Function at 0x14010d230
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x9e8], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x890], rax
mov qword [rsp + 0x30], r8
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x70]
call fcn.140189c40
xor r12d, r12d
mov word [rbp + 0x70], r12w
mov dword [rbp - 0x78], 0x207
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, str.Path
lea rdx, str.SOFTWARE2345Explorer
mov rcx, 0xffffffff80000002
call fcn.14010c480
test al, al
je 0x14010d2f9
lea rdx, [0x14023d458]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14023e3d0]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14010d2fe
mov word [rbp + 0x70], r12w
xor dil, dil
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010dd58
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14010d340
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006b90
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400c7930
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14010d3a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d3a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dda5
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400efba0
movzx edi, dil
mov eax, 1
cmp dword [rbp - 0x78], 7
cmovge edi, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010d420
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d41b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddab
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
test dil, dil
je 0x14010dd58
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
mov dword [rbp + 0x20], 0x2d002d
mov dword [rbp + 0x24], 0x650073
mov dword [rbp + 0x28], 0x2d0074
mov dword [rbp + 0x2c], 0x650064
mov dword [rbp + 0x30], 0x610066
mov dword [rbp + 0x34], 0x6c0075
mov dword [rbp + 0x38], 0x2d0074
mov dword [rbp + 0x3c], 0x61006c
mov dword [rbp + 0x40], 0x6e0075
mov dword [rbp + 0x44], 0x680063
mov dword [rbp + 0x48], 0x61002d
mov dword [rbp + 0x4c], 0x740063
mov dword [rbp + 0x50], 0x6f0069
mov dword [rbp + 0x54], 0x3d006e
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x6e006f
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x73002d
mov dword [rbp - 0x20], 0x740065
mov dword [rbp - 0x1c], 0x64002d
mov dword [rbp - 0x18], 0x660065
mov dword [rbp - 0x14], 0x750061
mov dword [rbp - 0x10], 0x74006c
mov dword [rbp - 0xc], 0x61002d
mov dword [rbp - 8], 0x740063
mov dword [rbp - 4], 0x6f0069
mov dword [rbp], 0x3d006e
mov r14, qword [rsp + 0x30]
mov r8, rbx
cmp r15d, 1
jne 0x14010d5b4
mov dword [rbp + 0x58], 0x6e0069
mov dword [rbp + 0x5c], 0x740073
mov dword [rbp + 0x60], 0x6c0061
mov dword [rbp + 0x64], 0x65006c
mov dword [rbp + 0x68], 0x72
mov dword [rbp + 4], 0x6e0069
mov dword [rbp + 8], 0x740073
mov dword [rbp + 0xc], 0x6c0061
mov dword [rbp + 0x10], 0x65006c
mov dword [rbp + 0x14], 0x72
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], 0
je 0x14010d594
lea rax, [rbp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d580
lea rdx, [rbp + 0x20]
jmp 0x14010d632
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d5a0
lea rdx, [rbp - 0x30]
jmp 0x14010d632
mov dword [rbp + 0x58], 0x6f0073
mov dword [rbp + 0x5c], 0x740066
mov dword [rbp + 0x60], 0x610077
mov dword [rbp + 0x64], 0x650072
xor r11d, r11d
mov word [rbp + 0x68], r11w
mov dword [rbp + 4], 0x6f0073
mov dword [rbp + 8], 0x740066
mov dword [rbp + 0xc], 0x610077
mov dword [rbp + 0x10], 0x650072
xor eax, eax
mov word [rbp + 0x14], ax
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], r11
je 0x14010d620
lea rax, [rbp + 0x20]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d610
lea rdx, [rbp + 0x20]
jmp 0x14010d632
lea rax, [rbp - 0x30]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d624
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140006b90
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
lea r15, [r14 + 0x10]
xor r13d, r13d
cmp qword [r15], r13
je 0x14010d72f
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x650073
mov dword [rbp - 0x28], 0x2d0074
mov dword [rbp - 0x24], 0x650064
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x6c0075
mov dword [rbp - 0x18], 0x2d0074
mov dword [rbp - 0x14], 0x720066
mov dword [rbp - 0x10], 0x6d006f
mov dword [rbp - 0xc], 0x3d
lea rax, [rbp - 0x30]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x14010d6b2
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006b90
cmp qword [r14 + 0x18], 8
jb 0x14010d6d7
mov r14, qword [r14]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d71d
lea rdi, [rdx + rcx]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp r8, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r14
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010d72f
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.1400074b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x40]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rdx, rax
ja 0x14010d7a8
lea rdi, [rcx + rdx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010d7bf
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov r9d, 2
cmp qword [rsp + 0x78], 0
je 0x14010d8ad
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d819
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, r9d
lea rdx, [0x140240034]
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010d838
mov qword [rsp + 0x20], 1
lea r9, [0x140240034]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x14010d895
lea rax, [r15 + rdi]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdi + rdi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.140189500
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x14010d8a7
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r9d, 2
mov r15, qword [rbp - 0x78]
cmp qword [r15], 0
je 0x14010da59
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x14010d908
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8, r9
lea rdx, [0x140240034]
call fcn.140189500
mov word [rbx + rdi*2], r13w
mov ebx, 1
jmp 0x14010d925
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140240034]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d970
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1402407a0]
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010d989
mov qword [rsp + 0x20], rbx
lea r9, [0x1402407a0]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
cmp qword [rsi + 0x18], 8
jb 0x14010d993
mov rsi, qword [rsi]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d9da
lea rdi, [rdx + rcx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, rsi
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010d9ec
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010da3a
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r15d, 2
mov r8d, r15d
lea rdx, [0x1402407a0]
call fcn.140189500
mov word [rbx + rdi*2], r13w
jmp 0x14010da5f
mov qword [rsp + 0x20], 1
lea r9, [0x1402407a0]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r15d, 2
xor sil, sil
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x480]
call fcn.140189c40
lea rcx, [rbp + 0x480]
call fcn.14010c790
test al, al
je 0x14010db6e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, str.Shlwapi.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8020
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010db0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010db0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddb1
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rbx, rbx
je 0x14010db6e
lea rdx, str.StrStrIW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14010db6e
lea rdx, str.2345ExplorerHTML
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14010db6b
lea rdx, [0x14023e3d0]
lea rcx, [rbp + 0x480]
call rbx
test rax, rax
je 0x14010db6e
mov sil, 1
mov ebx, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, [0x140240900]
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8020
mov rdi, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010dbf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dbf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddb7
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rdi, rdi
je 0x14010dc61
lea rdx, str.ShellExecuteW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010dc61
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
lea rdx, str.open
xor ecx, ecx
call rax
cmp rax, 0x20
jbe 0x14010dc61
mov ebx, 0x12
test sil, sil
cmovne ebx, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14010dca3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dc9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddbd
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010dcf8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dcf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddc3
call fcn.140183214
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
cmp r12, 8
jb 0x14010dd42
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14010dd3a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd9f
mov rcx, r14
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r13w
mov eax, ebx
jmp 0x14010dd75
cmp qword [rsi + 0x10], 0
jne 0x14010dd63
xor eax, eax
jmp 0x14010dd75
cmp qword [rsi + 0x18], 8
jb 0x14010dd6d
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.14010cf10
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.1401837c0
mov rbx, qword [rsp + 0x9e8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195ffc
nop
call fcn.140195ffc
nop
call fcn.140195ffc
nop
call fcn.140195ffc
int3
call fcn.140195ffc
nop
call fcn.140195ffc
nop
call fcn.140195ffc
int3