Function at 0x140013fc8
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x310
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.140004508
nop
lea rdx, str._table_aligncenter__tr__td__n
lea rcx, [rsp + 0x40]
call fcn.140004d58
lea rdx, str._br_
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str._form_idxxx_action
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, [0x140039cf6]
lea rcx, [rsp + 0x80]
call fcn.140004c38
nop
lea rcx, [rsp + 0x38]
call fcn.140010bd4
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140004ca8
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
lea rdx, [0x14003a72c]
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str.seite
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str.Microsoft
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, [0x14003a714]
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x80]
call fcn.140004544
lea rdx, [0x14003a714]
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str.Autoupdate
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.14000451c
lea rdx, str._methodpost__br__n
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, [0x14003a6e8]
lea rcx, [rsp + 0xa0]
call fcn.140004c38
nop
lea rdx, [0x14003a6e8]
lea rcx, [rsp + 0x98]
call fcn.140004c38
nop
lea rdx, [0x14003a6e4]
lea rcx, [rsp + 0xa0]
call fcn.140004d58
lea rdx, [0x14003a6e4]
lea rcx, [rsp + 0x98]
call fcn.140004d58
xor ecx, ecx
call fcn.140023dfc
imul eax, eax, 0x1af
mov dword [0x140053008], eax
lea rcx, [rsp + 0xa8]
call fcn.140004508
nop
lea rdx, [0x14003a6e0]
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
mov r8d, dword [0x140053008]
mov rdx, qword [rax]
lea rcx, [rsp + 0xa8]
call fcn.1400054b0
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
lea rcx, [rsp + 0xb8]
call fcn.1400117e4
nop
lea rcx, [rsp + 0xd0]
call fcn.140004508
nop
lea rbp, [0x14003a6dc]
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea r12, str._value_
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140004c38
nop
lea rsi, str._input_typehidden_name
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rcx, [rsp + 0x48]
call fcn.140015ccc
mov rbx, rax
lea rdx, str.Version
lea rcx, [rsp + 0x50]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140004000
nop
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, str.Unicode
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [rsp + 0x98]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, str.Portable
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [0x140053010]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, [0x14003a688]
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140004c38
call qword [rax + 0x48d68b48]
lea ecx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, str.time
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str._value_YES___n
lea rcx, [rsp + 0x78]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, str.Passiv_Autoupdate
lea rcx, [rsp + 0x58]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140004c38
nop
lea rcx, [rsp + 0xb0]
call fcn.140015bbc
mov rbx, rax
lea rdx, str.LangName
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0xb0]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xc0]
call fcn.140005290
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.140011538
xor ebx, ebx
cmp eax, ebx
je 0x140014ad6
lea rcx, [rsp + 0x30]
call fcn.140004508
nop
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0xd8]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x90]
call fcn.140011428
lea rdx, [rsp + 0x30]
lea rcx, [0x140053020]
call fcn.140004ca8
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140004c38
nop
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.140004c38
nop
lea rdx, str.Ihre_SHA
lea rcx, [rsp + 0x68]
call fcn.140004c38
nop
mov r8, rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call fcn.140004000
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004000
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
nop
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004000
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x68]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
lea rdx, str._input_typesubmit_namexxxx_value_9658_9658__Start_Autoupdate_9668_9668___stylefont_size:20px__font_weight:bold___br__n
lea rcx, [rsp + 0x88]
call fcn.140004c38
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
lea rdx, str.__form___td___tr___table__n
lea rcx, [rsp + 0x78]
call fcn.140004c38
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x78]
call fcn.140004268
lea rdx, str._script__n
lea rcx, [rsp + 0x38]
call fcn.140004c38
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x38]
call fcn.140004268
lea rdx, str.el_fdocument.getElementById__xxx____el_f.submit____n
lea rcx, [rsp + 0x60]
call fcn.140004c38
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
lea rdx, str.__script__n
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000451c
nop
lea rcx, [rsp + 0x30]
call fcn.140004268
mov dword [rsp + 0xf0], ebx
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0xf4]
call fcn.140021ef0
lea rdx, [rsp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14003a1a0]
lea rcx, [rsp + 0x48]
call fcn.140004c38
mov rdx, qword [rax]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x48]
call fcn.140004268
lea rdx, str.Autoupdate
lea rcx, [rsp + 0x50]
call fcn.140004c38
mov rdx, qword [rax]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x50]
call fcn.140004268
lea rdx, str._.html
lea rcx, [rsp + 0x58]
call fcn.140004c38
mov rdx, qword [rax]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x58]
call fcn.140004268
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xc0]
call fcn.1400052d4
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400116e0
call fcn.140010ddc
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x14005300c], ebx
mov ebx, 0x28038
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_KillTimer]
lea r9, [0x140013e80]
mov r8d, 0x3e8
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetTimer]
nop
lea rcx, [rsp + 0xd0]
call fcn.140004268
nop
lea rcx, [rsp + 0xb8]
call fcn.140004268
nop
lea rcx, [rsp + 0xa8]
call fcn.140004268
nop
lea rcx, [rsp + 0x98]
call fcn.140004268
nop
lea rcx, [rsp + 0xa0]
call fcn.140004268
nop
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret