Function at 0x14000aab0
Capabilities:
Check if file exists
Delete file
Encode data using xor
Get common file path
Get startup folder

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x448], rbx
mov r13, rdx
movsxd rbx, ecx
lea rcx, [0x14000aa90]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r15d, 1
mov r12, rbx
cmp rbx, r15
jle 0x14000ad6c
mov r14d, r15d
xor edi, edi
nop word [rax + rax]
mov rdx, qword [r13 + r14*8]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000ab20
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
lea rcx, [rsp + 0x70]
call fcn.140006be0
nop
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
mov rax, qword [rbp - 0x80]
lea rbx, [rcx + rax*2]
mov r11, rbx
mov rdx, rbx
call fcn.14000a070
cmp rax, rbx
je 0x14000abab
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000ab7e
cmp cx, 0x2f
jne 0x14000ab84
add rax, 2
jmp 0x14000ab6a
cmp rax, rbx
je 0x14000abab
nop dword [rax]
lea rdx, [r11 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000abab
cmp cx, 0x2f
je 0x14000abab
mov r11, rdx
cmp rax, rdx
jne 0x14000ab90
mov r8, r11
cmp r11, rbx
je 0x14000ac00
cmp word [r8], 0x3a
je 0x14000abc3
add r8, 2
cmp r8, rbx
jne 0x14000abb3
cmp r11, r8
je 0x14000ac00
lea rdx, [r8 - 2]
cmp r11, rdx
je 0x14000ac00
cmp word [rdx], 0x2e
jne 0x14000abe8
lea rax, [rdx - 2]
cmp r11, rax
jne 0x14000ac03
cmp word [rax], 0x2e
jne 0x14000ac03
jmp 0x14000ac00
sub rdx, 2
cmp r11, rdx
je 0x14000ac00
cmp word [rdx], 0x2e
je 0x14000ac03
sub rdx, 2
cmp r11, rdx
jne 0x14000abf1
mov rdx, r8
sub r8, rdx
sar r8, 1
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea rcx, [rsp + 0x50]
call fcn.140006be0
nop
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.14000a180
mov rsi, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14000ac43
mov rax, qword [rax]
mov r8, rsi
cmp rsi, 5
mov ecx, 5
cmova r8, rcx
lea rdx, str..json
mov rcx, rax
call fcn.1400131a0
mov ebx, eax
test eax, eax
jne 0x14000ac78
cmp rsi, 5
jae 0x14000ac73
lea ebx, [rax - 1]
jmp 0x14000ac78
mov ebx, edi
seta bl
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000acb3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b65a
call fcn.140010d2c
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000ad05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b660
call fcn.140010d2c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000ad59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b666
call fcn.140010d2c
test ebx, ebx
je 0x14000ad8c
inc r15d
inc r14
cmp r14, r12
jl 0x14000ab10
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x448]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r15d, r15d
jle 0x14000ad6c
movsxd rax, r15d
mov rdx, qword [r13 + rax*8]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000adb0
lea rcx, [rbp - 0x70]
call fcn.140006be0
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov r8, qword [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.140006be0
nop
lea r14, [0x14004fc90]
mov r8, r14
lea rdx, [0x14000bdb0]
lea rcx, [0x14004fca0]
call fcn.14000ed8c
test eax, eax
je 0x14000b66c
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp - 0x50]
call fcn.14000fd00
mov esi, eax
test eax, eax
jne 0x14000ae77
mov ebx, dword [rbp - 0x40]
bt ebx, 0xa
jae 0x14000ae6c
mov eax, dword [rbp - 0x3c]
cmp eax, 0xa000000c
jne 0x14000ae5e
lea ebx, [rsi + 4]
jmp 0x14000ae82
cmp eax, 0xa0000003
jne 0x14000ae6c
mov ebx, 0xa
jmp 0x14000ae82
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x14000ae82
add eax, 0xfffffffe
mov ebx, edi
cmp eax, 1
setbe bl
mov r8, r14
lea rdx, [0x14000bdb0]
lea rcx, [0x14004fca0]
call fcn.14000ed8c
test eax, eax
je 0x14000b672
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], r14
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
test ebx, ebx
je 0x14000af44
mov r8, r14
lea rdx, [0x14000bdb0]
lea rcx, [0x14004fca0]
call fcn.14000ed8c
test eax, eax
je 0x14000b678
cmp ebx, 1
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000af22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b67e
call fcn.140010d2c
xor r9d, r9d
xor ecx, ecx
test bl, bl
je 0x14000af50
lea r8, [0x14003c8e0]
lea rdx, [0x140045790]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000b53f
mov bl, 1
test esi, esi
jne 0x14000b64a
jmp 0x14000aee0
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r8 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.System32drivers_sysdiag.sys
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000b0a5
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], di
mov r8d, 7
lea rdx, str.sysdiag
lea rcx, [rsp + 0x70]
call fcn.140006be0
nop
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], di
mov r8d, 0x27
lea rdx, str.C:WindowsSystem32drivers_sysdiag.sys
lea rcx, [rsp + 0x50]
call fcn.140006be0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000db50
test al, al
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000b03e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b038
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b684
call fcn.140010d2c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000b07f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b07a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b68a
call fcn.140010d2c
test bl, bl
je 0x14000b1f9
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, str.Load_Failed_1
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000b53f
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.System32drivers_sysdiag_win10.sys
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], di
mov r8d, 7
lea rdx, str.sysdiag
lea rcx, [rsp + 0x70]
call fcn.140006be0
nop
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], di
lea rax, [rbp + 0xf0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b122
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.140006be0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000db50
test al, al
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000b196
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b190
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b690
call fcn.140010d2c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000b1d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b1d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b696
call fcn.140010d2c
test bl, bl
je 0x14000b1f9
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, str.Load_Failed_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000b53f
call fcn.140001fb0
mov qword [0x14004fc50], rax
cmp rax, 0xffffffffffffffff
jne 0x14000b229
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, str.Load_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000b53f
mov byte [rbp + 0x340], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
lea r8, [rbp + 0x341]
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x50]
call fcn.14000bb10
nop
lea rcx, [rbp - 0x70]
call fcn.14000e070
mov rsi, rax
mov r8d, 0x20
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.14000e570
nop
mov rax, qword [rbp - 0x20]
movsxd rax, dword [rax + 4]
test byte [rbp + rax - 0x10], 6
je 0x14000b31e
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax - 0x20], rdx
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x10]
call fcn.1400064b0
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x24], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x90]
call fcn.14000f348
nop
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, [0x1400458b8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [0x14004fc50]
call fcn.1400024b0
mov rbx, qword [rsp + 0x50]
jmp 0x14000b504
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x48], 1
mov rax, qword [rbp + rax + 0x28]
mov qword [rsp + 0x70], rax
test rax, rax
sete byte [rsp + 0x78]
mov byte [rsp + 0x79], 0
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000e840
mov rbx, qword [rsp + 0x50]
cmp rsi, 0x40
jb 0x14000b3f5
lea eax, [rsi - 1]
movsxd rcx, eax
add rcx, rbx
cmp rbx, rcx
jbe 0x14000b3f5
mov rax, rsi
and eax, 0x3f
mov rdx, rsi
sub rdx, rax
movdqa xmm2, xmmword [0x140046270]
lea rcx, [rbx + 0x10]
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
add edi, 0x40
lea rcx, [rcx + 0x40]
movsxd rax, edi
cmp rax, rdx
jb 0x14000b3a0
movsxd rax, edi
cmp rax, rsi
jae 0x14000b412
lea rcx, [rbx + rax]
xor byte [rcx], 0x88
inc edi
lea rcx, [rcx + 1]
movsxd rax, edi
cmp rax, rsi
jb 0x14000b401
lea rcx, [rbp - 0x10]
call fcn.1400071a0
test rax, rax
jne 0x14000b44d
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea r9, [rbp - 0x20]
add rcx, r9
mov edx, 6
mov eax, 2
cmp qword [rcx + 0x48], 0
cmovne edx, eax
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001a40
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rdx
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x10]
call fcn.1400064b0
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x24], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x90]
call fcn.14000f348
nop
lea rax, [rbp + 0x350]
mov qword [rsp + 0x48], rax
mov rdx, rbx
mov rcx, qword [0x14004fc50]
call fcn.14000c1b0
test rax, rax
jne 0x14000b588
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, [0x1400458d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [0x14004fc50]
call fcn.1400024b0
nop
test rbx, rbx
je 0x14000b53f
mov rdx, qword [rsp + 0x60]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b536
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b69c
mov rcx, rbx
call fcn.140010d2c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000ad6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b57e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b6a2
call fcn.140010d2c
jmp 0x14000ad6c
mov rcx, qword [0x14004fc50]
call fcn.1400024b0
test al, al
jne 0x14000b5b1
xor r9d, r9d
lea r8, [0x14003c8e0]
lea rdx, [0x1400458f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test rbx, rbx
je 0x14000b601
mov rdx, qword [rsp + 0x60]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b5f8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b6a8
mov rcx, rbx
call fcn.140010d2c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000b63d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b638
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b644
call fcn.140010d2c
xor eax, eax
jmp 0x14000ad71
call fcn.140016bd0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
call fcn.14000aa20
nop
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.1400158b0
int3
call fcn.1400158b0
int3
call fcn.1400158b0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
int3
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
int3