Function at 0x1400e4b8b
Capabilities:
Delete file
Execute command
Self delete

Disassembly:
jmp 0x14027cbb0
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14034c280]
xor rax, rbp
mov qword [rbp + 0xc58], rax
mov dword [rbp + 0xc14], 0
lea rcx, [0x140373394]
call fcn.1400e88c6
lea rcx, str.Config_System
call fcn.1400e6a3a
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x80
lea rdx, [0x140357bb0]
lea rcx, str.New_Config_Name
call fcn.1400e5707
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x714]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Create_Config
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027ccb8
lea rdx, [0x140357bb0]
lea rcx, [rbp + 0x738]
call fcn.1400e6102
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, str..config
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 8]
call fcn.1400e82a9
nop
lea rcx, [rbp + 0x738]
call fcn.1400e4d43
lea rcx, [rbp + 8]
call fcn.1400e6c10
nop
lea rcx, [rbp + 8]
call fcn.1400e4d43
call fcn.1400e8600
lea rdx, [0x14034db98]
lea rcx, [rbp + 0x48]
call fcn.1400e499c
nop
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x140357ffc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140357ba8], eax
jle 0x14027cd3d
lea rcx, [0x140357ba8]
call fcn.1400e8137
cmp dword [0x140357ba8], 0xffffffff
jne 0x14027cd3d
mov edx, 0x20
lea rcx, [0x140357c30]
call fcn.1400e462c
lea rcx, [0x140357c30]
call fcn.1400e5c3e
lea rcx, [0x1402bb630]
call fcn.1400e5c5c
lea rcx, [0x140357ba8]
call fcn.1400e82f9
lea rcx, [0x140357c30]
call fcn.1400e68f0
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x778]
call fcn.1400e79e4
nop
lea rdx, [rbp + 0x778]
lea rcx, [rbp + 0xa8]
call fcn.1400e8899
nop
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x778]
call fcn.1400e8286
mov edx, 0x10
lea rcx, [rbp + 0xd8]
call fcn.1400e5991
lea rax, [rbp + 0x7b8]
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x7e8]
call fcn.1400e6148
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0xd8]
call fcn.1400e4b7c
nop
mov edx, 0x10
lea rcx, [rbp + 0x108]
call fcn.1400e5991
lea rax, [rbp + 0x808]
mov qword [rbp + 0x838], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x838]
call fcn.1400e6148
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0x108]
call fcn.1400e5c7f
nop
jmp 0x14027ce33
lea rcx, [rbp + 0xd8]
call fcn.1400e60b7
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xd8]
call fcn.1400e8673
movzx eax, al
test eax, eax
je 0x14027d00d
lea rcx, [rbp + 0xd8]
call fcn.1400e6a80
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x138]
call fcn.1400e8335
movzx eax, al
test eax, eax
je 0x14027cf03
xor r8d, r8d
lea rdx, str..config
lea rcx, [rbp + 0x878]
call fcn.1400e427b
nop
mov eax, dword [rbp + 0xc14]
or eax, 1
mov dword [rbp + 0xc14], eax
mov rcx, qword [rbp + 0x138]
call fcn.1400e6c24
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8b8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e4b95
mov qword [rbp + 0xc30], rax
mov eax, dword [rbp + 0xc14]
or eax, 2
mov dword [rbp + 0xc14], eax
lea rdx, [rbp + 0x878]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e4514
movzx eax, al
test eax, eax
je 0x14027cf03
mov dword [rbp + 0xc38], 1
jmp 0x14027cf0d
mov dword [rbp + 0xc38], 0
movzx eax, byte [rbp + 0xc38]
mov byte [rbp + 0x854], al
mov eax, dword [rbp + 0xc14]
and eax, 2
test eax, eax
je 0x14027cf3b
and dword [rbp + 0xc14], 0xfffffffd
lea rcx, [rbp + 0x8b8]
call fcn.1400e8286
nop
mov eax, dword [rbp + 0xc14]
and eax, 1
test eax, eax
je 0x14027cf5b
and dword [rbp + 0xc14], 0xfffffffe
lea rcx, [rbp + 0x878]
call fcn.1400e8286
movzx eax, byte [rbp + 0x854]
test eax, eax
je 0x14027d008
mov rcx, qword [rbp + 0x138]
call fcn.1400e6c24
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8f8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e615c
mov qword [rbp + 0xc30], rax
mov rax, qword [rbp + 0xc30]
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
lea rdx, [rbp + 0x938]
mov rcx, qword [rbp + 0xc40]
call fcn.1400e4bef
mov qword [rbp + 0xc48], rax
mov rax, qword [rbp + 0xc48]
mov qword [rbp + 0xc50], rax
mov rdx, qword [rbp + 0xc50]
lea rcx, [0x140357c30]
call fcn.1400e5941
nop
lea rcx, [rbp + 0x938]
call fcn.1400e4d43
nop
lea rcx, [rbp + 0x8f8]
call fcn.1400e8286
jmp 0x14027ce27
lea rcx, [rbp + 0x108]
call fcn.1400e4668
nop
lea rcx, [rbp + 0xd8]
call fcn.1400e4668
nop
lea rcx, [rbp + 0xa8]
call fcn.1400e4668
mov dword [rbp + 0x154], 0
jmp 0x14027d04d
mov eax, dword [rbp + 0x154]
inc eax
mov dword [rbp + 0x154], eax
movsxd rax, dword [rbp + 0x154]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59f0
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d108
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x974]
call fcn.1400e6e36
mov qword [rbp + 0xc28], rax
mov eax, dword [rbp + 0x154]
cmp dword [0x14034c208], eax
jne 0x14027d0a7
mov byte [rbp + 0xc30], 1
jmp 0x14027d0ae
mov byte [rbp + 0xc30], 0
movsxd rax, dword [rbp + 0x154]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e543c
mov rcx, rax
call fcn.1400e46a9
mov qword [rbp + 0xc38], rax
mov r9, qword [rbp + 0xc28]
xor r8d, r8d
movzx edx, byte [rbp + 0xc30]
mov rcx, qword [rbp + 0xc38]
call fcn.1400e811e
movzx eax, al
test eax, eax
je 0x14027d103
mov eax, dword [rbp + 0x154]
mov dword [0x14034c208], eax
jmp 0x14027d03f
cmp dword [0x14034c208], 0xffffffff
je 0x14027d13e
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e543c
mov rcx, rax
call fcn.1400e46a9
mov rdx, rax
lea rcx, str.Selected:__s
call fcn.1400e692c
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x994]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Load_Selected
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d1d4
cmp dword [0x14034c208], 0
jl 0x14027d1d4
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59f0
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d1d4
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e543c
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.1400e499c
nop
lea rcx, [rbp + 0x178]
call fcn.1400e69b3
nop
lea rcx, [rbp + 0x178]
call fcn.1400e4d43
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x9b4]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Save_Selected
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d249
cmp dword [0x14034c208], 0
jl 0x14027d249
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59f0
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d249
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e4915
movzx eax, al
test eax, eax
je 0x14027d330
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6643
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0x9d4]
call fcn.1400e6e36
lea rdx, [rbp + 0x9d4]
lea rcx, [0x1402ecdf0]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d2a6
call fcn.1400e6fb7
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0x9f4]
call fcn.1400e6e36
lea rdx, [rbp + 0x9f4]
lea rcx, [0x1402ecdec]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d32b
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e543c
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.1400e499c
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e6c10
call fcn.1400e6fb7
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e4d43
call fcn.1400e58dd
call fcn.1400e8600
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xa14]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Delete_Selected
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d39a
cmp dword [0x14034c208], 0
jl 0x14027d39a
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357c30]
call fcn.1400e59f0
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027d39a
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e4915
movzx eax, al
test eax, eax
je 0x14027d5bd
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6643
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0xa34]
call fcn.1400e6e36
lea rdx, [rbp + 0xa34]
lea rcx, [0x1402ecdf0]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d3f7
call fcn.1400e6fb7
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0xa54]
call fcn.1400e6e36
lea rdx, [rbp + 0xa54]
lea rcx, [0x1402ecdec]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d5b8
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357c30]
call fcn.1400e543c
mov rdx, rax
lea rcx, [rbp + 0x1f8]
call fcn.1400e499c
nop
lea r8, [0x140316c9c]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xa78]
call fcn.1400e7958
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, [rbp + 0x1f8]
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 0x238]
call fcn.1400e58b0
nop
lea rcx, [rbp + 0xa78]
call fcn.1400e4d43
lea rcx, [rbp + 0x238]
call fcn.1400e46a9
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
jne 0x14027d599
lea rax, [rbp + 0xab8]
mov qword [rbp + 0xae8], rax
lea rdx, [rbp + 0xb08]
lea rcx, [0x140357c30]
call fcn.1400e5284
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc38], rax
mov r8, qword [rbp + 0xc38]
lea rdx, [rbp + 0xb38]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e6c92
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
mov rcx, qword [rbp + 0xae8]
call fcn.1400e4fd2
mov qword [rbp + 0xc48], rax
mov r8, qword [rbp + 0xc48]
lea rdx, [rbp + 0xb68]
lea rcx, [0x140357c30]
call fcn.1400e7b1f
lea rcx, [rbp + 0xb68]
call fcn.1400e4550
lea rcx, [rbp + 0xb38]
call fcn.1400e4550
lea rcx, [rbp + 0xb08]
call fcn.1400e4550
mov dword [0x14034c208], 0xffffffff
call fcn.1400e6fb7
nop
lea rcx, [rbp + 0x238]
call fcn.1400e4d43
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400e4d43
call fcn.1400e58dd
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xb94]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Reset_Config
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d603
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e7e49
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e4915
movzx eax, al
test eax, eax
je 0x14027d6b0
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6643
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0xbb4]
call fcn.1400e6e36
lea rdx, [rbp + 0xbb4]
lea rcx, [0x1402ecdf0]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d660
call fcn.1400e6fb7
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
movss xmm1, dword [0x14030f200]
lea rcx, [rbp + 0xbd4]
call fcn.1400e6e36
lea rdx, [rbp + 0xbd4]
lea rcx, [0x1402ecdec]
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d6ab
call fcn.1400e6bf2
call fcn.1400e6fb7
call fcn.1400e58dd
movss xmm1, dword [0x1402d6ba8]
xorps xmm0, xmm0
call fcn.1400e6ff3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xbf4]
call fcn.1400e6e36
mov rdx, rax
lea rcx, str.Open_Directory
call fcn.1400e57f7
movzx eax, al
test eax, eax
je 0x14027d796
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x278]
call fcn.1400e79e4
nop
lea rcx, [rbp + 0x278]
call fcn.1400e60f3
movzx eax, al
test eax, eax
je 0x14027d789
lea rcx, [rbp + 0x278]
call fcn.1400e45d2
movzx eax, al
test eax, eax
je 0x14027d789
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x278]
call fcn.1400e4bef
nop
lea r8, [rbp + 0x2b8]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x2f8]
call fcn.1400e430c
lea rcx, [rbp + 0x2f8]
call fcn.1400e46a9
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x334], eax
lea rcx, [rbp + 0x2f8]
call fcn.1400e4d43
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400e4d43
nop
lea rcx, [rbp + 0x278]
call fcn.1400e8286
nop
lea rcx, [rbp + 0x48]
call fcn.1400e4d43
lea rcx, [rbp - 0x30]
lea rdx, [0x140315e40]
call fcn.1400e7c87
mov rcx, qword [rbp + 0xc58]
xor rcx, rbp
call fcn.1400e62fb
lea rsp, [rbp + 0xc68]
pop rdi
pop rbp
ret