Function at 0x180015f90
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov ebx, r9d
mov dword [rsp + 0x44], ebx
mov r13, r8
mov qword [rsp + 0x68], r8
mov r12d, edx
mov dword [rsp + 0x40], edx
mov rbp, rcx
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
mov rdx, qword [rsp + 0x250]
mov qword [rsp + 0x48], rdx
lea rsi, [0x18002e4fb]
mov rdx, rsi
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x58], rdx
lea rax, [0x180033c14]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x50], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rsi
call fcn.1800012d0
mov r14, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rsi
call fcn.1800012d0
mov r15, rax
xor r8d, r8d
mov edx, r12d
mov rcx, rbp
call fcn.180003830
xor r8d, r8d
mov edx, ebx
mov rcx, r13
call fcn.180003830
call fcn.180013a30
mov rdx, qword [rax + 8]
lea rcx, str._ssccon0987.txt
call fcn.180001930
mov rsi, rax
mov qword [rsp + 0x60], rax
call fcn.180013ac0
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.180013ac0
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800160dc
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, [0x180033c28]
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180013a30
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.180013a30
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180016123
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, [0x180033c40]
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180013ac0
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013ac0
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013a30
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013ac0
mov rbx, rax
call fcn.180013ac0
mov rdi, rax
call fcn.180013a30
mov r9, qword [rbx + 8]
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, [0x180033c60]
call fcn.180003e90
mov rcx, qword [rsi + 8]
call fcn.180002090
mov rsi, rax
xor ebx, ebx
test rax, rax
je 0x18001625f
mov rdx, qword [rax + 8]
mov edi, ebx
cmp dword [rax + 4], ebx
jle 0x1800161dd
lea r8, str._abd04
mov rcx, r8
cmp byte [str._abd04], bl
je 0x1800161d8
mov eax, edi
inc edi
cmp eax, dword [rsi + 4]
jge 0x1800161d8
movzx eax, byte [rcx]
add byte [rdx], al
inc rcx
inc rdx
cmp byte [rcx], bl
jne 0x1800161c0
cmp edi, dword [rsi + 4]
jl 0x1800161b5
mov rcx, rsi
call fcn.180002660
mov r13, rax
mov r12d, ebx
mov ecx, dword [rax + 0xc]
mov rbp, rbx
test ecx, ecx
jle 0x18001623e
cmp r12d, ecx
jge 0x180016209
test rbp, rbp
js 0x180016209
mov rax, qword [r13 + 0x10]
mov rdi, qword [rax + rbp*8]
jmp 0x18001620c
mov rdi, rbx
cmp dword [rdi + 4], ebx
jle 0x18001622f
mov edx, 1
mov rcx, qword [rdi + 8]
call fcn.180005d40
mov rdx, qword [rdi + 8]
lea rcx, [0x180033c78]
call fcn.180003e90
inc r12d
inc rbp
mov ecx, dword [r13 + 0xc]
cmp r12d, ecx
jl 0x1800161f5
mov dl, 1
mov rcx, r13
call fcn.1800016d0
mov rcx, rsi
call fcn.180001800
mov rbp, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
mov edx, 8
lea rcx, [rsp + 0x1b0]
call fcn.1800045f0
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033c8c]
mov byte [rdi + 3], al
call fcn.180013ac0
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r14
call fcn.180001b60
mov rcx, qword [r14 + 8]
call fcn.180003a10
test al, al
jne 0x180016270
mov r8d, r12d
mov rdx, rbp
mov rcx, qword [r14 + 8]
call fcn.180003b60
mov rdx, qword [r14 + 8]
lea rcx, [0x180033c90]
call fcn.180003e90
mov rcx, qword [r14 + 8]
call fcn.180003a10
test al, al
jne 0x180016320
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, [0x180033ca0]
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
lea edx, [rax + 8]
lea rcx, [rsp + 0x1b0]
call fcn.1800045f0
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033c8c]
mov byte [rdi + 3], al
call fcn.180013ac0
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r15
call fcn.180001b60
mov rcx, qword [r15 + 8]
call fcn.180003a10
test al, al
jne 0x180016320
mov r8d, dword [rsp + 0x44]
mov rdx, r13
mov rcx, qword [r15 + 8]
call fcn.180003b60
mov rcx, qword [r15 + 8]
call fcn.180003a10
test al, al
jne 0x1800163d1
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, [0x180033cb8]
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [r15 + 8]
lea rcx, [0x180033c90]
call fcn.180003e90
call fcn.180013ac0
mov rdi, rax
call fcn.180013ac0
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, str._s_r_n_s
call fcn.180001930
mov rcx, rax
mov edx, 5
call fcn.180002040
mov r8d, dword [rcx + 4]
mov rdx, qword [rcx + 8]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call fcn.180003b60
mov rcx, qword [rsp + 0x48]
call fcn.1800018c0
mov rdi, rax
lea rbp, [0x18002e4fb]
mov r8, rbp
lea rdx, [0x18002e4fc]
mov rcx, rax
call fcn.180001c50
lea r8, [0x18002e560]
lea rdx, [0x18002e550]
mov rcx, rdi
call fcn.180001c50
call fcn.180013ac0
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 8]
mov r8, qword [r15 + 8]
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x80]
call fcn.180014240
nop
cmp byte [rsp + 0x260], 0
jne 0x1800165c0
lea rcx, [0x180033ce0]
call fcn.180003e90
xor ecx, ecx
call fcn.1800072e0
test eax, eax
je 0x180016553
call fcn.180007330
test eax, eax
je 0x1800165c0
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
jne 0x1800164ec
mov rdi, rbx
jmp 0x180016503
mov dword [rax + 4], ebx
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
mov rsi, qword [0x18003dff0]
lea r8, [0x180033b4c]
mov edx, 0x67
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x180016532
lea rcx, [0x1800329f8]
call fcn.180003df0
jmp 0x180016540
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180005b80
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r8d, [rdx - 6]
mov rcx, rdi
call fcn.180005960
jmp 0x1800165c0
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
jne 0x18001656c
mov rdi, rbx
jmp 0x180016583
mov dword [rax + 4], ebx
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
mov rsi, qword [0x18003dff0]
lea r8, [0x180033b4c]
mov edx, 0x66
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x1800165b2
lea rcx, [0x1800329f8]
call fcn.180003df0
jmp 0x1800165c0
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180005b80
mov qword [rsp + 0x28], rbp
lea rax, [0x1800338d8]
mov qword [rsp + 0x20], rax
mov r9, rbp
lea r8, [0x1800338d4]
mov rdx, qword [r14 + 8]
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
call fcn.180013720
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, str.XXX__s
call fcn.180003e90
mov rcx, qword [rdi + 8]
call fcn.180005fd0
test eax, eax
jne 0x180016631
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, str.rundll32
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
call fcn.180001800
cmp byte [rsp + 0x258], 0
jne 0x1800166c6
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
test ecx, ecx
cmove r14, r15
mov qword [rsp + 0x28], rbp
lea rax, [0x1800338dc]
mov qword [rsp + 0x20], rax
mov r9, rbp
lea r8, [0x1800338d4]
mov rdx, qword [r14 + 8]
call fcn.1800138b0
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, [0x180033d20]
call fcn.180003e90
mov rcx, qword [rdi + 8]
call fcn.180005fd0
test eax, eax
jne 0x1800166be
lea rcx, str.c:_xscp.txt
call fcn.180003d40
lea rcx, str.rundll32
call fcn.180003e90
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
call fcn.180001800
cmp byte [rsp + 0x268], 0
jne 0x1800166e3
lea rcx, [0x180033d38]
call fcn.180003e90
xor ecx, ecx
call fcn.180015b30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x1a8]
test rax, rax
je 0x180016706
cmp dword [rax], 0
jne 0x180016706
cmp dword [rax + 4], 0
je 0x18001670d
inc ebx
cmp ebx, 0x32
jl 0x1800166f6
lea rcx, [rsp + 0x80]
call fcn.180013e40
xor eax, eax
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.180017810
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret