Function at 0x140027ae0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Move file

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x26c0
call fcn.14005a020
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x26f8], rbx
mov qword [rsp + 0x2700], rsi
mov rax, qword [0x140092690]
xor rax, rsp
mov qword [rsp + 0x26b0], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov r15, rcx
mov qword [rsp + 0x50], rcx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor edx, edx
mov r14d, 0x80043298
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1a70]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1410]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1630]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1850]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1960]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x3c], Ordinal_266
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x1b80]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x25a0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x2490]
call sub.VCRUNTIME140.dll_memset
lea rax, vtable.CEncrypter.0
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x2490]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
call qword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
test eax, eax
jne 0x140027ca1
lea rdi, [rbx + 0x510]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140027c56
lea edx, [rax + 1]
call fcn.140025ed0
lea rdx, str._t_CProfileConverter::Convert90to100ForAllUser___started_
mov rcx, qword [rdi]
call fcn.140025be0
mov edx, 1
mov rcx, qword [rdi]
call fcn.140025ed0
mov r8d, Ordinal_266
lea rdx, [rsp + 0x25a0]
mov rcx, rbx
call fcn.14002dd60
test al, al
jne 0x140027cab
mov rcx, qword [rdi]
test rcx, rcx
je 0x140027ca1
lea rdx, str._t_FAILED__Unable_to_obtain_the_sub_folder_name__The_conversion_process_STOPPED_
call fcn.140025be0
lea rdx, str._t_CProfileConverter::Convert90to100ForAllUser___ended_
mov rcx, qword [rdi]
call fcn.140025be0
mov edx, 1
mov rcx, qword [rdi]
call fcn.140025ed0
nop
mov eax, 0x80043298
jmp 0x14002879d
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x1960]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
je 0x140027ca1
mov r9d, Ordinal_265
lea r8, [rsp + 0x1960]
lea edx, [r9 + 1]
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
lea rdx, [0x140065290]
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x1a70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x140027d6f
cmp qword [rdi], 0
je 0x140027ca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x1a70]
mov qword [rsp + 0x20], rax
lea r9, str._tInvalid_File_Handle_from_FindFirstFile__s_._GetLastError___reports__d
or r8, r13
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
nop
mov eax, 0x80043298
jmp 0x14002879d
mov eax, 1
nop dword [rax]
nop dword [rax + rax]
add rsi, 0x510
mov qword [rsp + 0x58], rsi
test eax, eax
je 0x14002877c
xor r12d, r12d
mov dword [rsp + 0x38], r12d
mov rcx, qword [rsi]
test rcx, rcx
je 0x140027de8
lea edx, [r12 + 1]
call fcn.140025ed0
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._t__START__User:__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rdx, [0x140065298]
lea rcx, [rsp + 0x2bc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x140028672
lea rdx, [0x140065c90]
lea rcx, [rsp + 0x2bc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x140028672
mov rcx, qword [rdi]
test rcx, rcx
je 0x140027e75
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._t_1_User:__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
mov rcx, qword [rbx + 0x510]
test byte [rsp + 0x290], 0x10
je 0x14002871d
mov r9d, Ordinal_265
lea r8, [rsp + 0x1960]
lea edx, [r9 + 1]
lea rcx, [rsp + 0x1410]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
lea rdx, [rsp + 0x2bc]
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [r15 + 0x55a]
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, str.IntelWirelessWLANProfiles.sav
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov r9d, Ordinal_265
lea r8, [rsp + 0x1960]
lea edx, [r9 + 1]
lea rcx, [rsp + 0x1630]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
lea rdx, [rsp + 0x2bc]
lea rcx, [rsp + 0x1630]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [r15 + 0x55a]
lea rcx, [rsp + 0x1630]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x1630]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, str.IntelWirelessWLANProfiles.sav
lea rcx, [rsp + 0x1630]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140027fab
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x20], rax
lea r9, str._tszProfileFileName:__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rdx, [0x140065468]
lea rcx, [rsp + 0x2bc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x140027fe5
lea rdx, [rsp + 0x290]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
jmp 0x140027d80
lea rdx, [0x140065468]
lea rcx, [rsp + 0x2bc]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
je 0x14002844f
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x2380]
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x1410]
mov edx, Ordinal_265
lea rcx, [rsp + 0x2380]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rdx, str.ITProfiles.enc
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140028094
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x20], rax
lea r9, str._tIT_Profile__szProfileFileName__s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rcx, [rsp + 0x1410]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rcx, qword [rsi]
test eax, eax
je 0x140028403
test rcx, rcx
je 0x140028103
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._tConverting_profiles_of_user___s__in_folder__s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
xor r8d, r8d
lea rdx, [rsp + 0x2bc]
mov rcx, r15
call fcn.14002df70
cmp eax, 0x43297
jne 0x14002844f
mov rcx, qword [rdi]
test rcx, rcx
je 0x140028160
mov edx, 1
call fcn.140025ed0
lea r9, str._tInitProfileMgr
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rcx, [rsp + 0x68]
call fcn.140011350
nop
lea rdx, str.IConvrtr_9.0_to_10.0
lea rcx, [rsp + 0x68]
call fcn.1400113f0
lea r8, [rsp + 0x2bc]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x3d0]
call fcn.1400181d0
nop
xor edx, edx
mov r8d, Ordinal_266
lea rcx, [rsp + 0x1740]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x1400], eax
mov byte [rsp + 0x1404], al
lea r8, [0x14006c1dc]
lea edx, [rax + 5]
lea rcx, [rsp + 0x1400]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r9, [rsp + 0x1740]
xor r8d, r8d
lea rdx, [rsp + 0x1400]
lea rcx, [rsp + 0x2380]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov r14d, eax
test eax, eax
je 0x1400283c2
lea rdx, [rsp + 0x1740]
lea rcx, [rsp + 0x3d0]
call fcn.140019a60
cmp eax, 0x43297
jne 0x1400283ad
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002826c
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1740]
mov qword [rsp + 0x20], rax
lea r9, str._tExportDatabase__s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
mov r14d, 0x80043298
mov qword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.PfMgrApi.dll_Ordinal_50
cmp eax, 0x43297
jne 0x1400283b3
lea rdx, [rsp + 0x1740]
mov rcx, r15
call fcn.14002def0
cmp eax, 0x43297
jne 0x1400283a6
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400282ff
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1740]
mov qword [rsp + 0x20], rax
lea r9, str._tImportItProfileDb90to100__s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
mov r14d, 0x43297
mov r12d, 1
mov dword [rsp + 0x38], r12d
lea r9, str.9.0.0
lea r8, str.SRC_VERSION
lea rdx, [rsp + 0x1850]
mov rcx, r15
call fcn.140030090
lea r9, str.10.0.0
lea r8, str.TGT_VERSION
lea rdx, [rsp + 0x1850]
mov rcx, r15
call fcn.140030090
lea r9, str.ITProfiles.enc
lea r8, str.ORG_IT_DB_FILE_NAME
lea rdx, [rsp + 0x1850]
mov rcx, r15
call fcn.140030090
lea r9, str.ITtemp.enc
lea r8, str.SRC_IT_DB_FILE_NAME
lea rdx, [rsp + 0x1850]
mov rcx, r15
call fcn.140030090
lea r9, str.ITProfil.enc
lea r8, str.TGT_IT_DB_FILE_NAME
lea rdx, [rsp + 0x1850]
mov rcx, r15
call fcn.140030090
call sub.PfMgrApi.dll_Ordinal_52
jmp 0x1400283b3
mov r14d, 0x80043298
lea rcx, [rsp + 0x1740]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x3d0]
call fcn.140018450
nop
lea rcx, [rsp + 0x68]
call fcn.140011370
nop
jmp 0x14002844f
test rcx, rcx
je 0x14002844f
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._tProfiles_of_user___s__in_folder__s_does_not_exist_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
cmp r14d, 0x43297
jne 0x1400284b4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400284a4
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1630]
mov qword [rsp + 0x20], rax
lea r9, str._tRemoving_Profile_folder__s_after_convert.
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rdx, [rsp + 0x1630]
mov rcx, r15
call fcn.14002e9f0
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, Ordinal_265
lea rcx, [rsp + 0x1520]
call sub.VCRUNTIME140.dll_memset
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x1960]
mov edx, 0x104
lea rcx, [rsp + 0x1520]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
lea rdx, [rsp + 0x2bc]
lea rcx, [rsp + 0x1520]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [r15 + 0x55a]
lea rcx, [rsp + 0x1520]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x1520]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, str.IntelWirelessWLANProfiles
lea rcx, [rsp + 0x1520]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002858e
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1520]
mov qword [rsp + 0x20], rax
lea r9, str._tszExistingFolder___s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rsi]
call fcn.140025be0
mov rcx, qword [rbx + 0x510]
cmp r14d, 0x80043298
jne 0x1400285f0
test rcx, rcx
je 0x1400285e0
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1520]
mov qword [rsp + 0x20], rax
lea r9, str._tProfile_folder___s__is_getting_deleted
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rsi]
call fcn.140025be0
lea rdx, [rsp + 0x1520]
mov rcx, r15
call fcn.14002e9f0
mov rdi, rsi
lea rcx, [rsp + 0x1520]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140028672
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002865c
lea edx, [rax + 1]
call fcn.140025ed0
lea rax, [rsp + 0x1520]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1630]
mov qword [rsp + 0x20], rax
lea r9, str._tProfile_folder___s__is_getting_renamed_back_to__s
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rsi]
call fcn.140025be0
lea rdx, [rsp + 0x1520]
lea rcx, [rsp + 0x1630]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
cmp qword [rdi], 0
je 0x140028702
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, str._t_d_profile_s__in_folder___s__is_are_converted.
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._t__END__User:__s_
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
mov edx, 1
mov rcx, qword [rdi]
call fcn.140025ed0
lea rdx, [rsp + 0x290]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rsi, qword [rsp + 0x40]
jmp 0x140027d80
test rcx, rcx
je 0x1400284b9
mov edx, 1
call fcn.140025ed0
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2bc]
mov qword [rsp + 0x20], rax
lea r9, str._tProfile_folder___s__does_not_exist._No_profile_conversion_will_be_performed.
or r8, 0xffffffffffffffff
mov edx, 0x800
lea rcx, [rsp + 0x1b80]
call fcn.140008c50
lea rdx, [rsp + 0x1b80]
mov rcx, qword [rdi]
call fcn.140025be0
jmp 0x1400284b9
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002879a
lea rdx, str._t_CProfileConverter::Convert90to100ForAllUser___completed_
call fcn.140025be0
nop
mov eax, r14d
mov rcx, qword [rsp + 0x26b0]
xor rcx, rsp
call fcn.140059ef0
lea r11, [rsp + 0x26c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret