Function at 0x5fdf00
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create thread
Delete file
Execute shellcode via indirect call
Find taskbar
Get common file path
Inject thread
Print debug messages
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push rbp
push rbx
sub rsp, 0x2c8
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x2b8], 0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x198], rbp
nop
lea rcx, [0x005f4ee0]
call fcn.00415a70
nop
nop
mov byte [0x0063ab18], 1
call sub.kernel32.dll_GetCommandLineW
lea rcx, [rbp + 0x188]
mov rdx, rax
call fcn.0040fb30
lea rcx, [rbp + 0x190]
lea rdx, [0x005ff7ec]
mov r8, qword [rbp + 0x188]
call fcn.0040fef0
mov rcx, qword [rbp + 0x190]
call fcn.005f4e10
call fcn.00408a00
cmp eax, 1
jge 0x5fe238
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
call fcn.00408a00
cmp eax, 1
jne 0x5fe26c
lea rcx, [0x0063a8b8]
mov edx, 1
call fcn.00408a90
lea rcx, [0x0063ab00]
lea rdx, [0x005ff80c]
call fcn.0040e690
jmp 0x5fe375
call fcn.00408a00
cmp eax, 2
jne 0x5fe29f
lea rcx, [0x0063a8b8]
mov edx, 2
call fcn.00408a90
lea rcx, [0x0063ab00]
mov edx, 1
call fcn.00408a90
jmp 0x5fe375
call fcn.00408a00
cmp eax, 3
jne 0x5fe35d
lea rcx, [rbp + 0x2b8]
mov edx, 3
call fcn.00408a90
lea rcx, [rbp + 0x2b0]
lea rdx, [0x005ff820]
call fcn.0040e710
mov rax, qword [rbp + 0x2b8]
cmp rax, qword [rbp + 0x2b0]
jne 0x5fe2eb
mov byte [rbp + 0x2af], 1
jmp 0x5fe326
cmp qword [rbp + 0x2b8], 0
je 0x5fe2ff
cmp qword [rbp + 0x2b0], 0
jne 0x5fe308
mov byte [rbp + 0x2af], 0
jmp 0x5fe326
mov rcx, qword [rbp + 0x2b8]
mov rdx, qword [rbp + 0x2b0]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x2af], al
nop
cmp byte [rbp + 0x2af], 0
sete al
mov byte [0x0063ab18], al
lea rcx, [0x0063a8b8]
mov edx, 2
call fcn.00408a90
lea rcx, [0x0063ab00]
mov edx, 1
call fcn.00408a90
jmp 0x5fe375
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
mov rcx, qword [0x0063a8b8]
mov dl, 1
call fcn.004743c0
test al, al
jne 0x5fe3ab
lea rcx, [0x005ff844]
call fcn.005f4e10
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
mov byte [0x0063ab08], 0
call fcn.005f4d20
cmp dword [rax], 0xa
jne 0x5fe3d5
call fcn.005f4d20
cmp dword [rax + 4], 0
jne 0x5fe3d5
call fcn.005f4d20
cmp dword [rax + 8], 0x4563
je 0x5fe3da
xor rax, rax
jmp 0x5fe3dc
mov al, 1
mov byte [0x0063ab08], al
lea rcx, [0x005ff866]
call sub.kernel32.dll_OutputDebugStringW
lea rcx, [rbp + 0x180]
mov rdx, qword [0x0063a8b8]
call fcn.00474560
lea rcx, [rbp + 0x2a0]
mov rdx, qword [rbp + 0x180]
call fcn.0040e710
lea rcx, [rbp + 0x298]
lea rdx, [0x005ff8a0]
call fcn.0040e710
mov rax, qword [rbp + 0x2a0]
cmp rax, qword [rbp + 0x298]
jne 0x5fe440
mov byte [rbp + 0x297], 1
jmp 0x5fe47b
cmp qword [rbp + 0x2a0], 0
je 0x5fe454
cmp qword [rbp + 0x298], 0
jne 0x5fe45d
mov byte [rbp + 0x297], 0
jmp 0x5fe47b
mov rcx, qword [rbp + 0x2a0]
mov rdx, qword [rbp + 0x298]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x297], al
nop
cmp byte [rbp + 0x297], 0
jne 0x5fe59d
cmp byte [0x0063ab18], 0
je 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ff8b8]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ff900]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ff954]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ff9b4]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ff9ec]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ffa08]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ffa24]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ffa58]
call fcn.005f4930
test al, al
jne 0x5fe59d
mov rcx, qword [0x0063a8b8]
lea rdx, [0x005ffa84]
call fcn.005f4930
test al, al
jne 0x5fe59d
lea rcx, [0x005ffae4]
call sub.kernel32.dll_OutputDebugStringW
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
mov ecx, 0x104
lea rdx, [0x0063a8f0]
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x5fe5cb
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
lea rcx, [rbp + 0x178]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0x178]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [rbp + 0x178]
mov dl, 1
call fcn.004743c0
test al, al
je 0x5fe64b
lea rcx, [rbp + 0x170]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0x170]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [rbp + 0x170]
call fcn.0040fa90
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [rbp + 0x168]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0x168]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [0x005ebd98]
mov dl, 1
mov r8, qword [rbp + 0x168]
call fcn.005f04e0
mov qword [0x0063a8c0], rax
lea rcx, [rbp + 0x288]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x280]
lea rdx, [0x005ffb54]
call fcn.0040e710
mov rax, qword [rbp + 0x288]
cmp rax, qword [rbp + 0x280]
jne 0x5fe6d3
mov byte [rbp + 0x27f], 1
jmp 0x5fe70e
cmp qword [rbp + 0x288], 0
je 0x5fe6e7
cmp qword [rbp + 0x280], 0
jne 0x5fe6f0
mov byte [rbp + 0x27f], 0
jmp 0x5fe70e
mov rcx, qword [rbp + 0x288]
mov rdx, qword [rbp + 0x280]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x27f], al
nop
cmp byte [rbp + 0x27f], 0
je 0x5fe724
mov byte [rbp + 0x266], 1
jmp 0x5fe7ad
lea rcx, [rbp + 0x270]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x268]
lea rdx, [0x005ffb6c]
call fcn.0040e710
mov rax, qword [rbp + 0x270]
cmp rax, qword [rbp + 0x268]
jne 0x5fe763
mov byte [rbp + 0x267], 1
jmp 0x5fe79e
cmp qword [rbp + 0x270], 0
je 0x5fe777
cmp qword [rbp + 0x268], 0
jne 0x5fe780
mov byte [rbp + 0x267], 0
jmp 0x5fe79e
mov rcx, qword [rbp + 0x270]
mov rdx, qword [rbp + 0x268]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x267], al
nop
movzx rax, byte [rbp + 0x267]
mov byte [rbp + 0x266], al
cmp byte [rbp + 0x266], 0
je 0x5fe7c2
mov byte [rbp + 0x24e], 1
jmp 0x5fe84b
lea rcx, [rbp + 0x258]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x250]
push rax
add al, byte [rax]
add byte [rax - 0x73], cl
adc eax, 0x13b1
call fcn.0040e710
mov rax, qword [rbp + 0x258]
cmp rax, qword [rbp + 0x250]
jne 0x5fe801
mov byte [rbp + 0x24f], 1
jmp 0x5fe83c
cmp qword [rbp + 0x258], 0
je 0x5fe815
cmp qword [rbp + 0x250], 0
jne 0x5fe81e
mov byte [rbp + 0x24f], 0
jmp 0x5fe83c
mov rcx, qword [rbp + 0x258]
mov rdx, qword [rbp + 0x250]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x24f], al
nop
movzx rax, byte [rbp + 0x24f]
mov byte [rbp + 0x24e], al
cmp byte [rbp + 0x24e], 0
je 0x5fe89a
mov rcx, qword [0x0063a8b8]
call fcn.0040fa90
lea rcx, [rbp + 0x160]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [0x0063a8c0]
lea rdx, [0x005ffbc0]
lea r8, [0x005ffbe4]
mov r9, qword [rbp + 0x160]
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
jmp 0x5fe8de
mov rcx, qword [0x0063a8b8]
call fcn.0040fa90
lea rcx, [rbp + 0x158]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [0x0063a8c0]
lea rdx, [0x005ffc08]
lea r8, [0x005ffbe4]
mov r9, qword [rbp + 0x158]
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
mov rcx, qword [0x0063a8c0]
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 0xc0]
mov rcx, qword [0x0063a8c0]
call fcn.0040b2f0
lea rcx, [rbp + 0x148]
xor rdx, rdx
call fcn.00408a90
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x148]
call fcn.004744b0
lea rcx, [0x0063a8a0]
mov rdx, qword [rbp + 0x150]
lea r8, [0x005ffc28]
call fcn.0040fef0
lea rcx, [rbp + 0x138]
xor rdx, rdx
call fcn.00408a90
lea rcx, [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
call fcn.004744b0
lea rcx, [0x0063a8a0]
mov rdx, qword [rbp + 0x140]
lea r8, [0x005ffc50]
call fcn.0040fef0
mov rcx, qword [0x0063a8a0]
mov dl, 1
call fcn.004743c0
test al, al
jne 0x5fe9a3
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005ff548]
call fcn.0040d3b0
jmp 0x5ff548
mov ecx, 0xa
call sub.kernel32.dll_Sleep
mov rcx, qword [0x0063a8a0]
call fcn.0040fa90
mov qword [0x0063a898], rax
mov rax, qword [0x0063a898]
mov qword [rbp + 0x240], rax
mov rcx, qword [rbp + 0x240]
call fcn.0040e8a0
mov dword [rbp + 0x23c], eax
mov eax, dword [rbp + 0x23c]
add eax, 1
add eax, eax
mov dword [0x0063a8a8], eax
lea rcx, [0x005ffc66]
xor rdx, rdx
call sub.user32.dll_FindWindowW
mov rcx, rax
lea rdx, [0x0063a888]
call sub.user32.dll_GetWindowThreadProcessId
mov ecx, 0x2a
xor rdx, rdx
mov r8d, dword [0x0063a888]
call sub.kernel32.dll_OpenProcess
mov dword [0x0063a888], eax
cmp dword [0x0063a888], 0
jne 0x5fea94
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x128]
mov edx, eax
mov r8d, 8
call fcn.00473b90
lea rcx, [rbp + 0x130]
lea rdx, [0x005ffc90]
mov r8, qword [rbp + 0x128]
call fcn.0040fef0
mov rcx, qword [rbp + 0x130]
call fcn.0040fa90
lea rcx, [rbp + 0x120]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0x120]
call fcn.005f4e10
jmp 0x5ff441
mov ecx, dword [0x0063a888]
xor rdx, rdx
mov r8d, dword [0x0063a8a8]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [0x0063a8b0], rax
cmp qword [0x0063a8b0], 0
jne 0x5feb29
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x110]
mov edx, eax
mov r8d, 8
call fcn.00473b90
lea rcx, [rbp + 0x118]
lea rdx, [0x005ffcd0]
mov r8, qword [rbp + 0x110]
call fcn.0040fef0
mov rcx, qword [rbp + 0x118]
call fcn.0040fa90
lea rcx, [rbp + 0x108]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0x108]
call fcn.005f4e10
jmp 0x5ff441
mov ecx, dword [0x0063a888]
mov rdx, qword [0x0063a8b0]
mov r8, qword [0x0063a898]
mov r9d, dword [0x0063a8a8]
lea rax, [0x0063a890]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
setne al
test al, al
jne 0x5febbe
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0xf8]
mov edx, eax
mov r8d, 8
call fcn.00473b90
lea rcx, [rbp + 0x100]
lea rdx, [0x005ffd18]
mov r8, qword [rbp + 0xf8]
call fcn.0040fef0
mov rcx, qword [rbp + 0x100]
call fcn.0040fa90
lea rcx, [rbp + 0xf0]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0xf0]
call fcn.005f4e10
jmp 0x5ff441
lea rcx, [0x005ffd5a]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x005ffd74]
call fcn.00419bd0
mov ecx, dword [0x0063a888]
xor rdx, rdx
xor r8, r8
mov r9, rax
mov rax, qword [0x0063a8b0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rax, [0x0063a88c]
mov qword [rsp + 0x30], rax
call sub.kernel32.dll_CreateRemoteThread
mov qword [0x0063a8e8], rax
cmp qword [0x0063a8e8], 0
je 0x5ff3f8
lea rcx, [rbp + 0xe8]
lea rdx, [0x005ffd8e]
call fcn.0040fb30
mov rcx, qword [rbp + 0xe8]
call fcn.005f4e10
mov rcx, qword [0x0063a8e8]
mov edx, 0x3a98
call sub.kernel32.dll_WaitForSingleObject
mov ecx, dword [0x0063a888]
mov rdx, qword [0x0063a8b0]
xor r8, r8
mov r9d, 0x8000
call sub.kernel32.dll_VirtualFreeEx
mov rcx, qword [0x0063a8e8]
xor rdx, rdx
call sub.kernel32.dll_TerminateThread
lea rcx, [rbp + 0xe0]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0xe0]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [0x005ebd98]
mov dl, 1
mov r8, qword [rbp + 0xe0]
call fcn.005f04e0
mov qword [0x0063a8c0], rax
lea rcx, [rbp + 0x230]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x228]
lea rdx, [0x005ffdb8]
call fcn.0040e710
mov rax, qword [rbp + 0x230]
cmp rax, qword [rbp + 0x228]
jne 0x5fed06
mov byte [rbp + 0x227], 1
jmp 0x5fed41
cmp qword [rbp + 0x230], 0
je 0x5fed1a
cmp qword [rbp + 0x228], 0
jne 0x5fed23
mov byte [rbp + 0x227], 0
jmp 0x5fed41
mov rcx, qword [rbp + 0x230]
mov rdx, qword [rbp + 0x228]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x227], al
nop
cmp byte [rbp + 0x227], 0
je 0x5fed57
mov byte [rbp + 0x20e], 1
jmp 0x5fede0
lea rcx, [rbp + 0x218]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x210]
lea rdx, [0x005ffb6c]
call fcn.0040e710
mov rax, qword [rbp + 0x218]
cmp rax, qword [rbp + 0x210]
jne 0x5fed96
mov byte [rbp + 0x20f], 1
jmp 0x5fedd1
cmp qword [rbp + 0x218], 0
je 0x5fedaa
cmp qword [rbp + 0x210], 0
jne 0x5fedb3
mov byte [rbp + 0x20f], 0
jmp 0x5fedd1
mov rcx, qword [rbp + 0x218]
mov rdx, qword [rbp + 0x210]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x20f], al
nop
movzx rax, byte [rbp + 0x20f]
mov byte [rbp + 0x20e], al
cmp byte [rbp + 0x20e], 0
je 0x5fedf5
mov byte [rbp + 0x1f6], 1
jmp 0x5fee7e
lea rcx, [rbp + 0x200]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x1f8]
lea rdx, [0x005ff80c]
call fcn.0040e710
mov rax, qword [rbp + 0x200]
cmp rax, qword [rbp + 0x1f8]
jne 0x5fee34
mov byte [rbp + 0x1f7], 1
jmp 0x5fee6f
cmp qword [rbp + 0x200], 0
je 0x5fee48
cmp qword [rbp + 0x1f8], 0
jne 0x5fee51
mov byte [rbp + 0x1f7], 0
jmp 0x5fee6f
mov rcx, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x1f8]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x1f7], al
nop
movzx rax, byte [rbp + 0x1f7]
mov byte [rbp + 0x1f6], al
cmp byte [rbp + 0x1f6], 0
je 0x5fee93
mov byte [rbp + 0x1de], 1
jmp 0x5fef1c
lea rcx, [rbp + 0x1e8]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x1e0]
lea rdx, [0x005ffb54]
call fcn.0040e710
mov rax, qword [rbp + 0x1e8]
cmp rax, qword [rbp + 0x1e0]
jne 0x5feed2
mov byte [rbp + 0x1df], 1
jmp 0x5fef0d
cmp qword [rbp + 0x1e8], 0
je 0x5feee6
cmp qword [rbp + 0x1e0], 0
jne 0x5feeef
mov byte [rbp + 0x1df], 0
jmp 0x5fef0d
mov rcx, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1e0]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x1df], al
nop
movzx rax, byte [rbp + 0x1df]
mov byte [rbp + 0x1de], al
cmp byte [rbp + 0x1de], 0
je 0x5fefb4
mov rcx, qword [0x0063a8c0]
lea rdx, [rbp + 0xd8]
lea r8, [0x005ffddc]
lea r9, [0x005ffdfc]
mov qword [rsp + 0x20], 0
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [0x0063a8d0]
mov rdx, qword [rbp + 0xd8]
call fcn.0040e690
lea rcx, [rbp + 0xd0]
mov rdx, qword [0x0063ab00]
lea r8, [0x005ffe28]
call fcn.0040fef0
mov rcx, qword [rbp + 0xd0]
call fcn.0040fa90
lea rcx, [rbp + 0xc8]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0xc8]
call fcn.005f4e10
jmp 0x5ff180
lea rcx, [rbp + 0x1d0]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x1c8]
lea rdx, [0x005ffe58]
call fcn.0040e710
mov rax, qword [rbp + 0x1d0]
cmp rax, qword [rbp + 0x1c8]
jne 0x5feff3
mov byte [rbp + 0x1c7], 1
jmp 0x5ff02e
cmp qword [rbp + 0x1d0], 0
je 0x5ff007
cmp qword [rbp + 0x1c8], 0
jne 0x5ff010
mov byte [rbp + 0x1c7], 0
jmp 0x5ff02e
mov rcx, qword [rbp + 0x1d0]
mov rdx, qword [rbp + 0x1c8]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x1c7], al
nop
cmp byte [rbp + 0x1c7], 0
je 0x5ff044
mov byte [rbp + 0x1ae], 1
jmp 0x5ff0cd
lea rcx, [rbp + 0x1b8]
mov rdx, qword [0x0063ab00]
call fcn.0040e710
lea rcx, [rbp + 0x1b0]
lea rdx, [0x005ffb94]
call fcn.0040e710
mov rax, qword [rbp + 0x1b8]
cmp rax, qword [rbp + 0x1b0]
jne 0x5ff083
mov byte [rbp + 0x1af], 1
jmp 0x5ff0be
cmp qword [rbp + 0x1b8], 0
je 0x5ff097
cmp qword [rbp + 0x1b0], 0
jne 0x5ff0a0
mov byte [rbp + 0x1af], 0
jmp 0x5ff0be
mov rcx, qword [rbp + 0x1b8]
mov rdx, qword [rbp + 0x1b0]
call fcn.00472c30
test eax, eax
sete al
mov byte [rbp + 0x1af], al
nop
movzx rax, byte [rbp + 0x1af]
mov byte [rbp + 0x1ae], al
cmp byte [rbp + 0x1ae], 0
je 0x5ff174
mov rcx, qword [0x0063a8c0]
lea rdx, [rbp + 0xc0]
lea r8, [0x005ffddc]
lea r9, [0x005ffe80]
mov qword [rsp + 0x20], 0
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [0x0063a8d0]
mov rdx, qword [rbp + 0xc0]
call fcn.0040e690
lea rcx, [rbp + 0xb8]
mov edx, 3
mov r8, qword [0x0063ab00]
lea r9, [0x005ffeb0]
mov rax, qword [0x0063a8d0]
mov qword [rsp + 0x20], rax
call fcn.00410010
mov rcx, qword [rbp + 0xb8]
call fcn.0040fa90
lea rcx, [rbp + 0xb0]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0xb0]
call fcn.005f4e10
jmp 0x5ff180
lea rcx, [0x0063a8d0]
call fcn.0040e060
mov rcx, qword [0x0063a8c0]
lea rdx, [rbp + 0xa8]
lea r8, [0x005ffee4]
lea r9, [0x005fff0c]
mov qword [rsp + 0x20], 0
mov rax, qword [0x0063a8c0]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [0x0063a8d8]
mov rdx, qword [rbp + 0xa8]
call fcn.0040e690
cmp qword [0x0063a8d0], 0
jne 0x5ff1ec
mov rcx, qword [0x0046aa50]
mov dl, 1
lea r8, [0x005fff2c]
call fcn.0047c560
mov rcx, rax
call fcn.0040d200
mov rcx, qword [0x0063a8d0]
call fcn.00473c60
mov qword [0x0063a8c8], rax
mov rcx, qword [0x0063a8d8]
call fcn.00473bb0
movsxd rax, eax
mov qword [0x0063a8e0], rax
mov rcx, qword [0x0063a8c0]
call fcn.0040b2f0
lea rcx, [0x005fff5c]
call fcn.005f4e10
mov ecx, 0x1e
call sub.kernel32.dll_Sleep
mov ecx, dword [0x0063a888]
xor rdx, rdx
xor r8, r8
mov r9, qword [0x0063a8c8]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
lea rax, [0x0063a88c]
mov qword [rsp + 0x30], rax
call sub.kernel32.dll_CreateRemoteThread
mov qword [0x0063a8e8], rax
cmp qword [0x0063a8e8], 0
je 0x5ff3a1
mov rcx, qword [0x0063a8e8]
mov edx, 0x3a98
call sub.kernel32.dll_WaitForSingleObject
lea rcx, [rbp + 0xa0]
lea rdx, [0x005fff88]
call fcn.0040fb30
mov rcx, qword [rbp + 0xa0]
call fcn.005f4e10
mov rcx, qword [0x0063a8e8]
xor rdx, rdx
call sub.kernel32.dll_TerminateThread
mov dword [0x0063a8a8], 0xc
lea rcx, [0x005ffd5a]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x005fffc6]
call fcn.00419bd0
mov ecx, dword [0x0063a888]
xor rdx, rdx
xor r8, r8
mov r9, rax
mov rax, qword [0x0063a8e0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rax, [0x0063a88c]
mov qword [rsp + 0x30], rax
call sub.kernel32.dll_CreateRemoteThread
mov qword [0x0063a8e8], rax
cmp qword [0x0063a8e8], 0
je 0x5ff37d
lea rcx, [rbp + 0x98]
lea rdx, [0x005fffde]
call fcn.0040fb30
mov rcx, qword [rbp + 0x98]
call fcn.005f4e10
mov rcx, qword [0x0063a8e8]
mov edx, 0x3a98
call sub.kernel32.dll_WaitForSingleObject
mov rcx, qword [0x0063a8e8]
xor rdx, rdx
call sub.kernel32.dll_TerminateThread
lea rcx, [0x005fffde]
call sub.kernel32.dll_OutputDebugStringW
jmp 0x5ff441
lea rcx, [rbp + 0x90]
lea rdx, [0x00600014]
call fcn.0040fb30
mov rcx, qword [rbp + 0x90]
call fcn.005f4e10
jmp 0x5ff441
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x80]
mov edx, eax
mov r8d, 8
call fcn.00473b90
lea rcx, [rbp + 0x88]
lea rdx, [0x00600048]
mov r8, qword [rbp + 0x80]
call fcn.0040fef0
mov rcx, qword [rbp + 0x88]
call fcn.0040fa90
lea rcx, [rbp + 0x78]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0x78]
call fcn.005f4e10
jmp 0x5ff441
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x68]
mov edx, eax
mov r8d, 8
call fcn.00473b90
lea rcx, [rbp + 0x70]
lea rdx, [0x00600048]
mov r8, qword [rbp + 0x68]
call fcn.0040fef0
mov rcx, qword [rbp + 0x70]
call fcn.0040fa90
lea rcx, [rbp + 0x60]
mov rdx, rax
call fcn.0040fb30
mov rcx, qword [rbp + 0x60]
call fcn.005f4e10
mov ecx, 0x1e
call sub.kernel32.dll_Sleep
cmp dword [0x0063a888], 0
jbe 0x5ff460
mov ecx, dword [0x0063a888]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x58]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0x58]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [rbp + 0x58]
mov dl, 1
call fcn.004743c0
test al, al
je 0x5ff4ce
lea rcx, [rbp + 0x50]
lea rdx, [0x0063a8f0]
mov r8d, 0x105
call fcn.0040fb90
lea rcx, [rbp + 0x50]
lea rdx, [0x005ffb34]
call fcn.0040fe00
mov rcx, qword [rbp + 0x50]
call fcn.0040fa90
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [0x00600098]
call fcn.005f4e10
jmp 0x5ff547
nop
lea rcx, [rbp + 0x40]
mov edx, 0x2b
call fcn.0040e140
lea rcx, [rbp + 0x1b0]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x1c8]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x1e0]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x1f8]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x210]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x228]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x250]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x268]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x280]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x298]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x2b0]
mov edx, 2
call fcn.0040e140
call fcn.0040dbd0
jmp 0x5ff62c
lea rsp, [rbp + 0x2c8]
pop rbx
pop rbp
ret