Function at 0x14002e400
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xa20
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140132280]
xor rax, rsp
mov qword [rsp + 0xa10], rax
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x31b8
call fcn.1400307f0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x7f0]
call fcn.140065dd0
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0xb0]
add r8, 0x2da8
mov edx, 0x104
lea rcx, [rsp + 0x7f0]
call fcn.14006f110
lea rcx, [rsp + 0x7f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
cmp dword [rcx + 0x80a8], r12d
jne 0x14002e77f
lea rdx, [rsp + 0x7f0]
lea rcx, [rsp + 0xe0]
call fcn.140001f50
nop
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x160]
call fcn.140065dd0
lea rdx, [0x1400ba850]
lea rcx, [rsp + 0x80]
call fcn.140001f50
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.140002630
nop
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140002e70
nop
cmp qword [rax + 0x18], 0x10
jb 0x14002e539
mov rax, qword [rax]
lea rdx, [rsp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0xc0]
call fcn.1400036b0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400036b0
nop
lea rcx, [rsp + 0x80]
call fcn.1400036b0
or r15, 0xffffffffffffffff
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.14002cd80
cmp rbx, r15
je 0x14002e762
nop word [rax + rax]
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0x80]
call fcn.140001f50
nop
lea rdx, [0x140101908]
lea rcx, [rsp + 0x120]
call fcn.140001f50
nop
or edi, 1
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x80]
call fcn.140002550
test al, al
jne 0x14002e625
lea rdx, [0x1401038d4]
lea rcx, [rsp + 0x100]
call fcn.140001f50
nop
or edi, 2
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x80]
call fcn.140002550
test al, al
jne 0x14002e625
xor r14b, r14b
jmp 0x14002e628
mov r14b, 1
test dil, 2
je 0x14002e643
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x100]
call fcn.1400036b0
nop
test dil, 1
je 0x14002e65d
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x120]
call fcn.1400036b0
test r14b, r14b
je 0x14002e667
jmp 0x14002e73c
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0xc0]
call fcn.140001f50
nop
lea rdx, [0x140101904]
lea rcx, [rsp + 0xa0]
call fcn.140001f50
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.140002630
nop
lea r8, [rsp + 0xc0]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002630
nop
lea rcx, [rsp + 0x140]
call fcn.1400036b0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400036b0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400036b0
lea rcx, [rsp + 0x60]
call fcn.140002720
mov rcx, rax
call fcn.140046400
test eax, eax
je 0x14002e731
lea rcx, [rsp + 0x60]
call fcn.140002720
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e731
lea rcx, [rsp + 0x60]
call fcn.140002720
mov rcx, rax
xor edx, edx
call fcn.140047940
nop
lea rcx, [rsp + 0x60]
call fcn.1400036b0
nop
lea rcx, [rsp + 0x80]
call fcn.1400036b0
lea rdx, [rsp + 0x160]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002e5a0
lea rcx, [rsp + 0x38]
call fcn.14002cd80
nop
lea rcx, [rsp + 0xe0]
call fcn.1400036b0
jmp 0x14002f082
mov rcx, qword [rsi + 0x38]
call fcn.140029460
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14002cc20
nop
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x14002e7eb
mov rcx, rbx
call fcn.140002720
mov rcx, rax
call fcn.140046400
test eax, eax
je 0x14002e7e5
mov rcx, rbx
call fcn.140002720
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e7e5
mov rcx, rbx
call fcn.140002720
mov rcx, rax
xor edx, edx
call fcn.140047940
add rbx, 0x20
jmp 0x14002e7a0
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2da8
call fcn.140046400
test eax, eax
je 0x14002e83b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2da8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e83b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2da8
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x14c8
call fcn.140046400
test eax, eax
je 0x14002e88b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x14c8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e88b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x14c8
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x15cc
call fcn.140046400
test eax, eax
je 0x14002e8db
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x15cc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e8db
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x15cc
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x33c0
call fcn.140046400
test eax, eax
je 0x14002e92b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x33c0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e92b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x33c0
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x898
call fcn.140046400
test eax, eax
je 0x14002e97b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x898
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e97b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x898
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x99c
call fcn.140046400
test eax, eax
je 0x14002e9cb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x99c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002e9cb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x99c
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xaa0
call fcn.140046400
test eax, eax
je 0x14002ea1b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xaa0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ea1b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xaa0
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xba4
call fcn.140046400
test eax, eax
je 0x14002ea6b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xba4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ea6b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xba4
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xca8
call fcn.140046400
test eax, eax
je 0x14002eabb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xca8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002eabb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xca8
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xdac
call fcn.140046400
test eax, eax
je 0x14002eb0b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xdac
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002eb0b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xdac
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xeb0
call fcn.140046400
test eax, eax
je 0x14002eb5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xeb0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002eb5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xeb0
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x13c4
call fcn.140046400
test eax, eax
je 0x14002ebab
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x13c4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ebab
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x13c4
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9808
call fcn.140046400
test eax, eax
je 0x14002ebfb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9808
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ebfb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x9808
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x36cc
call fcn.140046400
test eax, eax
je 0x14002ec4b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x36cc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ec4b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x36cc
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x37d0
call fcn.140046400
test eax, eax
je 0x14002ec9b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x37d0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ec9b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x37d0
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x30b4
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x30b4
call fcn.140046400
test eax, eax
je 0x14002ece7
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x30b4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x38d4
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x38d4
call fcn.140046400
test eax, eax
je 0x14002ed33
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x38d4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x488
call fcn.140046400
test eax, eax
je 0x14002ed83
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x488
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ed83
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x488
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2fb0
call fcn.140046400
test eax, eax
je 0x14002edd3
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2fb0
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002edd3
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2fb0
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x34c4
call fcn.140046400
test eax, eax
je 0x14002ee23
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x34c4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ee23
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x34c4
xor edx, edx
call fcn.140047940
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5d0]
call fcn.140065dd0
lea r9, str.clntprxy.dll
lea r8, [rsp + 0x7f0]
lea rdx, [0x1400b8c04]
lea rcx, [rsp + 0x5d0]
call fcn.140027490
lea rcx, [rsp + 0x5d0]
call fcn.140046400
test eax, eax
je 0x14002ee7a
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r9, str.clntprxyio.dll
lea r8, [rsp + 0x7f0]
lea rdx, [0x1400b8c04]
lea rcx, [rsp + 0x5d0]
call fcn.140027490
lea rcx, [rsp + 0x5d0]
call fcn.140046400
test eax, eax
je 0x14002eebc
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa87c
call fcn.140046400
test eax, eax
je 0x14002ef0c
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa87c
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ef0c
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xa87c
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x690
call fcn.140046400
test eax, eax
je 0x14002ef5d
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x690
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002ef5d
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x690
xor edx, edx
call fcn.140047940
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002f07e
mov rdi, qword [rsp + 0x68]
mov rbx, rcx
mov qword [rsp + 0x50], rcx
nop dword [rax + rax]
cmp rbx, rdi
je 0x14002f00b
mov rax, qword [rbx + 0x18]
cmp rax, 0x10
jb 0x14002efda
mov rcx, qword [rbx]
inc rax
cmp rax, 0x1000
jb 0x14002efd5
test cl, 0x1f
je 0x14002efab
call fcn.14006ef04
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002efb9
call fcn.14006ef04
sub rcx, rax
cmp rcx, 8
jae 0x14002efc7
call fcn.14006ef04
cmp rcx, 0x27
jbe 0x14002efd2
call fcn.14006ef04
mov rcx, rax
call fcn.1400369b0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r12
cmp qword [rbx + 0x18], 0x10
jb 0x14002eff2
mov rax, qword [rbx]
jmp 0x14002eff5
mov rax, rbx
mov byte [rax], 0
add rbx, 0x20
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x60]
jmp 0x14002ef80
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 5
movabs rdx, 0x7ffffffffffffff
cmp rax, rdx
jbe 0x14002f02b
call fcn.14006ef04
shl rax, 5
cmp rax, 0x1000
jb 0x14002f06b
test cl, 0x1f
je 0x14002f041
call fcn.14006ef04
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002f04f
call fcn.14006ef04
sub rcx, rax
cmp rcx, 8
jae 0x14002f05d
call fcn.14006ef04
cmp rcx, 0x27
jbe 0x14002f068
call fcn.14006ef04
mov rcx, rax
call fcn.1400369b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
or r15, 0xffffffffffffffff
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xccb8
call fcn.140046400
test eax, eax
je 0x14002f0d2
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xccb8
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f0d2
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xccb8
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbb4
call fcn.140046400
test eax, eax
je 0x14002f122
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbb4
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f122
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0xcbb4
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x30b4
mov edx, 0x5c
call fcn.140064f8c
mov rdi, rax
test rax, rax
je 0x14002f2f9
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002f150
cmp rcx, 5
jb 0x14002f2f9
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2414
mov edx, 0x5c
call fcn.140064f8c
mov rbx, rax
test rax, rax
je 0x14002f2f9
nop dword [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x14002f190
cmp r15, 5
jb 0x14002f2f9
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x160]
call fcn.140065dd0
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rsp + 0x160]
call fcn.140045f40
lea rcx, [rsp + 0x160]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x14002f1f0
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14002f200
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x4c0]
call fcn.140065dd0
movzx eax, byte [rsp + r12 + 0x160]
mov byte [rsp + r12 + 0x4c0], al
lea r12, [r12 + 1]
test al, al
jne 0x14002f225
lea rcx, [rsp + 0x4c0]
call fcn.140045f40
lea rcx, [rsp + 0x4c0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x14002f257
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rdx + 1]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14002f270
xor edx, edx
lea rcx, [rsp + 0x4c0]
call fcn.140047940
lea rcx, [rsp + 0x4c0]
call fcn.140046400
test eax, eax
je 0x14002f2ae
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x4c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x1400ba828]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x160]
call fcn.140047940
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
lea rdx, [rsp + 0x2a0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x14002f320
mov edx, 0x2e
lea rcx, [rsp + 0x2a0]
call fcn.140064f8c
mov rbx, rax
test rax, rax
je 0x14002f45f
mov ecx, dword [str..hlp]
mov dword [rax], ecx
movzx ecx, byte [0x1400b94a8]
mov byte [rax + 4], cl
lea rcx, [rsp + 0x2a0]
call fcn.140046400
test eax, eax
je 0x14002f393
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f393
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140047940
mov eax, dword [str..cnt]
mov dword [rbx], eax
movzx eax, byte [0x1400b94b0]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.140046400
test eax, eax
je 0x14002f3d7
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f3d7
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140047940
mov eax, dword [str..chm]
mov dword [rbx], eax
movzx eax, byte [0x1400b94b8]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.140046400
test eax, eax
je 0x14002f41b
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f41b
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140047940
mov eax, dword [str..gid]
mov dword [rbx], eax
movzx eax, byte [0x1400b94c0]
mov byte [rbx + 4], al
lea rcx, [rsp + 0x2a0]
call fcn.140046400
test eax, eax
je 0x14002f45f
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f45f
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
lea rdx, [rsp + 0x6e0]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x14002f480
mov edx, 0x5c
lea rcx, [rsp + 0x6e0]
call fcn.140064f8c
test rax, rax
je 0x14002f4ab
mov byte [rax], 0
lea rcx, [rsp + 0x6e0]
call fcn.140045f40
lea rcx, [rsp + 0x6e0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x14002f4c3
movsd xmm0, qword [str.SpectorCNE.chm]
movsd qword [rcx], xmm0
mov eax, dword [0x1400ba880]
mov dword [rcx + 8], eax
movzx eax, word [0x1400ba884]
mov word [rcx + 0xc], ax
movzx eax, byte [0x1400ba886]
mov byte [rcx + 0xe], al
lea rcx, [rsp + 0x6e0]
call fcn.140046400
test eax, eax
je 0x14002f528
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f528
xor edx, edx
lea rcx, [rsp + 0x6e0]
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
call fcn.140046400
test eax, eax
je 0x14002f578
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002f578
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
xor edx, edx
call fcn.140047940
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x89c8
cmp byte [rcx], 0
je 0x14002f596
xor edx, edx
call fcn.140046240
lea rax, [rsp + 0x900]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsi + 0x10]
call fcn.14002ff30
nop
mov rcx, qword [rax]
lea rdx, [rsp + 0x3b0]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x14002f5d0
lea rcx, [rsp + 0x38]
call fcn.1400446d0
mov edx, 0x5c
lea rcx, [rsp + 0x3b0]
call fcn.140064f8c
test rax, rax
je 0x14002f605
mov byte [rax], 0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
call fcn.14006f224
test eax, eax
je 0x14002f669
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x1400ba828]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x3b0]
call fcn.140047940
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 0xb0]
add rcx, 0x2eac
lea r8, [rsp + 0x3b0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8], al
lea rcx, [rcx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x14002f690
mov edx, 0x5c
lea rcx, [rsp + 0x3b0]
call fcn.140064f8c
test rax, rax
je 0x14002f6bc
mov byte [rax], 0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
call fcn.14006f224
test eax, eax
je 0x14002f720
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x1400ba828]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edx, edx
lea rcx, [rsp + 0x3b0]
call fcn.140047940
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, 1
mov dword [rsp + 0x34], eax
jmp 0x14002f72f
mov rcx, qword [rsp + 0xa10]
xor rcx, rsp
call fcn.140063ed0
lea r11, [rsp + 0xa20]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret