Function at 0x140001290
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create process suspended
Execute command
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rbp - 0x70], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r12b
lea rdx, str.Input_id:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c40
lea rdx, [rbp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003e20
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], r14b
lea rdx, str.Input_Install_Path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c40
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003e20
lea rcx, str.install
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000239f
test al, 0x10
je 0x14000239f
lea rax, [0x1400065f8]
mov qword [rbp + 0x1c0], rax
lea rax, str.libcurl.dll
mov qword [rbp + 0x1c8], rax
lea rax, str.zlib1.dll
mov qword [rbp + 0x1d0], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r14b
lea rbx, [rbp + 0x1c0]
nop dword [rax]
mov r8d, 8
lea rcx, [rbp]
call fcn.1400039c0
mov rdi, qword [rbx]
mov rdx, rdi
lea rcx, [rbp]
call fcn.1400034d0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call fcn.1400025a0
mov r13, 0xffffffffffffffff
test al, al
je 0x140002313
add rbx, 8
lea rax, [rbp + 0x1d8]
cmp rbx, rax
jne 0x1400013b0
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rsi, qword [rbp - 0x20]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000146d
test al, 0x10
jne 0x1400014ea
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rsi, qword [rbp - 0x20]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400014ea
lea rdx, str.Couldnt_create_installation_dir
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x14000232c
lea r15, [rbp + 0x1c0]
mov r8d, 8
lea rcx, [rbp]
call fcn.1400039c0
mov rax, qword [r15]
mov qword [rbp - 0x70], rax
mov rdx, rax
lea rcx, [rbp]
call fcn.1400034d0
mov r14, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x140002495
lea r13, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r13, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x1400015dd
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001585
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400015b1
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x1400015d5
cmp rcx, 0x1000
jb 0x1400015d0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400024ad
mov rcx, rax
call fcn.140004760
test rax, rax
je 0x14000186c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400015d8
call fcn.140004760
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x140006664]
mov byte [rdi + r14], cl
mov byte [rdi + rsi], 0
or r12d, 8
mov rdx, qword [r15]
lea rcx, [rsp + 0x50]
call fcn.1400034d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor ecx, ecx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
or r12d, 0x10
lea rdi, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdi, qword [rsp + 0x70]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r13, 0xffffffffffffffff
mov r9d, r13d
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov r14, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rsi, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rsi, qword [rbp]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, 1
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000175c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001757
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001865
call fcn.14000479c
xor r14d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400017ad
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000186c
call fcn.14000479c
test ebx, ebx
je 0x1400022a8
add r15, 8
lea rax, [rbp + 0x1d8]
cmp r15, rax
jne 0x1400014f1
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x1400024a7
lea r15, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r15, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r14, [rsi + 1]
mov edi, 0xf
lea rbx, [rsp + 0x70]
cmp r14, rdi
jbe 0x1400018b9
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001873
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004760
test rax, rax
je 0x1400018a5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400018b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14000188d
xor ebx, ebx
jmp 0x1400018b4
cmp rcx, 0x1000
jb 0x1400018ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000249b
jmp 0x14000184a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004760
mov rbx, rax
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x140006664]
mov byte [rbx + rsi], cl
mov byte [rbx + r14], 0
or r12d, 0x20
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x70]
cmp rax, 2
jb 0x140001924
lea rax, [rdx + 2]
mov qword [rbp - 0x80], rax
cmp r8, 0xf
cmova rcx, qword [rsp + 0x70]
movzx eax, word [0x140006680]
mov word [rcx + rdx], ax
mov byte [rcx + rdx + 2], 0
lea rax, [rsp + 0x70]
jmp 0x14000193e
mov qword [rsp + 0x20], 2
lea r9, [0x140006680]
mov edx, 2
call fcn.1400042c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
or r12d, 0x40
lea rbx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rbx, qword [rbp - 0x68]
lea rax, [0x1400067c0]
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts r12d, 7
mov dword [rbp - 0x70], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rsi
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x48], rax
mov byte [rbp + 0xc4], dil
mov byte [rbp + 0xb9], dil
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xc8], rdi
mov rax, qword [0x14000aa00]
mov qword [rbp + 0xbc], rax
mov qword [rbp + 0xb0], rdi
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.140003880
test rax, rax
jne 0x140001a5a
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x40], rsi
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001ab7
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001b06
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.140004510
lea rcx, [rbp + 0x48]
call fcn.1400037c0
test rax, rax
jne 0x140001b5d
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rsi, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 8
jb 0x1400024b3
lea r15, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r15, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea r14, [rsi + 8]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x140001c29
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001bea
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004760
test rax, rax
je 0x140001d03
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001c24
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001c04
xor edi, edi
jmp 0x140001c24
cmp rcx, 0x1000
jb 0x140001c1c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400024a1
jmp 0x140001bcb
call fcn.140004760
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [str.RAN.EXE]
mov qword [rdi + rsi], rcx
mov byte [rdi + r14], 0
or r12d, 4
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rsi, qword [rsp + 0x50]
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r9d, r9d
lea r8, [rbp + 0x1e0]
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001d0f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
lea r8, [rbp + 0x1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
lea ecx, [rbx + 1]
movsxd rcx, ecx
call fcn.1400047a4
mov rsi, rax
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rbp + 0x1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rbx + rsi], 0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001e40
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140006700]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 8
jb 0x1400024cb
lea r15, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r15, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r14, [rsi + 8]
mov edi, 0xf
lea rbx, [rsp + 0x50]
cmp r14, rdi
jbe 0x140001f0c
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001eb0
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001ee0
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001eca
xor ebx, ebx
jmp 0x140001f07
cmp rcx, 0x1000
jb 0x140001eff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400024b9
mov rcx, rax
call fcn.140004760
test rax, rax
je 0x140001f96
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001f07
call fcn.140004760
mov rbx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [str.RAN.exe]
mov qword [rbx + rsi], rcx
mov byte [rbx + r14], 0
or r12d, 2
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400025a0
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001f8a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f96
call fcn.14000479c
test bl, bl
jne 0x140001fa0
xor r14d, r14d
jmp 0x140001e40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rsi, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 3
jb 0x1400024c5
lea r15, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r15, qword [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea r14, [rsi + 3]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x14000206a
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002012
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000203e
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x140002062
cmp rcx, 0x1000
jb 0x14000205d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400024bf
mov rcx, rax
call fcn.140004760
test rax, rax
je 0x1400022a1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002065
call fcn.140004760
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140006714]
mov word [rdi + rsi], ax
movzx eax, byte [0x140006716]
mov byte [rdi + rsi + 2], al
mov byte [rdi + r14], 0
or r12d, 1
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.1400025a0
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400020f6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400022a1
call fcn.14000479c
test bl, bl
je 0x140001fa0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
movups xmmword [rbp + 0x184], xmm0
movups xmmword [rbp + 0x194], xmm0
movups xmmword [rbp + 0x1a4], xmm0
mov dword [rbp + 0x1b4], eax
mov dword [rbp + 0x150], 0x68
xor ecx, ecx
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r13
mov rcx, rax
call fcn.1400047a4
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, qword [rbp - 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000008
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r13d, r14d
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0xc8], r14
je 0x140002268
lea rcx, [rbp + 0xb8]
mov rax, qword [rbp + 0x60]
cmp qword [rax], rcx
jne 0x140002268
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
mov qword [rax], rcx
mov rax, qword [rbp + 0x80]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x98]
mov dword [rax], edx
cmp byte [rbp + 0xc4], 0
je 0x14000227a
lea rcx, [rbp + 0x48]
call fcn.1400037c0
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14000234f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.Couldnt_copy
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c40
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rax
call fcn.140004510
lea rdx, str._to
mov rcx, rax
call fcn.140003c40
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140004510
lea rdx, [0x140006664]
mov rcx, rax
call fcn.140003c40
mov rdx, qword [rbp - 0x70]
jmp 0x140002329
lea rdx, str.Couldnt_find
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c40
mov rdx, rdi
mov rcx, rax
call fcn.140003c40
lea rdx, [0x140004000]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000238d
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002388
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002388
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
jmp 0x1400023d6
lea rdx, str.Couldnt_find_install_folder
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c40
lea rdx, [0x140004000]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r13, 0xffffffffffffffff
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002414
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000240f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000240f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140002462
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000245d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000245d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000479c
mov eax, r13d
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140004740
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
int3
call fcn.140001110
nop
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3