Function at 0x140038df0
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140092690]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov edi, r9d
mov rsi, r8
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x50], 0xffffffffffffffff
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], r13d
test rdx, rdx
je 0x140039206
test r8, r8
je 0x140039206
mov byte [rsp + 0x2d8], r13b
xor edx, edx
mov r8d, 0x224
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
nop
lea edx, [r13 + 0x14]
lea rcx, [rsp + 0x2e0]
call fcn.14000a6cc
lea r9d, [r13 + 0x29]
lea r8d, [r13 + 0x14]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x2e0]
call fcn.1400396c0
lea r9, [rsp + 0x80]
lea r8d, [r13 + 0x29]
lea rdx, [rsp + 0x2b0]
mov rcx, r15
call fcn.140037460
mov dword [rsp + 0x284], edi
mov dword [rsp + 0x80], 0x5a
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x140038f1a
mov eax, 0x800432a8
jmp 0x14003920b
mov edx, 0x41
lea rcx, str.__xml_version_1.0___
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str.__xml_version_1.0___
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400391f8
cmp r14d, dword [rsp + 0x40]
jne 0x1400391f8
mov edx, 0x41
lea rcx, str._ExportedProfiles_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r14, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str._ExportedProfiles_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400391f1
cmp r14d, dword [rsp + 0x40]
jne 0x1400391f1
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400391ea
cmp dword [rsp + 0x40], edi
jne 0x1400391ea
mov edx, 0x41
lea rcx, str.__ExportedProfiles_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdi, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, str.__ExportedProfiles_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400391e3
cmp edi, dword [rsp + 0x40]
jne 0x1400391e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0xffffffffffffffff
lea rdx, str.temp.txt
mov rcx, r15
call fcn.1400344c0
mov dword [rsp + 0x2a0], eax
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x58]
call fcn.140008d08
nop
lea r8, str.temp.enc
lea rdx, str.temp.txt
lea rcx, [rsp + 0x58]
call fcn.14000a05c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400390b1
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14003920b
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14003910b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14003920b
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, 0x224
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400391d2
cmp dword [rsp + 0x40], 0x224
jne 0x1400391d2
nop
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov r8d, 0x200
lea rdx, [rsp + 0x300]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140039193
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x300]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140039193
cmp dword [rsp + 0x44], 0x200
je 0x140039140
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.temp.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.temp.enc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x58]
call fcn.14000909c
nop
mov eax, 0x43297
jmp 0x14003920b
lea rcx, [rsp + 0x58]
call fcn.14000909c
mov eax, 0x80043298
jmp 0x14003920b
mov eax, 0x800432a9
jmp 0x14003920b
mov eax, 0x800432aa
jmp 0x14003920b
mov eax, 0x800432a9
jmp 0x14003920b
mov eax, 0x800432a9
jmp 0x14003920b
mov eax, 0x800432b1
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140059ef0
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret