
call fcn.140013e3c
lea rcx, [rbp - 0x30]
call fcn.14000cdf8
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.14000ed6c
lea rcx, [rbp - 0x30]
call fcn.14000704c
mov r8, rax
lea rcx, [rbp - 0x30]
call fcn.14000cdf0
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140007a80
test al, al
je 0x140013827
lea rcx, [rbp + 0x270]
call fcn.1400079e0
lea rcx, [rbp - 0x10]
call fcn.1400024c0
nop
lea rdx, str.COMSPEC
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140012f20
mov bl, al
lea rcx, [rbp + 0x10]
call fcn.140002050
test bl, bl
je 0x14001390e
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r9, rax
lea rcx, [rbp - 0x10]
call fcn.1400018c0
mov r8, rax
lea rdx, str._s__c___s_
lea rcx, [rbp + 0x10]
call fcn.14000e34c
nop
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400164c0
mov dword [rsp + 0x60], ebx
mov dword [rbp - 0x64], 1
mov word [rbp - 0x60], r13w
lea rcx, [0x14003c280]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x10]
call fcn.1400018c0
mov rdx, rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.14000d828
nop
lea rcx, [rbp + 0x270]
call fcn.140007684
nop
lea rcx, [rbp + 0x70]
call fcn.140002050
nop
lea rcx, [rbp + 0x130]
call fcn.140002050
nop
lea rcx, [rbp + 0xf0]
call fcn.140002050
nop
lea rcx, [rbp + 0x150]
call fcn.140002050
nop
lea rcx, [rbp + 0x190]
call fcn.140002050
nop
lea rcx, [rbp + 0x1b0]
call fcn.140002050
nop
lea rcx, [rbp + 0x1d0]
call fcn.140002050
nop
lea rcx, [rbp + 0xb0]
call fcn.140002050
nop
lea rcx, [rbp + 0xd0]
call fcn.140002050
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400143f0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret