Function at 0x1400052d0
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe70]
sub rsp, 0xf70
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rbp + 0xe60], rax
mov r14, r8
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], r8
xor r12d, r12d
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000531c
mov r9, qword [rdx]
mov r8, r15
lea rdx, str.Rundll32Command_1__hImpersonationToken_d__WorkPath_s
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
test r15, r15
je 0x140005a27
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140005348
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140005a27
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
xor r8d, r8d
lea rdx, [0x14000b6e0]
lea rcx, [rbp - 0x70]
call fcn.140007b10
nop
mov edx, 0x104
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000542a
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x250]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x40]
lea r8, str._s_rundll32.exe
mov edx, 0x207
lea rcx, [rbp + 0x250]
call fcn.140008120
lea rax, [rbp + 0x250]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400053e0
mov rax, qword [rbp - 0x58]
cmp rdx, rax
ja 0x140005421
lea rdi, [rbp - 0x70]
cmp rax, 8
cmovae rdi, qword [rbp - 0x70]
mov qword [rbp - 0x60], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0x250]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx], r12w
jmp 0x14000547a
lea r9, [rbp + 0x250]
jmp 0x140005471
mov rax, qword [rbp - 0x58]
cmp rax, 0x20
jb 0x140005465
lea rbx, [rbp - 0x70]
cmp rax, 8
cmovae rbx, qword [rbp - 0x70]
mov qword [rbp - 0x60], 0x20
mov r8d, 0x40
lea rdx, str.C:WindowsSystem32_rundll32.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x40], r12w
jmp 0x14000547a
lea r9, str.C:WindowsSystem32_rundll32.exe
mov edx, 0x20
lea rcx, [rbp - 0x70]
call fcn.140007c50
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
je 0x1400055be
lea rdx, str.Rundll32Command_2_failed__strRundll32Path_not_exist
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400054ec
mov rcx, qword [rbp - 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054e7
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a20
call fcn.140008cb0
mov word [rbp - 0x70], r12w
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000553c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140005537
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005a4f
mov rcx, r8
call fcn.140008cb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14000558b
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140005586
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005a56
mov rcx, r8
call fcn.140008cb0
xor al, al
mov word [r14], r12w
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], r12
mov rcx, qword [rbp + 0xe60]
xor rcx, rsp
call fcn.140008c90
add rsp, 0xf70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x1d
jb 0x140005a5d
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400055e6
mov r9, qword [rsi]
mov qword [rsp + 0x30], 0x1d
lea rax, str.LenovoBatteryGaugePackage.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.140007f90
nop
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rbx, qword [rbp - 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
jne 0x140005974
test rbx, rbx
je 0x140005974
cmp word [rbx], ax
je 0x140005652
call fcn.140008a40
mov rcx, qword [rax]
mov rax, qword [rcx]
test rax, rax
je 0x140005652
mov rcx, rbx
call rax
test eax, eax
je 0x140005662
mov rcx, rbx
call fcn.140001b60
test al, al
je 0x140005974
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x660]
call sub.VCRUNTIME140.dll_memset
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x140005683
mov rax, qword [r14]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.__s___s
mov edx, 0x3ff
lea rcx, [rbp + 0x660]
call fcn.140008120
lea r8, [rbp + 0x660]
lea rdx, str.Rundll32Command_5_cmd_s
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x60]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x14000573d
lea rdx, str.Rundll32Command_6__failed:_CreateEnvironmentBlock
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140005726
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005721
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400059bf
call fcn.140008cb0
movdqa xmm0, xmmword [0x14000e710]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
jmp 0x1400054ac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
movups xmmword [rbp + 0x14], xmm1
movups xmmword [rbp + 0x24], xmm1
mov dword [rbp + 0x34], eax
mov dword [rbp - 0x30], 0x68
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
je 0x14000578c
lea rdx, str.Rundll32Command_4__failed:_MainDll_file_not_exist_at_second_check
jmp 0x1400056d9
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000420
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x660]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test ebx, ebx
je 0x140005968
mov edx, 0x7530
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Rundll32Command_8_runcmd__OK_________
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140005870
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000586b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400059bf
call fcn.140008cb0
movdqa xmm0, xmmword [0x14000e710]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400058c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a20
call fcn.140008cb0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140005912
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000590d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005a4f
mov rcx, r8
call fcn.140008cb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140005961
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000595c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005a56
mov rcx, r8
call fcn.140008cb0
mov al, 1
jmp 0x14000558d
lea rdx, str.Rundll32Command_9_runcmd_failed.....
jmp 0x1400056d9
lea rdx, str.Rundll32Command_4__failed:_main_dll_file_not_valid
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400059cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008cb0
movdqa xmm0, xmmword [0x14000e710]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r12w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400054ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400054e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x140005a34
mov r9, qword [rsi]
mov r8, r15
lea rdx, str.Rundll32Command_2_error:_not_impersonate_or_path_not_exist.__hImpersonationToken_d__WorkPath_s
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140001900
jmp 0x1400054fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011b0
int3