Function at 0x140031530
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Get program files directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1400bc0f8]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
xor r8d, r8d
lea rdx, [0x14008804e]
call fcn.14001ced0
mov dword [rsp + 0x40], 1
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea ecx, [rbx + 0x30]
call fcn.14003fb30
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x60], rax
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
lea rax, [rbp - 0x50]
mov r15, 0xffffffffffffffff
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400315e7
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
ja 0x140031fda
mov eax, reloc.WS2_32.dll_shutdown
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x140031632
mov qword [rbp - 0x80], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.14004c3b0
mov byte [rsp + rdi + 0x70], 0
jmp 0x14003167d
mov rsi, rdi
or rsi, 0xf
cmp rsi, r14
jbe 0x140031643
mov rsi, r14
jmp 0x14003164a
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x70]
call fcn.1400158a0
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rsi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14004c3b0
mov byte [rbx + rdi], 0
xor ebx, ebx
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400316b0
lea rax, [rcx + 1]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x70]
mov word [rax + rcx], 0x5c
jmp 0x1400316d1
mov qword [rsp + 0x20], 1
lea r9, [0x14008c4ac]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x70]
call fcn.140015de0
mov r13, qword [rsp + 0x60]
movabs rax, 0x555555555555555
cmp qword [rsp + 0x68], rax
je 0x140031fcd
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov ecx, gethostbyname
call fcn.14003fb30
mov r12, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rbx
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov rsi, qword [rbp - 0x80]
cmp rsi, r14
ja 0x140031fe0
movabs rcx, 0x8000000000000000
mov qword [r12 + 0x28], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x140031773
mov qword [r12 + 0x20], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rax
lea rcx, [r12 + 0x10]
call fcn.14004c3b0
jmp 0x140031800
mov rbx, rsi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400317a8
mov rbx, r14
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.14003fb30
mov rcx, rax
test rax, rax
je 0x140031fe6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400317df
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400317d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140031fbb
jmp 0x140031786
test rcx, rcx
je 0x1400317dd
call fcn.14003fb30
jmp 0x1400317df
xor eax, eax
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x20], rsi
mov qword [r12 + 0x28], rbx
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14004c3b0
nop
inc qword [rsp + 0x68]
mov rax, qword [r13 + 8]
mov qword [r12], r13
mov qword [r12 + 8], rax
mov qword [r13 + 8], r12
mov qword [rax], r12
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rax, [rbp - 0x50]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031833
mov rax, qword [rbp - 0x78]
cmp rdi, rax
ja 0x14003186d
lea rbx, [rsp + 0x70]
cmp rax, 0x10
cmovae rbx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14004c3b0
mov byte [rbx + rdi], 0
jmp 0x140031881
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400152b0
mov r8d, 1
lea rdx, [0x14008c4ac]
lea rcx, [rsp + 0x70]
call fcn.14001f470
mov rdi, qword [rsp + 0x60]
movabs rsi, 0x555555555555555
cmp qword [rsp + 0x68], rsi
je 0x140031fcd
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
lea edx, [r12 + 1]
lea rcx, [rsp + 0x60]
call fcn.140036200
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x70]
call fcn.14001d150
nop
inc qword [rsp + 0x68]
mov rcx, qword [rdi + 8]
mov qword [rbx], rdi
mov qword [rbx + 8], rcx
mov qword [rdi + 8], rbx
mov qword [rcx], rbx
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rax, [rbp - 0x50]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031917
mov rax, qword [rbp - 0x78]
cmp rdi, rax
ja 0x140031951
lea rbx, [rsp + 0x70]
cmp rax, 0x10
cmovae rbx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14004c3b0
mov byte [rbx + rdi], 0
jmp 0x140031965
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400152b0
mov r8d, 1
lea rdx, [0x14008c4ac]
lea rcx, [rsp + 0x70]
call fcn.14001f470
mov r13, qword [rsp + 0x60]
cmp qword [rsp + 0x68], rsi
je 0x140031fcd
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
mov ecx, gethostbyname
call fcn.14003fb30
mov r12, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov rsi, qword [rbp - 0x80]
cmp rsi, r14
ja 0x140031fec
mov qword [r12 + 0x28], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x140031a0a
mov qword [r12 + 0x20], rsi
lea r8d, [rdx + 0x10]
mov rdx, rax
lea rcx, [r12 + 0x10]
call fcn.14004c3b0
jmp 0x140031aa2
mov rbx, rsi
or rbx, 0xf
cmp rbx, r14
jbe 0x140031a49
mov rbx, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003fb30
mov rcx, rax
test rax, rax
je 0x140031ff2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031a81
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140031a72
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140031fc1
jmp 0x140031a27
test rcx, rcx
je 0x140031a7e
call fcn.14003fb30
jmp 0x140031a81
mov rax, rdx
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x20], rsi
mov qword [r12 + 0x28], rbx
lea r8, [rsi + 1]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14004c3b0
nop
inc qword [rsp + 0x68]
mov rax, qword [r13 + 8]
mov qword [r12], r13
mov qword [r12 + 8], rax
mov qword [r13 + 8], r12
mov qword [rax], r12
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rbp - 0x50]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031ad1
mov rax, qword [rbp - 0x78]
cmp rdi, rax
ja 0x140031b0b
lea rbx, [rsp + 0x70]
cmp rax, 0x10
cmovae rbx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14004c3b0
mov byte [rbx + rdi], 0
jmp 0x140031b1f
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400152b0
mov r13, qword [rsp + 0x60]
movabs rax, 0x555555555555555
cmp qword [rsp + 0x68], rax
je 0x140031fcd
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, gethostbyname
call fcn.14003fb30
mov rsi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
lea r12, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r12, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x80]
cmp rdi, r14
ja 0x140031ff8
mov qword [rax + 0x28], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x140031bb3
mov qword [rax + 0x20], rdi
lea r8d, [rdx + 0x10]
mov rdx, r12
lea rcx, [rax + 0x10]
call fcn.14004c3b0
jmp 0x140031c46
mov rax, rdi
or rax, 0xf
cmp rax, r14
jbe 0x140031bef
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003fb30
mov rcx, rax
test rax, rax
je 0x140031ffe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031c2a
mov r14, rax
cmp rax, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140031c1b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140031fc7
jmp 0x140031bcd
test rcx, rcx
je 0x140031c27
call fcn.14003fb30
jmp 0x140031c2a
mov rax, rdx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x28], r14
lea r8, [rdi + 1]
mov rdx, r12
mov rcx, rax
call fcn.14004c3b0
nop
inc qword [rsp + 0x68]
mov rax, qword [r13 + 8]
mov qword [rsi], r13
mov qword [rsi + 8], rax
mov qword [r13 + 8], rsi
mov qword [rax], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor r14d, r14d
mov qword [rbp - 0x60], r14
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x58], rcx
mov byte [rbp - 0x70], r14b
mov rax, qword [rsp + 0x60]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140031dfa
nop dword [rax]
lea r9, [rbx + 0x10]
cmp qword [r9 + 0x18], 0x10
jb 0x140031c9e
mov r9, qword [r9]
mov rsi, r15
inc rsi
cmp byte [r9 + rsi], 0
jne 0x140031ca1
cmp rsi, rcx
ja 0x140031cd5
lea rdi, [rbp - 0x70]
cmp rcx, 0x10
cmovae rdi, qword [rbp - 0x70]
mov qword [rbp - 0x60], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rdi
call fcn.14004c3b0
mov byte [rdi + rsi], 0
jmp 0x140031ce4
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1400152b0
lea rcx, [rbp - 0x70]
mov r8, qword [rbp - 0x58]
cmp r8, 0x10
setae r10b
mov r9, qword [rbp - 0x70]
cmovae rcx, r9
lea rdx, [rbp - 0x50]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140031d10
mov rcx, qword [rbp - 0x60]
sub r8, rcx
cmp r8, 7
jb 0x140031d5c
lea rax, [rcx + 7]
mov qword [rbp - 0x60], rax
lea rdi, [rbp - 0x70]
test r10b, r10b
cmovne rdi, r9
add rdi, rcx
mov r8d, 7
lea rdx, str.log.txt
mov rcx, rdi
call fcn.14004c3b0
mov byte [rdi + 7], 0
jmp 0x140031d7c
mov qword [rsp + 0x20], 7
lea r9, str.log.txt
xor r8d, r8d
lea edx, [r8 + 7]
lea rcx, [rbp - 0x70]
call fcn.140015de0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
lea rdx, [0x14008c4b8]
call fcn.140053038
mov rdi, rax
test rax, rax
je 0x140031db3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400543c8
mov rcx, rdi
call fcn.1400531cc
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140031dd0
test al, 0x10
je 0x140031de6
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsp + 0x60]
je 0x140031dfa
mov rcx, qword [rbp - 0x58]
jmp 0x140031c90
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rax, [rbp - 0x50]
nop
inc r15
cmp byte [rax + r15], 0
jne 0x140031e00
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x140031e50
lea rax, [rcx + r15]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140031e36
mov rax, qword [rsi]
lea rbx, [rax + rcx]
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14004c3b0
mov byte [rbx + r15], 0
jmp 0x140031e68
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call fcn.140015de0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140031ea3
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032004
call fcn.14003f74c
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140031eef
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031eea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003200a
call fcn.14003f74c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + 8]
mov qword [rax], r14
mov rbx, qword [rcx]
test rbx, rbx
je 0x140031f73
mov rdi, qword [rbx]
mov rdx, qword [rbx + 0x28]
cmp rdx, 0x10
jb 0x140031f4e
inc rdx
mov rcx, qword [rbx + 0x10]
cmp rdx, 0x1000
jb 0x140031f49
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140031fb5
mov rcx, r8
call fcn.14003f74c
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x10], 0
mov edx, gethostbyname
mov rcx, rbx
call fcn.14003f74c
mov rbx, rdi
test rdi, rdi
jmp 0x140031f12
mov edx, gethostbyname
mov rcx, qword [rsp + 0x60]
call fcn.14003f74c
mov rax, rsi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14003fb10
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140062acc
nop
call fcn.140015860
nop
call fcn.140015860
nop
call fcn.140015860
nop
lea rcx, str.list_too_long
call fcn.140038598
nop
call fcn.140015880
nop
call fcn.140015880
int3
call fcn.140062acc
nop
call fcn.140015880
int3
call fcn.140062acc
nop
call fcn.140015880
int3
call fcn.140062acc
nop
call fcn.140062acc
nop
call fcn.140062acc
int3