Function at 0x140012bf0
Capabilities:
Check os version
Create directory
Delete file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x480
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + AfxProcessWndProcException], rbx
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov esi, r9d
mov rdi, r8
mov qword [rsp + 0x30], r8
mov rbp, rdx
mov qword [rsp + 0xb8], rdx
mov rbx, rcx
cmp dword [rcx + 0x120], 0
jne 0x140013253
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
test eax, eax
jne 0x140012cd1
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
je 0x140012ca3
mov rbp, qword [rsp + 0x30]
nop dword [rax + rax]
test esi, esi
je 0x140012c9b
test rdi, rdi
je 0x140012c8a
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140012bf0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
jne 0x140012c70
mov rbp, qword [rsp + 0xb8]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
test rax, rax
je 0x140013253
mov r9d, 1
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rcx, rbx
call fcn.140012bf0
jmp 0x140013253
mov rdx, rdi
lea rcx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x48]
test eax, eax
je 0x14001308a
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
je 0x140012d43
mov rbp, qword [rsp + 0x30]
nop dword [rax]
test esi, esi
je 0x140012d3b
test rdi, rdi
je 0x140012d2a
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140012bf0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
jne 0x140012d10
mov rbp, qword [rsp + 0xb8]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x38]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0xf0]
call fcn.140012010
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rdx, [0x14008ee14]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
cmp dword [0x1400ce808], 0
jne 0x140012fcc
xor esi, esi
mov word [rsp + 0x260], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x262]
call sub.MSVCR90.dll_memset
mov r8d, new[]
lea rdx, [rsp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x260]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140012fd6
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x40], 0x50
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x88], CDHtmlElementEventSink::AddRef
mov dword [rsp + 0x90], 0x20
lea rax, [rsp + 0x260]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xb8], 0xaac56b
mov eax, 0xcd44
mov word [rsp + 0xbc], ax
mov eax, 0x11d0
mov word [rsp + 0xbe], ax
mov byte [rsp + 0xc0], 0x8c
mov byte [rsp + 0xc1], SetErrorInfo
mov byte [rsp + 0xc2], sil
mov byte [rsp + 0xc3], 0xc0
mov byte [rsp + 0xc4], 0x4f
mov byte [rsp + 0xc5], SetErrorInfo
mov byte [rsp + 0xc6], 0x95
mov byte [rsp + 0xc7], 0xee
mov rax, qword [0x1400ce810]
test rax, rax
jne 0x140012f39
lea rcx, str.Wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140012f29
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ce810], rax
jmp 0x140012f30
mov rax, qword [0x1400ce810]
test rax, rax
je 0x140012fd6
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xb8]
xor ecx, ecx
call rax
mov ecx, esi
test eax, eax
sete cl
mov dword [0x1400c27e4], ecx
test ecx, ecx
jne 0x140012fc0
xor edx, edx
mov r8d, ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0x144]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x140], ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140012f91
mov ecx, esi
jmp 0x140012fba
mov eax, dword [rsp + 0x144]
cmp eax, 6
jae 0x140012fa4
mov ecx, 1
jmp 0x140012fba
cmp eax, 6
jbe 0x140012fad
mov ecx, esi
jmp 0x140012fba
mov ecx, esi
cmp dword [rsp + 0x148], 1
setbe cl
mov dword [0x1400c27e4], ecx
mov dword [0x1400ce808], 1
jmp 0x140012fd2
mov ecx, dword [0x1400c27e4]
test ecx, ecx
je 0x14001304e
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x14001304e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x104
jb 0x140013019
mov rcx, rdx
call fcn.140011f20
jmp 0x140013022
mov rcx, rdx
call qword [sym.imp.MSVCR90.dll__mkdir]
cmp eax, 2
jne 0x14001304e
mov r9d, 0x1001
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140013280
nop
lea rcx, [rsp + 0xf0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
jmp 0x140013245
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
test rax, rax
je 0x140013077
mov r9d, 1
lea r8, [rsp + 0xc8]
mov rdx, rax
mov rcx, rbx
call fcn.140012bf0
nop
lea rcx, [rsp + 0xf0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
jmp 0x140013245
inc dword [rbx + 0x148]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x38]
mov rdx, rax
lea rcx, [rsp + 0x118]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x118]
call fcn.140012010
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rdx, [rsp + 0xc8]
mov rcx, rbx
call fcn.140013460
lea rdi, [rbx + 0xf8]
mov qword [rsp + 0xb8], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp dword [rbx + 0x120], 0
je 0x14001311e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x118]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
jmp 0x140013245
mov qword [rbx + 0x58], rbp
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rax, [rbx + 0x130]
mov qword [rbx + 0x128], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140013280
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [0x1400372e0]
lea r8, [rsp + 0xc8]
mov rdx, rbp
lea rcx, [rbx + 0x130]
call fcn.140011400
cmp eax, 0x3f7
je 0x140013194
cmp eax, 0x37
jne 0x1400131be
jmp 0x1400131b4
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rbx + 0x120], 1
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x40]
add qword [rbx + 0xc8], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rbx + 0x128], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdx, qword [rbp]
mov rcx, rbp
call qword [rdx + 0x28]
mov rdi, rax
test rax, rax
je 0x140013236
nop
test esi, esi
je 0x140013236
cmp dword [rbx + 0x120], 0
jne 0x140013236
test rdi, rdi
je 0x140013225
xor r9d, r9d
mov r8, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.140012bf0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
jne 0x140013200
lea rcx, [rsp + 0x118]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xc8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret