Function at 0x140012fa0
Capabilities:
Create process on windows
Delete file
Move file
Self delete
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x50], r13d
lea rcx, [rbp + 0xd0]
call fcn.14000aa48
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.1400071c0
nop
lea rcx, [rbp + 0xb0]
call fcn.14000a4ac
lea rcx, [rbp + 0xb0]
call fcn.14000694c
test al, al
jne 0x140013933
lea rcx, [rbp + 0xb0]
call fcn.14000ab44
lea rcx, [rbp + 0xb0]
call fcn.14000a3a8
mov ecx, 0x13f6
call fcn.14000db8c
mov rbx, rax
mov ecx, 0x13f5
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140001b9c
nop
lea r8, str._r_n_r_n
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006c18
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140006c18
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x170]
call fcn.140002050
mov esi, 0x13f2
cmp byte [0x140046772], r13b
jne 0x140013106
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140001b9c
nop
mov dword [rsp + 0x50], 1
lea rcx, [rbp + 0x1d0]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140001b9c
nop
lea edi, [r13 + 3]
mov dword [rsp + 0x50], edi
mov r9d, 0x10024
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011cc4
cmp eax, 6
mov bl, 1
jne 0x140013109
mov bl, r13b
test dil, 2
je 0x140013120
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
test dil, 1
je 0x140013136
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
lea rcx, [rbp - 0x30]
call fcn.140002050
test bl, bl
jne 0x140013926
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
lea rdx, [0x14003d7e4]
lea rcx, [rbp + 0x110]
call fcn.140008840
mov r15, rax
lea rcx, [rbp + 0x110]
call fcn.140002050
test r15, r15
jne 0x1400131dd
mov ecx, 0x1400
call fcn.14000db8c
mov rdx, rax
lea r8, str.Uninstall.lst
lea rcx, [rbp - 0x10]
call fcn.14000e30c
nop
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140001b9c
nop
mov r9d, 0x10010
lea r8, [rbp + 0x110]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.140011cc4
nop
lea rcx, [rbp + 0x110]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
jmp 0x140013920
mov ecx, 0x1406
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140001b9c
nop
mov ecx, esi
call fcn.14000db8c
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140001b9c
nop
call fcn.14001397c
lea rcx, [0x140046771]
call fcn.14000d920
cmp byte [0x140046773], r13b
jne 0x14001390c
mov r12b, r13b
mov r14d, r13d
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a2c
test rax, rax
je 0x14001351b
lea rcx, [rbp - 0x30]
call fcn.1400024c0
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x170]
call fcn.14000e948
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x170]
call fcn.14000edb0
nop
lea rcx, [rbp + 0x170]
call fcn.14000d7e8
lea rcx, [rbp - 0x30]
call fcn.14000df28
lea rcx, [rbp - 0x30]
call fcn.14000694c
test al, al
jne 0x1400134de
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.14000aed8
nop
lea rcx, [rbp + 0x50]
call fcn.140008610
mov ebx, eax
lea rcx, [rbp + 0x50]
call fcn.140008698
cmp ebx, 0xffffffff
je 0x1400132eb
test bl, 0x10
je 0x1400132eb
lea rcx, [rbp + 0x50]
call fcn.1400087b4
movzx eax, al
add r14d, eax
jmp 0x1400134d4
lea rcx, [rbp + 0x50]
call fcn.140008728
movzx ecx, al
add r14d, ecx
test al, al
jne 0x1400134d4
cmp ebx, 0xffffffff
je 0x1400134d4
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000a23c
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1f0]
call fcn.14000a23c
nop
or edi, 4
mov dword [rsp + 0x50], edi
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007050
test eax, eax
je 0x14001336f
lea rdx, str.Uninstall.lst
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
or edi, 8
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140007050
test eax, eax
mov bl, 1
jne 0x140013372
mov bl, r13b
test dil, 8
je 0x140013389
and edi, 0xfffffff7
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
test dil, 4
je 0x1400133a2
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
lea rcx, [rbp + 0x1f0]
call fcn.140002050
test bl, bl
je 0x1400134ca
mov r12b, 1
lea rcx, [rbp + 0x90]
call fcn.1400024c0
nop
mov esi, r13d
mov edx, esi
lea rcx, [rbp + 0x30]
call fcn.140008f6c
mov rbx, rax
lea r8, [0x14003c250]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140006b9c
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.140008974
nop
lea r8, str..tmp
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140006c18
nop
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140006a24
nop
lea rcx, [rbp + 0x210]
call fcn.140002050
nop
lea rcx, [rbp + 0x230]
call fcn.140002050
nop
lea rcx, [rbp + 0x250]
call fcn.140002050
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x90]
call fcn.140008610
cmp eax, 0xffffffff
je 0x14001346c
inc esi
cmp esi, 0x3e8
jb 0x1400133bd
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1400018c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400134a1
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140007078
lea rcx, [rbp + 0x90]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbp + 0x90]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp + 0x50]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.140002050
mov r8, r15
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140020a2c
test rax, rax
jne 0x14001324f
test r14d, r14d
je 0x14001351b
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140020ca4
jmp 0x14001322f
mov rcx, r15
call fcn.14001f9f8
lea rcx, str.Uninstall.lst
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x150]
call fcn.1400024c0
nop
lea rcx, [rbp + 0x150]
call fcn.140013df0
lea rcx, [rbp + 0x150]
call fcn.1400085e0
test al, al
je 0x140013565
lea rcx, [rbp + 0x150]
call fcn.14000623c
lea rcx, [rbp + 0xf0]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xf0]
call fcn.14000ab60
test r12b, r12b
je 0x14001360d
cmp byte [0x140046772], r13b
jne 0x14001360d
mov r9d, 0x10040
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
call fcn.140011cc4
lea rdx, [0x14003b400]
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x30]
call fcn.14000a23c
nop
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.140007050
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.140002050
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
test ebx, ebx
jne 0x14001360d
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov rcx, rax
xor edx, edx
lea r8d, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rbp + 0x30]
call fcn.1400113c4
nop
lea r8, str.Uninstall_Rar.Bat
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140006c18
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x70]
call fcn.1400024c0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rdx, str.__s___wait_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
mov ebx, 5
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r8, rax
lea rcx, [rbp + 0xf0]
call fcn.1400018c0
mov qword [rsp + 0x20], r8
mov r9, rax
lea rdx, str.del___s__r_nrd___s__r_nif_not_exist___s__goto_done_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
sub rbx, 1
jne 0x14001367c
lea rdx, str.:done_r_n
lea rcx, [rbp + 0x70]
call fcn.140006a14
cmp byte [0x140046772], r13b
jne 0x14001371e
lea rcx, [rbp + 0xd0]
call fcn.1400018c0
mov r9, rax
mov r8, rax
lea rdx, str.if_exist___s____s___warning_r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r8, rax
lea rdx, str.del___s__r_n
lea rcx, [rbp + 0x30]
call fcn.14000e30c
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006a1c
nop
lea rcx, [rbp + 0x30]
call fcn.140002050
lea rcx, [rbp + 0x270]
call fcn.1400075ac
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x270]
call fcn.140007884
test al, al
je 0x1400138ce
lea rcx, [rbp + 0x270]
call fcn.140013de8
lea rcx, [rbp - 0x30]
call fcn.14000cdb8
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.14000ed2c
lea rcx, [rbp - 0x30]
call fcn.140007014
mov r8, rax
lea rcx, [rbp - 0x30]
call fcn.14000cdb0
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140007a40
test al, al
je 0x1400137d3
lea rcx, [rbp + 0x270]
call fcn.1400079a0
lea rcx, [rbp - 0x10]
call fcn.1400024c0
nop
lea rdx, str.COMSPEC
lea rcx, [rbp + 0x10]
call fcn.140001b9c
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140012ecc
mov bl, al
lea rcx, [rbp + 0x10]
call fcn.140002050
test bl, bl
je 0x1400138ba
lea rcx, [rbp + 0x130]
call fcn.1400018c0
mov r9, rax
lea rcx, [rbp - 0x10]
call fcn.1400018c0
mov r8, rax
lea rdx, str._s__c___s_
lea rcx, [rbp + 0x10]
call fcn.14000e30c
nop
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140016470
mov dword [rsp + 0x60], ebx
mov dword [rbp - 0x64], 1
mov word [rbp - 0x60], r13w
lea rcx, [0x14003c270]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbp + 0x10]
call fcn.1400018c0
mov rdx, rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
lea rcx, [rbp + 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x10]
call fcn.140002050
nop
lea rcx, [rbp - 0x30]
call fcn.14000d7e8
nop
lea rcx, [rbp + 0x270]
call fcn.140007644
nop
lea rcx, [rbp + 0x70]
call fcn.140002050
nop
lea rcx, [rbp + 0x130]
call fcn.140002050
nop
lea rcx, [rbp + 0xf0]
call fcn.140002050
nop
lea rcx, [rbp + 0x150]
call fcn.140002050
nop
lea rcx, [rbp + 0x190]
call fcn.140002050
nop
lea rcx, [rbp + 0x1b0]
call fcn.140002050
nop
lea rcx, [rbp + 0x1d0]
call fcn.140002050
nop
lea rcx, [rbp + 0xb0]
call fcn.140002050
nop
lea rcx, [rbp + 0xd0]
call fcn.140002050
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400143a0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret