Function at 0x140016a90
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
xor eax, eax
mov dword [rbp + 0xa0], eax
lea rax, [fcn.140003cf0]
mov qword [rsp + 0x20], rax
lea r9, [0x140013680]
mov edx, 8
lea r8d, [rdx - 6]
lea rcx, [rbp - 0x60]
call fcn.1400d7720
nop
call fcn.140004b20
test rax, rax
je 0x1400175f9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, str.ShellExtension
mov r13, 0xffffffffffffffff
cmp rcx, 0x10000
jae 0x140016b1d
movzx edx, cx
lea rcx, [rsp + 0x68]
call fcn.1400054f0
jmp 0x140016b3b
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x140016b20
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.14000ac20
nop
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140016b57
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140016b68
call fcn.140004b20
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140017604
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0xa0], 1
lea rax, [0x140247598]
mov rsi, r13
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140016b94
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x1400175ee
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140016bd3
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140005800
mov rbx, qword [rsp + 0x70]
add r12, r12
je 0x140016bfd
test rbx, rbx
jne 0x140016bef
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
jmp 0x140016bfd
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1400d9910
lea rcx, [r12 + rbx]
movsxd r8, esi
add r8, r8
je 0x140016c2c
test rcx, rcx
jne 0x140016c20
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
jmp 0x140016c2c
lea rdx, [0x140247598]
call fcn.1400d9910
cmp r14d, dword [rbx - 0xc]
jg 0x1400175ee
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor esi, esi
mov word [rbx + rax*2], si
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.140014a70
mov dword [rbp + 0xa0], esi
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140016c73
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
nop
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140016c8e
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + 8]
call fcn.140004b20
test rax, rax
je 0x1400175f9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.ShellExtension
cmp rdx, 0x10000
jae 0x140016ccd
movzx edx, dx
lea rcx, [rsp + 0x78]
call fcn.1400054f0
jmp 0x140016ce8
mov rax, r13
inc rax
cmp word [rdx + rax*2], 0
jne 0x140016cd0
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.14000ac20
nop
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140016d04
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140016d15
call fcn.140004b20
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001760f
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
mov dword [rbp + 0xa0], 2
lea rax, str._x64.dll
mov rsi, r13
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140016d40
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x14001765c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140016d7d
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.140005800
mov rbx, qword [rbp - 0x80]
add r12, r12
je 0x140016da7
test rbx, rbx
jne 0x140016d99
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
jmp 0x140016da7
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1400d9910
lea rcx, [r12 + rbx]
movsxd r8, esi
add r8, r8
je 0x140016dd6
test rcx, rcx
jne 0x140016dca
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
jmp 0x140016dd6
lea rdx, str._x64.dll
call fcn.1400d9910
cmp r14d, dword [rbx - 0xc]
jg 0x14001765c
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.140014a70
mov dword [rbp + 0xa0], r14d
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140016e1f
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
nop
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140016e3a
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + 8]
lea rcx, [rbp + 0xb0]
call fcn.140027d10
nop
mov rcx, qword [rbp + 0xb0]
movsxd r8, dword [rcx - 0x10]
lea eax, [r8 - 1]
test eax, eax
js 0x140017651
cmp eax, r8d
jg 0x140017651
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x140016f19
dec r8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xb0]
call fcn.14000cfb0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xb0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140016ef4
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x140016ee3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140016ee3
call fcn.14000c360
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140016ed6
mov rcx, qword [rbx]
mov rdx, qword [rcx]
mov r8, qword [rdx + 8]
mov rdx, rbx
call r8
lea rax, [rdi + 0x18]
mov qword [rbp + 0xb0], rax
jmp 0x140016ef4
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000ac20
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140016f12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0xb0]
mov edx, 0x5c
call fcn.1400da150
test rax, rax
je 0x140016fdd
sub rax, qword [rbp + 0xb0]
sar rax, 1
test eax, eax
js 0x140016fdd
lea r8d, [rax + 1]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb0]
call fcn.14000cfb0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp + 0xb0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140016fbf
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x140016fae
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140016fae
call fcn.14000c360
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140016fa1
mov rcx, qword [rbx]
mov rdx, qword [rcx]
mov r8, qword [rdx + 8]
mov rdx, rbx
call r8
lea rax, [rdi + 0x18]
mov qword [rbp + 0xb0], rax
jmp 0x140016fbf
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xb0]
call fcn.14000ac20
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140016fdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0xb8]
call fcn.140027d10
nop
lea rdx, str.......Shell_
mov rax, r13
inc rax
cmp word [rdx + rax*2], 0
jne 0x140016ff4
mov r8d, eax
lea rcx, [rbp + 0xb8]
call fcn.14000c240
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rcx, qword [rbp + 0xb8]
test eax, eax
jne 0x14001702f
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140017034
call fcn.140017670
lea rsi, [rbp - 0x60]
mov qword [rbp - 0x70], rsi
lea rbx, str.regsvr32__s__
mov r8, rsi
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x78]
call fcn.14000bcd0
nop
mov r8, rsi
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x58]
call fcn.14000bcd0
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140017349
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140017349
call fcn.140004b20
test rax, rax
je 0x140017630
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
mov rax, qword [rbp + 0xb8]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400170cd
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400170dc
call fcn.140004b20
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140017625
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
mov r15d, dword [rbp + 0xa0]
or r15d, 0x10
mov dword [rbp + 0xa0], r15d
mov r12, qword [rsi]
mov eax, dword [r12 - 0x10]
mov dword [rbp + 0xa8], eax
mov r13, qword [rbp + 0xb8]
movsxd rsi, dword [r13 - 0x10]
lea r14d, [rsi + rax]
test r14d, r14d
js 0x14001761a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or ecx, eax
jge 0x140017150
mov edx, r14d
lea rcx, [rbp - 0x68]
call fcn.140005800
mov rbx, qword [rbp - 0x68]
add rsi, rsi
je 0x140017186
test rbx, rbx
je 0x140017176
mov r8, rsi
mov rcx, rbx
test r13, r13
je 0x14001716f
mov rdx, r13
call fcn.1400d9910
jmp 0x140017186
xor edx, edx
call fcn.1400d9fc0
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
lea rcx, [rsi + rbx]
movsxd r8, dword [rbp + 0xa8]
add r8, r8
je 0x1400171c1
test rcx, rcx
je 0x1400171b1
test r12, r12
je 0x1400171aa
mov rdx, r12
call fcn.1400d9910
jmp 0x1400171c1
xor edx, edx
call fcn.1400d9fc0
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
lea rsi, [rbx - 0x18]
cmp r14d, dword [rsi + 0xc]
jg 0x14001761a
mov dword [rsi + 8], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
add rdi, 0xffffffffffffffe8
cmp rsi, rdi
je 0x140017248
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x140017237
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x140017237
mov rcx, rsi
call fcn.14000c360
mov rbx, rax
mov r13, 0xffffffffffffffff
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140017225
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
mov r15d, dword [rbp + 0xa0]
jmp 0x14001724f
mov r8d, dword [rsi + 8]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000ac20
mov r13, 0xffffffffffffffff
and r15d, 0xffffffef
mov dword [rbp + 0xa0], r15d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140017273
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
mov r8d, 4
lea rdx, str..bak
lea rcx, [rsp + 0x60]
call fcn.14000c240
mov edi, 1
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400172da
mov rsi, qword [rbp - 0x70]
mov eax, edi
inc edi
mov dword [rsp + 0x20], eax
mov r9, qword [rsi]
mov r8, qword [rbp + 0xb8]
lea rdx, str._s_s__d.bak
lea rcx, [rsp + 0x60]
call fcn.14000c550
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400172a5
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14001730b
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9d, [rax + 2]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140017328
xor edx, edx
lea r8d, [rax + 5]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017342
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rbx, str.regsvr32__s__
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140017527
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140004b20
test rax, rax
je 0x140017646
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
cmp rbx, 0x10000
jae 0x1400173a5
movzx edx, bx
call fcn.1400054f0
jmp 0x1400173b4
mov r8d, 0xd
mov rdx, rbx
call fcn.14000ac20
nop
mov rdi, qword [rsp + 0x58]
movsxd rax, dword [rdi - 0x10]
mov r15, rdi
mov rbx, qword [rsp + 0x50]
sub r15, rbx
sar r15, 1
mov r12d, dword [rbx - 0x10]
test eax, eax
js 0x14001763b
test rdi, rdi
je 0x1400173ea
mov rdx, rax
mov rcx, rdi
call fcn.1400ea46c
mov r14, rax
mov ecx, 0x7fffffff
sub ecx, r14d
cmp ecx, r12d
jl 0x14001763b
lea esi, [r14 + r12]
test esi, esi
js 0x14001763b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140017429
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140005800
mov rbx, qword [rsp + 0x50]
cmp r15, r12
ja 0x140017432
lea rdi, [rbx + r15*2]
lea rcx, [rbx + r12*2]
movsxd r8, r14d
add r8, r8
je 0x140017469
test rcx, rcx
je 0x140017459
test rdi, rdi
je 0x140017452
mov rdx, rdi
call fcn.1400d9910
jmp 0x140017469
xor edx, edx
call fcn.1400d9fc0
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
cmp esi, dword [rbx - 0xc]
jg 0x14001763b
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor r14d, r14d
mov word [rbx + rax*2], r14w
lea r8d, [r14 + 1]
lea rdx, [0x140246434]
lea rcx, [rsp + 0x50]
call fcn.14000c240
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001750c
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017527
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017547
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017565
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp - 0x70]
add rsi, 8
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x50]
cmp rsi, rax
jne 0x14001703c
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400175a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x1400175c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea r9, [fcn.140003cf0]
mov edx, 8
lea r8d, [rdx - 6]
lea rcx, [rbp - 0x60]
call fcn.1400d7790
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80070057
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80070057
call fcn.1400049a0
nop
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80070057
call fcn.1400049a0
nop
mov ecx, 0x80070057
call fcn.1400049a0
int3