Function at 0x140110e90
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x9e8], rbx
mov rax, qword [0x1402c4148]
xor rax, rsp
mov qword [rbp + 0x890], rax
mov qword [rsp + 0x30], r8
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x70]
call fcn.14018da90
xor r12d, r12d
mov word [rbp + 0x70], r12w
mov dword [rbp - 0x78], 0x207
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, str.Path
lea rdx, str.SOFTWARE2345Explorer
mov rcx, 0xffffffff80000002
call fcn.1401100e0
test al, al
je 0x140110f59
lea rdx, [0x140242148]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140243160]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140110f5e
mov word [rbp + 0x70], r12w
xor dil, dil
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401119b8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140110fa0
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006b60
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400cb590
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140111007
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111002
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a05
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400f3800
movzx edi, dil
mov eax, 1
cmp dword [rbp - 0x78], 7
cmovge edi, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140111080
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011107b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a0b
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
test dil, dil
je 0x1401119b8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
mov dword [rbp + 0x20], 0x2d002d
mov dword [rbp + 0x24], 0x650073
mov dword [rbp + 0x28], 0x2d0074
mov dword [rbp + 0x2c], 0x650064
mov dword [rbp + 0x30], 0x610066
mov dword [rbp + 0x34], 0x6c0075
mov dword [rbp + 0x38], 0x2d0074
mov dword [rbp + 0x3c], 0x61006c
mov dword [rbp + 0x40], 0x6e0075
mov dword [rbp + 0x44], 0x680063
mov dword [rbp + 0x48], 0x61002d
mov dword [rbp + 0x4c], 0x740063
mov dword [rbp + 0x50], 0x6f0069
mov dword [rbp + 0x54], 0x3d006e
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x6e006f
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x73002d
mov dword [rbp - 0x20], 0x740065
mov dword [rbp - 0x1c], 0x64002d
mov dword [rbp - 0x18], 0x660065
mov dword [rbp - 0x14], 0x750061
mov dword [rbp - 0x10], 0x74006c
mov dword [rbp - 0xc], 0x61002d
mov dword [rbp - 8], 0x740063
mov dword [rbp - 4], 0x6f0069
mov dword [rbp], 0x3d006e
mov r14, qword [rsp + 0x30]
mov r8, rbx
cmp r15d, 1
jne 0x140111214
mov dword [rbp + 0x58], 0x6e0069
mov dword [rbp + 0x5c], 0x740073
mov dword [rbp + 0x60], 0x6c0061
mov dword [rbp + 0x64], 0x65006c
mov dword [rbp + 0x68], 0x72
mov dword [rbp + 4], 0x6e0069
mov dword [rbp + 8], 0x740073
mov dword [rbp + 0xc], 0x6c0061
mov dword [rbp + 0x10], 0x65006c
mov dword [rbp + 0x14], 0x72
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], 0
je 0x1401111f4
lea rax, [rbp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1401111e0
lea rdx, [rbp + 0x20]
jmp 0x140111292
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140111200
lea rdx, [rbp - 0x30]
jmp 0x140111292
mov dword [rbp + 0x58], 0x6f0073
mov dword [rbp + 0x5c], 0x740066
mov dword [rbp + 0x60], 0x610077
mov dword [rbp + 0x64], 0x650072
xor r11d, r11d
mov word [rbp + 0x68], r11w
mov dword [rbp + 4], 0x6f0073
mov dword [rbp + 8], 0x740066
mov dword [rbp + 0xc], 0x610077
mov dword [rbp + 0x10], 0x650072
xor eax, eax
mov word [rbp + 0x14], ax
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], r11
je 0x140111280
lea rax, [rbp + 0x20]
inc r8
cmp word [rax + r8*2], r11w
jne 0x140111270
lea rdx, [rbp + 0x20]
jmp 0x140111292
lea rax, [rbp - 0x30]
inc r8
cmp word [rax + r8*2], r11w
jne 0x140111284
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140006b60
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
lea r15, [r14 + 0x10]
xor r13d, r13d
cmp qword [r15], r13
je 0x14011138f
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x650073
mov dword [rbp - 0x28], 0x2d0074
mov dword [rbp - 0x24], 0x650064
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x6c0075
mov dword [rbp - 0x18], 0x2d0074
mov dword [rbp - 0x14], 0x720066
mov dword [rbp - 0x10], 0x6d006f
mov dword [rbp - 0xc], 0x3d
lea rax, [rbp - 0x30]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x140111312
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006b60
cmp qword [r14 + 0x18], 8
jb 0x140111337
mov r14, qword [r14]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011137d
lea rdi, [rdx + rcx]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp r8, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r14
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x14011138f
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.140007480
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x14024e310]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x40]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rdx, rax
ja 0x140111408
lea rdi, [rcx + rdx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x14011141f
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.140007480
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov r9d, 2
cmp qword [rsp + 0x78], 0
je 0x14011150d
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140111479
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, r9d
lea rdx, [0x140244f3c]
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x140111498
mov qword [rsp + 0x20], 1
lea r9, [0x140244f3c]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.140007480
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x1401114f5
lea rax, [r15 + rdi]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdi + rdi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14018d350
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x140111507
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140007480
mov r9d, 2
mov r15, qword [rbp - 0x78]
cmp qword [r15], 0
je 0x1401116b9
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x140111568
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8, r9
lea rdx, [0x140244f3c]
call fcn.14018d350
mov word [rbx + rdi*2], r13w
mov ebx, 1
jmp 0x140111585
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140244f3c]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140007480
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401115d0
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1402456c8]
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x1401115e9
mov qword [rsp + 0x20], rbx
lea r9, [0x1402456c8]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140007480
cmp qword [rsi + 0x18], 8
jb 0x1401115f3
mov rsi, qword [rsi]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011163a
lea rdi, [rdx + rcx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, rsi
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x14011164c
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.140007480
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14011169a
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r15d, 2
mov r8d, r15d
lea rdx, [0x1402456c8]
call fcn.14018d350
mov word [rbx + rdi*2], r13w
jmp 0x1401116bf
mov qword [rsp + 0x20], 1
lea r9, [0x1402456c8]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.140007480
mov r15d, 2
xor sil, sil
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x480]
call fcn.14018da90
lea rcx, [rbp + 0x480]
call fcn.1401103f0
test al, al
je 0x1401117ce
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, str.Shlwapi.dll
lea rcx, [rbp - 0x78]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbc80
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14011176f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011176a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a11
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rbx, rbx
je 0x1401117ce
lea rdx, str.StrStrIW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1401117ce
lea rdx, str.2345ExplorerHTML
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1401117cb
lea rdx, [0x140243160]
lea rcx, [rbp + 0x480]
call rbx
test rax, rax
je 0x1401117ce
mov sil, 1
mov ebx, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, [0x140245808]
lea rcx, [rbp - 0x78]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbc80
mov rdi, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140111856
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a17
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rdi, rdi
je 0x1401118c1
lea rdx, str.ShellExecuteW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401118c1
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
lea rdx, str.open
xor ecx, ecx
call rax
cmp rax, 0x20
jbe 0x1401118c1
mov ebx, 0x12
test sil, sil
cmovne ebx, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140111903
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401118fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a1d
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140111958
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111953
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a23
call fcn.140187064
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
cmp r12, 8
jb 0x1401119a2
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14011199a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401119ff
mov rcx, r14
call fcn.140187064
movdqa xmm0, xmmword [0x14024e310]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r13w
mov eax, ebx
jmp 0x1401119d5
cmp qword [rsi + 0x10], 0
jne 0x1401119c3
xor eax, eax
jmp 0x1401119d5
cmp qword [rsi + 0x18], 8
jb 0x1401119cd
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.140110b70
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.140187610
mov rbx, qword [rsp + 0x9e8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140199e4c
nop
call fcn.140199e4c
nop
call fcn.140199e4c
nop
call fcn.140199e4c
int3
call fcn.140199e4c
nop
call fcn.140199e4c
nop
call fcn.140199e4c
int3