Function at 0x1401d6a90
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x6a0
mov qword [rsp + 0x608], 0xfffffffffffffffe
mov rax, qword [rsp + 0x6b0]
add rax, 0x2a8
mov ecx, 1
xchg dword [rax], ecx
lea rcx, [rsp + 0x30]
call fcn.14000e170
nop
mov dword [rsp + 0x1c8], 1
lea rcx, [rsp + 0x30]
call fcn.1401e4480
lea rcx, [rsp + 0x598]
call fcn.140001000
mov qword [rsp + 0x610], rax
mov rax, qword [rsp + 0x610]
mov qword [rsp + 0x618], rax
lea r8, [0x140230bfc]
mov rdx, qword [rsp + 0x618]
lea rcx, [rsp + 0x5a0]
call fcn.1400010b0
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x628], rax
call fcn.14000f0b0
mov r8, rax
mov rdx, qword [rsp + 0x628]
lea rcx, [rsp + 0x5a8]
call fcn.1400010b0
mov qword [rsp + 0x630], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x638], rax
lea r8, [0x140232e38]
mov rdx, qword [rsp + 0x638]
lea rcx, [rsp + 0x5b0]
call fcn.1400010b0
mov qword [rsp + 0x640], rax
mov rcx, qword [rsp + 0x640]
call fcn.140050200
mov r9, rax
mov r8d, 1
lea rdx, [0x140232e48]
lea rcx, [0x140232e60]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x594], eax
lea rcx, [rsp + 0x5b0]
call fcn.140007060
nop
lea rcx, [rsp + 0x5a8]
call fcn.140007060
nop
lea rcx, [rsp + 0x5a0]
call fcn.140007060
nop
lea rcx, [rsp + 0x598]
call fcn.140007060
cmp dword [rsp + 0x594], 0
je 0x1401d706d
lea rdx, [0x140232464]
lea rcx, [rsp + 0x558]
call fcn.140002050
nop
lea rdx, str._echo_off_r_nREM_CCBootShare_Required_Services_r_n_r_n:rpc_endpoint_mapper_r_nREM_RPC_Endpoint_Mapper_r_nsc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_nif_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_r_n:start_rpc_mapper_service_r_nsc_config_nsi_start_AUTO_r_nnet_start_nsi_r_n_r_n:dcom_server_process_launcher_r_nREM_DCOM_Server_Process_Launcher_r_nsc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_nif_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_r_n:start_dcom_service_r_nsc_config_DcomLaunch_start_AUTO_r_nnet_start_DcomLaunch_r_n_r_n:remote_procedure_call_r_nREM_Remote_Procedure_Call__RPC__r_nsc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_nif_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_r_n:start_rpc_service_r_nsc_config_RpcSs_start_AUTO_r_nnet_start_RpcSs_r_n_r_n:security_accounts_manager_r_nREM_Security_Accounts_Manager_r_nsc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_nif_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_r_n:start_security_service_r_nsc_config_SamSs_start_AUTO_r_nnet_start_SamSs_r_n_r_n:server_service_r_nREM_Server_r_nsc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_nif_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_r_n:start_server_service_r_nsc_config_LanmanServer_start_AUTO_r_nnet_start_LanmanServer_r_n_r_n:bat_exit_r_necho_12__get_sid_gust_variable_r_nfor__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_______if_not____a__SID____r_n_t___set_sid_guest__a_r_n__________goto_loop_end_r_n_________r_n______r_n_r_n:loop_end_r_n_r_necho_13__create_script_for_regini_r_n_echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_r_necho_14__add_permission_for_machine_security_r_nnet_user_guest__active:yes_r_nregini_x_r_ndel_x_r_n_echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_echo__hex_0_:42_00_00_00____y.reg_r_nreg_import_y.reg_r_ndel_y.reg_r_n_echo_on_r_n
lea rcx, [rsp + 0x558]
call fcn.140002020
mov rdx, qword [rsp + 0x6b0]
add rdx, 0x228
lea r8, str.CCBootShare.bat
lea rcx, [rsp + 0x568]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x570]
call fcn.140093cf4
nop
lea rcx, [rsp + 0x568]
call fcn.140050200
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.14009447c
test eax, eax
je 0x1401d6dcb
lea rcx, [rsp + 0x570]
call fcn.140025730
lea rcx, [rsp + 0x558]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x5b8]
call fcn.1400dad10
mov qword [rsp + 0x648], rax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x650], rax
lea rcx, [rsp + 0x558]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x5c0]
call fcn.1400dad10
mov qword [rsp + 0x658], rax
mov rax, qword [rsp + 0x658]
mov qword [rsp + 0x660], rax
mov rcx, qword [rsp + 0x650]
call fcn.1400019a0
mov ebx, eax
mov rcx, qword [rsp + 0x660]
call fcn.140050200
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.140093974
nop
lea rcx, [rsp + 0x5c0]
call fcn.140007060
nop
lea rcx, [rsp + 0x5b8]
call fcn.140007060
lea rcx, [rsp + 0x570]
call fcn.140093c6c
lea rcx, [rsp + 0x568]
call fcn.140050200
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004880
lea rcx, [rsp + 0x568]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x1d8]
xor edx, edx
call fcn.140006e50
movzx r8d, ax
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
lea rdx, [0x1402340a0]
call fcn.140002ba0
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401d6e4f
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x228
xor edx, edx
call fcn.140006e50
movzx r8d, ax
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
lea rdx, [0x1402340b0]
call fcn.140002ba0
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
lea rdx, str.Steam
call fcn.140006080
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401d6ea7
mov rcx, qword [rsp + 0x6b0]
add rcx, 0x2b0
call fcn.140050200
mov rcx, rax
call fcn.140004b40
xor edx, edx
lea rcx, [rsp + 0x370]
call fcn.140181160
nop
lea rax, [rsp + 0x5c8]
mov qword [rsp + 0x5d0], rax
lea rax, [rsp + 0x5d8]
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x5e8]
mov qword [rsp + 0x5f0], rax
lea rdx, str.FULL
mov rcx, qword [rsp + 0x5d0]
call fcn.140002050
mov qword [rsp + 0x668], rax
mov rax, qword [rsp + 0x668]
mov qword [rsp + 0x670], rax
lea rdx, [0x1402340e0]
mov rcx, qword [rsp + 0x5e0]
call fcn.140002050
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x678]
mov qword [rsp + 0x680], rax
mov rdx, qword [rsp + 0x6b0]
add rdx, 0x2b0
mov rcx, qword [rsp + 0x5f0]
call fcn.140001430
mov qword [rsp + 0x688], rax
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x670]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x680]
mov r8d, 1
mov rdx, qword [rsp + 0x688]
lea rcx, [rsp + 0x370]
call fcn.14018c5b0
mov dword [rsp + 0x560], eax
mov r8d, dword [rsp + 0x560]
lea rdx, str.SetAcl___d_
xor ecx, ecx
call fcn.1400de020
xor r9d, r9d
mov r8d, 1
xor edx, edx
lea rcx, [0x140234110]
call fcn.140004880
lea rdx, [0x140232654]
lea rcx, [rsp + 0x550]
call fcn.140002050
nop
mov r8, qword [rsp + 0x6b0]
mov r8, qword [r8 + 0x2b0]
lea rdx, str.NET_SHARE_CCBootShare__s___GRANT:everyone_FULL__UNLIMITED__Y
lea rcx, [rsp + 0x550]
call fcn.140002ba0
lea rcx, [rsp + 0x550]
call fcn.140050200
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004880
nop
lea rcx, [rsp + 0x550]
call fcn.140007060
nop
lea rcx, [rsp + 0x370]
call fcn.140181070
nop
lea rcx, [rsp + 0x570]
call fcn.140093f40
nop
lea rcx, [rsp + 0x568]
call fcn.140007060
nop
lea rcx, [rsp + 0x558]
call fcn.140007060
lea rcx, [rsp + 0x1f8]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x1401d70a2
lea rcx, [0x1402341e0]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6b0]
mov dword [rax + 0x2ac], r11d
jmp 0x1401d710c
lea rcx, [rsp + 0x1f8]
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x5f8]
call fcn.140002d40
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x690]
mov qword [rsp + 0x698], rax
mov rcx, qword [rsp + 0x698]
call fcn.140002df0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6b0]
mov dword [rax + 0x2ac], r11d
lea rcx, [rsp + 0x5f8]
call fcn.140002dd0
mov edx, 1
mov ecx, dword [rsp + 0x6b8]
call fcn.1400d9110
test eax, eax
jne 0x1401d71cb
xor edx, edx
mov ecx, dword [rsp + 0x6b8]
call fcn.1400d9110
test eax, eax
jne 0x1401d71cb
mov r8d, dword [rsp + 0x6b8]
lea rdx, str.Listen_at_TCP_UDP_port__d
xor ecx, ecx
call fcn.1400de020
mov r9d, dword [rsp + 0x6c8]
mov r8, qword [rsp + 0x6c0]
mov edx, dword [rsp + 0x6b8]
mov rcx, qword [rsp + 0x6b0]
call fcn.1400e3c20
mov dword [rsp + 0x590], eax
cmp dword [rsp + 0x590], 0
je 0x1401d71aa
mov edx, 0x65
mov rcx, qword [rsp + 0x6b0]
call fcn.1400e3ba0
mov edx, 0x66
mov rcx, qword [rsp + 0x6b0]
call fcn.1400e3ba0
mov eax, dword [rsp + 0x590]
mov dword [rsp + 0x600], eax
lea rcx, [rsp + 0x30]
call fcn.140005e30
mov eax, dword [rsp + 0x600]
jmp 0x1401d71e7
mov dword [rsp + 0x604], 0
lea rcx, [rsp + 0x30]
call fcn.140005e30
mov eax, dword [rsp + 0x604]
add rsp, 0x6a0
pop rbx
ret