Function at 0x1400030e0
Capabilities:
Check if file exists
Delete file
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x130], rax
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140003138
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
lea r8d, [rax + 0xe]
lea rdx, str.fps_config.ini
lea rcx, [rsp + 0x60]
call fcn.140004fb0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x20], rax
mov qword [rbp - 8], r14
mov qword [rbp], r14
lea ecx, [r14 + 0x60]
call fcn.14000625c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 8], rax
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r14
lea ecx, [r14 + 0x40]
call fcn.14000625c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 8], rax
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
lea rdx, [0x140008504]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
lea rbx, [r14 - 1]
test rax, rax
jne 0x1400031f7
mov edi, ebx
jmp 0x140003215
lea r9, [rbp - 0x10]
mov rdx, rsi
mov rcx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
call fcn.140001330
mov edi, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rbp - 0x10], edi
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000325b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003253
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003253
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov edi, dword [rbp - 0x10]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
test edi, edi
je 0x140003649
lea rcx, [0x1400085f0]
call fcn.1400010b0
lea rcx, [0x140008648]
call fcn.1400010b0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov r8d, 0xc
lea rdx, str.YuanShen.exe
lea rcx, [rsp + 0x40]
call fcn.140004fb0
lea rcx, [rsp + 0x40]
call fcn.1400027f0
movabs r12, 0x7ffffffff4143dff
movabs r15, 0x7fffffffffffffff
test eax, eax
jne 0x1400033af
nop
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov r8d, 0x11
lea rdx, str.GenshinImpact.exe
lea rcx, [rsp + 0x40]
call fcn.140004fb0
lea rcx, [rsp + 0x40]
call fcn.1400027f0
test eax, eax
jne 0x1400033af
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14000333a
imul rax, rax, 0x64
jmp 0x140003355
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r12
jge 0x140003366
add rax, 0xbebc200
mov qword [rbp - 0x20], rax
jmp 0x14000336a
mov qword [rbp - 0x20], r15
lea rcx, [rbp - 0x20]
call fcn.140005c00
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov r8d, 0xc
lea rdx, str.YuanShen.exe
lea rcx, [rsp + 0x40]
call fcn.140004fb0
lea rcx, [rsp + 0x40]
call fcn.1400027f0
test eax, eax
je 0x1400032e0
mov r8d, eax
xor edx, edx
mov ecx, 0x101001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x14000349f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp - 0x20], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov rdx, qword [rbp - 0x20]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140003417
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.140004fb0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
mov edx, edi
lea rcx, str.OpenProcess_failed___d_:__s
call fcn.1400010b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140003867
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003495
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
jmp 0x140003867
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x18], 0x104
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x20]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
lea rax, [rbp + 0x20]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400034d0
mov r8, rbx
lea rdx, [rbp + 0x20]
lea rdi, [0x14000b050]
mov rcx, rdi
call fcn.140004fb0
mov ebx, dword [0x14000b048]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140004ed0
mov edx, ebx
mov rcx, rax
call fcn.140002940
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
jne 0x140003590
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140003540
imul rax, rax, 0x64
jmp 0x14000355b
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r12
jge 0x14000356c
add rax, 0xbebc200
mov qword [rbp - 0x20], rax
jmp 0x140003570
mov qword [rbp - 0x20], r15
lea rcx, [rbp - 0x20]
call fcn.140005c00
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
je 0x140003522
mov dword [rbp + 0x18], 0x103
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rbp + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400035de
imul rax, rax, 0x64
jmp 0x1400035f9
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r12
jge 0x14000360a
add rax, 0xbebc200
mov qword [rbp - 0x20], rax
jmp 0x14000360e
mov qword [rbp - 0x20], r15
lea rcx, [rbp - 0x20]
call fcn.140005c00
cmp dword [rbp + 0x18], 0x103
je 0x1400035a0
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400086b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140003867
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
xor r8d, r8d
lea rdx, [0x1400084fa]
lea rcx, [rsp + 0x40]
call fcn.140004fb0
nop
lea rax, [rbp - 0x80]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov r8d, 4
lea rdx, str.Path
lea rcx, [rbp - 0x80]
call fcn.140004fb0
nop
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov r8d, 7
lea rdx, str.Setting
lea rcx, [rbp - 0x60]
call fcn.140004fb0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x10]
call fcn.140001810
mov rbx, rax
lea rdi, [0x14000b050]
cmp rdi, rax
je 0x140003776
mov rdx, qword [0x14000b068]
cmp rdx, 0x10
jb 0x14000373b
mov rcx, qword [0x14000b050]
inc rdx
cmp rdx, 0x1000
jb 0x140003736
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400037a8
mov rcx, r8
call fcn.1400064e8
movdqa xmm0, xmmword [0x140008c10]
movdqu xmmword [0x14000b060], xmm0
mov byte [0x14000b050], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14000b050], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14000b060], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400037b4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov ebx, dword [0x14000b048]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov r8d, 3
lea rdx, [0x1400086d0]
lea rcx, [rbp - 0x60]
call fcn.140004fb0
nop
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov r8d, 7
lea rdx, str.Setting
lea rcx, [rbp - 0x80]
call fcn.140004fb0
nop
mov r9d, ebx
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.140001c30
mov dword [0x14000b048], eax
cmp qword [0x14000b068], 0x10
cmovae rdi, qword [0x14000b050]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140003867
lea rcx, [0x1400086d8]
call fcn.1400010b0
lea rcx, str.config.ini
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400030e0
nop
mov r8, qword [rbp + 8]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 8]
lea rcx, [rbp + 8]
call fcn.140005d40
mov edx, 0x40
mov rcx, qword [rbp + 8]
call fcn.1400064e8
mov rcx, qword [rbp - 8]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x1400038d7
nop dword [rax + rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rbp - 8]
lea rcx, [rbp - 8]
call fcn.140005e00
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.140005fe0
mov edx, 0x60
mov rcx, rbx
call fcn.1400064e8
cmp byte [rdi + 0x19], 0
je 0x1400038a0
mov rcx, qword [rbp - 8]
mov edx, 0x60
call fcn.1400064e8
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1400060c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret