Function at 0x140019660
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
xor eax, eax
mov dword [rbp + 0xa0], eax
lea rax, [fcn.140003e50]
mov qword [rsp + 0x20], rax
lea r9, [fcn.1400155e0]
mov edx, 8
lea r8d, [rdx - 6]
lea rcx, [rbp - 0x60]
call fcn.140240fb0
nop
call fcn.140004c80
test rax, rax
je 0x14001a1c9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, str.ShellExtension
mov r13, 0xffffffffffffffff
cmp rcx, 0x10000
jae 0x1400196ed
movzx edx, cx
lea rcx, [rsp + 0x68]
call fcn.140005650
jmp 0x14001970b
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400196f0
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.14000ae10
nop
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140019727
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140019738
call fcn.140004c80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001a1d4
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0xa0], 1
lea rax, [0x1402880a8]
mov rsi, r13
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140019764
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x14001a1be
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400197a3
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140005960
mov rbx, qword [rsp + 0x70]
add r12, r12
je 0x1400197cd
test rbx, rbx
jne 0x1400197bf
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
jmp 0x1400197cd
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1402430d0
lea rcx, [r12 + rbx]
movsxd r8, esi
add r8, r8
je 0x1400197fc
test rcx, rcx
jne 0x1400197f0
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
jmp 0x1400197fc
lea rdx, [0x1402880a8]
call fcn.1402430d0
cmp r14d, dword [rbx - 0xc]
jg 0x14001a1be
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor esi, esi
mov word [rbx + rax*2], si
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.140017160
mov dword [rbp + 0xa0], esi
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140019843
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + ioctlsocket]
nop
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x14001985e
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + ioctlsocket]
call fcn.140004c80
test rax, rax
je 0x14001a1c9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.ShellExtension
cmp rdx, 0x10000
jae 0x14001989d
movzx edx, dx
lea rcx, [rsp + 0x78]
call fcn.140005650
jmp 0x1400198b8
mov rax, r13
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400198a0
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.14000ae10
nop
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x1400198d4
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400198e5
call fcn.140004c80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001a1df
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
mov dword [rbp + 0xa0], 2
lea rax, str._x64.dll
mov rsi, r13
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140019910
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x14001a22c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14001994d
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.140005960
mov rbx, qword [rbp - 0x80]
add r12, r12
je 0x140019977
test rbx, rbx
jne 0x140019969
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
jmp 0x140019977
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1402430d0
lea rcx, [r12 + rbx]
movsxd r8, esi
add r8, r8
je 0x1400199a6
test rcx, rcx
jne 0x14001999a
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
jmp 0x1400199a6
lea rdx, str._x64.dll
call fcn.1402430d0
cmp r14d, dword [rbx - 0xc]
jg 0x14001a22c
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.140017160
mov dword [rbp + 0xa0], r14d
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400199ef
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + ioctlsocket]
nop
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140019a0a
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + ioctlsocket]
lea rcx, [rbp + 0xb0]
call fcn.140031f00
nop
mov rcx, qword [rbp + 0xb0]
movsxd r8, dword [rcx - 0x10]
lea eax, [r8 - 1]
test eax, eax
js 0x14001a221
cmp eax, r8d
jg 0x14001a221
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x140019ae9
dec r8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xb0]
call fcn.14000de60
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xb0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140019ac4
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x140019ab3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140019ab3
call fcn.14000ce00
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140019aa6
mov rcx, qword [rbx]
mov rdx, qword [rcx]
mov r8, qword [rdx + 8]
mov rdx, rbx
call r8
lea rax, [rdi + 0x18]
mov qword [rbp + 0xb0], rax
jmp 0x140019ac4
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000ae10
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140019ae2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rcx, qword [rbp + 0xb0]
mov edx, 0x5c
call fcn.140243910
test rax, rax
je 0x140019bad
sub rax, qword [rbp + 0xb0]
sar rax, 1
test eax, eax
js 0x140019bad
lea r8d, [rax + 1]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb0]
call fcn.14000de60
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xb0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140019b8f
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x140019b7e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140019b7e
call fcn.14000ce00
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140019b71
mov rcx, qword [rbx]
mov rdx, qword [rcx]
mov r8, qword [rdx + 8]
mov rdx, rbx
call r8
lea rax, [rdi + 0x18]
mov qword [rbp + 0xb0], rax
jmp 0x140019b8f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000ae10
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140019bad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rcx, [rbp + 0xb8]
call fcn.140031f00
nop
lea rdx, str.......Shell_
mov rax, r13
inc rax
cmp word [rdx + rax*2], 0
jne 0x140019bc4
mov r8d, eax
lea rcx, [rbp + 0xb8]
call fcn.14000cce0
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rcx, qword [rbp + 0xb8]
test eax, eax
jne 0x140019bff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140019c04
call fcn.14001a240
lea rsi, [rbp - 0x60]
mov qword [rbp - 0x70], rsi
lea rbx, str.regsvr32__s__
mov r8, rsi
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x78]
call fcn.14000c770
nop
mov r8, rsi
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x58]
call fcn.14000c770
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140019f19
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140019f19
call fcn.140004c80
test rax, rax
je 0x14001a200
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
mov rax, qword [rbp + 0xb8]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140019c9d
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140019cac
call fcn.140004c80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x14001a1f5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
mov r15d, dword [rbp + 0xa0]
or r15d, 0x10
mov dword [rbp + 0xa0], r15d
mov r12, qword [rsi]
mov eax, dword [r12 - 0x10]
mov dword [rbp + 0xa8], eax
mov r13, qword [rbp + 0xb8]
movsxd rsi, dword [r13 - 0x10]
lea r14d, [rsi + rax]
test r14d, r14d
js 0x14001a1ea
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or ecx, eax
jge 0x140019d20
mov edx, r14d
lea rcx, [rbp - 0x68]
call fcn.140005960
mov rbx, qword [rbp - 0x68]
add rsi, rsi
je 0x140019d56
test rbx, rbx
je 0x140019d46
mov r8, rsi
mov rcx, rbx
test r13, r13
je 0x140019d3f
mov rdx, r13
call fcn.1402430d0
jmp 0x140019d56
xor edx, edx
call fcn.140243780
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
lea rcx, [rsi + rbx]
movsxd r8, dword [rbp + 0xa8]
add r8, r8
je 0x140019d91
test rcx, rcx
je 0x140019d81
test r12, r12
je 0x140019d7a
mov rdx, r12
call fcn.1402430d0
jmp 0x140019d91
xor edx, edx
call fcn.140243780
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
lea rsi, [rbx - 0x18]
cmp r14d, dword [rsi + 0xc]
jg 0x14001a1ea
mov dword [rsi + 8], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
add rdi, 0xffffffffffffffe8
cmp rsi, rdi
je 0x140019e18
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x140019e07
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x140019e07
mov rcx, rsi
call fcn.14000ce00
mov rbx, rax
mov r13, 0xffffffffffffffff
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140019df5
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rioctlsocket + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
mov r15d, dword [rbp + 0xa0]
jmp 0x140019e1f
mov r8d, dword [rsi + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000ae10
mov r13, 0xffffffffffffffff
and r15d, 0xffffffef
mov dword [rbp + 0xa0], r15d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140019e43
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + ioctlsocket]
mov r8d, 4
lea rdx, str..bak
lea rcx, [rsp + 0x60]
call fcn.14000cce0
mov edi, 1
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140019eaa
mov rsi, qword [rbp - 0x70]
mov eax, edi
inc edi
mov dword [rsp + 0x20], eax
mov r9, qword [rsi]
mov r8, qword [rbp + 0xb8]
lea rdx, str._s_s__d.bak
lea rcx, [rsp + 0x60]
call fcn.14000d000
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140019e75
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140019edb
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9d, [rax + 2]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140019ef8
xor edx, edx
lea r8d, [rax + 5]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140019f12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rbx, str.regsvr32__s__
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14001a0f7
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140004c80
test rax, rax
je 0x14001a216
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
cmp rbx, 0x10000
jae 0x140019f75
movzx edx, bx
call fcn.140005650
jmp 0x140019f84
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
call fcn.14000ae10
nop
mov rdi, qword [rsp + 0x58]
movsxd rax, dword [rdi - 0x10]
mov r15, rdi
mov rbx, qword [rsp + 0x50]
sub r15, rbx
sar r15, 1
mov r12d, dword [rbx - 0x10]
test eax, eax
js 0x14001a20b
test rdi, rdi
je 0x140019fba
mov rdx, rax
mov rcx, rdi
call fcn.140253bac
mov r14, rax
mov ecx, 0x7fffffff
sub ecx, r14d
cmp ecx, r12d
jl 0x14001a20b
lea esi, [r14 + r12]
test esi, esi
js 0x14001a20b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140019ff9
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140005960
mov rbx, qword [rsp + 0x50]
cmp r15, r12
ja 0x14001a002
lea rdi, [rbx + r15*2]
lea rcx, [rbx + r12*2]
movsxd r8, r14d
add r8, r8
je 0x14001a039
test rcx, rcx
je 0x14001a029
test rdi, rdi
je 0x14001a022
mov rdx, rdi
call fcn.1402430d0
jmp 0x14001a039
xor edx, edx
call fcn.140243780
call fcn.14025224c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14024809c
cmp esi, dword [rbx - 0xc]
jg 0x14001a20b
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor r14d, r14d
mov word [rbx + rax*2], r14w
lea r8d, [r14 + 1]
lea rdx, [0x140286ab4]
lea rcx, [rsp + 0x50]
call fcn.14000cce0
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001a0dc
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001a0f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001a117
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001a135
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rsi, qword [rbp - 0x70]
add rsi, 8
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x50]
cmp rsi, rax
jne 0x140019c0c
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001a170
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14001a191
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
lea r9, [fcn.140003e50]
mov edx, 8
lea r8d, [rdx - 6]
lea rcx, [rbp - 0x60]
call fcn.140240ee0
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80070057
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80070057
call fcn.140004b00
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
mov ecx, 0x80070057
call fcn.140004b00
nop
mov ecx, 0x80070057
call fcn.140004b00
int3