Function at 0x1401c8cf0
Capabilities:
Check if file exists
Delete file
Read .ini file
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x690
mov qword [rsp + 0x600], 0xfffffffffffffffe
mov rax, qword [rsp + 0x6a0]
add rax, 0x2a8
mov ecx, 1
xchg dword [rax], ecx
lea rcx, [rsp + 0x30]
call fcn.14000d210
nop
mov dword [rsp + 0x1c8], 1
lea rcx, [rsp + 0x30]
call fcn.1401d56b0
lea rcx, [rsp + 0x598]
call fcn.140001000
mov qword [rsp + 0x608], rax
mov rax, qword [rsp + 0x608]
mov qword [rsp + 0x610], rax
lea r8, [0x14022055c]
mov rdx, qword [rsp + 0x610]
lea rcx, [rsp + 0x5a0]
call fcn.1400010b0
mov qword [rsp + 0x618], rax
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x620], rax
call fcn.14000e2c0
mov r8, rax
mov rdx, qword [rsp + 0x620]
lea rcx, [rsp + 0x5a8]
call fcn.1400010b0
mov qword [rsp + 0x628], rax
mov rax, qword [rsp + 0x628]
mov qword [rsp + 0x630], rax
lea r8, [0x140222728]
mov rdx, qword [rsp + 0x630]
lea rcx, [rsp + 0x5b0]
call fcn.1400010b0
mov qword [rsp + 0x638], rax
mov rcx, qword [rsp + 0x638]
call fcn.14000f8f0
mov r9, rax
xor r8d, r8d
lea rdx, [0x140222738]
lea rcx, [0x140222750]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x594], eax
lea rcx, [rsp + 0x5b0]
call fcn.140001490
nop
lea rcx, [rsp + 0x5a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x5a0]
call fcn.140001490
nop
lea rcx, [rsp + 0x598]
call fcn.140001490
cmp dword [rsp + 0x594], 0
je 0x1401c9287
lea rdx, [0x1402208bc]
lea rcx, [rsp + 0x558]
call fcn.140002100
nop
lea rdx, str._echo_off_r_nREM_CCBootShare_Required_Services_r_n_r_n:rpc_endpoint_mapper_r_nREM_RPC_Endpoint_Mapper_r_nsc_query__find__i__SERVICE_NAME:_RpcEptMapper___nul_2_nul_r_nif_not_errorlevel_1__goto_dcom_server_process_launcher__else_goto_start_rpc_mapper_service_r_n_r_n:start_rpc_mapper_service_r_nsc_config_nsi_start_AUTO_r_nnet_start_nsi_r_n_r_n:dcom_server_process_launcher_r_nREM_DCOM_Server_Process_Launcher_r_nsc_query__find__i__SERVICE_NAME:_DcomLaunch___nul_2_nul_r_nif_not_errorlevel_1__goto_remote_procedure_call__else_goto_start_dcom_service_r_n_r_n:start_dcom_service_r_nsc_config_DcomLaunch_start_AUTO_r_nnet_start_DcomLaunch_r_n_r_n:remote_procedure_call_r_nREM_Remote_Procedure_Call__RPC__r_nsc_query__find__i__SERVICE_NAME:_RpcSs___nul_2_nul_r_nif_not_errorlevel_1__goto_security_accounts_manager__else_goto_start_rpc_service_r_n_r_n:start_rpc_service_r_nsc_config_RpcSs_start_AUTO_r_nnet_start_RpcSs_r_n_r_n:security_accounts_manager_r_nREM_Security_Accounts_Manager_r_nsc_query__find__i__SERVICE_NAME:_SamSs___nul_2_nul_r_nif_not_errorlevel_1__goto_server_service__else_goto_start_security_service_r_n_r_n:start_security_service_r_nsc_config_SamSs_start_AUTO_r_nnet_start_SamSs_r_n_r_n:server_service_r_nREM_Server_r_nsc_query__find__i__SERVICE_NAME:_LanmanServer___nul_2_nul_r_nif_not_errorlevel_1__goto_bat_exit__else_goto_start_server_service_r_n_r_n:start_server_service_r_nsc_config_LanmanServer_start_AUTO_r_nnet_start_LanmanServer_r_n_r_n:bat_exit_r_necho_12__get_sid_gust_variable_r_nfor__f__delims_____a_in___wmic_useraccount_where_nameguest_get_sid___do___r_n_______if_not____a__SID____r_n_t___set_sid_guest__a_r_n__________goto_loop_end_r_n_________r_n______r_n_r_n:loop_end_r_n_r_necho_13__create_script_for_regini_r_n_echo_RegistryMachineSECURITY__1_5_7_11_17_21___x_r_n_echo_RegistryMachineSECURITYpolicy__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts__1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest___1_5_7_11_17_21____x_r_n_echo_RegistryMachineSECURITYpolicy_accounts_sid_guest_ActSysAc__1_5_7_11_17_21____x_r_n_r_necho_14__add_permission_for_machine_security_r_nnet_user_guest__active:yes_r_nregini_x_r_ndel_x_r_n_echo_Windows_Registry_Editor_Version_5.00___y.reg_r_n_echo__HKEY_LOCAL_MACHINESECURITYPolicyAccounts_sid_guest_ActSysAc_____y.reg_r_n_echo__hex_0_:42_00_00_00____y.reg_r_nreg_import_y.reg_r_ndel_y.reg_r_n_echo_on_r_n
lea rcx, [rsp + 0x558]
call fcn.1400020d0
mov rdx, qword [rsp + 0x6a0]
add rdx, 0x228
lea r8, str.CCBootShare.bat
lea rcx, [rsp + 0x568]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x570]
call fcn.140092c60
nop
lea rcx, [rsp + 0x568]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 0x1001
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.1400933e8
test eax, eax
je 0x1401c8fe5
lea rcx, [rsp + 0x570]
call fcn.140023c90
lea rcx, [rsp + 0x558]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x5b8]
call fcn.1400d9cc0
mov qword [rsp + 0x640], rax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x648], rax
lea rcx, [rsp + 0x558]
call fcn.140001a40
mov ebx, eax
mov rcx, qword [rsp + 0x648]
call fcn.14000f8f0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.1400928e0
nop
lea rcx, [rsp + 0x5b8]
call fcn.140001490
lea rcx, [rsp + 0x570]
call fcn.140092bd8
lea rcx, [rsp + 0x568]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004930
lea rcx, [rsp + 0x568]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x1d8]
xor edx, edx
call fcn.140006dd0
movzx r8d, ax
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
lea rdx, [0x140223990]
call fcn.140002c70
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c9069
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x228
xor edx, edx
call fcn.140006dd0
movzx r8d, ax
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
lea rdx, [0x1402239a0]
call fcn.140002c70
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
lea rdx, str.Steam
call fcn.1400060d0
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401c90c1
mov rcx, qword [rsp + 0x6a0]
add rcx, 0x2b0
call fcn.14000f8f0
mov rcx, rax
call fcn.140004bf0
xor edx, edx
lea rcx, [rsp + 0x370]
call fcn.14017c720
nop
lea rax, [rsp + 0x5c0]
mov qword [rsp + 0x5c8], rax
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x5d8], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x5e8], rax
lea rdx, str.FULL
mov rcx, qword [rsp + 0x5c8]
call fcn.140002100
mov qword [rsp + 0x650], rax
mov rax, qword [rsp + 0x650]
mov qword [rsp + 0x658], rax
lea rdx, [0x1402239d0]
mov rcx, qword [rsp + 0x5d8]
call fcn.140002100
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x660]
mov qword [rsp + 0x668], rax
mov rdx, qword [rsp + 0x6a0]
add rdx, 0x2b0
mov rcx, qword [rsp + 0x5e8]
call fcn.140001430
mov qword [rsp + 0x670], rax
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x658]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x668]
mov r8d, 1
mov rdx, qword [rsp + 0x670]
lea rcx, [rsp + 0x370]
call fcn.140187b80
mov dword [rsp + 0x560], eax
mov r8d, dword [rsp + 0x560]
lea rdx, str.SetAcl___d_
xor ecx, ecx
call fcn.1400dcf70
xor r9d, r9d
mov r8d, 1
xor edx, edx
lea rcx, [0x140223a00]
call fcn.140004930
lea rdx, [0x140222124]
lea rcx, [rsp + 0x550]
call fcn.140002100
nop
mov r8, qword [rsp + 0x6a0]
mov r8, qword [r8 + 0x2b0]
lea rdx, str.NET_SHARE_CCBootShare__s___GRANT:everyone_FULL__UNLIMITED__Y
lea rcx, [rsp + 0x550]
call fcn.140002c70
lea rcx, [rsp + 0x550]
call fcn.14000f8f0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.140004930
nop
lea rcx, [rsp + 0x550]
call fcn.140001490
nop
lea rcx, [rsp + 0x370]
call fcn.14017c630
nop
lea rcx, [rsp + 0x570]
call fcn.140092eac
nop
lea rcx, [rsp + 0x568]
call fcn.140001490
nop
lea rcx, [rsp + 0x558]
call fcn.140001490
lea rcx, [rsp + 0x1f8]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x1401c92bc
lea rcx, [0x140223ad0]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6a0]
mov dword [rax + 0x2ac], r11d
jmp 0x1401c9326
lea rcx, [rsp + 0x1f8]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0x5f0]
call fcn.140002e10
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x678]
mov qword [rsp + 0x680], rax
mov rcx, qword [rsp + 0x680]
call fcn.140002ec0
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov r11d, eax
mov rax, qword [rsp + 0x6a0]
mov dword [rax + 0x2ac], r11d
lea rcx, [rsp + 0x5f0]
call fcn.140002ea0
mov edx, 1
mov ecx, dword [rsp + 0x6a8]
call fcn.1400d80c0
test eax, eax
jne 0x1401c93e5
xor edx, edx
mov ecx, dword [rsp + 0x6a8]
call fcn.1400d80c0
test eax, eax
jne 0x1401c93e5
mov r8d, dword [rsp + 0x6a8]
lea rdx, str.Listen_at_TCP_UDP_port__d
xor ecx, ecx
call fcn.1400dcf70
mov r9d, dword [rsp + 0x6b8]
mov r8, qword [rsp + 0x6b0]
mov edx, dword [rsp + 0x6a8]
mov rcx, qword [rsp + 0x6a0]
call fcn.1400e29c0
mov dword [rsp + 0x590], eax
cmp dword [rsp + 0x590], 0
je 0x1401c93c4
mov edx, 0x65
mov rcx, qword [rsp + 0x6a0]
call fcn.1400e2940
mov edx, 0x66
mov rcx, qword [rsp + 0x6a0]
call fcn.1400e2940
mov eax, dword [rsp + 0x590]
mov dword [rsp + 0x5f8], eax
lea rcx, [rsp + 0x30]
call fcn.140014ec0
mov eax, dword [rsp + 0x5f8]
jmp 0x1401c9401
mov dword [rsp + 0x5fc], 0
lea rcx, [rsp + 0x30]
call fcn.140014ec0
mov eax, dword [rsp + 0x5fc]
add rsp, 0x690
pop rbx
ret