Function at 0x140017520
Capabilities:
Delete file
Get file version info
Move file
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1e0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1400ee080]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
xor r13d, r13d
call fcn.1400189d0
call fcn.14001ff50
test al, al
jne 0x140017588
lea rdx, str.Please_run_as_administrator
lea rcx, [0x1400f0850]
call fcn.140001870
mov rcx, rax
call fcn.14000cca0
nop
jmp 0x1400187f6
lea rdx, [0x1400ba648]
xor ecx, ecx
call fcn.1400391e8
lea rcx, [rsp + 0xe0]
call fcn.14001fd80
nop
mov rdi, rax
cmp qword [rax + 0x18], 7
jbe 0x1400175b1
mov rdi, qword [rax]
mov rax, qword [rax + 0x10]
lea rbx, [rdi + rax*2]
mov rdx, rbx
mov rcx, rdi
call fcn.140011470
cmp rax, rbx
je 0x14001762d
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400175df
cmp cx, 0x2f
jne 0x1400175e8
add rax, 2
cmp rax, rbx
jne 0x1400175d0
cmp rax, rbx
je 0x14001762d
nop dword [rax]
lea rcx, [rbx - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x14001760d
cmp dx, 0x2f
je 0x14001760d
mov rbx, rcx
cmp rax, rcx
jne 0x1400175f0
jmp 0x14001762d
cmp rax, rbx
je 0x14001762d
lea rcx, [rbx - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x140017625
cmp dx, 0x2f
jne 0x14001762d
mov rbx, rcx
cmp rax, rcx
jne 0x140017612
sub rbx, rdi
sar rbx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140001eb0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400130f0
lea rax, [0x1400ba650]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 9
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.140001fe0
nop
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.14000f0e0
nop
lea rcx, [rsp + 0x120]
call fcn.1400130f0
lea rax, str.dsrole.dll
mov qword [rsp + 0x20], rax
mov r14d, 0xa
mov qword [rsp + 0x28], r14
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.140001fe0
nop
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.14000f0e0
nop
lea rcx, [rsp + 0x140]
call fcn.1400130f0
lea rax, str.version.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xb
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x1a0]
call fcn.140001fe0
nop
lea r8, [rsp + 0x1a0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x100]
call fcn.14000f0e0
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400130f0
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rcx, qword [rsp + 0xa0]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0xe0]
call fcn.14002c764
mov r8d, eax
test eax, eax
jne 0x140017821
mov edx, dword [rsp + 0xf0]
test dl, 1
mov r15d, 0x1ff
mov ecx, r15d
mov r12d, 0x16d
cmovne ecx, r12d
mov dword [rsp + 0x24], ecx
mov eax, edx
shr eax, 0xa
test al, 1
je 0x140017816
mov eax, dword [rsp + 0xf4]
cmp eax, 0xa000000c
jne 0x14001780a
mov edx, 4
jmp 0x140017851
cmp eax, 0xa0000003
jne 0x140017816
mov edx, r14d
jmp 0x140017851
shr edx, 4
and edx, 1
or edx, 2
jmp 0x140017851
mov dword [rsp + 0x24], 0xffff
sub eax, 2
je 0x140017840
sub eax, 1
je 0x140017840
sub eax, 0x32
je 0x140017840
cmp eax, 0x46
mov edx, r13d
jne 0x140017845
mov edx, 1
mov r15d, 0x1ff
mov r12d, 0x16d
mov dword [rsp + 0x20], r8d
lea rdi, str.pw_v_
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
test edx, edx
je 0x140018760
cmp edx, 1
je 0x140018769
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 9
lea rdx, str.dopus.exe
lea rcx, [rsp + 0x60]
call fcn.140001eb0
nop
lea rcx, [rsp + 0x60]
call fcn.14001fdf0
mov rbx, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400178f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400178f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018848
call fcn.14002a8ac
movdqa xmm6, xmmword [0x1400bb140]
movdqu xmmword [rsp + 0x70], xmm6
mov word [rsp + 0x60], r13w
test rbx, rbx
je 0x140017c2e
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.14001fed0
nop
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x140]
call fcn.140014b30
test eax, eax
jne 0x140017c21
lea rcx, str.DOpus_is_running__should_we_close_it_first_
call fcn.140018af0
test al, al
je 0x140017b73
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140017a4c
lea rdx, str.Failed_to_close_DOpus
lea rcx, [0x1400f0850]
call fcn.140001870
mov rcx, rax
call fcn.14000cca0
nop
lea rcx, [rsp + 0x140]
call fcn.1400130f0
nop
lea rcx, [rsp + 0x100]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400130f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140017a3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001884e
call fcn.14002a8ac
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r13w
jmp 0x1400187f6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, r13d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8d, 9
lea rdx, str.dopus.exe
lea rcx, [rsp + 0x60]
call fcn.140001eb0
nop
lea rcx, [rsp + 0x60]
call fcn.14001fdf0
mov rdi, rax
mov r8, qword [rsp + 0x78]
cmp r8, 7
jbe 0x140017ab1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400111c0
test rdi, rdi
je 0x140017c1a
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x140017a60
lea rdx, str.Failed_to_close_DOpus
lea rcx, [0x1400f0850]
call fcn.140001870
mov rcx, rax
call fcn.14000cca0
nop
lea rcx, [rsp + 0x140]
call fcn.1400130f0
nop
lea rcx, [rsp + 0x100]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400130f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140017b62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001884e
call fcn.14002a8ac
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r13w
jmp 0x1400187f6
lea rdx, str.Please_close_DOpus_first
lea rcx, [0x1400f0850]
call fcn.140001870
mov rcx, rax
call fcn.14000cca0
nop
lea rcx, [rsp + 0x140]
call fcn.1400130f0
nop
lea rcx, [rsp + 0x100]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400130f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140017c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001884e
call fcn.14002a8ac
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r13w
jmp 0x1400187f6
lea rdi, str.pw_v_
lea rcx, [rsp + 0x140]
call fcn.1400130f0
lea rax, str.dopus.exe.bak
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xd
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.140001fe0
nop
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000f0e0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x180]
call fcn.14000d970
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x160]
call fcn.140012e30
test eax, eax
je 0x140017cfc
mov ecx, eax
sub ecx, 2
je 0x140017cfc
sub ecx, 1
je 0x140017cfc
sub ecx, 0x32
je 0x140017cfc
cmp ecx, 0x46
je 0x140017cfc
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140017d2e
mov qword [rsp + 0x190], r13
lea rax, [rsp + 0x180]
cmp qword [rsp + 0x198], 7
cmova rax, qword [rsp + 0x180]
mov word [rax], r13w
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x140017d4e
lea r9, [rsp + 0x20]
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x160]
call fcn.1400107d0
nop
lea rcx, [rsp + 0x180]
call fcn.1400130f0
cmp dword [rsp + 0x20], 0
jne 0x140018854
lea rcx, [rsp + 0xe0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0x120]
call fcn.1400130f0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.14000d970
nop
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x140017dc9
mov rsi, r13
jmp 0x140017f11
mov rdi, rsi
cmp rsi, 0x1000
jb 0x140017dfe
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140018871
call fcn.14002a870
test rax, rax
je 0x14001887d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140017e09
mov rcx, rdi
call fcn.14002a870
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.140054350
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
mov r9, rbx
mov r8d, esi
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140017e7e
test rbx, rbx
je 0x140017e76
cmp rdi, 0x1000
jb 0x140017e6b
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14001887d
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.14002a8ac
mov rsi, r13
jmp 0x140017f0a
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x20]
lea rdx, [0x1400ba604]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140017e41
mov rax, qword [rsp + 0x20]
movzx edx, word [rax + 0xa]
movzx ecx, word [rax + 8]
movzx r8d, word [rax + 0xe]
movzx r9d, word [rax + 0xc]
imul rax, rdx, 0x3e8
add rax, rcx
imul rcx, rax, 0x3e8
add rcx, r8
imul rsi, rcx, 0x3e8
add rsi, r9
test rbx, rbx
je 0x140017f0a
cmp rdi, 0x1000
jb 0x140017eff
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14001887d
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.14002a8ac
lea rdi, str.pw_v_
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140017f5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018877
call fcn.14002a8ac
nop
movabs rax, 0x307472d18
cmp rsi, rax
jb 0x140017fc3
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rcx, qword [rsp + 0xa0]
lea r8, str.2D_64_64_72_6F_6C_65_2E_64_6C_6C_00
lea rdx, str.2D_64_73_72_6F_6C_65_2E_64_6C_6C_00
call fcn.140024820
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rcx, qword [rsp + 0xa0]
lea r8, str.64_00_64_00_72_00_6F_00_6C_00_65_00_2E_00_64_00_6C_00_6C_00
lea rdx, str.64_00_73_00_72_00_6F_00_6C_00_65_00_2E_00_64_00_6C_00_6C_00
call fcn.140024820
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 7
cmova rcx, qword [rsp + 0xc0]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0xe0]
call fcn.14002c764
mov r8d, eax
test eax, eax
jne 0x140018048
mov edx, dword [rsp + 0xf0]
test dl, 1
mov ecx, r15d
cmovne ecx, r12d
mov dword [rsp + 0x24], ecx
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x14001803d
mov eax, dword [rsp + 0xf4]
cmp eax, 0xa000000c
jne 0x140018031
mov edx, 4
jmp 0x14001806c
cmp eax, 0xa0000003
jne 0x14001803d
mov edx, r14d
jmp 0x14001806c
shr edx, 4
and edx, 1
or edx, 2
jmp 0x14001806c
mov dword [rsp + 0x24], 0xffff
sub eax, 2
je 0x140018067
sub eax, 1
je 0x140018067
sub eax, 0x32
je 0x140018067
cmp eax, 0x46
mov edx, r13d
jne 0x14001806c
mov edx, 1
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
test edx, edx
je 0x140018255
cmp edx, 1
je 0x1400181e8
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 7
cmova rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400181e8
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 7
cmova rcx, qword [rsp + 0xc0]
call fcn.14002cbb4
test al, al
jne 0x1400181e8
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r9b, 1
lea r8, [0x1400ba890]
lea rcx, [rsp + 0x60]
call fcn.14001f420
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 7
cmova rcx, qword [rsp + 0xc0]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400181be
lea rdx, str.Rename_hijack.dll_to_temp_file_failed:
lea rcx, [0x1400f0730]
call fcn.140001220
mov rbx, rax
mov edx, 9
lea rcx, [rsp + 0xe0]
call fcn.140018930
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14001817c
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140005250
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140016e20
movzx edx, al
mov rcx, rbx
call fcn.140015f20
mov rcx, rbx
call fcn.1400155a0
nop
lea rcx, [rsp + 0xe0]
call fcn.14000ea10
jmp 0x1400181de
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rsp + 0x60]
call fcn.1400130f0
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0xe0]
call fcn.14002c764
mov r8d, eax
test eax, eax
jne 0x140018275
mov edx, dword [rsp + 0xf0]
test dl, 1
cmovne r15d, r12d
mov dword [rsp + 0x24], r15d
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x140018267
mov eax, dword [rsp + 0xf4]
cmp eax, 0xa000000c
jne 0x140018260
mov r14d, 4
jmp 0x14001829c
test r8d, r8d
jne 0x140018883
jmp 0x1400181e8
cmp eax, 0xa0000003
je 0x14001829c
shr edx, 4
and edx, 1
or edx, 2
mov r14d, edx
jmp 0x14001829c
mov dword [rsp + 0x24], 0xffff
sub eax, 2
je 0x140018294
sub eax, 1
je 0x140018294
sub eax, 0x32
je 0x140018294
cmp eax, 0x46
mov eax, r13d
jne 0x140018299
mov eax, 1
mov r14d, eax
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
test r14d, r14d
je 0x140018718
cmp r14d, 1
je 0x14001841a
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001841a
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
call fcn.14002cbb4
test al, al
jne 0x14001841a
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r9b, 1
lea r8, [0x1400ba890]
lea rcx, [rsp + 0x60]
call fcn.14001f420
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400183f0
lea rdx, str.Rename_hijack.dll_to_temp_file_failed:
lea rcx, [0x1400f0730]
call fcn.140001220
mov rbx, rax
mov edx, 9
lea rcx, [rsp + 0xe0]
call fcn.140018930
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400183ae
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140005250
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140016e20
movzx edx, al
mov rcx, rbx
call fcn.140015f20
mov rcx, rbx
call fcn.1400155a0
nop
lea rcx, [rsp + 0xe0]
call fcn.14000ea10
jmp 0x140018410
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rsp + 0x60]
call fcn.1400130f0
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 7
cmova rcx, qword [rsp + 0xc0]
mov r8, qword [0x1400b7180]
lea rdx, [0x140057580]
call fcn.1400105c0
mov rbx, qword [0x1400b7188]
lea rdi, str.cert_file.txt
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0xd
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.140001fe0
nop
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000f0e0
nop
cmp qword [rax + 0x18], 7
jbe 0x1400184af
mov rax, qword [rax]
mov r8, rbx
lea rdx, str._CertificateDetails__r_nRegistrationCode84LW5_ZQJKN_JFR2W_3QGR2_r_nVersion13.0_r_n_r_n_____BEGIN_GPSOFT_PROGRAM_CERTIFICATE______r_nDGuOAAIYSw_HbO4SIHYkAcszpwqUSShGP6swMfafkwsCHLdIiOSNbd_guQ3_r_nDk5r7jBr6gNxz2EGFYbDolbNhrS79pdB4iExg31CKcLfPIUlTy9dVa96r_r_nDtonOyOvLvgX9LzGQz8WjLQhhh9rtzIpAR7RiNJfFsfBz454dB0dNf65eGuOA_r_nDAJ1hybzaUZaNzR0drA8917RnMSYa5rVevRKy5niHF3Qa3xEIv6xUzuR4wo3H_r_nDfcHppZ8KP6f2ueGT6kWwizo3CVaQRcse3BGmmtTQLD46LKseGyMeDMxgk6J_r_nDtqr8miSuEVRcJPmJOgqNUMnOA2bVb6R1IsbWwmxVF9kTZYVAorNvGuOAAGXB_r_nDv2cFCcatGT7PDG2Z_DpdxfcBMAdR64pPmDahXbSzOgdqkJu9PkfpGsO1m_f_r_nDyA1CPrCXUrba3vu6qi4stPQz1M8QZMc9v_cimjmD1w_AgEjB3DHtwqw81cWa_r_nDpYzbDaObQsTh24TxfVFaDub8DKCEQcSE2Y0NOoUnZqBNcGsGuOAAHgCuVwt_r_nDtTvA8hBiX7n1Ks8Y84P3FQvXk6AtvFQjMXEZdm7PP7RsJMFayHIbWar1eCCy_r_nD2kIVlPWdE8Hnj6VlPAojRYiZAw13IgetHarjyQzBogSk4wXaNTIIFrseb_y_r_nD7QssjGwGxy6iMrpFt1MSFqnJ0CwZRu6qfkMFIf7XVZTGuOAADBb2ckETgZ8_r_nDG6V7DC6MkLgEm36ctw_oPF2Qxag_Qc_pQ5eA8bP17lXku2Enx1seAQmWn6b_r_nDbKoWY4sBClKjzc3piqROYeLHZaq8hjLV4gEBfzRkgtzN6AUIjKhce88Yi_US_r_nD1m0TYytQc36EIuNhUyM25s3KMKuqpHY5TEN0Mtx0_r_ncfsNHzIsSNrHuQX1TCLjkA_r_n_____END_GPSOFT_PROGRAM_CERTIFICATE______r_n
mov rcx, rax
call fcn.1400105c0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0x120]
call fcn.1400130f0
nop
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0xd
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
call fcn.140001fe0
nop
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x160]
call fcn.14000f0e0
nop
cmp qword [rax + 0x18], 7
jbe 0x140018538
mov rax, qword [rax]
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 7
cmova rcx, qword [rsp + 0xa0]
lea rdx, str.____cert_____regcode_84LW5_ZQJKN_JFR2W_3QGR2__norun
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], 0x37
mov qword [rsp + 0x70], rcx
movabs rcx, 0xb000000000000000
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x78], rax
movabs rax, 0xb000000000000008
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x80], xmm1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.14000d180
nop
lea rcx, [rsp + 0x160]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400130f0
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x140]
call fcn.140020000
mov r8, qword [rsp + 0x158]
cmp r8, 7
jbe 0x140018632
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x140]
call fcn.1400111c0
movdqu xmmword [rsp + 0x150], xmm6
mov word [rsp + 0x140], r13w
mov r8, qword [rsp + 0x138]
cmp r8, 7
jbe 0x140018667
mov rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0x120]
call fcn.1400111c0
lea rdx, str.Patch_success._You_can_run_DOpus_now
lea rcx, [0x1400f0850]
call fcn.140001870
mov rcx, rax
call fcn.14000cca0
nop
lea rcx, [rsp + 0x100]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400130f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400186ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400186ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400188d9
call fcn.14002a8ac
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], r13w
call fcn.14001ffe0
test al, al
je 0x140018711
lea rcx, str.pause
call fcn.1400351d8
nop
xor eax, eax
jmp 0x140018811
test r8d, r8d
jne 0x14001889f
jmp 0x14001841a
test r8d, r8d
jne 0x1400188bc
lea rcx, str.dopus.exe_not_found__please_put_this_program_in_the_same_directory_as_dopus.exe_n
call fcn.1400188e0
nop
lea rcx, [rsp + 0x100]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400130f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400130f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400187e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400187dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400188d9
call fcn.14002a8ac
movdqa xmm0, xmmword [0x1400bb140]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
call fcn.14001ffe0
test al, al
je 0x14001880c
lea rcx, str.pause
call fcn.1400351d8
nop
mov eax, 1
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.14002a9d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140034ed4
nop
call fcn.140034ed4
nop
mov r9, rbx
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x20]
lea rcx, str.copy
call fcn.140012fa0
nop
call fcn.140012f30
nop
call fcn.140034ed4
nop
call fcn.140034ed4
nop
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x80]
lea rcx, str.exists
call fcn.140013010
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x80]
lea rcx, str.exists
call fcn.140013010
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x80]
lea rcx, str.exists
call fcn.140013010
nop
call fcn.140034ed4
int3