Function at 0x140110ec0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x9e8], rbx
mov rax, qword [0x1402c5168]
xor rax, rsp
mov qword [rbp + 0x890], rax
mov qword [rsp + 0x30], r8
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x70]
call fcn.14018d8d0
xor r12d, r12d
mov word [rbp + 0x70], r12w
mov dword [rbp - 0x78], 0x207
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, str.Path
lea rdx, str.SOFTWARE2345Explorer
mov rcx, 0xffffffff80000002
call fcn.140110110
test al, al
je 0x140110f89
lea rdx, [0x140242458]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140243470]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140110f8e
mov word [rbp + 0x70], r12w
xor dil, dil
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401119e8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140110fd0
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006b90
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400cb5c0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140111037
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111032
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a35
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400f3830
movzx edi, dil
mov eax, 1
cmp dword [rbp - 0x78], 7
cmovge edi, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1401110b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401110ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a3b
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
test dil, dil
je 0x1401119e8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
mov dword [rbp + 0x20], 0x2d002d
mov dword [rbp + 0x24], 0x650073
mov dword [rbp + 0x28], 0x2d0074
mov dword [rbp + 0x2c], 0x650064
mov dword [rbp + 0x30], 0x610066
mov dword [rbp + 0x34], 0x6c0075
mov dword [rbp + 0x38], 0x2d0074
mov dword [rbp + 0x3c], 0x61006c
mov dword [rbp + 0x40], 0x6e0075
mov dword [rbp + 0x44], 0x680063
mov dword [rbp + 0x48], 0x61002d
mov dword [rbp + 0x4c], 0x740063
mov dword [rbp + 0x50], 0x6f0069
mov dword [rbp + 0x54], 0x3d006e
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x6e006f
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x73002d
mov dword [rbp - 0x20], 0x740065
mov dword [rbp - 0x1c], 0x64002d
mov dword [rbp - 0x18], 0x660065
mov dword [rbp - 0x14], 0x750061
mov dword [rbp - 0x10], 0x74006c
mov dword [rbp - 0xc], 0x61002d
mov dword [rbp - 8], 0x740063
mov dword [rbp - 4], 0x6f0069
mov dword [rbp], 0x3d006e
mov r14, qword [rsp + 0x30]
mov r8, rbx
cmp r15d, 1
jne 0x140111244
mov dword [rbp + 0x58], 0x6e0069
mov dword [rbp + 0x5c], 0x740073
mov dword [rbp + 0x60], 0x6c0061
mov dword [rbp + 0x64], 0x65006c
mov dword [rbp + 0x68], 0x72
mov dword [rbp + 4], 0x6e0069
mov dword [rbp + 8], 0x740073
mov dword [rbp + 0xc], 0x6c0061
mov dword [rbp + 0x10], 0x65006c
mov dword [rbp + 0x14], 0x72
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], 0
je 0x140111224
lea rax, [rbp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140111210
lea rdx, [rbp + 0x20]
jmp 0x1401112c2
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140111230
lea rdx, [rbp - 0x30]
jmp 0x1401112c2
mov dword [rbp + 0x58], 0x6f0073
mov dword [rbp + 0x5c], 0x740066
mov dword [rbp + 0x60], 0x610077
mov dword [rbp + 0x64], 0x650072
xor r11d, r11d
mov word [rbp + 0x68], r11w
mov dword [rbp + 4], 0x6f0073
mov dword [rbp + 8], 0x740066
mov dword [rbp + 0xc], 0x610077
mov dword [rbp + 0x10], 0x650072
xor eax, eax
mov word [rbp + 0x14], ax
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], r11
je 0x1401112b0
lea rax, [rbp + 0x20]
inc r8
cmp word [rax + r8*2], r11w
jne 0x1401112a0
lea rdx, [rbp + 0x20]
jmp 0x1401112c2
lea rax, [rbp - 0x30]
inc r8
cmp word [rax + r8*2], r11w
jne 0x1401112b4
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140006b90
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
lea r15, [r14 + 0x10]
xor r13d, r13d
cmp qword [r15], r13
je 0x1401113bf
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x650073
mov dword [rbp - 0x28], 0x2d0074
mov dword [rbp - 0x24], 0x650064
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x6c0075
mov dword [rbp - 0x18], 0x2d0074
mov dword [rbp - 0x14], 0x720066
mov dword [rbp - 0x10], 0x6d006f
mov dword [rbp - 0xc], 0x3d
lea rax, [rbp - 0x30]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x140111342
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006b90
cmp qword [r14 + 0x18], 8
jb 0x140111367
mov r14, qword [r14]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1401113ad
lea rdi, [rdx + rcx]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp r8, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r14
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x1401113bf
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.1400074b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x40]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rdx, rax
ja 0x140111438
lea rdi, [rcx + rdx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x14011144f
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov r9d, 2
cmp qword [rsp + 0x78], 0
je 0x14011153d
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401114a9
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, r9d
lea rdx, [0x14024524c]
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x1401114c8
mov qword [rsp + 0x20], 1
lea r9, [0x14024524c]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x140111525
lea rax, [r15 + rdi]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdi + rdi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14018d190
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x140111537
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r9d, 2
mov r15, qword [rbp - 0x78]
cmp qword [r15], 0
je 0x1401116e9
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x140111598
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8, r9
lea rdx, [0x14024524c]
call fcn.14018d190
mov word [rbx + rdi*2], r13w
mov ebx, 1
jmp 0x1401115b5
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x14024524c]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140111600
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1402459d8]
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x140111619
mov qword [rsp + 0x20], rbx
lea r9, [0x1402459d8]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
cmp qword [rsi + 0x18], 8
jb 0x140111623
mov rsi, qword [rsi]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011166a
lea rdi, [rdx + rcx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, rsi
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x14011167c
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401116ca
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r15d, 2
mov r8d, r15d
lea rdx, [0x1402459d8]
call fcn.14018d190
mov word [rbx + rdi*2], r13w
jmp 0x1401116ef
mov qword [rsp + 0x20], 1
lea r9, [0x1402459d8]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r15d, 2
xor sil, sil
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x480]
call fcn.14018d8d0
lea rcx, [rbp + 0x480]
call fcn.140110420
test al, al
je 0x1401117fe
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, str.Shlwapi.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbcb0
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14011179f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011179a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a41
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rbx, rbx
je 0x1401117fe
lea rdx, str.StrStrIW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1401117fe
lea rdx, str.2345ExplorerHTML
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1401117fb
lea rdx, [0x140243470]
lea rcx, [rbp + 0x480]
call rbx
test rax, rax
je 0x1401117fe
mov sil, 1
mov ebx, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, [0x140245b18]
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbcb0
mov rdi, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140111886
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111881
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a47
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rdi, rdi
je 0x1401118f1
lea rdx, str.ShellExecuteW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401118f1
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
lea rdx, str.open
xor ecx, ecx
call rax
cmp rax, 0x20
jbe 0x1401118f1
mov ebx, 0x12
test sil, sil
cmovne ebx, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140111933
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011192e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a4d
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140111988
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a53
call fcn.140186ea4
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
cmp r12, 8
jb 0x1401119d2
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1401119ca
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111a2f
mov rcx, r14
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r13w
mov eax, ebx
jmp 0x140111a05
cmp qword [rsi + 0x10], 0
jne 0x1401119f3
xor eax, eax
jmp 0x140111a05
cmp qword [rsi + 0x18], 8
jb 0x1401119fd
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.140110ba0
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.140187450
mov rbx, qword [rsp + 0x9e8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140199c8c
nop
call fcn.140199c8c
nop
call fcn.140199c8c
nop
call fcn.140199c8c
int3
call fcn.140199c8c
nop
call fcn.140199c8c
nop
call fcn.140199c8c
int3