Function at 0x14010d1f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x9e8], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x890], rax
mov qword [rsp + 0x30], r8
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x70]
call fcn.140189b30
xor r12d, r12d
mov word [rbp + 0x70], r12w
mov dword [rbp - 0x78], 0x207
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, str.Path
lea rdx, str.SOFTWARE2345Explorer
mov rcx, 0xffffffff80000002
call fcn.14010c440
test al, al
je 0x14010d2b9
lea rdx, [0x14023d488]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14023e498]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14010d2be
mov word [rbp + 0x70], r12w
xor dil, dil
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010dd18
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14010d300
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006b90
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400c78f0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14010d367
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d362
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd65
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400efb60
movzx edi, dil
mov eax, 1
cmp dword [rbp - 0x78], 7
cmovge edi, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010d3e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d3db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd6b
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
test dil, dil
je 0x14010dd18
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
mov dword [rbp + 0x20], 0x2d002d
mov dword [rbp + 0x24], 0x650073
mov dword [rbp + 0x28], 0x2d0074
mov dword [rbp + 0x2c], 0x650064
mov dword [rbp + 0x30], 0x610066
mov dword [rbp + 0x34], 0x6c0075
mov dword [rbp + 0x38], 0x2d0074
mov dword [rbp + 0x3c], 0x61006c
mov dword [rbp + 0x40], 0x6e0075
mov dword [rbp + 0x44], 0x680063
mov dword [rbp + 0x48], 0x61002d
mov dword [rbp + 0x4c], 0x740063
mov dword [rbp + 0x50], 0x6f0069
mov dword [rbp + 0x54], 0x3d006e
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x6e006f
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x73002d
mov dword [rbp - 0x20], 0x740065
mov dword [rbp - 0x1c], 0x64002d
mov dword [rbp - 0x18], 0x660065
mov dword [rbp - 0x14], 0x750061
mov dword [rbp - 0x10], 0x74006c
mov dword [rbp - 0xc], 0x61002d
mov dword [rbp - 8], 0x740063
mov dword [rbp - 4], 0x6f0069
mov dword [rbp], 0x3d006e
mov r14, qword [rsp + 0x30]
mov r8, rbx
cmp r15d, 1
jne 0x14010d574
mov dword [rbp + 0x58], 0x6e0069
mov dword [rbp + 0x5c], 0x740073
mov dword [rbp + 0x60], 0x6c0061
mov dword [rbp + 0x64], 0x65006c
mov dword [rbp + 0x68], 0x72
mov dword [rbp + 4], 0x6e0069
mov dword [rbp + 8], 0x740073
mov dword [rbp + 0xc], 0x6c0061
mov dword [rbp + 0x10], 0x65006c
mov dword [rbp + 0x14], 0x72
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], 0
je 0x14010d554
lea rax, [rbp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d540
lea rdx, [rbp + 0x20]
jmp 0x14010d5f2
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d560
lea rdx, [rbp - 0x30]
jmp 0x14010d5f2
mov dword [rbp + 0x58], 0x6f0073
mov dword [rbp + 0x5c], 0x740066
mov dword [rbp + 0x60], 0x610077
mov dword [rbp + 0x64], 0x650072
xor r11d, r11d
mov word [rbp + 0x68], r11w
mov dword [rbp + 4], 0x6f0073
mov dword [rbp + 8], 0x740066
mov dword [rbp + 0xc], 0x610077
mov dword [rbp + 0x10], 0x650072
xor eax, eax
mov word [rbp + 0x14], ax
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], r11
je 0x14010d5e0
lea rax, [rbp + 0x20]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d5d0
lea rdx, [rbp + 0x20]
jmp 0x14010d5f2
lea rax, [rbp - 0x30]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d5e4
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140006b90
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
lea r15, [r14 + 0x10]
xor r13d, r13d
cmp qword [r15], r13
je 0x14010d6ef
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x650073
mov dword [rbp - 0x28], 0x2d0074
mov dword [rbp - 0x24], 0x650064
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x6c0075
mov dword [rbp - 0x18], 0x2d0074
mov dword [rbp - 0x14], 0x720066
mov dword [rbp - 0x10], 0x6d006f
mov dword [rbp - 0xc], 0x3d
lea rax, [rbp - 0x30]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x14010d672
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006b90
cmp qword [r14 + 0x18], 8
jb 0x14010d697
mov r14, qword [r14]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d6dd
lea rdi, [rdx + rcx]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp r8, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r14
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010d6ef
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.1400074b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x40]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rdx, rax
ja 0x14010d768
lea rdi, [rcx + rdx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010d77f
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov r9d, 2
cmp qword [rsp + 0x78], 0
je 0x14010d86d
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d7d9
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, r9d
lea rdx, [0x140240064]
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010d7f8
mov qword [rsp + 0x20], 1
lea r9, [0x140240064]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x14010d855
lea rax, [r15 + rdi]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdi + rdi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.1401893f0
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x14010d867
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r9d, 2
mov r15, qword [rbp - 0x78]
cmp qword [r15], 0
je 0x14010da19
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x14010d8c8
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8, r9
lea rdx, [0x140240064]
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
mov ebx, 1
jmp 0x14010d8e5
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140240064]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d930
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1402407d0]
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010d949
mov qword [rsp + 0x20], rbx
lea r9, [0x1402407d0]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
cmp qword [rsi + 0x18], 8
jb 0x14010d953
mov rsi, qword [rsi]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d99a
lea rdi, [rdx + rcx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, rsi
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010d9ac
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d9fa
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r15d, 2
mov r8d, r15d
lea rdx, [0x1402407d0]
call fcn.1401893f0
mov word [rbx + rdi*2], r13w
jmp 0x14010da1f
mov qword [rsp + 0x20], 1
lea r9, [0x1402407d0]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r15d, 2
xor sil, sil
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x480]
call fcn.140189b30
lea rcx, [rbp + 0x480]
call fcn.14010c750
test al, al
je 0x14010db2e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, str.Shlwapi.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d7fe0
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010dacf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010daca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd71
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rbx, rbx
je 0x14010db2e
lea rdx, str.StrStrIW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14010db2e
lea rdx, str.2345ExplorerHTML
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14010db2b
lea rdx, [0x14023e498]
lea rcx, [rbp + 0x480]
call rbx
test rax, rax
je 0x14010db2e
mov sil, 1
mov ebx, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, [0x140240930]
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d7fe0
mov rdi, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010dbb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dbb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd77
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rdi, rdi
je 0x14010dc21
lea rdx, str.ShellExecuteW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010dc21
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
lea rdx, str.open
xor ecx, ecx
call rax
cmp rax, 0x20
jbe 0x14010dc21
mov ebx, 0x12
test sil, sil
cmovne ebx, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14010dc63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dc5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd7d
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010dcb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dcb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd83
call fcn.140183104
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
cmp r12, 8
jb 0x14010dd02
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14010dcfa
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd5f
mov rcx, r14
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r13w
mov eax, ebx
jmp 0x14010dd35
cmp qword [rsi + 0x10], 0
jne 0x14010dd23
xor eax, eax
jmp 0x14010dd35
cmp qword [rsi + 0x18], 8
jb 0x14010dd2d
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.14010ced0
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.1401836b0
mov rbx, qword [rsp + 0x9e8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195eec
nop
call fcn.140195eec
nop
call fcn.140195eec
nop
call fcn.140195eec
int3
call fcn.140195eec
nop
call fcn.140195eec
nop
call fcn.140195eec
int3