Function at 0x1400018f0
Capabilities:
Delete file
Execute command
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor r12d, r12d
lea rdx, [rbp - 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140001fee
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], 0xf
mov eax, dword [0x14000b634]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x14000b638]
mov byte [rsp + 0x34], al
mov byte [rsp + 0x35], r12b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001500
mov rsi, rax
lea rax, [rbp - 0x20]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001997
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x140001a3b
lea rax, [r8 + rbx]
mov qword [rsi + 0x10], rax
mov r14, rsi
cmp rcx, 0x10
jb 0x1400019cb
mov r14, qword [rsi]
lea rax, [rbp - 0x20]
add rax, rbx
cmp rax, r14
jbe 0x1400019fe
lea rax, [r14 + r8]
lea rcx, [rbp - 0x20]
cmp rcx, rax
ja 0x1400019fe
lea rax, [rbp - 0x20]
cmp r14, rax
ja 0x1400019f2
mov r15, r12
jmp 0x140001a01
lea rax, [rbp - 0x20]
mov r15, r14
sub r15, rax
jmp 0x140001a01
mov r15, rbx
lea rcx, [r14 + rbx]
inc r8
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
lea rdx, [rbp - 0x20]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + r15]
mov r8, rbx
sub r8, r15
lea rax, [r15 + rbx]
lea rdx, [rbp - 0x20]
add rdx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140001a57
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call fcn.140006cc0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001ac4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001abf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
movdqa xmm0, xmmword [0x14000b9a0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001b17
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], 0xf
mov eax, dword [0x14000b63c]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x14000b640]
mov byte [rsp + 0x34], al
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001500
mov rbx, rax
lea rax, [rbp - 0x20]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001b61
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
cmp rdi, rax
ja 0x140001c05
lea rax, [r8 + rdi]
mov qword [rbx + 0x10], rax
mov rsi, rbx
cmp rcx, 0x10
jb 0x140001b95
mov rsi, qword [rbx]
lea rax, [rbp - 0x20]
add rax, rdi
cmp rax, rsi
jbe 0x140001bc8
lea rax, [rsi + r8]
lea rcx, [rbp - 0x20]
cmp rcx, rax
ja 0x140001bc8
lea rax, [rbp - 0x20]
cmp rsi, rax
ja 0x140001bbc
mov r14, r12
jmp 0x140001bcb
lea rax, [rbp - 0x20]
mov r14, rsi
sub r14, rax
jmp 0x140001bcb
mov r14, rdi
lea rcx, [rsi + rdi]
inc r8
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, [rbp - 0x20]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r14]
mov r8, rdi
sub r8, r14
lea rax, [r14 + rdi]
lea rdx, [rbp - 0x20]
add rdx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140001c21
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140006cc0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001c90
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
movdqa xmm0, xmmword [0x14000b9a0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001ce3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
mov r8d, 0x1f91
lea rdx, [0x14000f070]
lea rcx, [rbp - 0x68]
call fcn.140001660
mov r8d, 0x8fe01
lea rdx, [0x140011010]
lea rcx, [rsp + 0x78]
call fcn.140001660
mov r14, qword [rbp - 0x78]
movabs rax, 0x7fffffffffffffff
cmp r14, rax
je 0x14000201e
lea r15, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae r15, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140001dd6
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001d97
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140009e18
test rax, rax
je 0x140001ec5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001dd1
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001dbf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002024
jmp 0x140001d78
test rcx, rcx
je 0x140001dce
call fcn.140009e18
mov rdi, rax
jmp 0x140001dd1
mov rdi, r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x20
mov byte [rdi + rsi], 0
mov rdi, qword [rbp - 0x58]
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r9, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140001e52
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x30]
jmp 0x140001e64
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400063c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001ed1
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ecc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ecc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001f4d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
movdqa xmm0, xmmword [0x14000b9a0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140001f9d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140001fec
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fe7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009a90
mov al, 1
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140009a70
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400013a0
nop
call fcn.140001300
int3