Function at 0x14010d220
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x9e8], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x890], rax
mov qword [rsp + 0x30], r8
mov r15d, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x70]
call fcn.140189b60
xor r12d, r12d
mov word [rbp + 0x70], r12w
mov dword [rbp - 0x78], 0x207
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, str.Path
lea rdx, str.SOFTWARE2345Explorer
mov rcx, 0xffffffff80000002
call fcn.14010c470
test al, al
je 0x14010d2e9
lea rdx, [0x14023d488]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14023e400]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14010d2ee
mov word [rbp + 0x70], r12w
xor dil, dil
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010dd48
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14010d330
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006b90
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400c7920
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14010d397
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd95
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.1400efb90
movzx edi, dil
mov eax, 1
cmp dword [rbp - 0x78], 7
cmovge edi, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010d410
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d40b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd9b
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r12w
test dil, dil
je 0x14010dd48
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r12w
mov dword [rbp + 0x20], 0x2d002d
mov dword [rbp + 0x24], 0x650073
mov dword [rbp + 0x28], 0x2d0074
mov dword [rbp + 0x2c], 0x650064
mov dword [rbp + 0x30], 0x610066
mov dword [rbp + 0x34], 0x6c0075
mov dword [rbp + 0x38], 0x2d0074
mov dword [rbp + 0x3c], 0x61006c
mov dword [rbp + 0x40], 0x6e0075
mov dword [rbp + 0x44], 0x680063
mov dword [rbp + 0x48], 0x61002d
mov dword [rbp + 0x4c], 0x740063
mov dword [rbp + 0x50], 0x6f0069
mov dword [rbp + 0x54], 0x3d006e
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x6e006f
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x73002d
mov dword [rbp - 0x20], 0x740065
mov dword [rbp - 0x1c], 0x64002d
mov dword [rbp - 0x18], 0x660065
mov dword [rbp - 0x14], 0x750061
mov dword [rbp - 0x10], 0x74006c
mov dword [rbp - 0xc], 0x61002d
mov dword [rbp - 8], 0x740063
mov dword [rbp - 4], 0x6f0069
mov dword [rbp], 0x3d006e
mov r14, qword [rsp + 0x30]
mov r8, rbx
cmp r15d, 1
jne 0x14010d5a4
mov dword [rbp + 0x58], 0x6e0069
mov dword [rbp + 0x5c], 0x740073
mov dword [rbp + 0x60], 0x6c0061
mov dword [rbp + 0x64], 0x65006c
mov dword [rbp + 0x68], 0x72
mov dword [rbp + 4], 0x6e0069
mov dword [rbp + 8], 0x740073
mov dword [rbp + 0xc], 0x6c0061
mov dword [rbp + 0x10], 0x65006c
mov dword [rbp + 0x14], 0x72
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], 0
je 0x14010d584
lea rax, [rbp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d570
lea rdx, [rbp + 0x20]
jmp 0x14010d622
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14010d590
lea rdx, [rbp - 0x30]
jmp 0x14010d622
mov dword [rbp + 0x58], 0x6f0073
mov dword [rbp + 0x5c], 0x740066
mov dword [rbp + 0x60], 0x610077
mov dword [rbp + 0x64], 0x650072
xor r11d, r11d
mov word [rbp + 0x68], r11w
mov dword [rbp + 4], 0x6f0073
mov dword [rbp + 8], 0x740066
mov dword [rbp + 0xc], 0x610077
mov dword [rbp + 0x10], 0x650072
xor eax, eax
mov word [rbp + 0x14], ax
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x78], rax
cmp qword [rax], r11
je 0x14010d610
lea rax, [rbp + 0x20]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d600
lea rdx, [rbp + 0x20]
jmp 0x14010d622
lea rax, [rbp - 0x30]
inc r8
cmp word [rax + r8*2], r11w
jne 0x14010d614
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140006b90
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
lea r15, [r14 + 0x10]
xor r13d, r13d
cmp qword [r15], r13
je 0x14010d71f
mov dword [rbp - 0x30], 0x2d002d
mov dword [rbp - 0x2c], 0x650073
mov dword [rbp - 0x28], 0x2d0074
mov dword [rbp - 0x24], 0x650064
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x6c0075
mov dword [rbp - 0x18], 0x2d0074
mov dword [rbp - 0x14], 0x720066
mov dword [rbp - 0x10], 0x6d006f
mov dword [rbp - 0xc], 0x3d
lea rax, [rbp - 0x30]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x14010d6a2
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140006b90
cmp qword [r14 + 0x18], 8
jb 0x14010d6c7
mov r14, qword [r14]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d70d
lea rdi, [rdx + rcx]
mov qword [rsp + 0x78], rdi
lea rbx, [rsp + 0x68]
cmp r8, 8
cmovae rbx, qword [rsp + 0x68]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r14
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010d71f
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.1400074b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r12, qword [rbp - 0x40]
cmp r12, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rdx, rax
ja 0x14010d798
lea rdi, [rcx + rdx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010d7af
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov r9d, 2
cmp qword [rsp + 0x78], 0
je 0x14010d89d
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d809
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, r9d
lea rdx, [0x140240064]
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010d828
mov qword [rsp + 0x20], 1
lea r9, [0x140240064]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, r15
cmp rdi, rax
ja 0x14010d885
lea rax, [r15 + rdi]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdi + rdi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.140189420
lea rax, [r15 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x14010d897
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r9d, 2
mov r15, qword [rbp - 0x78]
cmp qword [r15], 0
je 0x14010da49
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rax, 1
jb 0x14010d8f8
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8, r9
lea rdx, [0x140240064]
call fcn.140189420
mov word [rbx + rdi*2], r13w
mov ebx, 1
jmp 0x14010d915
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140240064]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010d960
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1402407d0]
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010d979
mov qword [rsp + 0x20], rbx
lea r9, [0x1402407d0]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400074b0
cmp qword [rsi + 0x18], 8
jb 0x14010d983
mov rsi, qword [rsi]
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010d9ca
lea rdi, [rdx + rcx]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp r8, 8
cmovae rbx, qword [rsp + 0x48]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, rsi
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010d9dc
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14010da2a
lea rdi, [rcx + 1]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r15d, 2
mov r8d, r15d
lea rdx, [0x1402407d0]
call fcn.140189420
mov word [rbx + rdi*2], r13w
jmp 0x14010da4f
mov qword [rsp + 0x20], 1
lea r9, [0x1402407d0]
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400074b0
mov r15d, 2
xor sil, sil
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x480]
call fcn.140189b60
lea rcx, [rbp + 0x480]
call fcn.14010c780
test al, al
je 0x14010db5e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, str.Shlwapi.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8010
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010daff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dafa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dda1
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rbx, rbx
je 0x14010db5e
lea rdx, str.StrStrIW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14010db5e
lea rdx, str.2345ExplorerHTML
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14010db5b
lea rdx, [0x14023e400]
lea rcx, [rbp + 0x480]
call rbx
test rax, rax
je 0x14010db5e
mov sil, 1
mov ebx, r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r13w
mov r8d, 0xb
lea rdx, [0x140240930]
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8010
mov rdi, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14010dbe6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dbe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dda7
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r13w
test rdi, rdi
je 0x14010dc51
lea rdx, str.ShellExecuteW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010dc51
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
lea rdx, str.open
xor ecx, ecx
call rax
cmp rax, 0x20
jbe 0x14010dc51
mov ebx, 0x12
test sil, sil
cmovne ebx, r15d
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14010dc93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dc8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddad
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14010dce8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010dce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ddb3
call fcn.140183134
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r13w
cmp r12, 8
jb 0x14010dd32
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14010dd2a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010dd8f
mov rcx, r14
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r13w
mov eax, ebx
jmp 0x14010dd65
cmp qword [rsi + 0x10], 0
jne 0x14010dd53
xor eax, eax
jmp 0x14010dd65
cmp qword [rsi + 0x18], 8
jb 0x14010dd5d
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.14010cf00
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.1401836e0
mov rbx, qword [rsp + 0x9e8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195f1c
nop
call fcn.140195f1c
nop
call fcn.140195f1c
nop
call fcn.140195f1c
int3
call fcn.140195f1c
nop
call fcn.140195f1c
nop
call fcn.140195f1c
int3