Function at 0x1400638f0
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Identify system language via api
Initialize winsock library
Set file attributes

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0x14021acd0], 0
mov dword [0x14021a6e0], eax
jne 0x140063962
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x198
call fcn.14014d290
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140064499
mov byte [0x14021acd0], 1
cmp qword [0x14021ace0], 0
jne 0x1400639b3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x14021ace0], rax
test rax, rax
je 0x140064499
lea rax, [0x14005fa30]
mov qword [0x143e6a4b0], rax
lea rax, [0x14005fa00]
mov qword [0x143e6a4a0], rax
lea rax, [0x14005f9b0]
mov qword [0x143e6a4a8], rax
call fcn.1400a3d60
cmp eax, 1
jne 0x140064499
cmp qword [0x14021acd8], 0
jne 0x140063a06
call fcn.1400b12f0
mov rcx, rax
call fcn.1400a3fb0
mov qword [0x14021acd8], rax
test rax, rax
je 0x140064499
movzx ecx, byte [rax + 0x2f9]
and cl, 0xf2
mov qword [rax + 0x4a8], 0
or cl, 2
mov byte [rax + 0x2f9], cl
mov qword [rsp + 0x308], rsi
xor r9d, r9d
mov qword [rsp + 0x300], rdi
xor r8d, r8d
mov qword [rsp + 0x2f8], r12
xor ecx, ecx
lea r12, [0x14021a2d0]
mov qword [rsp + 0x2f0], r14
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9, 0xffffffffffffffff
lea rcx, [0x14021a4d8]
mov r8, r12
mov edx, 0x104
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov r8, r12
mov edx, 0x104
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, [0x1401b9de0]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e19c
cmp word [rsp + 0x60], 0
je 0x140063ad1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140063ac4
test al, 0x10
jne 0x140063c65
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140063ad1
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, [0x1401b85e8]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e19c
cmp word [rsp + 0x60], 0
je 0x140063b2a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140063b1d
test al, 0x10
jne 0x140063c82
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140063b2a
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, str.Community
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14003e19c
cmp word [rsp + 0x60], 0
je 0x140063b83
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140063b76
test al, 0x10
jne 0x140063c9f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140063b83
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9, 0xffffffffffffffff
lea r8, str.MetaQuotesTerminalCommunitydns.dat
mov edx, 0x104
mov rcx, r12
call fcn.14003e19c
mov r9, 0xffffffffffffffff
lea r8, str.MetaQuotesTerminalCommunitycookies.dat
mov edx, 0x104
lea rcx, [0x14021a4d8]
call fcn.14003e19c
xorps xmm0, xmm0
mov qword [rsp + 0x40], 0
movdqu xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov r9d, 0x20
mov dword [rsp + 0x48], eax
lea rdx, str.Arabic___Saudi_Arabia
lea rax, [0x1400663d0]
mov r8d, 0xb8
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140040d4c
test rax, rax
je 0x140063cbc
mov r8, qword [rax + 8]
test r8, r8
je 0x140063cbc
mov edx, 0xff
lea rcx, [rsp + 0x60]
mov r9, 0xffffffffffffffff
call fcn.14003fbbc
cmp byte [rsp + 0x60], 0x65
jne 0x140063c46
cmp byte [rsp + 0x61], 0x6e
jne 0x140063c46
cmp byte [rsp + 0x62], 0
je 0x140063cbc
lea r9, [rsp + 0x60]
mov edx, 0x40
lea r8, str._s_en
lea rcx, [0x14021ab94]
call fcn.140008b90
jmp 0x140063cda
test al, 1
je 0x140063ad1
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140063ad1
test al, 1
je 0x140063b2a
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140063b2a
test al, 1
je 0x140063b83
xor eax, 1
lea rcx, [rsp + 0x60]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140063b83
mov r9, 0xffffffffffffffff
lea r8, [0x1401b89e4]
lea rcx, [0x14021ab94]
lea edx, [r9 + 0x41]
call fcn.14003fbbc
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x288
call fcn.14014d290
lea rdi, str.2a00:1178:1:60::2b
mov esi, reloc.WS2_32.dll_shutdown
nop dword [rax + rax]
mov r8, qword [rdi - 0x10]
lea rcx, [rsp + 0x60]
mov r9, 0xffffffffffffffff
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r8, qword [rdi - 8]
lea rcx, [rbp - 0x20]
mov r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.14003c218
mov r8, qword [rdi]
lea rcx, [rbp + 0xe0]
mov r9, 0xffffffffffffffff
mov edx, 0x80
call fcn.14003c218
mov edx, dword [0x14021a728]
lea rcx, [0x14021a710]
inc edx
call fcn.140003020
test al, al
je 0x140063d8e
mov eax, dword [0x14021a730]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021a728]
mov ecx, eax
add rcx, qword [0x14021a720]
call fcn.14014cbf0
inc dword [0x14021a728]
add rdi, 0x18
sub rsi, 1
jne 0x140063d00
call fcn.140062b00
call fcn.140062570
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, str..mql5.com
call fcn.140061ab0
lea rdx, str..mql5.net
call fcn.140061ab0
lea rdx, str..finteza.com
call fcn.140061ab0
lea rdx, str..metaquotes.net
call fcn.140061ab0
lea rdx, str..metatrader.com
call fcn.140061ab0
xor edx, edx
lea rcx, str.iphlpapi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
test rax, rax
je 0x140063f28
lea rdx, str.GetAdaptersAddresses
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140063e38
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x140063f28
lea rdx, [0x14014fdc0]
mov qword [rsp + 0x320], rbx
mov ecx, 0x8000
mov dword [rbp + 0x238], 0x8000
call fcn.14002e8b0
mov rbx, rax
test rax, rax
je 0x140063f15
xor r8d, r8d
lea rax, [rbp + 0x238]
mov r9, rbx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x1e]
lea ecx, [rdx - 7]
call rdi
test eax, eax
jne 0x140063efc
movzx edi, word [0x1401b955c]
mov rdx, rbx
mov esi, dword [0x1401b9558]
mov r8, qword [0x1401b9550]
nop dword [rax]
cmp dword [rdx + 0x68], 1
jne 0x140063ef3
test dword [rdx + 0x5c], 0x100
je 0x140063ef3
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x140063ef3
nop dword [rax + rax]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140063eea
cmp word [rax], 0x17
jne 0x140063eea
cmp qword [rax + 2], r8
jne 0x140063ee0
cmp dword [rax + 0xa], esi
jne 0x140063ee0
cmp word [rax + 0xe], di
je 0x140063eea
cmp byte [rax + 8], 0xfe
jne 0x140064470
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140063ec0
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x140063ea0
mov ecx, dword [rbp + 0x238]
xor eax, eax
shr rcx, 2
mov rdi, rbx
rep stosd dword [rdi], eax
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov rbx, qword [rsp + 0x320]
lea rcx, [0x14021a1b0]
mov byte [0x14021acd1], al
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..mql5.net
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.78c3968ff93b523601dae4269bd72697e449cb05
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
movdqa xmm0, xmmword [0x1401d51b0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
mov r14, qword [rsp + 0x2f0]
test al, al
je 0x140063fe6
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..mql5.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.d4aa637ffbb41770cf55351748d7e8c5e096385d
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
movdqa xmm0, xmmword [0x1401d51c0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
test al, al
je 0x1400640a3
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str.content.finteza.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, [0x1401b66c0]
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.OLets_Encrypt
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
xorps xmm0, xmm0
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
test al, al
je 0x14006415b
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..finteza.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.f7e87d62f0f3c84f674cfba77e8a64911bea0664
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
movdqa xmm0, xmmword [0x1401d51d0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
test al, al
je 0x140064218
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..metaquotes.net
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.1990746cbc4efa432ab0e4d25f99a392b16b65eb
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
movdqa xmm0, xmmword [0x1401d51d0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
test al, al
je 0x1400642d5
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, 0xffffffffffffffff
lea r8, str..ultency.com
lea rcx, [rsp + 0x60]
lea edx, [r9 + 0x41]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.03d83392b86fab2a2dfd8fdf198ba3e7d0210165
lea rcx, [rbp - 0x20]
lea edx, [r9 + 0x31]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str.CNSectigo_ECC_Domain_Validation_Secure_Server_CA
lea rcx, [rbp + 0x40]
lea edx, [r9 + 0x51]
call fcn.14003c218
mov edx, dword [0x14021aca0]
lea rcx, [0x14021ac88]
movdqa xmm0, xmmword [0x1401d51a0]
inc edx
movdqa xmmword [rbp + 0xe0], xmm0
call fcn.140003020
test al, al
je 0x140064392
mov eax, dword [0x14021aca8]
lea rdx, [rsp + 0x60]
mov r8d, eax
imul eax, dword [0x14021aca0]
mov ecx, eax
add rcx, qword [0x14021ac98]
call fcn.14014cbf0
inc dword [0x14021aca0]
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
xor eax, eax
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov r12, qword [rsp + 0x2f8]
test eax, eax
je 0x140064425
cmp dword [rsp + 0x50], 0
jbe 0x140064425
lea rdi, [rbp + 0x228]
mov qword [rbp + 0x230], 0
lea rsi, [rsp + 0x44]
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x230]
cmp rax, rcx
jge 0x140064425
movabs rdx, 0x25b7f3d4000
add rax, rdx
cmp rax, rcx
jg 0x140064455
lea rcx, [0x14021acb8]
call fcn.140003a20
test al, al
jne 0x140064455
mov r9d, 0x400000
lea r8, [0x14021a1b0]
lea rdx, [0x140060130]
lea rcx, [0x14021acb8]
call fcn.140003980
mov rdi, qword [rsp + 0x300]
mov al, 1
mov rsi, qword [rsp + 0x308]
add rsp, 0x310
pop rbp
ret
mov ecx, dword [rbp + 0x238]
xor eax, eax
shr rcx, 2
mov rdi, rbx
rep stosd dword [rdi], eax
mov rcx, rbx
call fcn.14002e8a8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x140063f20
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
add rsp, 0x310
pop rbp
ret