Function at 0x1400145c4
Capabilities:
Check mutex on windows
Delete file
Get common file path
Move file
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x980
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x14009b3d0]
xor rax, rsp
mov qword [rsp + reloc.mfc140.dll_Ordinal_2416], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x90], rdx
mov r13d, 0x35
mov dword [rsp + 0x20], r13d
lea r9d, [r13 + 0x32]
lea r8, str...UtilAutoImport.cpp
lea rdx, str.ImportProfile
lea rcx, [rsp + 0xe0]
call fcn.140006b9c
nop
xor ebx, ebx
mov dword [rsp + 0x80], ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
lea r8, str.INTEL_AUTOIMPORT_EVENT
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r15, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140014f38
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014f38
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp eax, 0xffffffff
je 0x140014f38
mov dl, 0x2e
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
cmp eax, 0xffffffff
je 0x140014eff
lea r8d, [rax + 1]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_1504]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_8374]
lea rdx, [0x14006f3e0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
test eax, eax
jne 0x1400149cf
mov esi, 0x100
mov qword [rsp + 0x40], rsi
lea rax, [rsp + reloc.mfc140.dll_Ordinal_1120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x560]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x250]
lea r14d, [r13 - 0x32]
mov r8d, r14d
lea rdx, [rsp + 0x68]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
lea rdx, [rsp + 0x350]
lea r12d, [rsi + 4]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400149bf
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x770]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x870]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x250]
mov r8d, r14d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x350]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea rax, [rsp + reloc.mfc140.dll_Ordinal_1120]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x560]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x68]
mov edx, r12d
lea rcx, [rsp + 0x350]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__makepath_s]
lea rax, [0x14006f3e4]
mov qword [rsp + 0x28], rax
lea rax, str.691E52C4_EB8D_42b0_9FC3_B06162500A13
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x250]
lea r8, [rsp + 0x68]
mov edx, r12d
lea rcx, [rsp + 0x660]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__makepath_s]
lea esi, [rbx + 1]
mov r8d, esi
lea rdx, [rsp + 0x350]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140014903
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov dword [rsp + 0x70], 0x124f80
lea rcx, [rsp + 0x70]
call fcn.1400141a8
mov r14d, ebx
cmp r14d, dword [rsp + 0x70]
jae 0x1400149bf
lea eax, [r13 - 0x20]
cmp eax, esi
ja 0x1400149bf
mov r8d, esi
lea rdx, [rsp + 0x350]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140014903
mov eax, 0x45e7b273
mul r14d
shr edx, 0xd
imul ecx, edx, 0x7530
cmp r14d, ecx
jne 0x1400148ec
lea rdx, str.Attempting_to_move_auto_import_executable_to_temporary_folder.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x50]
mov edx, 0x40
mov r8d, 0x800436ee
mov ecx, dword [0x1400a3b30]
call qword [sym.imp.TraceAPI.DLL_EvTraceString]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
add r14d, 0x7d0
jmp 0x14001486b
lea rdx, [rsp + 0x350]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_1507]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, esi
mov edx, 0x40000000
lea rcx, [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400149bf
mov dword [rsp + 0x70], ebx
or r9, 0xffffffffffffffff
mov r8, qword [rdi]
mov rdx, r12
lea rcx, [rsp + reloc.mfc140.dll_Ordinal_320]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov r8d, r12d
lea rdx, [rsp + reloc.mfc140.dll_Ordinal_320]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
test rsi, rsi
je 0x140014991
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400149a5
mov rdx, rdi
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140.dll_Ordinal_300]
mov rcx, rax
call fcn.140013a60
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
jmp 0x140014eff
lea rdx, [0x14006f428]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
test eax, eax
je 0x140014a7b
lea rdx, [0x14006f42c]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
test eax, eax
je 0x140014a7b
lea rdx, [0x14006f430]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
test eax, eax
je 0x140014a7b
lea rdx, str.profile
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
test eax, eax
je 0x140014a7b
mov r8, qword [rdi]
lea rdx, str._s_has_an_invalid_file_extension.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.140013d2c
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x50]
mov edx, 0x40
mov r8d, 0x800436ee
mov ecx, dword [0x1400a3b30]
call qword [sym.imp.TraceAPI.DLL_EvTraceString]
jmp 0x140014eff
lea rdx, [0x14006f428]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_2899]
mov r14d, ebx
test eax, eax
setne r14b
lea rcx, [rsp + 0xa8]
call fcn.140028078
nop
lea rcx, [rsp + 0x250]
call fcn.140040098
test r14d, r14d
je 0x140014b24
lea rcx, [rsp + 0xa8]
call fcn.140028420
test eax, eax
jne 0x140014aec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_impersonate_logon_user__d.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
mov dword [rsp + 0x60], 0xe2
jmp 0x140014b06
lea rdx, str.Successfully_impersonated_logon_user
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
mov dword [rsp + 0x60], 0xea
lea rax, str...UtilAutoImport.cpp
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x50]
mov edx, r13d
lea rcx, [rsp + 0x58]
call fcn.140006d78
mov rdx, rdi
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_300]
mov rcx, rax
call fcn.140013e58
test eax, eax
je 0x140014bfa
mov qword [rsi + 0x28], r12
mov rdx, rdi
mov rcx, rsi
call fcn.14002bba8
mov dword [rsp + 0x80], eax
mov dl, 0x5c
mov rcx, rdi
test eax, eax
jne 0x140014bab
call qword [sym.imp.mfc140.dll_Ordinal_12510]
mov r8d, 1
add r8d, eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import_IT_Administrator_Preferences__s.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov r8d, 0x800436f1
jmp 0x140014eae
call qword [sym.imp.mfc140.dll_Ordinal_12510]
mov r8d, 1
add r8d, eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Successfully_auto_imported_IT_Administrator_Preferences_from_file__s.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov edx, 0x40
mov r8d, 0x436f4
jmp 0x140014eb3
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
lea rdx, [rsp + 0x70]
mov ecx, 0x1b4
call sub.MurocApi.dll_Ordinal_39
mov edx, 0x4000
lea rcx, [rsp + 0x250]
call fcn.140040154
test eax, eax
jne 0x140014c36
lea rdx, [rsp + 0x68]
mov ecx, Ordinal_211
call sub.MurocApi.dll_Ordinal_51
cmp dword [rsp + 0x70], ebx
jne 0x140014e64
cmp dword [rsp + 0x68], ebx
jne 0x140014e64
mov qword [rsp + 0x20], rbx
mov esi, 1
mov r9d, esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.PfMgrApi.dll_Ordinal_50
mov r13d, 0x43297
cmp eax, r13d
jne 0x140014ed2
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_4938]
mov r8d, esi
mov edx, esi
mov rcx, rax
call sub.PfMgrApi.dll_Ordinal_25
cmp eax, r13d
je 0x140014df4
cmp eax, 0x800432a7
jne 0x140014ce2
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import__s._Auto_import_not_set_in_profile.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov r8d, 0x800436ec
jmp 0x140014e39
cmp eax, 0x80043298
jne 0x140014d33
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import__s._Profile_may_be_corrupt.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov r8d, 0x800436ed
jmp 0x140014e39
cmp eax, 0x800432c9
jne 0x140014d70
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import__s._Profile_EAP_type_not_supported.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
jmp 0x140014d1d
cmp eax, 0x800432ca
jne 0x140014db0
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str._s_profile_with_machine_certificate_is_available_only_for_a_user_with_administrator_privileges.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
jmp 0x140014d1d
cmp eax, 0x800432cd
jne 0x140014e5d
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import__s._Cisco_Profile_type_is_not_supported.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
jmp 0x140014d1d
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
lea r8d, [rsi + rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Successfully_auto_imported_profile__s.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov r8d, 0x436f4
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x50]
mov edx, 0x41
mov ecx, dword [0x1400a3b30]
call qword [sym.imp.TraceAPI.DLL_EvTraceString]
call sub.PfMgrApi.dll_Ordinal_52
jmp 0x140014ed2
mov dl, 0x5c
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_12510]
mov r8d, 1
add r8d, eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.mfc140.dll_Ordinal_8417]
nop
mov r8, qword [rax]
lea rdx, str.Failed_to_auto_import__s._Import_is_disabled.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
mov r8d, 0x800436ed
mov edx, 0x41
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x50]
mov ecx, dword [0x1400a3b30]
call qword [sym.imp.TraceAPI.DLL_EvTraceString]
test r14d, r14d
je 0x140014ee4
lea rcx, [rsp + 0xa8]
call fcn.140028794
mov rdx, r12
mov rcx, qword [rsp + 0x50]
call fcn.140013d2c
nop
lea rcx, [rsp + 0xa8]
call fcn.1400280a8
lea rdx, str.Deleting_the_import_file.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_4648]
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x50]
xor r8d, r8d
lea edx, [r8 + 0x40]
mov ecx, dword [0x1400a3b30]
call qword [sym.imp.TraceAPI.DLL_EvTraceString]
nop
jmp 0x140014f4a
test r15, r15
je 0x140014f61
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.INTEL_AUTOIMPORT_EVENT
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140014fb7
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014fb7
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp eax, 0xffffffff
je 0x140014fb7
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x140014fc1
test rsi, rsi
je 0x140014fd9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
nop
lea rcx, [rsp + 0xe0]
call fcn.140006cd4
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + reloc.mfc140.dll_Ordinal_2416]
xor rcx, rsp
call fcn.14005d930
add rsp, 0x980
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret