Function at 0x140001738
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x568]
sub rsp, 0x668
or dword [rbp + 0x5b8], 0xffffffff
lea rsi, [0x140021d38]
xor r14d, r14d
or rdi, 0xffffffffffffffff
mov r15, rcx
mov r13d, 1
mov dword [rbp + 0x5b0], r14d
cmp word [rcx], r14w
jne 0x1400019c7
mov rdx, rcx
mov r8d, 0x104
mov rcx, qword [0x140021d20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
lea r8d, [r13 + 0x3f]
mov edx, 0x8000
mov rcx, r15
call fcn.140004468
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400019e7
mov rcx, rax
call fcn.1400045c0
mov rcx, rdi
mov r14, rax
call fcn.140003b94
mov r12d, eax
mov eax, r14d
lea rcx, [r12 + 0x3e4]
cmp rax, rcx
jbe 0x1400019f1
mov ecx, 0x3e4
call fcn.14000a1fc
xor r8d, r8d
mov edx, r12d
mov rcx, rdi
mov rbx, rax
call fcn.140004560
mov r8d, 0x3e4
mov rdx, rbx
mov rcx, rdi
call fcn.140004600
cmp eax, 0x3e4
jne 0x1400019b5
cmp byte [rbx], 0x44
jne 0x1400019b5
cmp byte [rbx + 1], 0x45
jne 0x1400019b5
cmp byte [rbx + 2], 0x43
jne 0x1400019b5
cmp byte [rbx + 3], 0x43
jne 0x1400019b5
cmp byte [rbx + 4], 0x41
jne 0x1400019b5
cmp byte [rbx + 5], 0x42
jne 0x1400019b5
cmp byte [rbx + 7], 0x55
jne 0x1400019b5
lea rsi, [rbx + 0x210]
xor eax, eax
cmp word [rsi], ax
jne 0x14000187a
mov dword [rbx + 0x318], eax
mov byte [rbx + 6], 0x33
jmp 0x1400018e1
cmp byte [rbx + 6], 0x36
jne 0x1400018e1
or ecx, 0xffffffff
call fcn.140002438
test eax, eax
jne 0x1400018da
mov rcx, rbx
call fcn.14000a1e8
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov edx, 0x16
mov rcx, qword [0x140021d20]
lea r8, [rsp + 0x60]
mov r9d, 0x80
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x60]
lea r8, str.CAB_SFX
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140001ec5
mov byte [0x140021d36], 0x36
mov r8, r15
lea rcx, [0x140021d38]
mov rdx, rbx
call fcn.1400047d0
mov rdx, rsi
mov dword [rbp + 0x5b0], eax
lea rcx, [0x140021f40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rbx + 0x310]
lea rdx, [rbx + 0x324]
mov dword [0x140022040], eax
lea rcx, [0x140022054]
mov eax, dword [rbx + 0x314]
mov dword [0x140022044], eax
mov eax, dword [rbx + 0x318]
mov dword [0x140022048], eax
mov eax, dword [rbx + 0x31c]
mov dword [0x14002204c], eax
mov eax, dword [rbx + 0x320]
mov dword [0x140022050], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbx + 0x364]
lea rcx, [0x140022094]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r8d, dword [0x140022050]
xor esi, esi
test r8d, r8d
je 0x1400019a8
mov rdx, qword [0x140021d20]
lea r9d, [r14 + 0x3e4]
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov dword [rsp + 0x20], r12d
call fcn.140003fc8
test eax, eax
jne 0x1400019a8
cmp word [0x140021f40], si
jne 0x1400019f1
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140004560
mov rcx, rbx
call fcn.14000a1e8
xor r14d, r14d
lea rsi, [0x140021d38]
mov rdx, rdi
mov qword [0x140021ad8], r15
mov rcx, r15
call fcn.140001ee4
mov dword [rbp + 0x5c0], eax
mov r12d, eax
cmp eax, 0xffffffff
jne 0x1400019fe
mov edx, 0xc
jmp 0x1400018a1
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400018d3
cmp dword [0x140021ad0], 0xffffffff
jne 0x140001a11
mov edx, InitCommonControls
jmp 0x1400018a1
cmp word [0x140022094], r14w
je 0x140001a40
mov r9d, 0x24
lea r8, [0x140022054]
lea rdx, [0x140022094]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400018d3
lea r8, [rbp + 0x160]
mov rcx, r15
lea rdx, [rsp + 0x60]
call fcn.140003a58
cmp word [0x140021d38], r14w
jne 0x140001a6c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x2e
lea rcx, [rbp + 0x160]
call fcn.140006c60
test rax, rax
je 0x140001a86
mov word [rax], r14w
lea rcx, [rbp + 0x160]
call fcn.1400039fc
mov ebx, 0x5c
cmp dword [0x14002204c], r14d
jne 0x140001ab5
lea rcx, [rbp + 0x160]
call fcn.1400031d0
cmp eax, r13d
jne 0x1400018d3
mov rcx, rsi
call fcn.140003a34
mov rcx, rsi
call fcn.140003820
cmp word [0x140021d38], r14w
mov rcx, rsi
jne 0x140001ae2
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140001c37
mov edx, ebx
call fcn.140006c60
test rax, rax
jne 0x140001b1b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x140021d36]
cmp word [rax + rcx*2], 0x3a
je 0x140001b1b
mov rdx, rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rsi
jmp 0x140001ad2
movzx eax, word [0x140021d38]
cmp ax, bx
jne 0x140001b39
cmp word [0x140021d3a], bx
je 0x140001b55
lea rdx, [0x140021d3a]
jmp 0x140001b0b
mov ecx, 0x2e
cmp ax, cx
jne 0x140001b55
cmp word [0x140021d3a], bx
jne 0x140001b55
lea rdx, [0x140021d3c]
jmp 0x140001b0b
lea rdx, [0x140016840]
mov rcx, rsi
call fcn.140006d10
cmp rax, rsi
jne 0x140001c37
lea rdx, [0x140016840]
mov esi, r14d
lea rcx, [0x140021d38]
call fcn.140006d10
mov rbx, rax
test rax, rax
je 0x140001bc1
lea r12, [0x140021d38]
lea rdx, [rbx + 4]
mov rcx, r12
add esi, r13d
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140016840]
lea rcx, [rbx + 4]
call fcn.140006d10
mov rbx, rax
test rax, rax
jne 0x140001b92
mov r12d, dword [rbp + 0x5c0]
lea rcx, [rsp + 0x60]
call fcn.140003820
lea rcx, [rsp + 0x60]
call fcn.140009e20
mov rbx, rax
test esi, esi
jle 0x140001bfb
mov edx, 0x5c
mov rcx, rbx
call fcn.140006c60
xor ecx, ecx
test rax, rax
je 0x140001c69
add r14d, r13d
mov word [rax], cx
cmp r14d, esi
jl 0x140001bdc
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rsi, [0x140021d38]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.14000a1e8
xor r14d, r14d
lea rdx, str.____
mov rcx, rsi
call fcn.140009ea4
mov rcx, rsi
mov rbx, rax
call fcn.140009ee4
mov rcx, rsi
cmp rbx, rax
je 0x140001c8e
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140001a92
lea rsi, [0x140021d38]
mov rcx, rsi
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.14000a1e8
xor r14d, r14d
jmp 0x140001a92
call fcn.1400039fc
mov rcx, rsi
call fcn.1400037e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001d41
cmp dword [0x140022040], r14d
jne 0x140001d0c
mov rcx, qword [0x140021d20]
lea r8, [rsp + 0x60]
mov r9d, 0x80
lea edx, [r9 - 0x72]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x21
lea r8, str.CAB_SFX
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, r13d
jne 0x140001eb4
mov rcx, rsi
call fcn.140003694
test eax, eax
jne 0x140001d41
mov rcx, qword [0x140021d20]
lea r8, [rbp + 0x160]
mov r9d, 0x80
lea edx, [rax + 0x11]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rbp + 0x160]
jmp 0x1400018be
mov ecx, r12d
call fcn.140003234
lea rax, [rbp + 0x5c8]
mov r9, r15
mov qword [rsp + 0x28], rax
lea r8, [0x14000162c]
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call fcn.14000a33c
mov rbx, rax
jmp 0x140001d9e
mov rcx, qword [0x140022118]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140001d9e
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001d72
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x5b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400045ac
cmp rax, 0xffffffffffffffff
je 0x140001df0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x140021d2c], r14d
je 0x140001e01
mov r13d, r14d
jmp 0x140001eb4
cmp word [0x140021f40], r14w
je 0x140001e75
mov r8d, dword [0x140022048]
lea rcx, [0x140021f40]
mov rdx, rsi
call fcn.14000208c
cmp qword [0x140022160], r14
je 0x140001ec2
call fcn.14000477c
jmp 0x140001e51
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14000479c
mov rbx, rax
test rax, rax
jne 0x140001e35
cmp dword [rbp + 0x5b0], r14d
je 0x140001eb4
mov rcx, rsi
call section..text
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140001eb4
cmp dword [0x140022044], r14d
je 0x140001eb4
cmp dword [rbp + 0x5b8], r14d
jne 0x140001eb4
mov ecx, 0x40
call qword [sym.imp.USER32.dll_MessageBeep]
xor r9d, r9d
mov dword [rsp + 0x28], 0xa
mov r8, rsi
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp qword [0x140022160], r14
je 0x140001ec2
call fcn.1400046a4
mov eax, r13d
add rsp, 0x668
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret