Function at 0x1401c25c0
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x6d0
mov qword [rsp + 0x618], 0xfffffffffffffffe
mov rax, qword [rsp + 0x6e0]
add rax, 0x2a8
mov ecx, 1
xchg dword [rax], ecx
lea rcx, [rsp + 0x30]
call fcn.14000f1c0
nop
mov dword [rsp + 0x1c8], 1
lea rcx, [rsp + 0x30]
call fcn.1401cfc20
lea rcx, [rsp + 0x598]
call fcn.140001000
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x628], rax
lea r8, [0x140219a0c]
mov rdx, qword [rsp + 0x628]
lea rcx, [rsp + 0x5a0]
call fcn.1400010b0
mov qword [rsp + 0x630], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x638], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x638]
lea rcx, [rsp + 0x5a8]
call fcn.1400010b0
mov qword [rsp + 0x640], rax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x648], rax
lea r8, [0x14021bc38]
mov rdx, qword [rsp + 0x648]
lea rcx, [rsp + 0x5b0]
call fcn.1400010b0
mov qword [rsp + 0x650], rax
mov rcx, qword [rsp + 0x650]
call fcn.140023510
mov r9, rax
mov r8d, 1
lea rdx, [0x14021bc48]
lea rcx, [0x14021bc60]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x594], eax
lea rcx, [rsp + 0x5b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x5a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x598]
call fcn.140001490
cmp dword [rsp + 0x594], 0
je 0x1401c2c53
lea rdx, [0x14021b274]
lea rcx, [rsp + 0x558]
call fcn.1400020d0
nop
lea rdx, str._echo_off_r_nREM_CCBootShare_Required_Services_r_n_r_n:rpc_endpoint_mapper_r_nREM_RPC_Endpoint_Mapper_r_nsc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_nif_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_r_n:start_rpc_mapper_service_r_nsc_config_nsi_start_AUTO_r_nnet_start_nsi_r_n_r_n:dcom_server_process_launcher_r_nREM_DCOM_Server_Process_Launcher_r_nsc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_nif_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_r_n:start_dcom_service_r_nsc_config_DcomLaunch_start_AUTO_r_nnet_start_DcomLaunch_r_n_r_n:remote_procedure_call_r_nREM_Remote_Procedure_Call__RPC__r_nsc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_nif_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_r_n:start_rpc_service_r_nsc_config_RpcSs_start_AUTO_r_nnet_start_RpcSs_r_n_r_n:security_accounts_manager_r_nREM_Security_Accounts_Manager_r_nsc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_nif_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_r_n:start_security_service_r_nsc_config_SamSs_start_AUTO_r_nnet_start_SamSs_r_n_r_n:server_service_r_nREM_Server_r_nsc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_nif_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_r_n:start_server_service_r_nsc_config_LanmanServer_start_AUTO_r_nnet_start_LanmanServer_r_n_r_n:bat_exit_r_necho_12__get_sid_gust_variable_r_nfor__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_______if_not____a__SID____r_n_t___set_sid_guest__a_r_n__________goto_loop_end_r_n_________r_n______r_n_r_n:loop_end_r_n_r_necho_13__create_script_for_regini_r_n_echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_r_necho_14__add_permission_for_machine_security_r_nnet_user_guest__active:yes_r_nregini_x_r_ndel_x_r_n_echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_echo__hex_0_:42_00_00_00____y.reg_r_nreg_import_y.reg_r_ndel_y.reg_r_n_echo_on_r_n
lea rcx, [rsp + 0x558]
call fcn.1400020a0
mov rdx, qword [rsp + 0x6e0]
add rdx, 0x228
lea r8, str.CCBootShare.bat
lea rcx, [rsp + 0x568]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x570]
call fcn.1400924e0
nop
lea rcx, [rsp + 0x568]
call fcn.140023510
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.140092c68
test eax, eax
je 0x1401c28fb
lea rcx, [rsp + 0x570]
call fcn.140026460
lea rcx, [rsp + 0x558]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x5b8]
call fcn.1400d8920
mov qword [rsp + 0x658], rax
mov rax, qword [rsp + 0x658]
mov qword [rsp + 0x660], rax
lea rcx, [rsp + 0x558]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x5c0]
call fcn.1400d8920
mov qword [rsp + 0x668], rax
mov rax, qword [rsp + 0x668]
mov qword [rsp + 0x670], rax
mov rcx, qword [rsp + 0x660]
call fcn.140001a40
mov ebx, eax
mov rcx, qword [rsp + 0x670]
call fcn.140023510
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.140092160
nop
lea rcx, [rsp + 0x5c0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5b8]
call fcn.140001490
lea rcx, [rsp + 0x570]
call fcn.140092458
lea rcx, [rsp + 0x568]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
lea rcx, [rsp + 0x568]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x1d8]
xor edx, edx
call fcn.140006dd0
movzx r8d, ax
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
lea rdx, [0x14021cea0]
call fcn.140002c40
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c297f
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x228
xor edx, edx
call fcn.140006dd0
movzx r8d, ax
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
lea rdx, [0x14021ceb0]
call fcn.140002c40
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
lea rdx, str.SteamData
call fcn.140006000
mov r8, qword [rsp + 0x6e0]
add r8, 0x2b0
lea rdx, str.cmd__c__rd__S__Q
lea rcx, [rsp + 0x5c8]
call fcn.140006c90
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x678]
mov qword [rsp + 0x680], rax
lea r8, [0x14021b464]
mov rdx, qword [rsp + 0x680]
lea rcx, [rsp + 0x5d0]
call fcn.1400010b0
mov qword [rsp + 0x688], rax
mov rax, qword [rsp + 0x688]
mov qword [rsp + 0x690], rax
mov rcx, qword [rsp + 0x690]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
nop
lea rcx, [rsp + 0x5d0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5c8]
call fcn.140001490
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c2a8d
mov rcx, qword [rsp + 0x6e0]
add rcx, 0x2b0
call fcn.140023510
mov rcx, rax
call fcn.140004bc0
xor edx, edx
lea rcx, [rsp + 0x370]
call fcn.140176e90
nop
lea rax, [rsp + 0x5d8]
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x5e8]
mov qword [rsp + 0x5f0], rax
lea rax, [rsp + 0x5f8]
mov qword [rsp + 0x600], rax
lea rdx, [0x14021cf00]
mov rcx, qword [rsp + 0x5e0]
call fcn.1400020d0
mov qword [rsp + 0x698], rax
mov rax, qword [rsp + 0x698]
mov qword [rsp + 0x6a0], rax
lea rdx, [0x14021cf10]
mov rcx, qword [rsp + 0x5f0]
call fcn.1400020d0
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x6a8]
mov qword [rsp + 0x6b0], rax
mov rdx, qword [rsp + 0x6e0]
add rdx, 0x2b0
mov rcx, qword [rsp + 0x600]
call fcn.140001430
mov qword [rsp + 0x6b8], rax
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x6b0]
mov r8d, 1
mov rdx, qword [rsp + 0x6b8]
lea rcx, [rsp + 0x370]
call fcn.1401822e0
mov dword [rsp + 0x560], eax
mov r8d, dword [rsp + 0x560]
lea rdx, str.SetAcl___d_
xor ecx, ecx
call fcn.1400dc610
xor r9d, r9d
mov r8d, 1
xor edx, edx
lea rcx, [0x14021cf40]
call fcn.140004900
lea rdx, [0x14021b54c]
lea rcx, [rsp + 0x550]
call fcn.1400020d0
nop
mov r8, qword [rsp + 0x6e0]
mov r8, qword [r8 + 0x2b0]
lea rdx, str.NET_SHARE_CCBootShare__s___GRANT:everyone_FULL__UNLIMITED__Y
lea rcx, [rsp + 0x550]
call fcn.140002c40
lea rcx, [rsp + 0x550]
call fcn.140023510
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004900
nop
lea rcx, [rsp + 0x550]
call fcn.140001490
nop
lea rcx, [rsp + 0x370]
call fcn.140176da0
nop
lea rcx, [rsp + 0x570]
call fcn.14009272c
nop
lea rcx, [rsp + 0x568]
call fcn.140001490
nop
lea rcx, [rsp + 0x558]
call fcn.140001490
lea rcx, [rsp + 0x1f8]
call fcn.140006e20
movzx eax, al
test eax, eax
je 0x1401c2c88
lea rcx, [0x14021d010]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6e0]
mov dword [rax + 0x2ac], r11d
jmp 0x1401c2cf2
lea rcx, [rsp + 0x1f8]
call fcn.140023510
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140002de0
mov qword [rsp + 0x6c0], rax
mov rax, qword [rsp + 0x6c0]
mov qword [rsp + 0x6c8], rax
mov rcx, qword [rsp + 0x6c8]
call fcn.140002e90
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6e0]
mov dword [rax + 0x2ac], r11d
lea rcx, [rsp + 0x608]
call fcn.140002e70
mov edx, 1
mov ecx, dword [rsp + 0x6e8]
call fcn.1400d6d20
test eax, eax
jne 0x1401c2db1
xor edx, edx
mov ecx, dword [rsp + 0x6e8]
call fcn.1400d6d20
test eax, eax
jne 0x1401c2db1
mov r8d, dword [rsp + 0x6e8]
lea rdx, str.Listen_at_TCP_UDP_port__d
xor ecx, ecx
call fcn.1400dc610
mov r9d, dword [rsp + 0x6f8]
mov r8, qword [rsp + 0x6f0]
mov edx, dword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6e0]
call fcn.1400e3670
mov dword [rsp + 0x590], eax
cmp dword [rsp + 0x590], 0
je 0x1401c2d90
mov edx, 0x65
mov rcx, qword [rsp + 0x6e0]
call fcn.1400e35f0
mov edx, 0x66
mov rcx, qword [rsp + 0x6e0]
call fcn.1400e35f0
mov eax, dword [rsp + 0x590]
mov dword [rsp + 0x610], eax
lea rcx, [rsp + 0x30]
call fcn.140005db0
mov eax, dword [rsp + 0x610]
jmp 0x1401c2dcd
mov dword [rsp + 0x614], 0
lea rcx, [rsp + 0x30]
call fcn.140005db0
mov eax, dword [rsp + 0x614]
add rsp, 0x6d0
pop rbx
ret