Function at 0x1400e4b90
Capabilities:
Delete file
Execute command
Self delete

Disassembly:
jmp 0x14027d7a0
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14034c268]
xor rax, rbp
mov qword [rbp + 0xc58], rax
mov dword [rbp + 0xc14], 0
lea rcx, [0x140373394]
call fcn.1400e8871
lea rcx, str.Config_System
call fcn.1400e6a0d
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x80
lea rdx, [0x140357b50]
lea rcx, str.New_Config_Name
call fcn.1400e56f3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x714]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Create_Config
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027d8a8
lea rdx, [0x140357b50]
lea rcx, [rbp + 0x738]
call fcn.1400e60e4
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, str..config
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 8]
call fcn.1400e8263
nop
lea rcx, [rbp + 0x738]
call fcn.1400e4d48
lea rcx, [rbp + 8]
call fcn.1400e6be3
nop
lea rcx, [rbp + 8]
call fcn.1400e4d48
call fcn.1400e85b5
lea rdx, [0x14034db38]
lea rcx, [rbp + 0x48]
call fcn.1400e49a6
nop
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x140357f9c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140357b48], eax
jle 0x14027d92d
lea rcx, [0x140357b48]
call fcn.1400e80f1
cmp dword [0x140357b48], 0xffffffff
jne 0x14027d92d
mov edx, 0x20
lea rcx, [0x140357bd0]
call fcn.1400e462c
lea rcx, [0x140357bd0]
call fcn.1400e5c2a
lea rcx, [0x1402bb950]
call fcn.1400e5c48
lea rcx, [0x140357b48]
call fcn.1400e82b3
lea rcx, [0x140357bd0]
call fcn.1400e68cd
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x778]
call fcn.1400e79b7
nop
lea rdx, [rbp + 0x778]
lea rcx, [rbp + 0xa8]
call fcn.1400e8844
nop
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x778]
call fcn.1400e823b
mov edx, 0x10
lea rcx, [rbp + 0xd8]
call fcn.1400e596e
lea rax, [rbp + 0x7b8]
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x7e8]
call fcn.1400e612a
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0xd8]
call fcn.1400e4b81
nop
mov edx, 0x10
lea rcx, [rbp + 0x108]
call fcn.1400e596e
lea rax, [rbp + 0x808]
mov qword [rbp + 0x838], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x838]
call fcn.1400e612a
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0xc28]
lea rcx, [rbp + 0x108]
call fcn.1400e5c6b
nop
jmp 0x14027da23
lea rcx, [rbp + 0xd8]
call fcn.1400e6099
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xd8]
call fcn.1400e8628
movzx eax, al
test eax, eax
je 0x14027dbfd
lea rcx, [rbp + 0xd8]
call fcn.1400e6a53
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x138]
call fcn.1400e82ef
movzx eax, al
test eax, eax
je 0x14027daf3
xor r8d, r8d
lea rdx, str..config
lea rcx, [rbp + 0x878]
call fcn.1400e427b
nop
mov eax, dword [rbp + 0xc14]
or eax, 1
mov dword [rbp + 0xc14], eax
mov rcx, qword [rbp + 0x138]
call fcn.1400e6bf7
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8b8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e4b9a
mov qword [rbp + 0xc30], rax
mov eax, dword [rbp + 0xc14]
or eax, 2
mov dword [rbp + 0xc14], eax
lea rdx, [rbp + 0x878]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e4514
movzx eax, al
test eax, eax
je 0x14027daf3
mov dword [rbp + 0xc38], 1
jmp 0x14027dafd
mov dword [rbp + 0xc38], 0
movzx eax, byte [rbp + 0xc38]
mov byte [rbp + 0x854], al
mov eax, dword [rbp + 0xc14]
and eax, 2
test eax, eax
je 0x14027db2b
and dword [rbp + 0xc14], 0xfffffffd
lea rcx, [rbp + 0x8b8]
call fcn.1400e823b
nop
mov eax, dword [rbp + 0xc14]
and eax, 1
test eax, eax
je 0x14027db4b
and dword [rbp + 0xc14], 0xfffffffe
lea rcx, [rbp + 0x878]
call fcn.1400e823b
movzx eax, byte [rbp + 0x854]
test eax, eax
je 0x14027dbf8
mov rcx, qword [rbp + 0x138]
call fcn.1400e6bf7
mov qword [rbp + 0xc28], rax
lea rdx, [rbp + 0x8f8]
mov rcx, qword [rbp + 0xc28]
call fcn.1400e613e
mov qword [rbp + 0xc30], rax
mov rax, qword [rbp + 0xc30]
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rax
lea rdx, [rbp + 0x938]
mov rcx, qword [rbp + 0xc40]
call fcn.1400e4bf4
mov qword [rbp + 0xc48], rax
mov rax, qword [rbp + 0xc48]
mov qword [rbp + 0xc50], rax
mov rdx, qword [rbp + 0xc50]
lea rcx, [0x140357bd0]
call fcn.1400e5923
nop
lea rcx, [rbp + 0x938]
call fcn.1400e4d48
nop
lea rcx, [rbp + 0x8f8]
call fcn.1400e823b
jmp 0x14027da17
lea rcx, [rbp + 0x108]
call fcn.1400e4668
nop
lea rcx, [rbp + 0xd8]
call fcn.1400e4668
nop
lea rcx, [rbp + 0xa8]
call fcn.1400e4668
mov dword [rbp + 0x154], 0
jmp 0x14027dc3d
mov eax, dword [rbp + 0x154]
inc eax
mov dword [rbp + 0x154], eax
movsxd rax, dword [rbp + 0x154]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357bd0]
call fcn.1400e59d2
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027dcf8
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x974]
call fcn.1400e6e13
mov qword [rbp + 0xc28], rax
mov eax, dword [rbp + 0x154]
cmp dword [0x14034c208], eax
jne 0x14027dc97
mov byte [rbp + 0xc30], 1
jmp 0x14027dc9e
mov byte [rbp + 0xc30], 0
movsxd rax, dword [rbp + 0x154]
mov rdx, rax
lea rcx, [0x140357bd0]
call fcn.1400e5428
mov rcx, rax
call fcn.1400e46ae
mov qword [rbp + 0xc38], rax
mov r9, qword [rbp + 0xc28]
xor r8d, r8d
movzx edx, byte [rbp + 0xc30]
mov rcx, qword [rbp + 0xc38]
call fcn.1400e80d8
movzx eax, al
test eax, eax
je 0x14027dcf3
mov eax, dword [rbp + 0x154]
mov dword [0x14034c208], eax
jmp 0x14027dc2f
cmp dword [0x14034c208], 0xffffffff
je 0x14027dd2e
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357bd0]
call fcn.1400e5428
mov rcx, rax
call fcn.1400e46ae
mov rdx, rax
lea rcx, str.Selected:__s
call fcn.1400e6909
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x994]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Load_Selected
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027ddc4
cmp dword [0x14034c208], 0
jl 0x14027ddc4
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357bd0]
call fcn.1400e59d2
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027ddc4
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357bd0]
call fcn.1400e5428
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.1400e49a6
nop
lea rcx, [rbp + 0x178]
call fcn.1400e698b
nop
lea rcx, [rbp + 0x178]
call fcn.1400e4d48
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x9b4]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Save_Selected
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027de39
cmp dword [0x14034c208], 0
jl 0x14027de39
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357bd0]
call fcn.1400e59d2
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027de39
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e7e0d
xor edx, edx
lea rcx, str.reallySave
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027df20
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6625
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0x9d4]
call fcn.1400e6e13
lea rdx, [rbp + 0x9d4]
lea rcx, [0x1402ec990]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027de96
call fcn.1400e6f99
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0x9f4]
call fcn.1400e6e13
lea rdx, [rbp + 0x9f4]
lea rcx, [0x1402ec98c]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027df1b
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357bd0]
call fcn.1400e5428
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.1400e49a6
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e6be3
call fcn.1400e6f99
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400e4d48
call fcn.1400e58c4
call fcn.1400e85b5
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xa14]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Delete_Selected
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027df8a
cmp dword [0x14034c208], 0
jl 0x14027df8a
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc28], rax
lea rcx, [0x140357bd0]
call fcn.1400e59d2
mov rcx, qword [rbp + 0xc28]
cmp rcx, rax
jae 0x14027df8a
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e7e0d
xor edx, edx
lea rcx, str.reallyDelete
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027e1ad
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6625
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0xa34]
call fcn.1400e6e13
lea rdx, [rbp + 0xa34]
lea rcx, [0x1402ec990]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027dfe7
call fcn.1400e6f99
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0xa54]
call fcn.1400e6e13
lea rdx, [rbp + 0xa54]
lea rcx, [0x1402ec98c]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027e1a8
movsxd rax, dword [0x14034c208]
mov rdx, rax
lea rcx, [0x140357bd0]
call fcn.1400e5428
mov rdx, rax
lea rcx, [rbp + 0x1f8]
call fcn.1400e49a6
nop
lea r8, [0x14031649c]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xa78]
call fcn.1400e7930
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
lea r8, [rbp + 0x1f8]
mov rdx, qword [rbp + 0xc30]
lea rcx, [rbp + 0x238]
call fcn.1400e5897
nop
lea rcx, [rbp + 0xa78]
call fcn.1400e4d48
lea rcx, [rbp + 0x238]
call fcn.1400e46ae
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
jne 0x14027e189
lea rax, [rbp + 0xab8]
mov qword [rbp + 0xae8], rax
lea rdx, [rbp + 0xb08]
lea rcx, [0x140357bd0]
call fcn.1400e5270
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc30], rax
movsxd rax, dword [0x14034c208]
mov qword [rbp + 0xc38], rax
mov r8, qword [rbp + 0xc38]
lea rdx, [rbp + 0xb38]
mov rcx, qword [rbp + 0xc30]
call fcn.1400e6c65
mov qword [rbp + 0xc40], rax
mov rdx, qword [rbp + 0xc40]
mov rcx, qword [rbp + 0xae8]
call fcn.1400e4fc8
mov qword [rbp + 0xc48], rax
mov r8, qword [rbp + 0xc48]
lea rdx, [rbp + 0xb68]
lea rcx, [0x140357bd0]
call fcn.1400e7af7
lea rcx, [rbp + 0xb68]
call fcn.1400e4550
lea rcx, [rbp + 0xb38]
call fcn.1400e4550
lea rcx, [rbp + 0xb08]
call fcn.1400e4550
mov dword [0x14034c208], 0xffffffff
call fcn.1400e6f99
nop
lea rcx, [rbp + 0x238]
call fcn.1400e4d48
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400e4d48
call fcn.1400e58c4
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xb94]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Reset_Config
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027e1f3
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e7e0d
xor edx, edx
lea rcx, str.reallyReset
call fcn.1400e491f
movzx eax, al
test eax, eax
je 0x14027e2a0
xor edx, edx
lea rcx, str.Are_you_sure_
call fcn.1400e6625
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0xbb4]
call fcn.1400e6e13
lea rdx, [rbp + 0xbb4]
lea rcx, [0x1402ec990]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027e250
call fcn.1400e6f99
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
movss xmm1, dword [0x14030ecb0]
lea rcx, [rbp + 0xbd4]
call fcn.1400e6e13
lea rdx, [rbp + 0xbd4]
lea rcx, [0x1402ec98c]
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027e29b
call fcn.1400e6bc0
call fcn.1400e6f99
call fcn.1400e58c4
movss xmm1, dword [0x1402d6758]
xorps xmm0, xmm0
call fcn.1400e6fd5
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0xbf4]
call fcn.1400e6e13
mov rdx, rax
lea rcx, str.Open_Directory
call fcn.1400e57e3
movzx eax, al
test eax, eax
je 0x14027e386
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x278]
call fcn.1400e79b7
nop
lea rcx, [rbp + 0x278]
call fcn.1400e60d5
movzx eax, al
test eax, eax
je 0x14027e379
lea rcx, [rbp + 0x278]
call fcn.1400e45d2
movzx eax, al
test eax, eax
je 0x14027e379
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x278]
call fcn.1400e4bf4
nop
lea r8, [rbp + 0x2b8]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x2f8]
call fcn.1400e430c
lea rcx, [rbp + 0x2f8]
call fcn.1400e46ae
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x334], eax
lea rcx, [rbp + 0x2f8]
call fcn.1400e4d48
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400e4d48
nop
lea rcx, [rbp + 0x278]
call fcn.1400e823b
nop
lea rcx, [rbp + 0x48]
call fcn.1400e4d48
lea rcx, [rbp - 0x30]
lea rdx, [0x140315780]
call fcn.1400e7c55
mov rcx, qword [rbp + 0xc58]
xor rcx, rbp
call fcn.1400e62e2
lea rsp, [rbp + 0xc68]
pop rdi
pop rbp
ret