Function at 0x140012fd8
Capabilities:
Create process on windows
Delete file
Move file
Self delete
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x50], r13d
lea rcx, [rbp + 0xd0]
call fcn.14000aa48
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.1400071c0
nop
lea rcx, [rbp + 0xb0]
call fcn.14000a4ac
lea rcx, [rbp + 0xb0]
call fcn.14000694c
test al, al
jne 0x14001396b
lea rcx, [rbp + 0xb0]
call fcn.14000ab44
lea rcx, [rbp + 0xb0]
call fcn.14000a3a8
mov ecx, 0x13f6
call fcn.14000db8c
mov rbx, rax
mov ecx, 0x13f5
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140001b9c
nop
lea r8, str._r_n_r_n
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006c18
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140006c18
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x170]
call fcn.140002050
mov esi, 0x13f2
cmp dword [0x14004a9a8], 1
je 0x14001313e
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140001b9c
nop
mov dword [rsp + 0x50], 1
lea rcx, [rbp + 0x1d0]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140001b9c
nop
lea edi, [r13 + 3]
mov dword [rsp + 0x50], edi
mov r9d, 0x10024
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011cc4
cmp eax, 6
mov bl, 1
jne 0x140013141
mov bl, r13b
test dil, 2
je 0x140013158
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
test dil, 1
je 0x14001316e
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x30]
call fcn.140002050
test bl, bl
jne 0x14001395e
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
lea rdx, [0x14003d7e4]
lea rcx, [rbp + 0x110]
call fcn.140008840
mov r15, rax
lea rcx, [rbp + 0x110]
call fcn.140002050
test r15, r15
jne 0x140013215
mov ecx, 0x1400
call fcn.14000db8c
mov rdx, rax
lea r8, str.Uninstall.lst
lea rcx, [rbp - 0x10]
call fcn.14000e30c
nop
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
mov r9d, 0x10010
lea r8, [rbp + 0x110]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011cc4
nop
lea rcx, [rbp + 0x110]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
jmp 0x140013958
mov ecx, 0x1406
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140001b9c
nop
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140001b9c
nop
call fcn.1400139b4
lea rcx, [0x140046771]
call fcn.14000d920
cmp byte [0x140046772], r13b
jne 0x140013944
mov r12b, r13b
mov r14d, r13d
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a5c
test rax, rax
je 0x140013553
lea rcx, [rbp - 0x30]
call fcn.1400024c0
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x170]
call fcn.14000e948
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x170]
call fcn.14000edb0
nop
lea rcx, [rbp + 0x170]
call fcn.14000d7e8
lea rcx, [rbp - 0x30]
call fcn.14000df28
lea rcx, [rbp - 0x30]
call fcn.14000694c
test al, al
jne 0x140013516
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.14000aed8
nop
lea rcx, [rbp + 0x50]
call fcn.140008610
mov ebx, eax
lea rcx, [rbp + 0x50]
call fcn.140008698
cmp ebx, 0xffffffff
je 0x140013323
test bl, 0x10
je 0x140013323
lea rcx, [rbp + 0x50]
call fcn.1400087b4
movzx eax, al
add r14d, eax
jmp 0x14001350c
lea rcx, [rbp + 0x50]
call fcn.140008728
movzx ecx, al
add r14d, ecx
test al, al
jne 0x14001350c
cmp ebx, 0xffffffff
je 0x14001350c
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000a23c
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1f0]
call fcn.14000a23c
nop
or edi, 4
mov dword [rsp + 0x50], edi
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007050
test eax, eax
je 0x1400133a7
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
or edi, 8
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140007050
test eax, eax
mov bl, 1
jne 0x1400133aa
mov bl, r13b
test dil, 8
je 0x1400133c1
and edi, 0xfffffff7
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
test dil, 4
je 0x1400133da
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x1f0]
call fcn.140002050
test bl, bl
je 0x140013502
mov r12b, 1
lea rcx, [rbp + 0x90]
call fcn.1400024c0
nop
mov esi, r13d
mov edx, esi
lea rcx, [rbp + 0x30]
call fcn.140008f6c
mov rbx, rax
lea r8, [0x14003c250]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140006b9c
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.140008974
nop
lea r8, str..tmp
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140006c18
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140006a24
nop
lea rcx, [rbp + 0x210]
call fcn.140002050
nop
lea rcx, [rbp + 0x230]
call fcn.140002050
nop
lea rcx, [rbp + 0x250]
call fcn.140002050
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x90]
call fcn.140008610
cmp eax, 0xffffffff
je 0x1400134a4
inc esi
cmp esi, 0x3e8
jb 0x1400133f5
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1400018c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400134d9
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140007078
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbp + 0x90]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x50]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.140002050
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a5c
test rax, rax
jne 0x140013287
test r14d, r14d
je 0x140013553
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140020cd4
jmp 0x140013267
mov rcx, r15
call fcn.14001fa28
lea rcx, str.Uninstall.lst
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x150]
call fcn.1400024c0
nop
lea rcx, [rbp + 0x150]
call fcn.140013e28
lea rcx, [rbp + 0x150]
call fcn.1400085e0
test al, al
je 0x14001359d
lea rcx, [rbp + 0x150]
call fcn.14000623c
lea rcx, [rbp + 0xf0]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xf0]
call fcn.14000ab60
test r12b, r12b
je 0x140013645
cmp dword [0x14004a9a8], 1
je 0x140013645
mov r9d, 0x10040
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call fcn.140011cc4
lea rdx, [0x14003b400]
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x30]
call fcn.14000a23c
nop
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.140007050
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.140002050
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
test ebx, ebx
jne 0x140013645
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rbp + 0x30]
call fcn.1400113c4
nop
lea r8, str.Uninstall_Rar.Bat
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140006c18
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x70]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rdx, str.__s___wait_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
mov ebx, 5
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov qword [rsp + 0x20], r8
mov r9, rax
lea rdx, str.del___s__r_nrd___s__r_nif_not_exist___s__goto_done_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
sub rbx, 1
jne 0x1400136b4
lea rdx, str.:done_r_n
lea rcx, [rbp + 0x70]
call fcn.140006a14
cmp dword [0x14004a9a8], 1
je 0x140013756
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r9, rax
mov r8, rax
lea rdx, str.if_exist___s____s___warning_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r8, rax
lea rdx, str.del___s__r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x270]
call fcn.1400075ac
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x270]
call fcn.140007884
test al, al
je 0x140013906
lea rcx, [rbp + 0x270]
call fcn.140013e20
lea rcx, [rbp - 0x30]
call fcn.14000cdb8
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.14000ed2c
lea rcx, [rbp - 0x30]
call fcn.140007014
mov r8, rax
lea rcx, [rbp - 0x30]
call fcn.14000cdb0
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140007a40
test al, al
je 0x14001380b
lea rcx, [rbp + 0x270]
call fcn.1400079a0
lea rcx, [rbp - 0x10]
call fcn.1400024c0
nop
lea rdx, str.COMSPEC
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140012f04
mov bl, al
lea rcx, [rbp + 0x10]
call fcn.140002050
test bl, bl
je 0x1400138f2
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r9, rax
lea rcx, [rbp - 0x10]
call fcn.1400018c0
mov r8, rax
lea rdx, str._s__c___s_
lea rcx, [rbp + 0x10]
call fcn.14000e30c
nop
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400164a0
mov dword [rsp + 0x60], ebx
mov dword [rbp - 0x64], 1
mov word [rbp - 0x60], r13w
lea rcx, [0x14003c270]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x10]
call fcn.1400018c0
mov rdx, rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.14000d7e8
nop
lea rcx, [rbp + 0x270]
call fcn.140007644
nop
lea rcx, [rbp + 0x70]
call fcn.140002050
nop
lea rcx, [rbp + 0x130]
call fcn.140002050
nop
lea rcx, [rbp + 0xf0]
call fcn.140002050
nop
lea rcx, [rbp + 0x150]
call fcn.140002050
nop
lea rcx, [rbp + 0x190]
call fcn.140002050
nop
lea rcx, [rbp + 0x1b0]
call fcn.140002050
nop
lea rcx, [rbp + 0x1d0]
call fcn.140002050
nop
lea rcx, [rbp + 0xb0]
call fcn.140002050
nop
lea rcx, [rbp + 0xd0]
call fcn.140002050
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400143d0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret