Function at 0x140001240
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall rule properties via inetfwrule
Empty recycle bin quietly
Empty the recycle bin
Execute command
Get file attributes
Log keystrokes via polling
Self delete
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140002174
mov qword [rsp + 0x90], rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x98], rsi
lea r9, [0x140005aa8]
xor esi, esi
mov qword [rsp + 0xa0], r14
xor edx, edx
mov qword [rbp - 0x40], rsi
lea rcx, [0x140005ae0]
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400013ef
lea rax, [rbp - 0x50]
mov qword [rbp - 0x50], rsi
lea r9, [0x140005ab8]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8d, [rsi + 1]
lea rcx, [0x140005ad0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400013e5
lea rcx, str.MyOutboundRule
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp - 0x50]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x40]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, str.Allow_outbound_connections_on_port_443
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp - 0x50]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x50]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x50]
lea edx, [rsi + 2]
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov rcx, qword [rbp - 0x50]
lea edx, [rsi + 1]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rbp - 0x50]
lea edx, [rsi + 6]
mov rax, qword [rcx]
call qword [rax + 0x80]
lea rcx, [0x1400044a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp - 0x50]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x90]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], rsi
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400013db
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, str.reg_add__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___v__BagMRU_Size___t_REG_DWORD__d_0x00000000__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 6
lea rcx, str.C:Hider
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Nurik
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Expensive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Excellent
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Wild
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Arbuz
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Akrien
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:AkrienAntiLeak
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Celestial
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Rockstar
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:RockAntiLeak
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_USERNAME_AppDataRoaming.wex
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Celka
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:_baritone
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsRockstar
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftExpensive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftAvalon
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftDark
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftExclusive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_arbuz
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftRise
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftStarLine
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftImpact
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftInertia
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftGothaj
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraftFPDCLEINT_1.8
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsWissend
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVerist
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExclusive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:CarbonaraAntiLeak
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Carbonara
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Sk3dGuard
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Delta
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:MoonHackFree
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:DeadCode
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Nova
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_arbuz
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameDark
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:ANLVerist
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive_Reloaded
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsKwishFree
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsCentric_Free
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsExpensive_Reloaded
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsKwishFree
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsCentric_Free
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsExpensive
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:GamesMinecraft_versionsFlugerClient
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, [0x140005400]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:UserszxcroAppDataRoaming.tlauncherlegacyMinecraftgame_versions_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, [0x1400055a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 6
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versions_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.del__q__C:WindowsSystem32SRU___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__q__C:WindowsPrefetch___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerTypedPaths___v__url1___f__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___v__BagMRU_Size___t_REG_DWORD__d_0x00000000__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140007708], sil
jne 0x140001a72
nop dword [rax]
lea rcx, str.taskkill__F__IM_SystemInformer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_ProcessHacker.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_JournalTrace.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_RegScanner.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_BrowsingHistoryView.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_Everything.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_Taskmgr.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_WinRAR.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov cl, 1
call fcn.140001180
mov ecx, 0x50
movzx ebx, al
call fcn.1400021d0
movaps xmm0, xmmword [str.C:Program_Files__x86_Everything]
mov rdi, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140005970]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140005980]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140005990]
movups xmmword [rax + 0x30], xmm1
movzx ecx, word [0x1400059a0]
mov word [rax + 0x40], cx
mov word [rax + 0x42], si
test bl, bl
je 0x1400018f6
xor ecx, ecx
call fcn.140001180
jmp 0x140001956
mov ebx, 0x1e
nop dword [rax + rax]
mov r8d, 0x28
mov dword [rbp - 0x38], 1
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x30], 0x74
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x20], rsi
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x2c], 2
lea rdx, [rbp - 0x38]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140001900
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x14000199b
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x14000199b
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x140001980
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x140002140
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400019e2
lea rcx, str.start_C:HiderChilledWindows.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x140001a0a
lea rcx, str.start_C:HiderCockroachOnDesktop.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x140001a32
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___v__BagMRU_Size___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x140001a74
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x50
mov rcx, rdi
call fcn.14000220c
cmp byte [0x140007708], sil
je 0x140001830
jmp 0x140001a72
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_ChilledWindows.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Hider
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Hider
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Nurik
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Nurik
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Expensive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Expensive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Excellent
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Excellent
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Wild
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Wild
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Akrien
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Akrien
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Arbuz
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Arbuz
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:AkrienAntiLeak
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:AkrienAntiLeak
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Celestial
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Celestial
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Rockstar
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Rockstar
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:RockAntiLeak
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:RockAntiLeak
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_USERNAME_AppDataRoaming.wex
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_USERNAME_AppDataRoaming.wex
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Celka
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Celka
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:_baritone
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:_baritone
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsRockstar
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsRockstar
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftExpensive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftExpensive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftAvalon
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftAvalon
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftDark
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftDark
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftExclusive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftExclusive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_arbuz
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_arbuz
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftRise
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftRise
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftStarLine
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftStarLine
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftImpact
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftImpact
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftInertia
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftInertia
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftGothaj
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftGothaj
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraftFPDCLEINT_1.8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraftFPDCLEINT_1.8
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsWissend
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsWissend
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVerist
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVerist
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExclusive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExclusive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:CarbonaraAntiLeak
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:CarbonaraAntiLeak
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Carbonara
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Carbonara
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Sk3dGuard
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Sk3dGuard
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Delta
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Delta
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:MoonHackFree
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:MoonHackFree
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:DeadCode
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:DeadCode
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Nova
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Nova
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_arbuz
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_arbuz
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameDark
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameDark
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:ANLVerist
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:ANLVerist
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive_Reloaded
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive_Reloaded
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsKwishFree
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsKwishFree
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsCentric_Free
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsCentric_Free
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExpensive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsExpensive_Reloaded
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsExpensive_Reloaded
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsKwishFree
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsKwishFree
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsCentric_Free
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsCentric_Free
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsExpensive
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsExpensive
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:GamesMinecraft_versionsFlugerClient
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:GamesMinecraft_versionsFlugerClient
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x140005400]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, [0x140005400]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:UserszxcroAppDataRoaming.tlauncherlegacyMinecraftgame_versions_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:UserszxcroAppDataRoaming.tlauncherlegacyMinecraftgame_versions_
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x1400055a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, [0x1400055a0]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versions_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
lea rcx, str.C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versions_
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShell___v__BagMRU_Size___f
jmp 0x140002147
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x50
mov rcx, rdi
call fcn.14000220c
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400021b0
mov rdi, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret