Function at 0x140003180
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Empty the recycle bin
Get common file path
Get session user name
Open clipboard
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140046bc0], rax
lea rdx, [0x140046bd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [0x140046be0]
mov word [0x140046bc8], ax
lea rcx, str.Cleaner_2024_64_bits.
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 4
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_Cleaner_2024_64_bits.__n
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000427e
mov dword [rbp], 0x11c
lea rcx, [rbp]
call rax
mov eax, dword [rbp + 4]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
cvttsd2si eax, xmm0
cmp eax, 0xa
jne 0x14000427e
call fcn.140002d90
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140004430
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor edi, edi
mov rbx, 0xffffffffffffffff
test eax, eax
js 0x140003456
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140003360
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
mov r8d, 5
lea rdx, str.Temp
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003465
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000344f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004402
call fcn.14000c220
jmp 0x140003465
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x22
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003510
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140004430
jmp 0x14000351f
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_SysMain]
movups xmmword [rbp + 0x120], xmm1
movsd xmm0, qword [0x14003d600]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x14003d608]
mov dword [rbp + 0x138], eax
movzx eax, byte [0x14003d60c]
mov byte [rbp + 0x13c], al
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400036c4
movsd xmm0, qword [str.Prefetch]
movsd qword [rbp + 0x140], xmm0
movzx eax, word [0x14003d618]
mov word [rbp + 0x148], ax
mov r8d, 0xa
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x150]
call fcn.140016070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140004430
jmp 0x1400036d3
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_wuauserv]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d630]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d638]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d63c]
mov word [rsp + 0x6c], ax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003876
movups xmm0, xmmword [str.SoftwareDistribution]
movups xmmword [rsp + 0x78], xmm0
mov eax, dword [0x14003d650]
mov dword [rbp - 0x78], eax
movzx eax, word [0x14003d654]
mov word [rbp - 0x74], ax
mov r8d, 0x16
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x150]
call fcn.140016070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140004430
jmp 0x140003885
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xor edx, edx
xor ecx, ecx
mov r8d, 7
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Emptying_the_Trash
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x70], 0x101
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8d, 9
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003950
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov r8d, 0x2b
lea rdx, str.AppDataLocalLowSunJavaDeploymentcache
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003a44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004408
call fcn.14000c220
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003b97
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003aa0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsExplorer
lea rcx, [rsp + 0x50]
call fcn.1400075f0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003ba6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000440e
call fcn.14000c220
jmp 0x140003ba6
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003cf7
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003c00
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
mov r8d, 0x2e
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003d06
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004414
call fcn.14000c220
jmp 0x140003d06
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__ipconfig__flushdns]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d6f0]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d6f8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d6fc]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x14003d6fe]
mov byte [rsp + 0x6e], al
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_flushed_the_DNS_Resolver_Cache.
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x70], 0x101
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8d, 9
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
lea rax, [rbp + 0x150]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003e80
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov r8d, 0xa
lea rdx, str.Downloads
lea rcx, [rsp + 0x50]
call fcn.1400075f0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003f74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000441a
call fcn.14000c220
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400040b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003fd0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400040bf
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004420
call fcn.14000c220
jmp 0x1400040bf
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.14002fb30
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x21
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400041f5
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004113
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008ee0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140004430
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000a750
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004204
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400043fc
call fcn.14000c220
jmp 0x140004204
mov edx, eax
call fcn.140004850
mov rcx, rax
call fcn.140008a80
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__OK__
lea rcx, [0x140045580]
call fcn.1400087d0
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Empty_Clipboard_Function.
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xb
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14003d53d]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.1400087d0
mov rdx, qword [0x140046bd0]
mov rcx, rax
call fcn.140004650
mov rcx, rax
lea rdx, str._bytes.
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.1400087d0
mov rdx, qword [0x140046bd0]
shr rdx, 0xa
mov rcx, rax
call fcn.140004650
mov rcx, rax
lea rdx, str._kilobytes.
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.1400087d0
mov rdx, qword [0x140046bd0]
shr rdx, 0x14
mov rcx, rax
call fcn.140004650
mov rcx, rax
lea rdx, str._megabytes.
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.1400087d0
mov rdx, qword [0x140046bd0]
shr rdx, 0x1e
mov rcx, rax
call fcn.140004650
mov rcx, rax
lea rdx, str._gigabytes.
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14003d53d]
lea rcx, [0x140045580]
call fcn.1400087d0
mov rcx, rax
call fcn.140008a80
lea rcx, str.Pause
call fcn.14001527c
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14000c200
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140016c78
int3
call fcn.140016c78
int3
call fcn.140016c78
int3
call fcn.140016c78
int3
call fcn.140016c78
int3
call fcn.140016c78
int3
call fcn.140016c78
int3