Function at 0x140064790
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Identify system language via api
Initialize winsock library
Set file attributes

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0x14021bd60], 0
mov dword [0x14021b770], eax
jne 0x140064802
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x198
call fcn.14014e180
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400653fd
mov byte [0x14021bd60], 1
cmp qword [0x14021bd70], 0
jne 0x140064853
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x14021bd70], rax
test rax, rax
je 0x1400653fd
lea rax, [0x140060090]
mov qword [0x143e6b7e0], rax
lea rax, [0x140060060]
mov qword [0x143e6b7d0], rax
lea rax, [0x140060010]
mov qword [0x143e6b7d8], rax
call fcn.1400a4c50
cmp eax, 1
jne 0x1400653fd
cmp qword [0x14021bd68], 0
jne 0x1400648a6
call fcn.1400b21e0
mov rcx, rax
call fcn.1400a4ea0
mov qword [0x14021bd68], rax
test rax, rax
je 0x1400653fd
movzx ecx, byte [rax + 0x2f9]
and cl, 0xf2
mov qword [rax + 0x4a8], 0
or cl, 2
mov byte [rax + 0x2f9], cl
xor r9d, r9d
mov qword [rsp + 0x320], rbx
mov qword [rsp + 0x2f8], r12
xor r8d, r8d
lea r12, [0x14021b360]
mov qword [rsp + 0x2f0], r14
xor ecx, ecx
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9, 0xffffffffffffffff
lea rcx, [0x14021b568]
mov r8, r12
mov edx, 0x104
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov r8, r12
mov edx, 0x104
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, [0x1401bad40]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e54c
cmp word [rsp + 0x60], 0
je 0x140064969
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006495c
test al, 0x10
jne 0x140064afd
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140064969
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, [0x1401b95f8]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e54c
cmp word [rsp + 0x60], 0
je 0x1400649c2
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400649b5
test al, 0x10
jne 0x140064b1a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400649c2
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, str.Community
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e54c
cmp word [rsp + 0x60], 0
je 0x140064a1b
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140064a0e
test al, 0x10
jne 0x140064b37
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140064a1b
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, str.MetaQuotesTerminalCommunitydns.dat
mov edx, 0x104
mov rcx, r12
call fcn.14003e54c
mov r9, 0xffffffffffffffff
lea r8, str.MetaQuotesTerminalCommunitycookies.dat
mov edx, 0x104
lea rcx, [0x14021b568]
call fcn.14003e54c
xorps xmm0, xmm0
mov qword [rsp + 0x40], 0
movdqu xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov r9d, 0x20
mov dword [rsp + 0x48], eax
lea rdx, str.Arabic___Saudi_Arabia
lea rax, [0x140067510]
mov r8d, 0xb8
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400410fc
test rax, rax
je 0x140064b54
mov r8, qword [rax + 8]
test r8, r8
je 0x140064b54
mov edx, 0xff
lea rcx, [rsp + 0x60]
mov r9, 0xffffffffffffffff
call fcn.14003ff6c
cmp byte [rsp + 0x60], 0x65
jne 0x140064ade
cmp byte [rsp + 0x61], 0x6e
jne 0x140064ade
cmp byte [rsp + 0x62], 0
je 0x140064b54
lea r9, [rsp + 0x60]
mov edx, 0x40
lea r8, str._s_en
lea rcx, [0x14021bc24]
call fcn.140008fc0
jmp 0x140064b72
test al, 1
je 0x140064969
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140064969
test al, 1
je 0x1400649c2
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400649c2
test al, 1
je 0x140064a1b
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140064a1b
mov r9, 0xffffffffffffffff
lea r8, [0x1401b99f4]
lea rcx, [0x14021bc24]
lea edx, [r9 + 0x41]
call fcn.14003ff6c
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x288
call fcn.14014e180
mov qword [rsp + 0x308], rsi
lea rbx, str.2a00:1178:1:60::2b
mov qword [rsp + 0x300], rdi
mov r14d, 0x18
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx - 0x10]
lea rcx, [rsp + 0x60]
mov r9, 0xffffffffffffffff
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r8, qword [rbx - 8]
lea rcx, [rbp - 0x20]
mov r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.14003c5c8
mov r8, qword [rbx]
lea rcx, [rbp + 0xe0]
mov r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.14003c5c8
mov edx, dword [0x14021b7b8]
lea rcx, [0x14021b7a0]
inc edx
call fcn.140002fe0
test al, al
je 0x140064c5d
mov eax, dword [0x14021b7c0]
lea rsi, [rsp + 0x60]
mov edx, eax
imul eax, dword [0x14021b7b8]
mov ecx, edx
shr rcx, 2
mov r8d, eax
add r8, qword [0x14021b7b0]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140064c57
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021b7b8]
add rbx, 0x18
sub r14, 1
jne 0x140064bb0
call fcn.140063970
call fcn.1400633c0
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, str..mql5.com
call fcn.1400628f0
lea rdx, str..mql5.net
call fcn.1400628f0
lea rdx, str..finteza.com
call fcn.1400628f0
lea rdx, str..metaquotes.net
call fcn.1400628f0
lea rdx, str..metatrader.com
call fcn.1400628f0
xor edx, edx
lea rcx, str.iphlpapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
test rax, rax
je 0x140064dce
lea rdx, str.GetAdaptersAddresses
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140064dc5
lea rdx, [0x1401ae572]
mov dword [rbp + 0x238], 0x8000
mov ecx, 0x8000
call fcn.14002ec60
mov rbx, rax
test rax, rax
je 0x140064dc5
xor r8d, r8d
lea rax, [rbp + 0x238]
mov r9, rbx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x1e]
lea ecx, [rdx - 7]
call rdi
test eax, eax
jne 0x140064dac
movzx edi, word [0x1401ba63c]
mov rdx, rbx
mov esi, dword [0x1401ba638]
mov r8, qword [0x1401ba630]
cmp dword [rdx + 0x68], 1
jne 0x140064da3
test dword [rdx + 0x5c], 0x100
je 0x140064da3
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x140064da3
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140064d9a
cmp word [rax], 0x17
jne 0x140064d9a
cmp qword [rax + 2], r8
jne 0x140064d90
cmp dword [rax + 0xa], esi
jne 0x140064d90
cmp word [rax + 0xe], di
je 0x140064d9a
cmp byte [rax + 8], 0xfe
jne 0x1400653d4
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140064d70
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x140064d58
mov ecx, dword [rbp + 0x238]
xor eax, eax
shr rcx, 2
mov rdi, rbx
rep stosd dword [rdi], eax
mov rcx, rbx
call fcn.14002ec58
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
lea rcx, [0x14021b240]
mov byte [0x14021bd61], al
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str.content.finteza.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, [0x1401b76c0]
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.OLets_Encrypt
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
xorps xmm0, xmm0
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
mov r14, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x320]
test al, al
je 0x140064eaf
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r9d, edx
mov ecx, edx
imul r9d, dword [0x14021bd30]
shr rcx, 2
add r9, qword [0x14021bd28]
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140064ea9
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..mql5.net
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.78c3968ff93b523601dae4269bd72697e449cb05
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
movdqa xmm0, xmmword [0x1401d62f0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
test al, al
je 0x140064f8a
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r9d, edx
mov ecx, edx
imul r9d, dword [0x14021bd30]
shr rcx, 2
add r9, qword [0x14021bd28]
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140064f84
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..mql5.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.d4aa637ffbb41770cf55351748d7e8c5e096385d
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
movdqa xmm0, xmmword [0x1401d6300]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
test al, al
je 0x140065065
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r9d, edx
mov ecx, edx
imul r9d, dword [0x14021bd30]
shr rcx, 2
add r9, qword [0x14021bd28]
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x14006505f
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..finteza.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.f7e87d62f0f3c84f674cfba77e8a64911bea0664
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
movdqa xmm0, xmmword [0x1401d6310]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
test al, al
je 0x140065140
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r9d, edx
mov ecx, edx
imul r9d, dword [0x14021bd30]
shr rcx, 2
add r9, qword [0x14021bd28]
mov rdi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x14006513a
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..metaquotes.net
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.1990746cbc4efa432ab0e4d25f99a392b16b65eb
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
movdqa xmm0, xmmword [0x1401d6310]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
test al, al
je 0x14006521b
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r8d, edx
mov ecx, edx
imul r8d, dword [0x14021bd30]
shr rcx, 2
add r8, qword [0x14021bd28]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140065215
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..ultency.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.f0e74437b04845f8a92c70db3ad53c63513a4f4a
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c5c8
mov edx, dword [0x14021bd30]
lea rcx, [0x14021bd18]
movdqa xmm0, xmmword [0x1401d6320]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140002fe0
test al, al
je 0x1400652f6
mov edx, dword [0x14021bd38]
lea rsi, [rsp + 0x60]
mov r8d, edx
mov ecx, edx
imul r8d, dword [0x14021bd30]
shr rcx, 2
add r8, qword [0x14021bd28]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x1400652f0
and rdx, 0xfffffffffffffffc
lea rsi, [rsp + 0x60]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
inc dword [0x14021bd30]
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
xor eax, eax
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov r12, qword [rsp + 0x2f8]
test eax, eax
je 0x140065389
cmp dword [rsp + 0x50], 0
jbe 0x140065389
lea rdi, [rbp + 0x228]
mov qword [rbp + 0x230], 0
lea rsi, [rsp + 0x44]
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x230]
cmp rax, rcx
jge 0x140065389
movabs rdx, 0x25b7f3d4000
add rax, rdx
cmp rax, rcx
jg 0x1400653b9
lea rcx, [0x14021bd48]
call fcn.140003d60
test al, al
jne 0x1400653b9
mov r9d, 0x400000
lea r8, [0x14021b240]
lea rdx, [0x1400607e0]
lea rcx, [0x14021bd48]
call fcn.140003cc0
mov rdi, qword [rsp + 0x300]
mov al, 1
mov rsi, qword [rsp + 0x308]
add rsp, 0x310
pop rbp
ret
mov ecx, dword [rbp + 0x238]
xor eax, eax
shr rcx, 2
mov rdi, rbx
rep stosd dword [rdi], eax
mov rcx, rbx
call fcn.14002ec58
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x140064dd0
lea rcx, [0x14021b240]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
add rsp, 0x310
pop rbp
ret