Function at 0x14003f270
Capabilities:
Delete file
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov r15, rcx
mov rbx, 0xffffffffffffffff
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
lea r13, [rcx + 0x10]
xor esi, esi
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 7
mov word [r13], si
lea r12, [rcx + 0x30]
mov qword [rbp + 0x1f0], r12
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], 7
mov word [r12], si
lea rax, [rcx + 0x50]
mov qword [rbp + 0x1f8], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rcx
movups xmmword [r15 + 0x78], xmm0
movups xmmword [r15 + 0x88], xmm0
mov qword [r15 + 0x98], rcx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14003f864
lea rax, [rbp - 0x80]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14003f330
lea rdx, [rbp - 0x80]
mov rcx, r13
call fcn.140037b30
mov edx, 1
lea r8d, [rdx + 0x5b]
mov rcx, rax
call fcn.1400401e0
lea rdx, [0x14010c3e0]
cmp qword [0x14010c3f8], 8
cmovae rdx, qword [0x14010c3e0]
mov r8, qword [0x14010c3f0]
mov rcx, rax
call fcn.140038d10
lea rax, [rbp - 0x80]
inc rbx
cmp word [rax + rbx*2], si
jne 0x14003f381
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, r12
call fcn.140037b30
mov edx, 1
lea r8d, [rdx + 0x5b]
mov rcx, rax
call fcn.1400401e0
lea rdx, [0x14010cd00]
cmp qword [0x14010cd18], 8
cmovae rdx, qword [0x14010cd00]
mov r8, qword [0x14010cd10]
mov rcx, rax
call fcn.140038d10
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14003f3de
mov rcx, qword [r13]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r15], rax
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x14003f417
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r15 + 8], rax
cmp qword [r15], 0xffffffffffffffff
je 0x14003f651
lea rax, [0x14010ce00]
movsxd rdx, esi
shl rdx, 5
add rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140036f80
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], 4
mov dword [rsp + 0x60], 0x7d64697b
mov byte [rsp + 0x64], 0
lea rbx, [rsp + 0x40]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
cmp r12, 0x10
cmovae rbx, r15
mov r14, qword [rsp + 0x50]
cmp r14, 4
jb 0x14003f571
lea rdi, [r14 + rbx]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, 0x7b
mov rcx, rbx
call fcn.140074180
mov r10, rax
test rax, rax
je 0x14003f571
xor r8d, r8d
mov ecx, r8d
lea rax, [rsp + 0x60]
nop dword [rax + rax]
movzx edx, byte [r10 + rcx]
inc rcx
cmp dl, byte [rax + rcx - 1]
jne 0x14003f4f9
cmp rcx, 4
jne 0x14003f4e0
mov eax, r8d
jmp 0x14003f4fe
sbb eax, eax
or eax, 1
test eax, eax
je 0x14003f523
inc r10
lea r8, [rdi - 3]
sub r8, r10
mov edx, 0x7b
mov rcx, r10
call fcn.140074180
mov r10, rax
test rax, rax
jne 0x14003f4d0
jmp 0x14003f571
sub r10, rbx
cmp r10, 0xffffffffffffffff
je 0x14003f574
mov rax, qword [0x140125308]
lea r9, [0x1401252f8]
cmp qword [0x140125310], 0x10
cmovae r9, qword [0x1401252f8]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.14003e390
mov r12, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
xor r8d, r8d
cmp esi, 0x34
je 0x14003f6b1
lea rdx, [rsp + 0x40]
cmp r12, 0x10
cmovae rdx, r15
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x1e8]
mov r8d, r14d
mov r15, qword [rbp + 0x1e0]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003f5f1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f5ea
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f5e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c7
call fcn.140071ab4
inc esi
jmp 0x14003f44c
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [r13 + 0x18], 8
jb 0x14003f605
mov r13, qword [r13]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f64b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f646
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c7
call fcn.140071ab4
lea r12, [r15 + 0x30]
xor esi, esi
cmp qword [r15 + 8], 0xffffffffffffffff
je 0x14003f864
lea rdi, [0x14010cd80]
movabs r13, 0x7fffffffffffffff
lea rax, [0x14010cde0]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov rsi, qword [rdi + 0x10]
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14003f68f
mov r14, qword [rdi]
cmp rsi, 0x10
jae 0x14003f70e
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0xf
mov ebx, 0xf
jmp 0x14003f786
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f6fb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f6f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c7
call fcn.140071ab4
mov r15, qword [rbp + 0x1e0]
mov r12, qword [rbp + 0x1f0]
jmp 0x14003f64f
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003f758
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003f8bb
mov rcx, rax
call fcn.140071a78
mov rcx, rax
test rax, rax
je 0x14003f8c1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003f766
test rcx, rcx
je 0x14003f764
call fcn.140071a78
jmp 0x14003f766
xor eax, eax
mov qword [rsp + 0x40], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140073d70
mov qword [rsp + 0x58], rbx
lea rax, [0x14010cde0]
mov qword [rsp + 0x50], rsi
cmp rdi, rax
je 0x14003f87b
lea rdx, [rsp + 0x40]
cmp rbx, 0x10
cmovae rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1e0]
mov r8d, esi
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003f80c
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f801
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f7fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c1
call fcn.140071ab4
add rdi, 0x20
xor esi, esi
jmp 0x14003f66d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [r12 + 0x18], 8
jb 0x14003f822
mov r12, qword [r12]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f864
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f85f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c1
call fcn.140071ab4
mov rax, r15
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [r15 + 0x78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f864
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f85f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f8c1
jmp 0x14003f85f
call fcn.140036c60
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3