Function at 0x1400fcec0
Capabilities:
Create directory
Set current directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1403f3e10]
mov rsi, r8
mov rbx, rcx
test rax, rax
jne 0x1400fcf11
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403f3e10], rax
test rax, rax
je 0x1400fcf18
mov ecx, 0x800
call rax
lea rcx, str.C:WindowsSystem32
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r9d, 0x64
lea r8, [0x1403f3390]
mov rcx, rbx
lea edx, [r9 + 3]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x64
lea r14, [0x1403f32c0]
mov r8, r14
mov rcx, rbx
lea edx, [r9 + 9]
call qword [sym.imp.USER32.dll_LoadStringW]
xor edi, edi
mov dword [rbp + 0x10], 0x50
lea rax, [0x1400fd8f0]
mov dword [rbp + 0x14], 3
mov rcx, rbx
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rdi
lea edx, [rdi + 0x6b]
mov qword [rbp + 0x28], rbx
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x30], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
lea edx, [rdi + 0x6c]
mov rcx, qword [rbp + 0x28]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x50], r14
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x58], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], rdi
lea r8, [0x1403f3390]
mov qword [rsp + 0x50], rbx
mov r9d, 0xcf0000
mov qword [rsp + 0x48], rdi
mov rdx, r14
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x80000000
mov qword [0x1403f32b0], rbx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1403f3388], rax
test rax, rax
je 0x1400fd02c
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, WSASetLastError
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, str.ntdll.dll
mov dword [0x1403f38f0], 0x11c
mov r14, rax
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400fd076
lea rcx, [0x1403f38f0]
call rax
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xac
call fcn.1402a1a30
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [rbp + 0x60]
add eax, 0xfffffed4
cmp eax, 0xb4
ja 0x1400fd7b7
mov ebx, edi
nop word [rax + rax]
xor r9d, r9d
lea rcx, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400fd111
mov rcx, qword [0x1403f3388]
lea edx, [rbx + 0x400]
mov r8d, 0x64
mov r9d, 1
sub r8d, ebx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x58]
mov rdx, r14
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400fd111
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc ebx
cmp ebx, 0x14
jb 0x1400fd0b0
mov qword [rsp + 0x248], r12
xorps xmm0, xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 7
movups xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x20], di
test rsi, rsi
je 0x1400fd564
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], di
jne 0x1400fd150
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.140107ee0
cmp qword [rbp - 0x10], rdi
je 0x1400fd564
cmp qword [rbp - 8], 8
lea rbx, [rbp - 0x20]
mov rax, qword [0x1403f3e30]
cmovae rbx, qword [rbp - 0x20]
mov dword [rbp + 0x140], edi
test rax, rax
jne 0x1400fd1d8
mov rax, qword [0x1403f3e18]
test rax, rax
jne 0x1400fd1b8
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1403f3e18], rax
test rax, rax
jne 0x1400fd1b8
mov rax, rdi
lea rdx, [0x14033b848]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403f3e30], rax
test rax, rax
je 0x1400fd564
lea rdx, [rbp + 0x140]
mov rcx, rbx
call rax
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
je 0x1400fd564
cmp dword [rbp + 0x140], 1
je 0x1400fd564
xorps xmm0, xmm0
mov qword [rsp + 0x250], r13
movups xmmword [rsp + 0x60], xmm0
mov esi, edi
lea rdx, [rbp - 0x78]
movups xmmword [rbp - 0x78], xmm0
mov ecx, 5
mov byte [rsp + 0x60], sil
mov word [rbp - 0x78], di
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 7
call fcn.1401069e0
mov r13d, edi
cmp dword [rbp + 0x140], edi
jle 0x1400fd417
mov rbx, r12
mov qword [rsp + 0x258], r15
mov qword [rbp - 0x28], rbx
mov r15d, 1
add r12, 8
cmp qword [rbp - 0x60], 8
lea rdx, [rbp - 0x78]
mov rcx, qword [rbx]
cmovae rdx, qword [rbp - 0x78]
call fcn.1402c39f8
test eax, eax
jne 0x1400fd3e8
cmp r15d, dword [rbp + 0x140]
je 0x1400fd3e8
mov r14, qword [r12]
test r14, r14
je 0x1400fd371
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [r14 + rsi*2], di
jne 0x1400fd2b0
test esi, esi
je 0x1400fd371
mov qword [rsp + 0x38], rdi
mov r9d, esi
mov qword [rsp + 0x30], rdi
mov r8, r14
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400fd371
lea ebx, [rax + 1]
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x60]
call fcn.140108440
cmp qword [rsp + 0x78], 0x10
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov r9d, esi
cmovae rax, qword [rsp + 0x60]
mov r8, r14
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400fd371
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
cmovae rcx, qword [rsp + 0x60]
inc rax
cmp byte [rcx + rax], dil
jne 0x1400fd356
movsxd rdx, eax
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.140108440
jmp 0x1400fd3d1
cmp qword [rsp + 0x78], 0x10
lea rax, [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov r9, rdi
jb 0x1400fd39d
mov rcx, qword [rsp + 0x60]
mov rax, rbx
sub rax, rdi
mov rdx, rbx
cmp rax, rbx
cmovb rdx, rax
jmp 0x1400fd3b5
lea rdx, [rbx + rax]
lea rax, [rsp + 0x60]
sub rdx, rax
lea rcx, [rsp + 0x60]
cmp rbx, rdx
cmovb rdx, rbx
sub rbx, rdx
add rcx, r9
mov r8, rbx
add rdx, rcx
sub r8, r9
inc r8
call fcn.1402a1390
mov qword [rsp + 0x70], rbx
mov rbx, qword [rbp - 0x28]
inc r13d
add rbx, 8
inc r15d
add r12, 8
mov esi, 1
add rbx, 8
inc r13d
inc r15d
mov qword [rbp - 0x28], rbx
add r12, 8
cmp r13d, dword [rbp + 0x140]
jl 0x1400fd270
mov r15, qword [rsp + 0x258]
mov r14, qword [rbp]
mov r12, qword [rbp + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r13, qword [rsp + 0x250]
test esi, esi
je 0x1400fd4d7
cmp qword [rsp + 0x70], rdi
je 0x1400fd441
lea rcx, [rsp + 0x60]
call fcn.1400fe0f0
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400fd481
mov rcx, qword [rbp - 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd47c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fd7cd
call fcn.14022d284
mov rdx, qword [rsp + 0x78]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], di
cmp rdx, 0x10
jb 0x1400fd763
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd4cd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fd7cd
call fcn.14022d284
jmp 0x1400fd763
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400fd517
mov rcx, qword [rbp - 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd512
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fd7cd
call fcn.14022d284
mov rdx, qword [rsp + 0x78]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], di
cmp rdx, 0x10
jb 0x1400fd564
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd55f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fd7cd
call fcn.14022d284
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], edi
xor ecx, ecx
call fcn.1400fd9f0
test eax, eax
je 0x1400fd580
cmp dword [rbp - 0x80], 2
jae 0x1400fd763
lea rbx, [0x1403efbc8]
mov r8, rbx
call fcn.1401056a0
mov rcx, rbx
test eax, eax
je 0x1400fd5aa
mov r8d, 5
lea rdx, str.Temp
call fcn.140108f00
jmp 0x1400fd5d7
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.C:ProgramDataTemp
call fcn.140107ee0
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae rbx, qword [0x1403efbc8]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 3
call fcn.140232f80
call fcn.1400ff8a0
mov ecx, 0x18
call fcn.14022d248
mov rcx, rax
mov qword [0x1403f32b8], rax
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140123bb0
mov ebx, edi
nop dword [rax]
xor r9d, r9d
lea rcx, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400fd671
mov rcx, qword [0x1403f3388]
lea edx, [rbx + 0x400]
mov r8d, 0xc8
mov r9d, 1
sub r8d, ebx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x58]
mov rdx, r14
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400fd671
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc ebx
cmp ebx, 0x14
jb 0x1400fd610
call fcn.1400fdc10
mov ebx, edi
nop
xor r9d, r9d
lea rcx, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400fd6e1
mov rcx, qword [0x1403f3388]
lea edx, [rbx + 0x400]
mov r8d, 0x12c
mov r9d, 1
sub r8d, ebx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x58]
mov rdx, r14
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400fd6e1
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
inc ebx
cmp ebx, 0x14
jb 0x1400fd680
call fcn.140100c10
nop dword [rax]
xor r9d, r9d
lea rcx, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400fd74b
mov rcx, qword [0x1403f3388]
lea edx, [rdi + 0x400]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x58]
mov rdx, r14
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400fd74b
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xe10
jb 0x1400fd6f0
mov edi, dword [rbp - 0x48]
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400fd79f
mov rcx, qword [rbp - 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd79a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fd7c7
call fcn.14022d284
mov r12, qword [rsp + 0x248]
mov eax, edi
add rsp, 0x210
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0x210
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1402c2874
int3
call fcn.1402c2874
int3