Function at 0x14001c930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14001c930
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc70
mov rdi, rsp
mov ecx, 0x31c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc80]
mov qword [rsp + 0xc60], 0xfffffffffffffffe
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0xc68], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea r9, str.2345Explorer.exe
lea r8, str.SOFTWARE2345Explorer
mov edx, 0x207
lea rcx, [rsp + 0x40]
call fcn.14001ddf0
mov byte [rsp + 0x454], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001ca38
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x498]
call fcn.140001faa
nop
lea rdx, [rsp + 0x498]
lea rcx, [rsp + 0x468]
call fcn.140005f5b
nop
lea rcx, [rsp + 0x498]
call fcn.1400073ce
lea rcx, [rsp + 0x4c8]
call fcn.140001b09
lea rdx, [rsp + 0x468]
lea rcx, [rsp + 0x4c8]
call fcn.140001b81
cmp dword [rsp + 0x4c8], 7
jl 0x14001ca2b
mov byte [rsp + 0x454], 1
lea rcx, [rsp + 0x468]
call fcn.1400073ce
movzx eax, byte [rsp + 0x454]
test eax, eax
jne 0x14001ca80
mov rcx, qword [rsp + 0xc80]
call fcn.14000179e
movzx eax, al
test eax, eax
je 0x14001ca61
xor eax, eax
jmp 0x14001d6af
mov rcx, qword [rsp + 0xc80]
call fcn.140004fac
mov rcx, rax
call fcn.1400039ef
jmp 0x14001d6af
lea rcx, [rsp + 0x4f8]
call fcn.1400051eb
nop
cmp dword [rsp + 0xc88], 1
jne 0x14001ce9d
mov eax, 0x2d
mov word [rsp + 0x540], ax
mov eax, 0x2d
mov word [rsp + 0x542], ax
mov eax, 0x73
mov word [rsp + 0x544], ax
mov eax, 0x65
mov word [rsp + 0x546], ax
mov eax, 0x74
mov word [rsp + 0x548], ax
mov eax, 0x2d
mov word [rsp + 0x54a], ax
mov eax, 0x64
mov word [rsp + 0x54c], ax
mov eax, 0x65
mov word [rsp + 0x54e], ax
mov eax, 0x66
mov word [rsp + 0x550], ax
mov eax, 0x61
mov word [rsp + 0x552], ax
mov eax, 0x75
mov word [rsp + 0x554], ax
mov eax, 0x6c
mov word [rsp + 0x556], ax
mov eax, 0x74
mov word [rsp + 0x558], ax
mov eax, 0x2d
mov word [rsp + 0x55a], ax
mov eax, 0x6c
mov word [rsp + 0x55c], ax
mov eax, 0x61
mov word [rsp + 0x55e], ax
mov eax, 0x75
mov word [rsp + 0x560], ax
mov eax, 0x6e
mov word [rsp + 0x562], ax
mov eax, 0x63
mov word [rsp + 0x564], ax
mov eax, 0x68
mov word [rsp + 0x566], ax
mov eax, 0x2d
mov word [rsp + 0x568], ax
mov eax, 0x61
mov word [rsp + 0x56a], ax
mov eax, 0x63
mov word [rsp + 0x56c], ax
mov eax, 0x74
mov word [rsp + 0x56e], ax
mov eax, 0x69
mov word [rsp + 0x570], ax
mov eax, 0x6f
mov word [rsp + 0x572], ax
mov eax, 0x6e
mov word [rsp + 0x574], ax
mov eax, 0x3d
mov word [rsp + 0x576], ax
mov eax, 0x69
mov word [rsp + 0x578], ax
mov eax, 0x6e
mov word [rsp + 0x57a], ax
mov eax, 0x73
mov word [rsp + 0x57c], ax
mov eax, 0x74
mov word [rsp + 0x57e], ax
mov eax, 0x61
mov word [rsp + 0x580], ax
mov eax, 0x6c
mov word [rsp + 0x582], ax
mov eax, 0x6c
mov word [rsp + 0x584], ax
mov eax, 0x65
mov word [rsp + 0x586], ax
mov eax, 0x72
mov word [rsp + 0x588], ax
xor eax, eax
mov word [rsp + 0x58a], ax
mov eax, 0x2d
mov word [rsp + 0x5b0], ax
mov eax, 0x2d
mov word [rsp + 0x5b2], ax
mov eax, 0x6f
mov word [rsp + 0x5b4], ax
mov eax, 0x6e
mov word [rsp + 0x5b6], ax
mov eax, 0x6c
mov word [rsp + 0x5b8], ax
mov eax, 0x79
mov word [rsp + 0x5ba], ax
mov eax, 0x2d
mov word [rsp + 0x5bc], ax
mov eax, 0x73
mov word [rsp + 0x5be], ax
mov eax, 0x65
mov word [rsp + 0x5c0], ax
mov eax, 0x74
mov word [rsp + 0x5c2], ax
mov eax, 0x2d
mov word [rsp + 0x5c4], ax
mov eax, 0x64
mov word [rsp + 0x5c6], ax
mov eax, 0x65
mov word [rsp + 0x5c8], ax
mov eax, 0x66
mov word [rsp + 0x5ca], ax
mov eax, 0x61
mov word [rsp + 0x5cc], ax
mov eax, 0x75
mov word [rsp + 0x5ce], ax
mov eax, 0x6c
mov word [rsp + 0x5d0], ax
mov eax, 0x74
mov word [rsp + 0x5d2], ax
mov eax, 0x2d
mov word [rsp + 0x5d4], ax
mov eax, 0x61
mov word [rsp + 0x5d6], ax
mov eax, 0x63
mov word [rsp + 0x5d8], ax
mov eax, 0x74
mov word [rsp + 0x5da], ax
mov eax, 0x69
mov word [rsp + 0x5dc], ax
mov eax, 0x6f
mov word [rsp + 0x5de], ax
mov eax, 0x6e
mov word [rsp + 0x5e0], ax
mov eax, 0x3d
mov word [rsp + 0x5e2], ax
mov eax, 0x69
mov word [rsp + 0x5e4], ax
mov eax, 0x6e
mov word [rsp + 0x5e6], ax
mov eax, 0x73
mov word [rsp + 0x5e8], ax
mov eax, 0x74
mov word [rsp + 0x5ea], ax
mov eax, 0x61
mov word [rsp + 0x5ec], ax
mov eax, 0x6c
mov word [rsp + 0x5ee], ax
mov eax, 0x6c
mov word [rsp + 0x5f0], ax
mov eax, 0x65
mov word [rsp + 0x5f2], ax
mov eax, 0x72
mov word [rsp + 0x5f4], ax
xor eax, eax
mov word [rsp + 0x5f6], ax
mov rcx, qword [rsp + 0xc80]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14001ce83
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x4f8]
call fcn.140005731
jmp 0x14001ce98
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x4f8]
call fcn.140005731
jmp 0x14001d27f
mov eax, 0x2d
mov word [rsp + 0x620], ax
mov eax, 0x2d
mov word [rsp + 0x622], ax
mov eax, 0x73
mov word [rsp + 0x624], ax
mov eax, 0x65
mov word [rsp + 0x626], ax
mov eax, 0x74
mov word [rsp + 0x628], ax
mov eax, 0x2d
mov word [rsp + 0x62a], ax
mov eax, 0x64
mov word [rsp + 0x62c], ax
mov eax, 0x65
mov word [rsp + 0x62e], ax
mov eax, 0x66
mov word [rsp + 0x630], ax
mov eax, 0x61
mov word [rsp + 0x632], ax
mov eax, 0x75
mov word [rsp + 0x634], ax
mov eax, 0x6c
mov word [rsp + 0x636], ax
mov eax, 0x74
mov word [rsp + 0x638], ax
mov eax, 0x2d
mov word [rsp + 0x63a], ax
mov eax, 0x6c
mov word [rsp + 0x63c], ax
mov eax, 0x61
mov word [rsp + 0x63e], ax
mov eax, 0x75
mov word [rsp + 0x640], ax
mov eax, 0x6e
mov word [rsp + 0x642], ax
mov eax, 0x63
mov word [rsp + 0x644], ax
mov eax, 0x68
mov word [rsp + 0x646], ax
mov eax, 0x2d
mov word [rsp + 0x648], ax
mov eax, 0x61
mov word [rsp + 0x64a], ax
mov eax, 0x63
mov word [rsp + 0x64c], ax
mov eax, 0x74
mov word [rsp + 0x64e], ax
mov eax, 0x69
mov word [rsp + 0x650], ax
mov eax, 0x6f
mov word [rsp + 0x652], ax
mov eax, 0x6e
mov word [rsp + 0x654], ax
mov eax, 0x3d
mov word [rsp + 0x656], ax
mov eax, 0x73
mov word [rsp + 0x658], ax
mov eax, 0x6f
mov word [rsp + 0x65a], ax
mov eax, 0x66
mov word [rsp + 0x65c], ax
mov eax, 0x74
mov word [rsp + 0x65e], ax
mov eax, 0x77
mov word [rsp + 0x660], ax
mov eax, 0x61
mov word [rsp + 0x662], ax
mov eax, 0x72
mov word [rsp + 0x664], ax
mov eax, 0x65
mov word [rsp + 0x666], ax
xor eax, eax
mov word [rsp + 0x668], ax
mov eax, 0x2d
mov word [rsp + 0x690], ax
mov eax, 0x2d
mov word [rsp + 0x692], ax
mov eax, 0x6f
mov word [rsp + 0x694], ax
mov eax, 0x6e
mov word [rsp + 0x696], ax
mov eax, 0x6c
mov word [rsp + 0x698], ax
mov eax, 0x79
mov word [rsp + 0x69a], ax
mov eax, 0x2d
mov word [rsp + 0x69c], ax
mov eax, 0x73
mov word [rsp + 0x69e], ax
mov eax, 0x65
mov word [rsp + 0x6a0], ax
mov eax, 0x74
mov word [rsp + 0x6a2], ax
mov eax, 0x2d
mov word [rsp + 0x6a4], ax
mov eax, 0x64
mov word [rsp + 0x6a6], ax
mov eax, 0x65
mov word [rsp + 0x6a8], ax
mov eax, 0x66
mov word [rsp + 0x6aa], ax
mov eax, 0x61
mov word [rsp + 0x6ac], ax
mov eax, 0x75
mov word [rsp + 0x6ae], ax
mov eax, 0x6c
mov word [rsp + 0x6b0], ax
mov eax, 0x74
mov word [rsp + 0x6b2], ax
mov eax, 0x2d
mov word [rsp + 0x6b4], ax
mov eax, 0x61
mov word [rsp + 0x6b6], ax
mov eax, 0x63
mov word [rsp + 0x6b8], ax
mov eax, 0x74
mov word [rsp + 0x6ba], ax
mov eax, 0x69
mov word [rsp + 0x6bc], ax
mov eax, 0x6f
mov word [rsp + 0x6be], ax
mov eax, 0x6e
mov word [rsp + 0x6c0], ax
mov eax, 0x3d
mov word [rsp + 0x6c2], ax
mov eax, 0x73
mov word [rsp + 0x6c4], ax
mov eax, 0x6f
mov word [rsp + 0x6c6], ax
mov eax, 0x66
mov word [rsp + 0x6c8], ax
mov eax, 0x74
mov word [rsp + 0x6ca], ax
mov eax, 0x77
mov word [rsp + 0x6cc], ax
mov eax, 0x61
mov word [rsp + 0x6ce], ax
mov eax, 0x72
mov word [rsp + 0x6d0], ax
mov eax, 0x65
mov word [rsp + 0x6d2], ax
xor eax, eax
mov word [rsp + 0x6d4], ax
mov rcx, qword [rsp + 0xc80]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14001d26a
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x4f8]
call fcn.140005731
jmp 0x14001d27f
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x4f8]
call fcn.140005731
lea rcx, [rsp + 0x6f8]
call fcn.1400051eb
nop
mov rcx, qword [rsp + 0xc90]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14001d3d0
mov eax, 0x2d
mov word [rsp + 0x738], ax
mov eax, 0x2d
mov word [rsp + 0x73a], ax
mov eax, 0x73
mov word [rsp + 0x73c], ax
mov eax, 0x65
mov word [rsp + 0x73e], ax
mov eax, 0x74
mov word [rsp + 0x740], ax
mov eax, 0x2d
mov word [rsp + 0x742], ax
mov eax, 0x64
mov word [rsp + 0x744], ax
mov eax, 0x65
mov word [rsp + 0x746], ax
mov eax, 0x66
mov word [rsp + 0x748], ax
mov eax, 0x61
mov word [rsp + 0x74a], ax
mov eax, 0x75
mov word [rsp + 0x74c], ax
mov eax, 0x6c
mov word [rsp + 0x74e], ax
mov eax, 0x74
mov word [rsp + 0x750], ax
mov eax, 0x2d
mov word [rsp + 0x752], ax
mov eax, 0x66
mov word [rsp + 0x754], ax
mov eax, 0x72
mov word [rsp + 0x756], ax
mov eax, 0x6f
mov word [rsp + 0x758], ax
mov eax, 0x6d
mov word [rsp + 0x75a], ax
mov eax, 0x3d
mov word [rsp + 0x75c], ax
xor eax, eax
mov word [rsp + 0x75e], ax
lea rdx, [rsp + 0x738]
lea rcx, [rsp + 0x6f8]
call fcn.140005731
mov rdx, qword [rsp + 0xc90]
lea rcx, [rsp + 0x6f8]
call fcn.14000127b
lea rcx, [rsp + 0x778]
call fcn.1400051eb
nop
lea rdx, [rsp + 0x4f8]
lea rcx, [rsp + 0x778]
call fcn.14000127b
lea rcx, [rsp + 0x6f8]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14001d430
lea rdx, [0x1401ddd5c]
lea rcx, [rsp + 0x778]
call fcn.1400079c8
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x778]
call fcn.14000127b
mov rcx, qword [rsp + 0xc80]
call fcn.14000179e
movzx eax, al
test eax, eax
jne 0x14001d495
lea rdx, [0x1401ddd84]
lea rcx, [rsp + 0x778]
call fcn.1400079c8
lea rdx, [0x1401ddd94]
lea rcx, [rsp + 0x778]
call fcn.1400079c8
mov rdx, qword [rsp + 0xc80]
lea rcx, [rsp + 0x778]
call fcn.14000127b
lea rdx, [0x1401ddda4]
lea rcx, [rsp + 0x778]
call fcn.1400079c8
mov byte [rsp + 0x7a4], 0
lea rax, [rsp + 0x7c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
mov edx, 0x207
lea rcx, [rsp + 0x7c0]
call fcn.14001e040
movzx eax, al
test eax, eax
je 0x14001d588
mov qword [rsp + 0xbd8], 0
lea rdx, str.Shlwapi.dll
lea rcx, [rsp + 0xbe8]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0xbe8]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0xbe0], rax
lea rcx, [rsp + 0xbe8]
call fcn.1400073ce
cmp qword [rsp + 0xbe0], 0
je 0x14001d541
lea rdx, str.StrStrIW
mov rcx, qword [rsp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xbd8], rax
cmp qword [rsp + 0xbd8], 0
je 0x14001d588
lea rdx, str.2345ExplorerHTML
lea rcx, [rsp + 0x7c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001d580
lea rdx, str.2345Explorer.exe
lea rcx, [rsp + 0x7c0]
call qword [rsp + 0xbd8]
test rax, rax
je 0x14001d588
mov byte [rsp + 0x7a4], 1
mov dword [rsp + 0xc10], 0
mov qword [rsp + 0xc18], 0
lea rdx, [0x1401de038]
lea rcx, [rsp + 0xc28]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0xc28]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0xc20], rax
lea rcx, [rsp + 0xc28]
call fcn.1400073ce
cmp qword [rsp + 0xc20], 0
je 0x14001d606
lea rdx, [0x1401de050]
mov rcx, qword [rsp + 0xc20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc18], rax
cmp qword [rsp + 0xc18], 0
je 0x14001d671
lea rcx, [rsp + 0x778]
call fcn.140004fac
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rsp + 0x40]
lea rdx, [0x1401de060]
xor ecx, ecx
call qword [rsp + 0xc18]
cmp rax, 0x20
jbe 0x14001d671
movzx eax, byte [rsp + 0x7a4]
test eax, eax
je 0x14001d666
mov dword [rsp + 0xc10], 2
jmp 0x14001d671
mov dword [rsp + 0xc10], 0x12
mov eax, dword [rsp + 0xc10]
mov dword [rsp + 0xc58], eax
lea rcx, [rsp + 0x778]
call fcn.1400073ce
nop
lea rcx, [rsp + 0x6f8]
call fcn.1400073ce
nop
lea rcx, [rsp + 0x4f8]
call fcn.1400073ce
mov eax, dword [rsp + 0xc58]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401de740]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0xc68]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0xc70
pop rdi
ret