Function at 0x140003ab0
Capabilities:
Clear windows event logs
Create a process with modified i/o handles and window
Create process on windows
Empty the recycle bin
Get common file path
Get session user name
Get startup folder
Open clipboard
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x2d8]
sub rsp, 0x3d0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140046bc0], rax
lea rdx, [0x140046bd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [0x140046be0]
mov word [0x140046bc8], ax
lea rcx, str.Cleaner_2024_64_bits.
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [0x140045580]
call fcn.1400093f0
xorps xmm6, xmm6
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003b65
mov dword [rbp], 0x11c
lea rcx, [rbp]
call rax
mov eax, dword [rbp + 4]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
cvttsd2si eax, xmm6
cmp eax, 0xa
jne 0x140004e0b
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor edi, edi
mov rbx, 0xffffffffffffffff
test eax, eax
js 0x140003cc8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140003bd2
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
mov r8d, 5
lea rdx, str.Temp
lea rcx, [rsp + 0x50]
call fcn.140008070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003cd7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004f98
call fcn.14000cb90
jmp 0x140003cd7
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
xor edx, edx
xor ecx, ecx
mov r8d, 7
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Emptying_the_Trash
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_SysMain]
movups xmmword [rbp + 0x120], xmm1
movsd xmm0, qword [0x14003d5d0]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x14003d5d8]
mov dword [rbp + 0x138], eax
movzx eax, byte [0x14003d5dc]
mov byte [rbp + 0x13c], al
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140003ef2
movsd xmm0, qword [str.Prefetch]
movsd qword [rbp + 0x140], xmm0
movzx eax, word [0x14003d5e8]
mov word [rbp + 0x148], ax
mov r8d, 0xa
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x150]
call fcn.1400169e0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140002cf0
jmp 0x140003f01
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Emptying_the_clipboard.
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x78], 0x101
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov r8d, 9
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
lea rax, [rbp + 0x150]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003fd0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140008070
mov r8d, 0xa
lea rdx, str.Downloads
lea rcx, [rsp + 0x50]
call fcn.140008070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400040c4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004f9e
call fcn.14000cb90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__net_stop_wuauserv]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d600]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d608]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d60c]
mov word [rsp + 0x6c], ax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004267
movups xmm0, xmmword [str.SoftwareDistribution]
movups xmmword [rsp + 0x70], xmm0
mov eax, dword [0x14003d620]
mov dword [rbp - 0x80], eax
movzx eax, word [0x14003d624]
mov word [rbp - 0x7c], ax
mov r8d, 0x16
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x150]
call fcn.1400169e0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140002cf0
jmp 0x140004276
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140002cf0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmm1, xmmword [str.cmd.exe__C__wevtutil_cl_System]
movups xmmword [rbp + 0x120], xmm1
movsd xmm0, qword [0x14003d7b0]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x14003d7b8]
mov dword [rbp + 0x138], eax
movzx eax, word [0x14003d7bc]
mov word [rbp + 0x13c], ax
movzx eax, byte [0x14003d7be]
mov byte [rbp + 0x13e], al
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Setup]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14003d7d0]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d7d8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d7dc]
mov word [rsp + 0x6c], ax
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Security]
movups xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [0x14003d7f0]
movups xmmword [rbp + 0x270], xmm1
movzx eax, byte [0x14003d800]
mov byte [rbp + 0x280], al
movups xmm0, xmmword [str.cmd.exe__C__wevtutil_cl_Application]
movups xmmword [rbp + 0x288], xmm0
movups xmm1, xmmword [0x14003d818]
movups xmmword [rbp + 0x298], xmm1
mov eax, dword [0x14003d828]
mov dword [rbp + 0x2a8], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x288]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_cleared_windows_event_logs
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmm1, xmmword [str.cmd.exe__C__ipconfig__flushdns]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x14003d700]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14003d708]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14003d70c]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x14003d70e]
mov byte [rsp + 0x6e], al
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_flushed_the_DNS_Resolver_Cache.
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140002fc0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x22
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14000472e
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x150]
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x150]
call fcn.140002cf0
jmp 0x14000473d
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14000488b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140004794
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsWebCache
lea rcx, [rsp + 0x50]
call fcn.140008070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000489a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fa4
call fcn.14000cb90
jmp 0x14000489a
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400049e8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400048f1
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsExplorer
lea rcx, [rsp + 0x50]
call fcn.140008070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400049f7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004faa
call fcn.14000cb90
jmp 0x1400049f7
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x20
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004b30
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140004a50
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004b3f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fb0
call fcn.14000cb90
jmp 0x140004b3f
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
call fcn.1400033b0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x21
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004ba0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004c8f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fb6
call fcn.14000cb90
jmp 0x140004c8f
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
call fcn.1400035f0
call fcn.140003850
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400304a0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004dfc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rbp + 0x150]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004cf0
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.140009850
nop
mov r8d, 0x2e
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rsp + 0x50]
call fcn.140008070
mov edx, 0xa
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______
lea rcx, [0x140045580]
call fcn.140009140
mov edx, 6
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
call fcn.14000b0c0
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.140002cf0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004de7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004de2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004f92
call fcn.14000cb90
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
jmp 0x140004e0b
mov edx, eax
call fcn.1400051c0
mov rcx, rax
call fcn.1400093f0
mov edx, 0xb
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14003d53d]
lea rcx, [0x140045580]
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140009140
mov rdx, qword [0x140046bd0]
mov rcx, rax
call fcn.140004fc0
mov rcx, rax
lea rdx, str._bytes.
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140009140
mov rdx, qword [0x140046bd0]
shr rdx, 0xa
mov rcx, rax
call fcn.140004fc0
mov rcx, rax
lea rdx, str._kilobytes.
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140009140
mov rdx, qword [0x140046bd0]
shr rdx, 0x14
mov rcx, rax
call fcn.140004fc0
mov rcx, rax
lea rdx, str._megabytes.
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
lea rdx, str._File_Size
lea rcx, [0x140045580]
call fcn.140009140
mov rdx, qword [0x140046bd0]
shr rdx, 0x1e
mov rcx, rax
call fcn.140004fc0
mov rcx, rax
lea rdx, str._gigabytes.
call fcn.140009140
mov rcx, rax
call fcn.1400093f0
movzx edx, word [0x140046bc8]
mov rcx, qword [0x140046bc0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140045580]
call fcn.1400093f0
lea rdx, [0x14003d96c]
lea rcx, [0x140045580]
call fcn.140009140
lea rcx, str.Pause
call fcn.140015bec
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14000cb70
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.1400175e8
int3
call fcn.1400175e8
int3
call fcn.1400175e8
int3
call fcn.1400175e8
int3
call fcn.1400175e8
int3
call fcn.1400175e8
int3
call fcn.1400175e8
int3