Function at 0x140003180
Capabilities:
Clear windows event logs
Create a process with modified i/o handles and window
Create process on windows
Empty the recycle bin
Get common file path
Get session user name
Open clipboard
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140046bc0], rax
lea rdx, [0x140046bd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [0x140046be0]
mov word [0x140046bc8], ax
lea rcx, str.Cleaner_2024_64_bits.
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 4
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_Cleaner_2024_64_bits.__n
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000463c
mov dword [rbp], 0x11c
lea rcx, [rbp]
call rax
mov eax, dword [rbp + 4]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
cvttsd2si eax, xmm0
cmp eax, 0xa
jne 0x14000463c
call fcn.140002d90
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.1400047f0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor edi, edi
mov rbx, 0xffffffffffffffff
test eax, eax
js 0x140003456
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140003360
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
mov r8d, 5
lea rdx, str.Temp
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003465
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000344f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047c4
call fcn.14000c5e0
jmp 0x140003465
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x22
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003510
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.1400047f0
jmp 0x14000351f
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_SysMain]
movups xmmword [rbp + 0x120], xmm1
movsd xmm0, qword [0x14003d600]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x14003d608]
mov dword [rbp + 0x138], eax
movzx eax, byte [0x14003d60c]
mov byte [rbp + 0x13c], al
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400036c4
movsd xmm0, qword [str.Prefetch]
movsd qword [rbp + 0x140], xmm0
movzx eax, word [0x14003d618]
mov word [rbp + 0x148], ax
mov r8d, 0xa
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x150]
call fcn.140016430
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.1400047f0
jmp 0x1400036d3
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_wuauserv]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d630]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d638]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d63c]
mov word [rsp + 0x6c], ax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003876
movups xmm0, xmmword [str.SoftwareDistribution]
movups xmmword [rsp + 0x78], xmm0
mov eax, dword [0x14003d650]
mov dword [rbp - 0x78], eax
movzx eax, word [0x14003d654]
mov word [rbp - 0x74], ax
mov r8d, 0x16
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x150]
call fcn.140016430
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.1400047f0
jmp 0x140003885
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xor edx, edx
xor ecx, ecx
mov r8d, 7
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Emptying_the_Trash
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x70], 0x101
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8d, 9
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003950
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov r8d, 0x2b
lea rdx, str.AppDataLocalLowSunJavaDeploymentcache
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003a44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047ca
call fcn.14000c5e0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003b97
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003aa0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsExplorer
lea rcx, [rsp + 0x50]
call fcn.140007ac0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003ba6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047d0
call fcn.14000c5e0
jmp 0x140003ba6
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003cf7
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003c00
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
mov r8d, 0x2e
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003d06
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047d6
call fcn.14000c5e0
jmp 0x140003d06
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__ipconfig__flushdns]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d6f0]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d6f8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d6fc]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x14003d6fe]
mov byte [rsp + 0x6e], al
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_flushed_the_DNS_Resolver_Cache.
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x70], 0x101
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8d, 9
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
lea rax, [rbp + 0x150]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003e80
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov r8d, 0xa
lea rdx, str.Downloads
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003f74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047dc
call fcn.14000c5e0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400040b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003fd0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400040bf
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047e2
call fcn.14000c5e0
jmp 0x1400040bf
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x21
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400041f6
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140004116
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004205
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047e8
call fcn.14000c5e0
jmp 0x140004205
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Empty_Clipboard_Function.
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fef0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400043cc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400042d3
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400092a0
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsWebCache
lea rcx, [rsp + 0x50]
call fcn.140007ac0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000ab10
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400047f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400043db
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047be
call fcn.14000c5e0
jmp 0x1400043db
mov edx, eax
call fcn.140004c10
mov rcx, rax
call fcn.140008e40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
movups xmm1, xmmword [str.cmd.exe__C__wevtutil_cl_System]
movups xmmword [rbp + 0x120], xmm1
movsd xmm0, qword [0x14003d798]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x14003d7a0]
mov dword [rbp + 0x138], eax
movzx eax, word [0x14003d7a4]
mov word [rbp + 0x13c], ax
movzx eax, byte [0x14003d7a6]
mov byte [rbp + 0x13e], al
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Setup]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14003d7b8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d7c0]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d7c4]
mov word [rsp + 0x6c], ax
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Security]
movups xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [0x14003d7d8]
movups xmmword [rbp + 0x270], xmm1
movzx eax, byte [0x14003d7e8]
mov byte [rbp + 0x280], al
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Application]
movups xmmword [rbp + 0x288], xmm0
movups xmm1, xmmword [0x14003d800]
movups xmmword [rbp + 0x298], xmm1
mov eax, dword [0x14003d810]
mov dword [rbp + 0x2a8], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.140008b90
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_cleared_windows_event_logs
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xb
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14003d53d]
lea rcx, [0x140045580]
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140008b90
mov rdx, qword [0x140046bd0]
mov rcx, rax
call fcn.140004a10
mov rcx, rax
lea rdx, str._bytes.
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140008b90
mov rdx, qword [0x140046bd0]
shr rdx, 0xa
mov rcx, rax
call fcn.140004a10
mov rcx, rax
lea rdx, str._kilobytes.
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140008b90
mov rdx, qword [0x140046bd0]
shr rdx, 0x14
mov rcx, rax
call fcn.140004a10
mov rcx, rax
lea rdx, str._megabytes.
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140008b90
mov rdx, qword [0x140046bd0]
shr rdx, 0x1e
mov rcx, rax
call fcn.140004a10
mov rcx, rax
lea rdx, str._gigabytes.
call fcn.140008b90
mov rcx, rax
call fcn.140008e40
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140045580]
call fcn.140008e40
lea rdx, [0x14003d8bc]
lea rcx, [0x140045580]
call fcn.140008b90
lea rcx, str.Pause
call fcn.14001563c
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14000c5c0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3
call fcn.140017038
int3