Function at 0x14009a4b8
Capabilities:
Delete file
Get common file path
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r14, rcx
call fcn.14005c8d0
mov r8, qword [rsp + 0x188]
movabs rcx, 0xa00000000
mov qword [rsp + 0xe0], rax
cmp rax, rcx
movabs rcx, 0xa000047ba
setae byte [rsp + 0x42]
cmp rax, rcx
mov eax, 9
setae byte [rsp + 0x56]
lea ecx, [rax + 0x17]
lea r9d, [rax + 4]
lea r13d, [rax - 7]
xor ebp, ebp
jmp 0x14009a544
cmp ax, dx
ja 0x14009a534
cmp dx, r9w
jbe 0x14009a54d
cmp cx, dx
je 0x14009a54d
add r8, r13
mov qword [rsp + 0x188], r8
movzx edx, word [r8]
cmp dx, bp
jne 0x14009a529
lea rcx, [rsp + 0x188]
call fcn.140059074
mov rax, qword [rsp + 0x188]
mov ecx, 0x25
mov qword [rsp + 0xa8], rbp
lea ebx, [rcx - 0x24]
mov qword [rsp + 0xc0], rax
cmp cx, word [rax]
jne 0x14009a5b1
lea r8, [rsp + 0xa8]
xor r9d, r9d
mov rdx, rax
mov rcx, r14
mov byte [rsp + 0x20], bl
call fcn.140076e04
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x188], rax
mov r15d, dword [0x140130858]
mov rcx, rax
mov byte [rsp + 0x198], bpl
mov byte [rsp + 0x40], bpl
mov byte [rsp + 0x54], bpl
mov byte [rsp + 0x41], bpl
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x50], r15d
mov byte [rsp + 0x43], bpl
mov byte [rsp + 0x55], bpl
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x88]
add eax, ebx
lea eax, [rax + rax + 0x182a]
movsxd rdx, eax
call fcn.1400616e0
mov rbx, qword [rsp + 0x88]
lea rcx, [rsp + 0x98]
lea rsi, [rbx + 0x2410]
mov qword [rsp + 0xd0], rsi
lea rax, [rsi + 0x424]
mov qword [rsp + 0xc8], rax
add rax, 0x20a
lea r12, [rax + 0x12]
mov qword [rsp + 0x108], rax
mov word [r12], bp
mov qword [rsp + 0x78], r12
call fcn.14006166c
lea rcx, [rsp + 0xa0]
call fcn.14006166c
lea rcx, [rsp + 0x60]
call fcn.14006166c
lea rcx, [rsp + 0x68]
call fcn.14006166c
mov rax, qword [rsp + 0x188]
lea rdi, [0x14011f4c8]
mov ecx, 0x2d
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0x100], rdi
cmp cx, word [rax]
jne 0x14009a8ff
mov bl, byte [rsp + 0x42]
lea edi, [rcx - 0x2c]
lea rdx, [rsp + 0x188]
lea rcx, [0x14011f4b8]
mov r8d, 4
call fcn.1400610a0
cmp al, bpl
je 0x14009a6d2
mov byte [rsp + 0x54], dil
jmp 0x14009a8d5
lea rdx, [rsp + 0x188]
lea rcx, str._file
mov r8d, 5
call fcn.1400610a0
cmp al, bpl
je 0x14009a6fb
mov byte [rsp + 0x55], dil
jmp 0x14009a8d5
lea rdx, [rsp + 0x188]
lea rcx, str._TaskBand
mov r8d, 9
call fcn.1400610a0
cmp al, bpl
je 0x14009a724
mov byte [rsp + 0x43], r13b
jmp 0x14009a8d5
lea rdx, [rsp + 0x188]
lea rcx, str._StartMenu
mov r8d, 0xa
call fcn.1400610a0
cmp al, bpl
je 0x14009a74d
mov byte [rsp + 0x41], r13b
jmp 0x14009a8d5
mov rdx, qword [rsp + 0x188]
lea rcx, [0x14011f470]
mov r8d, 3
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
lea rdx, [rsp + 0x188]
cmp eax, ebp
jne 0x14009a7ba
add qword [rsp + 0x188], 6
mov eax, 0x1000
lea r8, [rsp + 0x60]
mov r9d, 0x2c
mov rcx, r14
mov word [rsp + 0x20], ax
call fcn.140052678
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov byte [rsp + 0x40], dil
mov word [rax], bp
jmp 0x14009a8d5
lea rcx, str._base:
mov r8d, 6
call fcn.1400610a0
cmp al, bpl
je 0x14009a814
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x188]
mov r9d, 0x1000
mov rcx, r14
mov word [rsp + 0x20], bp
call fcn.140052678
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov byte [rsp + 0x198], dil
mov word [rax], bp
jmp 0x14009a8d5
mov rdx, qword [rsp + 0x188]
lea rcx, [0x14011f458]
mov r8d, 3
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
jne 0x14009a881
mov rax, qword [rsp + 0x188]
mov ecx, 0x3f
add rax, 6
mov qword [rsp + 0x188], rax
cmp cx, word [rax]
jne 0x14009a85e
add qword [rsp + 0x188], r13
cmp bl, bpl
je 0x14009a8d5
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x188]
call fcn.140065ca8
mov r15d, dword [rsp + 0x50]
btr r15d, 0x1f
mov dword [rsp + 0x50], r15d
jmp 0x14009a8d5
mov rcx, qword [rsp + 0x188]
movzx eax, word [rcx]
cmp ax, bp
je 0x14009a8c8
mov edx, 9
lea esi, [rdx + 4]
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x14009a8a7
cmp ax, si
jbe 0x14009a8c0
cmp r8w, ax
je 0x14009a8c0
add rcx, r13
mov qword [rsp + 0x188], rcx
mov ax, word [rcx]
cmp ax, bp
jne 0x14009a89d
mov rsi, qword [rsp + 0xd0]
lea rcx, [rsp + 0x188]
call fcn.140059074
mov rax, qword [rsp + 0x188]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x14009a6a9
mov rbx, qword [rsp + 0x88]
mov dword [rsp + 0x70], r15d
lea rdi, [0x14011f4c8]
mov rax, qword [rsp + 0x188]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14009a951
add qword [rsp + 0x188], r13
lea r9d, [rcx + 2]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x188]
mov rcx, r14
mov word [rsp + 0x20], bp
call fcn.140052678
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x100], rax
call fcn.140059074
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x188]
mov r9d, 0x2c
mov rcx, r14
mov word [rsp + 0x20], bp
call fcn.140052678
mov r10, qword [rsp + 0x98]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0xd0], r10
call fcn.140059074
mov r9, qword [rsp + 0x188]
lea rcx, [0x14011f450]
mov rdx, r9
call fcn.14005a758
cmp al, bpl
je 0x14009ab65
cmp qword [0x140132b28], rbp
jne 0x14009aa09
lea rcx, [rsp + 0x68]
call fcn.1400590a4
lea rcx, [rsp + 0x60]
call fcn.1400590a4
lea rcx, [rsp + 0xa0]
call fcn.1400590a4
lea rcx, [rsp + 0x98]
call fcn.1400590a4
lea rcx, [rsp + 0x88]
call fcn.1400590a4
lea rcx, [rsp + 0xa8]
call fcn.1400590a4
xor eax, eax
jmp 0x14009bbc7
cmp word [r10], bp
cmovne rdi, r10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp rax, rbp
jne 0x14009aa83
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x68]
mov ebx, eax
cmp eax, ebp
mov eax, 1
cmove ebx, eax
call fcn.1400590a4
lea rcx, [rsp + 0x60]
call fcn.1400590a4
lea rcx, [rsp + 0xa0]
call fcn.1400590a4
lea rcx, [rsp + 0x98]
call fcn.1400590a4
lea rcx, [rsp + 0x88]
call fcn.1400590a4
lea rcx, [rsp + 0xa8]
call fcn.1400590a4
mov eax, ebx
jmp 0x14009bbc7
lea rcx, [rsp + 0xb8]
mov edx, 0x1032
call fcn.1400613f4
mov rcx, qword [0x140132b28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x198], ebp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0xb8]
mov r14d, 1
mov edi, r14d
lea r8, [rbx + 0x19]
mov r9d, 0x1000
mov edx, edi
mov rcx, rsi
mov byte [rbx + 0x19], bpl
call qword [sym.imp.USER32.dll_LoadStringA]
cmp eax, ebp
je 0x14009ab2b
lea rdx, str._r_n__12d_0x__7X
mov r9d, edi
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
mov byte [rbx + 0x18], 0x3a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x140132b28]
movsxd rdx, r13d
movsxd r8, eax
lea r9, [rsp + 0x198]
add rdx, rbx
sub r8d, r13d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r13d, ebp
add edi, r14d
cmp edi, 0xffff
jle 0x14009aac2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140132b28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb8]
mov qword [0x140132b28], rbp
call fcn.1400590a4
jmp 0x14009bb7c
cmp word [r10], bp
je 0x14009baea
mov eax, 0x2d
mov edi, ebp
mov dword [rsp + 0x50], ebp
lea r10d, [rax - 0x2c]
cmp ax, word [r9]
jne 0x14009ab97
add r9, r13
mov edi, r10d
mov dword [rsp + 0x50], r10d
mov qword [rsp + 0x188], r9
cmp word [r9], bp
je 0x14009abcc
lea rcx, str.StartMenu
mov rdx, r9
call fcn.14005a758
cmp al, bpl
jne 0x14009abcc
lea rcx, str.TaskBand
mov rdx, r9
call fcn.14005a758
cmp al, bpl
je 0x14009abd1
or byte [rsp + 0x43], r10b
jmp 0x14009abd1
or byte [rsp + 0x41], r10b
mov eax, dword [0x140134180]
test r10b, al
jne 0x14009abfe
or eax, r10d
lea rcx, [0x1401119d4]
mov qword [0x140134178], rbp
mov dword [0x140134180], eax
call fcn.1400f9c90
mov eax, dword [0x140134180]
test r13b, al
jne 0x14009ac25
or eax, r13d
lea rcx, [0x1401119c8]
mov qword [0x140134170], rbp
mov dword [0x140134180], eax
call fcn.1400f9c90
mov eax, dword [0x140134180]
test al, 4
jne 0x14009ac4b
or eax, 4
lea rcx, [0x1401119bc]
mov qword [0x140134168], rbp
mov dword [0x140134180], eax
call fcn.1400f9c90
mov eax, dword [0x140134180]
test al, 8
jne 0x14009ac6b
or eax, 8
lea rcx, [0x1401119b0]
mov qword [0x140134160], rbp
mov dword [0x140134180], eax
call fcn.1400f9c90
cmp edi, ebp
lea rcx, [0x140134170]
lea rax, [0x140134178]
cmovne rax, rcx
cmp edi, ebp
mov rdi, qword [rsp + 0x78]
lea rcx, [0x140134160]
lea r12, [0x140134168]
cmovne r12, rcx
cmp byte [rsp + 0x41], bpl
cmovne r12, rax
cmp byte [rsp + 0x198], bpl
jne 0x14009acbc
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rdi
lea ecx, [rax + 1]
mov dword [rsp + 0x58], eax
movsxd r8, ecx
lea rcx, [rsi + 0x424]
add r8, r8
call fcn.14001d128
mov word [rbx], bp
cmp byte [rsp + 0x40], bpl
je 0x14009ad2f
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0xb0], rax
neg rcx
mov rcx, rbx
sbb dil, dil
sub rax, rsi
and dil, byte [rsp + 0x40]
sar rax, 1
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dil, bpl
jne 0x14009ad64
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r11d, eax
lea rax, str.Explorer.exe
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], r11
mov eax, dword [rsp + 0x50]
lea rdx, str.WIN10FromStartMenu
lea rcx, str.WIN10ToStartMenu
cmp eax, ebp
lea rdi, str.WIN10ToTaskBand
cmovne rcx, rdx
cmp eax, ebp
lea rdx, str.WIN10FromTaskBand
cmovne rdi, rdx
cmp byte [rsp + 0x41], bpl
cmovne rdi, rcx
cmp r15d, ebp
lea rax, [rdi + 8]
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x130], rax
movsxd rax, dword [0x140130858]
jge 0x14009adbd
cmp eax, ebp
jl 0x14009adc7
cmp qword [r12], rbp
jne 0x14009b222
lea rcx, [rsp + 0x90]
mov edx, 0x1122
mov qword [rsp + 0xf0], rax
call fcn.1400616e0
cmp r15d, ebp
mov rsi, qword [rsp + 0x90]
mov rax, rsi
mov qword [rsi], rbp
mov qword [rsp + 0x48], rax
jge 0x14009ae2c
cmp dword [0x140130858], ebp
jge 0x14009ae2c
lea rcx, str.PINT.FLAGS
call fcn.14001b060
cmp rax, rbp
mov qword [rsp + 0xf0], rax
jl 0x14009ae27
mov dword [0x140130858], eax
mov r15d, eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x48]
cmp qword [r12], rbp
jne 0x14009ae8c
lea rcx, [rsp + 0x74]
lea r9, [rsp + 0x80]
lea rdx, str.SOFTWAREPELOGONUSRCFG
mov qword [rsp + 0x28], rcx
mov r8, rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x80], 1
mov dword [rsp + 0x74], 0x1ffc
mov qword [rsp + 0x20], rax
call fcn.14005a474
mov rax, qword [rsp + 0x48]
cmp word [rax], bp
je 0x14009ae8c
mov rdx, rax
mov rcx, r12
call fcn.14006d680
mov rax, qword [rsp + 0x48]
cmp r15d, ebp
mov cl, 1
lea rdx, str..USRCFG.INI
mov byte [rsp + 0x40], cl
mov r9d, 0xffe
jge 0x14009aeac
cmp dword [0x140130858], ebp
jl 0x14009aeb6
cmp qword [r12], rbp
jne 0x14009b121
movsxd rax, dword [rsp + 0x58]
mov r15, qword [rsp + 0x78]
lea rdi, [r15 + rax*2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r11d, 0x2e
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xf8]
lea r9d, [r11 - 0x27]
mov r8d, 0x80000000
mov rdx, r15
mov dword [rsp + 0x28], 3
mov word [rdi], r11w
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x20], rbp
call fcn.1400037a8
mov rcx, qword [rsp + 0xd8]
mov dword [rsp + 0x80], ebp
add rcx, 0xa
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdi, qword [rsp + 0xf8]
mov qword [rsi], rbp
lea r9, [rsp + 0x80]
mov rcx, rdi
mov r8d, 0x1ffe
mov rdx, rsi
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x80]
shr r11d, 1
mov eax, 0xffe
mov ecx, 0xfeff
cmp r11d, eax
cmova r11d, eax
movsxd rax, r11d
mov dword [rsp + 0x80], r11d
mov word [rsi + rax*2], bp
mov rax, qword [rsp + 0x48]
cmp cx, word [rax]
jne 0x14009af9c
add rax, r13
mov qword [rsp + 0x48], rax
mov r15, rax
cmp byte [rsp + 0x40], bpl
je 0x14009b150
cmp qword [rsp + 0xf0], rbp
jge 0x14009b040
jmp 0x14009aff4
lea rcx, [rsp + 0x48]
call fcn.140059074
mov rcx, qword [rsp + 0x48]
lea rdx, str.PINT.FLAGS:
mov r8d, 0xb
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
je 0x14009affb
lea rcx, [rsp + 0x48]
mov edx, 0xa
call fcn.14004e520
mov rax, qword [rsp + 0x48]
cmp word [rax], bp
jne 0x14009afba
jmp 0x14009b040
mov rax, qword [rsp + 0x48]
mov ecx, 0x3f
add rax, 0x16
mov qword [rsp + 0x48], rax
cmp cx, word [rax]
jne 0x14009b022
add rax, r13
mov qword [rsp + 0x48], rax
cmp byte [rsp + 0x42], bpl
je 0x14009b040
lea rdx, [0x140130858]
lea rcx, [rsp + 0x48]
call fcn.140065ca8
btr dword [0x140130858], 0x1f
mov rax, qword [rsp + 0x48]
cmp qword [r12], rbp
jne 0x14009b0fe
mov r10d, dword [rsp + 0x74]
mov rax, r15
mov qword [rsp + 0x48], rax
cmp word [r15], bp
je 0x14009b0fe
lea rcx, [rsp + 0x48]
call fcn.140059074
mov r15, qword [rsp + 0x48]
mov edx, 0xa
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x48]
call fcn.140059308
mov rdx, qword [rsp + 0xd8]
mov r8d, r10d
add rdx, 0xa
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
jne 0x14009b13e
movsxd r10, dword [rsp + 0x74]
mov ecx, 0x3a
cmp cx, word [r15 + r10*2]
jne 0x14009b143
lea eax, [r10 + 1]
movsxd rcx, eax
mov rax, qword [rsp + 0x48]
lea rdx, [r15 + rcx*2]
cmp word [rax], bp
je 0x14009b0dd
mov word [rax], bp
mov rax, qword [rsp + 0x48]
add rax, r13
mov qword [rsp + 0x48], rax
mov ecx, 0x3f
cmp cx, word [rdx]
jne 0x14009b0f1
add rdx, r13
cmp byte [rsp + 0x42], bpl
je 0x14009b0fe
mov rcx, r12
call fcn.14006d680
mov rax, qword [rsp + 0x48]
cmp rdi, rbp
je 0x14009b117
cmp rdi, 0xffffffffffffffff
je 0x14009b117
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
mov cl, byte [rsp + 0x40]
mov r9d, 0xffe
cmp cl, bpl
je 0x14009b184
cmp qword [r12], rbp
jne 0x14009b184
mov rdx, qword [rsp + 0x130]
mov byte [rsp + 0x40], bpl
jmp 0x14009aeb6
mov r10d, dword [rsp + 0x74]
mov rax, qword [rsp + 0x48]
cmp word [rax], bp
jmp 0x14009b05b
cmp word [rax], bp
je 0x14009b165
mov rdx, rax
mov rcx, r12
call fcn.14006d680
mov rax, qword [rsp + 0x48]
cmp rdi, rbp
je 0x14009b17e
cmp rdi, 0xffffffffffffffff
je 0x14009b17e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
mov r9d, 0xffe
movabs rcx, 0xa00000000
cmp qword [rsp + 0xe0], rcx
jb 0x14009b1d4
cmp qword [r12], rbp
jne 0x14009b1e9
mov word [rax], bp
mov al, byte [rsp + 0x41]
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140132a70]
neg al
sbb edx, edx
and edx, 0xfffffffb
add edx, 0x150a
add edx, dword [rsp + 0x50]
call fcn.140059640
mov rdx, qword [rsp + 0x48]
mov rcx, r12
call fcn.14006d680
cmp qword [r12], rbp
jne 0x14009b1e9
lea rdx, [0x140113598]
mov rcx, r12
call fcn.14006d680
cmp dword [0x140130858], ebp
jl 0x14009b1fb
btr dword [0x140130858], 0x1f
jmp 0x14009b20a
neg byte [rsp + 0x56]
sbb eax, eax
and eax, 4
mov dword [0x140130858], eax
lea rcx, [rsp + 0x90]
call fcn.1400590a4
mov eax, dword [0x140130858]
mov r15d, dword [rsp + 0x70]
mov cl, byte [rsp + 0x198]
cmp r15d, ebp
cmovl r15d, eax
mov dword [rsp + 0x70], r15d
cmp byte [rsp + 0x42], bpl
je 0x14009b34f
cmp byte [rsp + 0x43], bpl
je 0x14009b34f
cmp byte [rsp + 0x54], bpl
jne 0x14009b34f
cmp cl, bpl
jne 0x14009b34f
lea rcx, str.NODELAYEXPLORER
call fcn.14001b060
cmp rax, rbp
jg 0x14009b348
lea rdx, str.Explorer.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdi, qword [rsp + 0xd0]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
jne 0x14009b348
mov word [rbx], bp
mov rcx, qword [0x140132a70]
mov r9d, 0x1207
mov r8, rbx
mov edx, 0x2728
call fcn.140059640
cmp word [rbx], bp
je 0x14009b348
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x30]
mov dword [rsp + 0x20], ebp
call fcn.14002d7a0
cmp rax, rbp
jne 0x14009b348
lea rdx, [0x14011f308]
lea rcx, [rsp + 0x88]
call fcn.1400617a8
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x88]
call fcn.1400617a8
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x198]
mov r8, r14
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov word [rsp + 0x198], bp
mov dword [rsp + 0x20], ebp
call fcn.14000dfb8
mov rbp, rax
jmp 0x14009bb7c
mov cl, byte [rsp + 0x198]
mov rsi, qword [r12]
mov eax, r15d
mov r12d, 1
and eax, r12d
cmp byte [rsp + 0x42], bpl
je 0x14009b36d
cmp cl, bpl
cmove eax, r12d
test r15b, 0xe
je 0x14009b7a9
cmp byte [rsp + 0x55], bpl
jne 0x14009b9d4
mov rdi, qword [rsp + 0xb8]
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x110], rbp
lea eax, [rdi + 0x1e]
mov qword [rsp + 0x118], 0x20001
mov qword [rsp + 0x120], rbp
movsxd rcx, eax
mov qword [rsp + 0x128], rbp
lea rsi, [rbx + rcx*2]
lea r12, [rsi + 2]
test r15b, 0xc
je 0x14009b66c
movsxd rdi, edi
lea rdx, str.PECMDExp.exe
lea r14, [rbx + rdi*2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.GlobalPECMD:main:lock:PINT:FILE:4
lea rcx, [rsp + 0xe0]
call fcn.1400172cc
movsxd r11, dword [rsp + 0x58]
mov r15, qword [rsp + 0x78]
mov rcx, rbx
mov word [r15 + r11*2], bp
call fcn.1400f8c14
cmp eax, ebp
jne 0x14009b426
mov r8, qword [rsp + 0xb8]
mov rdx, rbx
mov rcx, r15
inc r8d
call fcn.14005e6a4
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r15, [r12 + rdi*2]
lea rdx, str.Explorer0.exe
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rdx, str.PECMDExp.exe
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [rsp + 0xb0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, qword [rsp + 0xb0]
mov eax, 0x22
lea rdi, [rsi + rdi*2 + 2]
mov word [rsi], ax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str._PINT__dir__file__base:
movsxd rcx, eax
mov eax, 0x22
lea rdi, [rdi + rcx*2]
mov word [rdi], ax
add rdi, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0xc8]
movsxd rcx, eax
lea rax, [rdi + rcx*2]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], rax
call fcn.14006951c
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test byte [rsp + 0x70], 8
mov rcx, qword [rsp + 0x180]
mov r8, rcx
mov word [rsp + 0x198], bp
lea r9, [rsp + 0x198]
mov rdx, rsi
je 0x14009b569
mov qword [rsp + 0x38], rbp
mov eax, 1
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call fcn.14000dfb8
mov dword [rsp + 0x50], eax
jmp 0x14009b589
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call fcn.14000dfb8
mov r13, qword [rsp + 0xb0]
mov rcx, r14
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.PECMDExp.exe
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, 0x1388
mov esi, edi
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, r12
call fcn.1400f8c14
cmp eax, ebp
jne 0x14009b5f5
mov rcx, rbx
call fcn.1400f8c14
cmp eax, ebp
je 0x14009b5f5
xor r9d, r9d
lea rcx, [0x1401330e0]
xor r8d, r8d
lea edx, [r9 + 0xa]
call fcn.14001f59c
sub esi, 0xa
cmp esi, ebp
jg 0x14009b5b4
lea rdx, str.Explorer0.exe
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, r12
call fcn.1400f8c14
cmp eax, ebp
jne 0x14009b652
mov rcx, rbx
call fcn.1400f8c14
cmp eax, ebp
je 0x14009b652
xor r9d, r9d
lea rcx, [0x1401330e0]
xor r8d, r8d
lea edx, [r9 + 0xa]
call fcn.14001f59c
sub edi, 0xa
cmp edi, ebp
jg 0x14009b611
lea rcx, [rsp + 0xe0]
call fcn.140017314
mov r14, qword [rsp + 0x180]
jmp 0x14009b760
lea rdx, str._wait__mem__exe:
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rsi, [r12 + 0x20]
mov r8d, 0x104
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x188]
mov ecx, 0x2a
mov word [rax], cx
add qword [rsp + 0x188], r13
movsxd rdi, edi
add rdi, rdi
mov rdx, rbx
add rsi, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [rsp + 0xb0]
add rsi, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str._PECMD_PINT__file__base:
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0xc8]
movsxd rcx, eax
lea rax, [rsi + rcx*2]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x198], rax
call fcn.14006951c
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x198]
mov r8, r14
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov word [rsp + 0x198], bp
mov dword [rsp + 0x20], ebp
call fcn.14000dfb8
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x120], rbp
je 0x14009b7a0
lea r9, [rsp + 0x110]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14001f59c
mov rcx, qword [rsp + 0x120]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0x50]
jmp 0x14009bb7c
cmp eax, r12d
jl 0x14009b9d4
mov r15, qword [rsp + 0x78]
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rbp
je 0x14009b9d4
add rax, r13
je 0x14009b9d4
lea rdx, [0x14011f1e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
je 0x14009b9d4
mov rcx, qword [rsp + 0x108]
lea rdx, str.__hide__
mov r8d, 0x12
call fcn.14001d128
movsxd rbx, dword [rsp + 0x58]
lea rdx, str..DirExplorer.exe
lea rcx, [r15 + rbx*2]
mov r8d, 0x24
call fcn.14001d128
mov rcx, r15
add ebx, 0x11
mov r12, rbp
mov edi, ebp
call fcn.1400f8c14
cmp eax, ebp
mov ecx, ebp
sete cl
cmp ecx, ebp
je 0x14009b8d2
lea rcx, str.NOTMPEXPLORER
call fcn.14001b060
cmp rax, rbp
jg 0x14009b9ce
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rbp
call fcn.1400047f4
movsxd rdi, eax
cmp edi, ebp
jle 0x14009b8c8
mov rcx, qword [rsp + 0x78]
cmp rcx, rbp
je 0x14009b8c8
cmp word [rcx], bp
je 0x14009b8c8
lea rcx, [rcx + rdi*2]
lea rdx, [0x14011f1e8]
mov r8d, 0x1a
call fcn.14001d128
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xc8]
xor r8d, r8d
add edi, 0xc
call fcn.14005e6a4
mov rdx, qword [rsp + 0x78]
lea r11d, [rdi + 1]
movsxd r8, r11d
mov rcx, r15
add r8, r8
call fcn.14001d128
mov ebx, edi
mov r12, r15
lea rcx, [rsp + 0x78]
call fcn.1400590a4
movsxd rax, ebx
lea rdx, str.__PINT__dir__base:
mov r8d, 0x28
lea rbx, [r15 + rax*2]
mov rcx, rbx
call fcn.14001d128
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x90]
add rbx, 0x26
mov qword [rsp + 0x90], rbx
call fcn.14006951c
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x38], rbp
mov eax, 1
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x198]
mov r8, r14
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov word [rsp + 0x198], bp
mov dword [rsp + 0x20], eax
call fcn.14000dfb8
mov rbx, rax
cmp r12, rbp
je 0x14009b97e
movsxd rdx, edi
mov rcx, r12
mov word [r12 + rdx*2], bp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x68]
call fcn.1400590a4
lea rcx, [rsp + 0x60]
call fcn.1400590a4
lea rcx, [rsp + 0xa0]
call fcn.1400590a4
lea rcx, [rsp + 0x98]
call fcn.1400590a4
lea rcx, [rsp + 0x88]
call fcn.1400590a4
lea rcx, [rsp + 0xa8]
call fcn.1400590a4
movsxd rax, ebx
jmp 0x14009bbc7
mov r12d, 1
cmp byte [rsp + 0x41], bpl
je 0x14009b9ea
mov ebx, dword [rsp + 0x50]
add ebx, 0x1505
jmp 0x14009ba74
mov r9, qword [rsp + 0x188]
mov eax, 0x23
cmp ax, word [r9]
jne 0x14009ba56
or dword [rsp + 0x198], 0xffffffff
add r9, r13
lea r8d, [rax + 9]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x188], r9
call fcn.140065954
mov ebx, dword [rsp + 0x198]
cmp ebx, ebp
jl 0x14009baea
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, rbp
jne 0x14009ba90
mov rbp, r12
jmp 0x14009bb7c
lea rcx, str.TaskBand
mov rdx, r9
call fcn.14005a758
cmp al, bpl
je 0x14009bacb
mov ebx, dword [rsp + 0x50]
add ebx, 0x150a
cmp rsi, rbp
je 0x14009ba38
cmp word [rsi], bp
je 0x14009ba38
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.14006d718
mov rbx, qword [rax]
jmp 0x14009badd
lea rcx, [rsp + 0x68]
mov edx, 0x1001
call fcn.14006176c
mov r8, qword [rsp + 0x68]
mov r9d, 0x1000
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov rbx, qword [rsp + 0x68]
cmp word [rbx], bp
je 0x14009ba4e
xor edx, edx
mov rcx, rbx
call fcn.1400594d4
jmp 0x14009badd
lea rcx, [rsp + 0x68]
mov rdx, r9
call fcn.14006d718
mov rbx, qword [rsp + 0x68]
mov rax, qword [rsp + 0xd0]
cmp word [rax], bp
jne 0x14009baf6
mov rbp, 0xffffffff80070057
jmp 0x14009bb7c
mov rcx, rax
call fcn.14001b680
mov rcx, rax
mov rdi, rax
call fcn.1400f8c14
cmp eax, ebp
jne 0x14009bb12
mov rbp, r13
jmp 0x14009bb7c
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.1400dc9e4
mov r11, qword [rsp + 0xe8]
cmp r11, rbp
je 0x14009ba4e
lea rdx, str.GlobalPECMD:main:lock:PINT
lea rcx, [rsp + 0x138]
mov word [r11 - 2], bp
call fcn.1400172cc
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa0]
mov r8, rbx
call fcn.140008d74
lea rcx, [rsp + 0x138]
mov rbp, rax
call fcn.140017314
lea rcx, [rsp + 0x68]
call fcn.1400590a4
lea rcx, [rsp + 0x60]
call fcn.1400590a4
lea rcx, [rsp + 0xa0]
call fcn.1400590a4
lea rcx, [rsp + 0x98]
call fcn.1400590a4
lea rcx, [rsp + 0x88]
call fcn.1400590a4
lea rcx, [rsp + 0xa8]
call fcn.1400590a4
mov rax, rbp
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret