Function at 0x1400e4b90
Capabilities:
Delete file
Execute command
Self delete

Disassembly:
jmp 0x14027d230
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14034c280]
xor rax, rbp
mov qword [rbp + 0xc58], rax
mov dword [rbp + 0xc14], 0
lea rcx, [0x140373394]
call fcn.1400e88b7
lea rcx, str.Config_System
call fcn.1400e6a30
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x80
lea rdx, [0x140357bb0]
lea rcx, str.New_Config_Name
call fcn.1400e5702
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x714]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Create_Config
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027d338
lea rdx, [0x140357bb0]
lea rcx, [rbp + 0x738]
call fcn.1400e60f8
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, str..config
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 8]
call fcn.1400e829f
nop
lea rcx, [rbp + 0x738]
call fcn.1400e4d4d
lea rcx, [rbp + 8]
call fcn.1400e6c10
nop
lea rcx, [rbp + 8]
call fcn.1400e4d4d
call fcn.1400e85f6
lea rdx, [0x14034db98]
lea rcx, [rbp + 0x48]
call fcn.1400e49a6
nop
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x140357ffc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140357ba8], eax
jle 0x14027d3bd
lea rcx, [0x140357ba8]
call fcn.1400e8132
cmp dword [0x140357ba8], 0xffffffff
jne 0x14027d3bd
mov edx, 0x20
lea rcx, [0x140357c30]
call fcn.1400e4631
lea rcx, [0x140357c30]
call fcn.1400e5c39
lea rcx, [0x1402bb580]
call fcn.1400e5c57
lea rcx, [0x140357ba8]
call fcn.1400e82ef
lea rcx, [0x140357c30]
call fcn.1400e68eb
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x778]
call fcn.1400e79e4
nop
lea rdx, [rbp + 0x778]
lea rcx, [rbp + 0xa8]
call fcn.1400e888a
nop
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x778]
call fcn.1400e827c
mov edx, 0x10
lea rcx, [rbp + 0xd8]
call fcn.1400e5987
lea rax, [rbp + 0x7b8]
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x7e8]
call fcn.1400e613e
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0xd8]
call fcn.1400e4b81
nop
mov edx, 0x10
lea rcx, [rbp + 0x108]
call fcn.1400e5987
lea rax, [rbp + 0x808]
mov qword [rbp + 0x838], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x838]
call fcn.1400e613e
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0x108]
call fcn.1400e5c7a
nop
jmp 0x14027d4b3
lea rcx, [rbp + 0xd8]
call fcn.1400e60ad
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xd8]
call fcn.1400e8669
movzx eax, al
test eax, eax
je 0x14027d68d
lea rcx, [rbp + 0xd8]
call fcn.1400e6a76
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x138]
call fcn.1400e832b
movzx eax, al
test eax, eax
je 0x14027d583
xor r8d, r8d
lea rdx, str..config
lea rcx, [rbp + 0x878]
call fcn.1400e4280
nop
mov eax, dword [rbp + 0xc14]
or eax, 1
mov dword [rbp + 0xc14], eax
mov rcx, qword [rbp + 0x138]
call fcn.1400e6c24
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8b8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e4b9a
mov qword [rbp + 0xc30], rax
mov eax, dword [rbp + 0xc14]
or eax, 2
mov dword [rbp + 0xc14], eax
lea rdx, [rbp + 0x878]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e4519
movzx eax, al
test eax, eax
je 0x14027d583
mov dword [rbp + 0xc38], 1
jmp 0x14027d58d
mov dword [rbp + 0xc38], 0
movzx eax, byte [rbp + 0xc38]
mov byte [rbp + 0x854], al
mov eax, dword [rbp + 0xc14]
and eax, 2
test eax, eax
je 0x14027d5bb
and dword [rbp + 0xc14], 0xfffffffd
lea rcx, [rbp + 0x8b8]
call fcn.1400e827c
nop
mov eax, dword [rbp + 0xc14]
and eax, 1
test eax, eax
je 0x14027d5db
and dword [rbp + 0xc14], 0xfffffffe
lea rcx, [rbp + 0x878]
call fcn.1400e827c
movzx eax, byte [rbp + 0x854]
test eax, eax
je 0x14027d688
mov rcx, qword [rbp + 0x138]
call fcn.1400e6c24
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8f8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e6152
mov qword [rbp + 0xc30], rax
mov rax, qword [rbp + 0xc30]
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
lea rdx, [rbp + 0x938]
mov rcx, qword [rbp + 0xc40]
call fcn.1400e4bf4
mov qword [rbp + 0xc48], rax
mov rax, qword [rbp + 0xc48]
mov qword [rbp + 0xc50], rax
mov rdx, qword [rbp + 0xc50]
lea rcx, [0x140357c30]
call fcn.1400e5937
nop
lea rcx, [rbp + 0x938]
call fcn.1400e4d4d
nop
lea rcx, [rbp + 0x8f8]
call fcn.1400e827c
jmp 0x14027d4a7
lea rcx, [rbp + 0x108]
call fcn.1400e466d
nop
lea rcx, [rbp + 0xd8]
call fcn.1400e466d
nop
lea rcx, [rbp + 0xa8]
call fcn.1400e466d
mov dword [rbp + 0x154], 0
jmp 0x14027d6cd
mov eax, dword [rbp + 0x154]
inc eax
mov dword [rbp + 0x154], eax
movsxd rax, dword [rbp + 0x154]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59e6
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d788
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x974]
call fcn.1400e6e40
mov qword [rbp + 0xc28], rax
mov eax, dword [rbp + 0x154]
cmp dword [0x14034c208], eax
jne 0x14027d727
mov byte [rbp + 0xc30], 1
jmp 0x14027d72e
mov byte [rbp + 0xc30], 0
movsxd rax, dword [rbp + 0x154]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e5437
mov rcx, rax
call fcn.1400e46ae
mov qword [rbp + 0xc38], rax
mov r9, qword [rbp + 0xc28]
xor r8d, r8d
movzx edx, byte [rbp + 0xc30]
mov rcx, qword [rbp + 0xc38]
call fcn.1400e8119
movzx eax, al
test eax, eax
je 0x14027d783
mov eax, dword [rbp + 0x154]
mov dword [0x14034c208], eax
jmp 0x14027d6bf
cmp dword [0x14034c208], 0xffffffff
je 0x14027d7be
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e5437
mov rcx, rax
call fcn.1400e46ae
mov rdx, rax
lea rcx, str.Selected:__s
call fcn.1400e6927
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x994]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Load_Selected
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027d854
cmp dword [0x14034c208], 0
jl 0x14027d854
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59e6
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d854
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e5437
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.1400e49a6
nop
lea rcx, [rbp + 0x178]
call fcn.1400e69ae
nop
lea rcx, [rbp + 0x178]
call fcn.1400e4d4d
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x9b4]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Save_Selected
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027d8c9
cmp dword [0x14034c208], 0
jl 0x14027d8c9
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59e6
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d8c9
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027d9b0
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6639
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0x9d4]
call fcn.1400e6e40
lea rdx, [rbp + 0x9d4]
lea rcx, [0x1402ecbf0]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027d926
call fcn.1400e6fc6
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0x9f4]
call fcn.1400e6e40
lea rdx, [rbp + 0x9f4]
lea rcx, [0x1402ecbec]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027d9ab
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e5437
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.1400e49a6
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e6c10
call fcn.1400e6fc6
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e4d4d
call fcn.1400e58d8
call fcn.1400e85f6
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xa14]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Delete_Selected
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027da1a
cmp dword [0x14034c208], 0
jl 0x14027da1a
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59e6
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027da1a
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027dc3d
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6639
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0xa34]
call fcn.1400e6e40
lea rdx, [rbp + 0xa34]
lea rcx, [0x1402ecbf0]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027da77
call fcn.1400e6fc6
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0xa54]
call fcn.1400e6e40
lea rdx, [rbp + 0xa54]
lea rcx, [0x1402ecbec]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027dc38
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e5437
mov rdx, rax
lea rcx, [rbp + 0x1f8]
call fcn.1400e49a6
nop
lea r8, [0x140316aec]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xa78]
call fcn.1400e7958
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, [rbp + 0x1f8]
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 0x238]
call fcn.1400e58ab
nop
lea rcx, [rbp + 0xa78]
call fcn.1400e4d4d
lea rcx, [rbp + 0x238]
call fcn.1400e46ae
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
jne 0x14027dc19
lea rax, [rbp + 0xab8]
mov qword [rbp + 0xae8], rax
lea rdx, [rbp + 0xb08]
lea rcx, [0x140357c30]
call fcn.1400e5284
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc38], rax
mov r8, qword [rbp + 0xc38]
lea rdx, [rbp + 0xb38]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e6c92
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
mov rcx, qword [rbp + 0xae8]
call fcn.1400e4fd7
mov qword [rbp + 0xc48], rax
mov r8, qword [rbp + 0xc48]
lea rdx, [rbp + 0xb68]
lea rcx, [0x140357c30]
call fcn.1400e7b24
lea rcx, [rbp + 0xb68]
call fcn.1400e4555
lea rcx, [rbp + 0xb38]
call fcn.1400e4555
lea rcx, [rbp + 0xb08]
call fcn.1400e4555
mov dword [0x14034c208], 0xffffffff
call fcn.1400e6fc6
nop
lea rcx, [rbp + 0x238]
call fcn.1400e4d4d
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400e4d4d
call fcn.1400e58d8
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xb94]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Reset_Config
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027dc83
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027dd30
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6639
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0xbb4]
call fcn.1400e6e40
lea rdx, [rbp + 0xbb4]
lea rcx, [0x1402ecbf0]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027dce0
call fcn.1400e6fc6
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
movss xmm1, dword [0x14030eff0]
lea rcx, [rbp + 0xbd4]
call fcn.1400e6e40
lea rdx, [rbp + 0xbd4]
lea rcx, [0x1402ecbec]
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027dd2b
call fcn.1400e6bed
call fcn.1400e6fc6
call fcn.1400e58d8
movss xmm1, dword [0x1402d69a8]
xorps xmm0, xmm0
call fcn.1400e7002
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xbf4]
call fcn.1400e6e40
mov rdx, rax
lea rcx, str.Open_Directory
call fcn.1400e57f2
movzx eax, al
test eax, eax
je 0x14027de16
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x278]
call fcn.1400e79e4
nop
lea rcx, [rbp + 0x278]
call fcn.1400e60e9
movzx eax, al
test eax, eax
je 0x14027de09
lea rcx, [rbp + 0x278]
call fcn.1400e45d7
movzx eax, al
test eax, eax
je 0x14027de09
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x278]
call fcn.1400e4bf4
nop
lea r8, [rbp + 0x2b8]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x2f8]
call fcn.1400e4311
lea rcx, [rbp + 0x2f8]
call fcn.1400e46ae
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x334], eax
lea rcx, [rbp + 0x2f8]
call fcn.1400e4d4d
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400e4d4d
nop
lea rcx, [rbp + 0x278]
call fcn.1400e827c
nop
lea rcx, [rbp + 0x48]
call fcn.1400e4d4d
lea rcx, [rbp - 0x30]
lea rdx, [0x140315c90]
call fcn.1400e7c8c
mov rcx, qword [rbp + 0xc58]
xor rcx, rbp
call fcn.1400e62f6
lea rsp, [rbp + 0xc68]
pop rdi
pop rbp
ret