Function at 0x140009dc0
Capabilities:
Delete file
Enumerate files on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x600
mov rax, qword [0x140089140]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
xor r13d, r13d
mov r14d, r13d
mov dword [rsp + 0x20], r13d
mov r8d, 0x104
lea rdx, [rsp + 0x3e0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140009f65
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x168], r13
mov r8d, 9
lea rdx, [0x1400796c0]
lea rcx, [rsp + 0x150]
call fcn.140020a80
nop
lea r8, [0x140078b70]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xc0]
call fcn.14001e7e0
cmp qword [rax + 0x18], 7
jbe 0x140009e7d
mov rax, qword [rax]
lea rdx, [rsp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xd8]
cmp rdx, 7
jbe 0x140009edb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa33
call fcn.14003f250
movdqa xmm0, xmmword [0x14007c9d0]
movdqu xmmword [rsp + 0xd0], xmm0
mov word [rsp + 0xc0], r13w
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140009f97
lea rdx, str.Error_finding_user_directories
lea rcx, [0x14008b140]
call fcn.14001e970
mov rcx, rax
call fcn.14001ec30
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140009f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa2d
call fcn.14003f250
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.14003f230
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
movabs rdx, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
mov r9d, 0xa
test byte [rsp + 0x190], 0x10
je 0x14000a9a1
movzx ecx, word [rsp + 0x1bc]
movzx eax, word [rsp + 0x1be]
cmp cx, 0x2e
jne 0x140009ff7
test ax, ax
je 0x14000a9a1
cmp cx, cx
jne 0x140009ff7
cmp ax, cx
jne 0x140009ff7
cmp word [rsp + 0x1c0], 0
je 0x14000a9a1
lea rax, [rsp + 0x1bc]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14000a006
mov rax, rdx
sub rax, qword [rsp + 0x160]
cmp rax, rdi
jb 0x14000aa39
lea r12, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova r12, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r15, qword [rsp + 0x160]
add r15, rdi
mov ebx, 7
lea rsi, [rsp + 0x60]
cmp r15, rbx
jbe 0x14000a0de
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x14000a0b2
mov rbx, rdx
lea rcx, [r8 + r8]
cmp rcx, 0x1000
jb 0x14000a0d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000aa4b
mov rcx, rax
call fcn.14003f4f8
test rax, rax
je 0x14000aa3f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000a0d9
cmp rbx, 0xa
cmovb rbx, r9
lea rcx, [rbx + 1]
cmp rcx, r8
ja 0x14000aa4b
add rcx, rcx
jne 0x14000a07d
mov rsi, r13
jmp 0x14000a0d9
call fcn.14003f4f8
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
mov rax, qword [rsp + 0x160]
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.140065d70
lea rcx, [rsi + rbx]
lea r8, [rdi + rdi]
lea rdx, [rsp + 0x1bc]
call fcn.140065d70
mov word [rsi + r15*2], r13w
bts r14d, 0xb
mov r8d, 8
lea rdx, str.Desktop
lea rcx, [rsp + 0x60]
call fcn.14001bd20
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x120], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts r14d, 0xc
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000a1c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa45
call fcn.14003f250
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 7
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, qword [rsp + 0x120]
lea rcx, [rsp + 0x28]
call fcn.140020a80
or r14d, 0x6000
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xe8]
call fcn.140005640
movsd xmm0, qword [rax]
movsd qword [rsp + 0xb0], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x90], ecx
lea rax, [0x140089dc0]
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x180], xmm0
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x14000a2b8
cmp eax, 1
setne bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a2c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a2c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa51
jmp 0x14000a2c4
xor bl, bl
test ecx, ecx
jne 0x14000aa57
jmp 0x14000a279
call fcn.14003f250
test bl, bl
je 0x14000a959
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 7
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, qword [rsp + 0x120]
lea rcx, [rsp + 0x28]
call fcn.140020a80
or r14d, 0x18000
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x100]
call fcn.14001e100
test eax, eax
jne 0x14000aa71
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a383
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a37e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa85
call fcn.14003f250
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov r15, qword [rsp + 0x108]
test r15, r15
je 0x14000a3ad
lock inc dword [r15 + 8]
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x170], xmm0
test r15, r15
je 0x14000a3d5
lock inc dword [r15 + 8]
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x180], xmm1
test r15, r15
je 0x14000a435
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14000a428
mov rbx, qword [rsp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a428
mov r15, qword [rsp + 0x108]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000a430
mov r15, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x20]
mov r12, qword [rsp + 0x180]
nop dword [rax]
mov rsi, qword [rsp + 0x170]
cmp rsi, r12
je 0x14000a8b2
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140004e20
mov edx, dword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
test edx, edx
je 0x14000a483
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x14000aa8b
cmp eax, 2
jne 0x14000a60e
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], r13
mov r8d, 4
lea rdx, [0x140079730]
lea rcx, [rsp + 0x130]
call fcn.140020a80
or r14d, 0x600
or r14d, 1
mov dword [rsp + 0x20], r14d
lea rcx, [rsi + 0x20]
cmp qword [rsi + 0x38], 7
jbe 0x14000a4e0
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsi + 0x30]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.140003c20
cmp rax, rdx
je 0x14000a52e
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000a504
cmp cx, 0x2f
jne 0x14000a50d
add rax, 2
cmp rax, rdx
jne 0x14000a4f5
cmp rax, rdx
je 0x14000a52e
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000a52e
cmp cx, 0x2f
je 0x14000a52e
mov rbx, r8
cmp rax, r8
jne 0x14000a512
mov r8d, 0x3a
mov rcx, rbx
call fcn.14003df50
cmp rbx, rax
je 0x14000a57f
lea rdx, [rax - 2]
cmp rbx, rdx
je 0x14000a57f
cmp word [rdx], 0x2e
jne 0x14000a561
lea rcx, [rdx - 2]
cmp rbx, rcx
jne 0x14000a582
cmp word [rcx], 0x2e
jne 0x14000a582
jmp 0x14000a57f
sub rdx, 2
cmp rbx, rdx
je 0x14000a57f
nop word [rax + rax]
cmp word [rdx], 0x2e
je 0x14000a582
sub rdx, 2
cmp rbx, rdx
jne 0x14000a570
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, rax
lea rcx, [rsp + 0x28]
call fcn.140020a80
or r14d, 0x1c2
mov dword [rsp + 0x20], r14d
lea rax, [rsp + 0x130]
mov rbx, qword [rsp + 0x148]
cmp rbx, 7
cmova rax, qword [rsp + 0x130]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140004050
test eax, eax
jne 0x14000a616
mov dil, 1
jmp 0x14000a619
mov rbx, qword [rsp + 0x148]
xor dil, dil
test r14b, 2
je 0x14000a686
and r14d, 0xfffffffd
mov dword [rsp + 0x20], r14d
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a672
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa9c
call fcn.14003f250
mov rbx, qword [rsp + 0x148]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r13w
test r14b, 1
je 0x14000a6d5
and r14d, 0xfffffffe
mov dword [rsp + 0x20], r14d
cmp rbx, 7
jbe 0x14000a6d5
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a6d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaa2
call fcn.14003f250
test dil, dil
je 0x14000a898
add rsi, 0x20
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000a6ef
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.140003c20
cmp rax, rdi
je 0x14000a74b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000a716
cmp cx, 0x2f
jne 0x14000a71f
add rax, 2
cmp rax, rdi
jne 0x14000a707
cmp rax, rdi
je 0x14000a74b
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000a74b
cmp cx, 0x2f
je 0x14000a74b
mov rbx, rdx
cmp rax, rdx
jne 0x14000a730
sub rdi, rbx
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140020a80
or r14d, 0x1c
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x130]
call fcn.14001bda0
or r14d, 0x20
mov dword [rsp + 0x20], r14d
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000a7d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a7d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaa8
call fcn.14003f250
lea rcx, [rsp + 0x130]
call fcn.140009af0
test al, al
je 0x14000a850
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000a7f7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000a829
lea rdx, str.Deleted:
lea rcx, [0x14008ae80]
call fcn.14001e970
mov rdx, rsi
mov rcx, rax
call fcn.14001ecc0
mov rcx, rax
call fcn.14001ec30
jmp 0x14000a850
lea rdx, str.Failed_to_delete:
lea rcx, [0x14008b140]
call fcn.14001e970
mov rdx, rsi
mov rcx, rax
call fcn.14001ecc0
mov rcx, rax
call fcn.14001ec30
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x14000a898
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a893
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aaae
call fcn.14003f250
lea rcx, [rsp + 0x170]
call fcn.140004f90
test eax, eax
jne 0x14000aab4
jmp 0x14000a440
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x14000a908
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a8fb
mov rbx, qword [rsp + 0x178]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a8fb
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rsp + 0x20]
mov r15, qword [rsp + 0x108]
test r15, r15
je 0x14000a94f
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14000a94a
mov rbx, qword [rsp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000a94a
mov rcx, qword [rsp + 0x108]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rsp + 0x20]
jmp 0x14000a959
mov rdx, qword [rsp + 0x128]
cmp rdx, 7
jbe 0x14000a9a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a99c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aabc
call fcn.14003f250
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
movabs rdx, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
mov r9d, 0xa
jne 0x140009fb1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140009f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009f60
call fcn.1400497f0
nop
call fcn.1400497f0
int3
call fcn.140002410
int3
call fcn.1400497f0
nop
call fcn.1400497f0
nop
call fcn.140002370
nop
call fcn.1400497f0
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x180]
lea rcx, str.exists
call fcn.140004dc0
nop
lea r8, [rsp + 0x28]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140004d50
nop
call fcn.1400497f0
nop
lea r8, [rsi + 0x20]
lea rcx, str.directory_entry::status
call fcn.140004d50
nop
call fcn.1400497f0
nop
call fcn.1400497f0
nop
call fcn.1400497f0
nop
call fcn.1400497f0
int3
mov edx, eax
call fcn.140004c60
nop
call fcn.1400497f0
int3