Function at 0x1400026b0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
movaps xmmword [rsp + 0x310], xmm7
movaps xmmword [rsp + 0x300], xmm6
mov rbx, r9
mov ebp, r8d
mov rsi, rcx
mov rdi, qword [rsp + 0x390]
mov rax, qword [0x140069028]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
test edx, edx
jne 0x140002808
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1400027b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xf0]
mov dword [rbx], 0xef
mov dword [rbx + 4], eax
xorps xmm6, xmm6
movups xmmword [rbx + 8], xmm6
mov qword [rbx + 0x18], 0
mov rcx, rdi
mov rdx, rbx
call fcn.1400024a0
cmp byte [rbx + 0x1f], 0
jns 0x140002765
mov rcx, qword [rsp + 0xf8]
call fcn.14000f2f0
xor eax, eax
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov qword [rsi + 0x18], rax
cmp byte [rsp + 0x77], 0
jns 0x140002783
mov rcx, qword [rsp + 0x60]
call fcn.14000f2f0
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.14000feb0
movaps xmm6, xmmword [rsp + 0x300]
movaps xmm7, xmmword [rsp + 0x310]
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, eax
dec eax
movsxd rdx, eax
lea r15, [rsp + 0x60]
mov rcx, r15
xor r8d, r8d
call fcn.14000f0e0
cmp byte [r15 + 0x17], 0
jns 0x1400027db
mov r15, qword [rsp + 0x60]
mov ecx, r14d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000291a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xf0]
mov dword [rbx], 0xf4
jmp 0x140002735
lea r15, [rsp + 0xf0]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.140012620
xor ecx, ecx
mov rdx, r15
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x80]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14005d800]
movaps xmmword [r14], xmm0
mov rcx, r14
mov rdx, r15
call fcn.14003b710
movzx eax, byte [r14 + 0x17]
test al, al
js 0x14000286b
and eax, 0x7f
jmp 0x14000287b
mov rax, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
test rax, rax
je 0x1400028a2
add rax, rax
test rax, rax
je 0x1400028a2
lea r9, [rax - 2]
cmp word [r14 + rax - 2], 0x5c
mov rax, r9
jne 0x140002883
cmp r9, 0xfffffffffffffffe
jne 0x140002a51
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0xa0]
mov dword [r14], 0xfe
mov dword [r14 + 4], eax
xorps xmm6, xmm6
movups xmmword [r14 + 8], xmm6
mov qword [r14 + 0x18], 0
mov rcx, rdi
mov rdx, r14
call fcn.1400024a0
cmp byte [r14 + 0x1f], 0
jns 0x1400028ea
mov rcx, qword [rsp + 0xa8]
call fcn.14000f2f0
xor eax, eax
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov qword [rsi + 0x18], rax
mov r14b, 1
cmp byte [rsp + 0x97], 0
jns 0x140002911
mov rcx, qword [rsp + 0x80]
call fcn.14000f2f0
test r14b, r14b
jne 0x140002772
xor eax, eax
mov qword [rsi], rax
xorps xmm6, xmm6
movups xmmword [rsi + 8], xmm6
mov qword [rsi + 0x18], rax
lea r13, [rsp + 0xa0]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm6
movaps xmm7, xmmword [0x14005d800]
lea r15, [rsp + 0x80]
movaps xmmword [r15], xmm7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea r14, [rsp + 0xf0]
movaps xmmword [r14 + 0x20], xmm7
movaps xmmword [r14 + 0x10], xmm7
movaps xmmword [r14], xmm7
mov dword [r14 + 0x30], 0xaaaaaaaa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [r15 + 0xe]
movzx edx, word [r15 + 0xc]
movzx r8d, word [r15 + 0xa]
movzx r10d, word [r15 + 8]
movzx r11d, word [r15 + 6]
movzx r9d, word [r15 + 2]
mov dword [rsp + 0x5c], r9d
movzx r12d, word [r15]
mov r9d, r12d
shr r9d, 2
imul r9d, r9d, 0x147b
shr r9d, 0x11
imul r9d, r9d, 0x64
sub r12d, r9d
movzx r9d, r12w
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
lea r8, str._02d_02d_02d_02d_02d_02d_03d_d
mov edx, 0x1a
mov rcx, r14
call fcn.1400033e0
mov rcx, r14
call fcn.140025e3c
mov rcx, r13
mov rdx, r14
mov r8, rax
call fcn.14000c690
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [r15 + 0x10], r14
movaps xmmword [r15], xmm7
lea r8, str.Opera_installer_
lea r12, [rsp + 0xd0]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.1400031c0
movzx r8d, byte [r13 + 0x17]
test r8b, r8b
js 0x140002c09
and r8d, 0x7f
jmp 0x140002c19
sar r9, 1
inc r9
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x80]
xor r8d, r8d
call fcn.14000c950
cmp byte [rsp + 0x77], 0
jns 0x140002a8d
mov rcx, qword [rsp + 0x60]
call fcn.14000f2f0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x60], xmm0
xor r14d, r14d
jmp 0x1400028fa
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0xf0]
call fcn.14000c590
jmp 0x140002be5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xf0]
mov dword [rbx], 0xc7
mov dword [rbx + 4], eax
xorps xmm6, xmm6
movups xmmword [rbx + 8], xmm6
mov qword [rbx + 0x18], 0
mov rcx, rdi
mov rdx, rbx
call fcn.1400024a0
cmp byte [rbx + 0x1f], 0
jns 0x140002b15
mov rcx, qword [rsp + 0xf8]
call fcn.14000f2f0
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xe0], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0xd0]
jmp 0x140002d58
test ebp, ebp
je 0x140002b98
xor r14d, r14d
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0xcc], 0xaaaaaaaa
mov r8d, ebp
sub r8d, r14d
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, rbx
lea r9, [rsp + 0xcc]
call r12
test eax, eax
je 0x140002ad1
mov eax, dword [rsp + 0xcc]
test eax, eax
je 0x140002ad1
add r14d, eax
cmp r14d, ebp
jne 0x140002b4e
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
cmp byte [rsp + 0x97], 0
lea r12, [rsp + 0xd0]
js 0x140002aaf
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xf0], xmm0
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
call fcn.140003320
movabs r14, 0xaaaaaaaaaaaaaaaa
jmp 0x140002d58
mov r8, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, r12
mov rdx, r13
call fcn.14000c790
movups xmm0, xmmword [rax]
lea r12, [rsp + 0xf0]
movaps xmmword [r12], xmm0
mov rcx, qword [rax + 0x10]
mov qword [r12 + 0x10], rcx
xor r13d, r13d
mov qword [rax + 0x10], r13
movups xmmword [rax], xmm6
lea rdx, [0x14005dd80]
mov r8d, 4
mov rcx, r12
call fcn.14000c790
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r13
cmp byte [r12 + 0x17], 0
jns 0x140002c8f
mov rcx, qword [rsp + 0xf0]
call fcn.14000f2f0
cmp byte [rsp + 0xe7], 0
jns 0x140002ca6
mov rcx, qword [rsp + 0xd0]
call fcn.14000f2f0
cmp byte [rsp + 0x97], 0
lea r12, [rsp + 0xd0]
jns 0x140002cc0
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, r15
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov r13, rax
inc r13
cmp r13, 2
jae 0x140002b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xf0]
mov dword [rbx], 0xbe
mov dword [rbx + 4], eax
xorps xmm6, xmm6
movups xmmword [rbx + 8], xmm6
mov qword [rbx + 0x18], 0
mov rcx, rdi
mov rdx, rbx
call fcn.1400024a0
cmp byte [rbx + 0x1f], 0
jns 0x140002d44
mov rcx, qword [rsp + 0xf8]
call fcn.14000f2f0
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xe0], 0
cmp r13, 2
jb 0x140002d67
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x97], 0
jns 0x140002d7e
mov rcx, qword [rsp + 0x80]
call fcn.14000f2f0
lea rbx, [rsi + 8]
cmp byte [rsp + 0xb7], 0
jns 0x140002d99
mov rcx, qword [rsp + 0xa0]
call fcn.14000f2f0
cmp rbx, r12
je 0x140002dd0
cmp byte [rsi + 0x1f], 0
movzx eax, byte [rsp + 0xe7]
js 0x14000316c
test al, al
jns 0x140002e6a
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
mov rcx, rbx
call fcn.14000cb80
cmp byte [rsp + 0xe7], 0
js 0x140002e86
mov word [rsp + 0xd0], 0
mov byte [rsp + 0xe7], 0
mov rcx, qword [rsp + 0xd8]
xor eax, eax
mov edx, eax
and dl, 0x7f
test al, al
movzx edx, dl
cmovs rdx, rcx
test rdx, rdx
je 0x140002e4c
test al, al
jns 0x140002e19
mov r12, qword [rsp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [rsp + 0xe7], 0
jns 0x140002e5d
mov rax, qword [rsp + 0xd0]
mov word [rax], 0
mov qword [rsp + 0xd8], 0
mov al, byte [rsp + 0xe7]
test al, al
jns 0x140002e5d
mov rcx, qword [rsp + 0xd0]
call fcn.14000f2f0
movzx eax, byte [rsi + 0x1f]
test al, al
js 0x140002ead
and eax, 0x7f
jmp 0x140002eb1
mov rax, qword [rsp + 0xe0]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [rbx], xmm0
jmp 0x140002dd0
mov rax, qword [rsp + 0xd0]
mov word [rax], 0
mov qword [rsp + 0xd8], 0
xor ecx, ecx
mov al, byte [rsp + 0xe7]
jmp 0x140002dfa
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x140003105
xorps xmm6, xmm6
movups xmmword [rsp + 0xf8], xmm6
mov qword [rsp + 0x108], 0
lea rcx, [0x14005dd34]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x140002f5e
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], r14
movups xmmword [rsp + 0xa8], xmm6
mov qword [rsp + 0xb8], 0
test rax, rax
je 0x140003007
mov ecx, 0x800
call qword [0x140072008]
test eax, eax
je 0x140002fa8
lea rcx, str.version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
jne 0x14000300a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0x80]
mov dword [rbx], 0x93
jmp 0x140002fbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xa0]
mov dword [rbx], 0x79
mov dword [rbx + 4], eax
movups xmmword [rbx + 8], xmm6
mov qword [rbx + 0x18], 0
mov rcx, rdi
mov rdx, rbx
call fcn.1400024a0
cmp byte [rbx + 0x1f], 0
jns 0x1400030a1
mov rcx, qword [rsp + 0xa8]
call fcn.14000f2f0
jmp 0x1400030a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0x80]
mov dword [rbx], 0x88
mov dword [rbx + 4], eax
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
mov qword [rbx + 0x18], 0
mov rcx, rdi
mov rdx, rbx
call fcn.1400024a0
cmp byte [rbx + 0x1f], 0
jns 0x14000302e
mov rcx, qword [rsp + 0x88]
call fcn.14000f2f0
jmp 0x14000302e
cmp qword [rsp + 0xb0], 0
je 0x140003081
mov rcx, qword [rsp + 0xa8]
jmp 0x14000304e
xor r14d, r14d
cmp byte [rsi + 0x1f], 0
jns 0x140003014
mov rbx, qword [rsi + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi], rax
test r14, r14
je 0x14000302e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0xa0], 0
cmp byte [rsp + 0xbf], 0
js 0x140002fee
je 0x14000308e
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [rsp + 0xbf], 0
jns 0x14000308e
mov rax, qword [rsp + 0xa8]
mov word [rax], 0
mov qword [rsp + 0xb0], 0
cmp byte [rsp + 0xbf], 0
jns 0x14000308e
mov rcx, qword [rsp + 0xa8]
call fcn.14000f2f0
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400030a1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0xf0], 0
cmp byte [rsp + 0x10f], 0
js 0x140003154
je 0x140003105
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [rsp + 0x10f], 0
jns 0x140003105
mov rax, qword [rsp + 0xf8]
mov word [rax], 0
mov qword [rsp + 0x100], 0
cmp byte [rsp + 0x10f], 0
jns 0x140003105
mov rcx, qword [rsp + 0xf8]
call fcn.14000f2f0
cmp qword [rsi], 0
jne 0x140002772
lea rsi, [rsp + 0xf0]
mov qword [rsi], 0x108
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], 0
mov rcx, rdi
mov rdx, rsi
call fcn.1400024a0
cmp byte [rsi + 0x1f], 0
jns 0x140002772
mov rcx, qword [rsp + 0xf8]
call fcn.14000f2f0
jmp 0x140002772
cmp qword [rsp + 0x100], 0
je 0x1400030f8
mov rcx, qword [rsp + 0xf8]
jmp 0x1400030c5
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
cmovns rdx, r12
mov rcx, rbx
call fcn.14000ca90
jmp 0x140002dd0