Function at 0x140002c1c
Capabilities:
Check os version
Copy file
Create directory
Delete file
Get common file path
Move file
Persist via lnk shortcut
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x6b0
mov qword [rsp + 0x168], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140050110]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov ebp, edx
mov rbx, rcx
call fcn.14000a988
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140002c78
mov ecx, 0x80004005
call fcn.140001478
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.14000a988
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140002ca9
mov ecx, 0x80004005
call fcn.140001478
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.14000a988
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140002cda
mov ecx, 0x80004005
call fcn.140001478
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r15d, 0x32
test ebp, ebp
jne 0x140002d10
lea rdx, str.Copy_files...
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [0x140056a00]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Defender.exe
lea r12, [0x1400569f8]
mov rdx, r12
lea rcx, [rsp + 0x158]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
or r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002d74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Defender.exe
lea rsi, [0x140056a00]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002dbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, 0x402
test ebp, ebp
jne 0x140002df7
xor r9d, r9d
lea r8d, [rbp + 0xa]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Daemon.exe
mov rdx, r12
lea rcx, [rsp + 0xf8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002e41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.DefenderDaemon.exe
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002e85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x140002eb8
xor r9d, r9d
lea r8d, [rbp + 0x14]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Commit.exe
mov rdx, r12
lea rcx, [rsp + 0x150]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002f02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Commit.exe
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002f4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, str.CmdTool.exe
mov rdx, r12
lea rcx, [rsp + 0x108]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002fa9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.CmdTool.exe
mov rdx, rsi
lea rcx, [rsp + 0x98]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140002ff3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x140003026
xor r9d, r9d
lea r8d, [rbp + 0x1e]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.ShellExt.dll
mov rdx, r12
lea rcx, [rsp + 0x148]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003070
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.ShellExt.dll
mov rdx, rsi
lea rcx, [rsp + 0xa8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400030ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdi, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000313f
lea r8, str..del
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140004428
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000311e
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000313f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebp, ebp
jne 0x140003166
xor r9d, r9d
mov edi, 0x402
lea r8d, [rbp + 0x28]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000316b
mov edi, 0x402
lea r8, str._res.ini
mov rdx, r12
lea rcx, [rsp + 0x118]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400031b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str._res.ini
mov rdx, rsi
lea rcx, [rsp + 0xb8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400031ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, str.CmdTool.txt
mov rdx, r12
lea rcx, [rsp + 0x160]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x160]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000325c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.CmdTool.txt
mov rdx, rsi
lea rcx, [rsp + 0xc8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400032a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x1400032d8
xor r9d, r9d
mov r8, r15
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Help.chm
mov rdx, r12
lea rcx, [rsp + 0x128]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003322
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Help.chm
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000336c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x14000339f
xor r9d, r9d
lea r8d, [rbp + 0x3c]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.eula.rtf
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400033e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.eula.rtf
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000342d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x140003460
xor r9d, r9d
lea r8d, [rbp + 0x46]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x170], 0x114
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x174], 5
jne 0x1400035cc
cmp dword [rsp + 0x178], 0
jne 0x1400035cc
lea r8, str.diskpt2k.sys
mov rdx, r12
lea rcx, [rsp + 0x138]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400034df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.driversdiskpt.sys
lea rdx, [0x140056a08]
lea rcx, [rsp + 0x60]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003527
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140003703
xor r8d, r8d
xor edx, edx
lea rcx, str.Copy_file_failed_
call fcn.14000a4d8
mov esi, 1
mov dword [0x1400569d4], esi
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003580
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400035a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400040e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400040e9
lea r8, str.diskpt.sys
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003610
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.driversdiskpt.sys
lea rdx, [0x140056a08]
lea rcx, [rsp + 0x80]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000365e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140003703
xor r8d, r8d
xor edx, edx
lea rcx, str.Copy_file_failed_
call fcn.14000a4d8
mov esi, 1
mov dword [0x1400569d4], esi
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400036b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400036d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400040e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400040e9
lea r8, str.Uninstall.exe
mov rdx, r12
lea rcx, [rsp + 0x90]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000374d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Uninstall.exe
mov rdx, rsi
lea rcx, [rsp + 0xa0]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003797
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test ebp, ebp
jne 0x1400037e4
xor r9d, r9d
lea r8d, [rbp + 0x50]
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Creating_registry_entries...
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.SYSTEM32driversdiskpt.sys
mov edx, 0x100
lea rcx, [rsp + 0x290]
call fcn.14001d538
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
lea esi, [rax + 1]
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.ImagePath
lea r12, str.SYSTEMCurrentControlSetServicesdiskpt
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea r8, str.System_Bus_Extender
mov edx, 0x100
lea rcx, [rsp + 0x290]
call fcn.14001d538
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.Group
mov rdx, r12
mov rdi, 0xffffffff80000002
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x48], 0x10000001
lea ecx, [rsi + 3]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.Control
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x48], esi
lea ecx, [rsi + 3]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.ErrorControl
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
and dword [rsp + 0x48], 0
lea ecx, [rsi + 3]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.Start
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x48], esi
lea ecx, [rsi + 3]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.Type
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x20], rdx
mov r12d, 0xf003f
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003995
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400039a9
lea rdx, [rsp + 0xb0]
lea rcx, str.UpperFilters
call fcn.140002444
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400039da
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400039ee
lea rdx, [rsp + 0xc0]
lea rcx, str.LowerFilters
call fcn.140002444
xor eax, eax
mov rcx, r13
mov rdx, qword [0x140056a00]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
lea edi, [rcx + rcx + 2]
cmp dword [rdx - 8], esi
jle 0x140003a2a
mov edx, dword [rdx - 0x10]
lea r12, [0x140056a00]
mov rcx, r12
call fcn.140001324
mov rdx, qword [0x140056a00]
jmp 0x140003a31
lea r12, [0x140056a00]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdx
mov r9d, esi
lea r8, str.Path
lea rdx, str.SOFTWAREShadow_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea r8, str.http:__www.shadowdefender.com_purchase.php_sid1
mov edx, 0x100
lea rcx, [rsp + 0x290]
call fcn.14001d538
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.RegURL
lea rdx, str.SOFTWAREShadow_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov r9, qword [0x140056a00]
lea r8, str.__sDefenderDaemon.exe___Auto
mov edx, 0x100
lea rcx, [rsp + 0x290]
call fcn.14001d240
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.Shadow_Defender_Daemon
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
test ebp, ebp
jne 0x140003b57
xor r9d, r9d
mov edx, 0x402
lea r8d, [rbp + 0x5a]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Initializing_the_environment...
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001a44
test ebp, ebp
jne 0x140003b99
xor r9d, r9d
mov edx, 0x402
lea r8d, [rbp + 0x5f]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Creating_shortcuts...
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140056a20]
call fcn.1400082c0
lea r8, str.Defender.exe
mov rdx, r12
lea rcx, [rsp + 0xd0]
call fcn.140004428
nop
mov rdx, rax
lea rdi, [0x140056a18]
mov rcx, rdi
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003bf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Shadow_Defender.lnk
lea rdx, [0x140056a20]
lea rcx, [rsp + 0xe0]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003c42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x40]
mov rdx, qword [0x140056a00]
mov rcx, qword [0x140056a18]
call fcn.14000234c
lea r8, str.Help.chm
mov rdx, r12
lea rcx, [rsp + 0xf0]
call fcn.140004428
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003ca2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Help.lnk
lea rdx, [0x140056a20]
lea rcx, [rsp + 0x100]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003cf0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x40]
mov rdx, qword [0x140056a00]
mov rcx, qword [0x140056a18]
call fcn.14000234c
lea r8, str.Uninstall.exe
mov rdx, r12
lea rcx, [rsp + 0x110]
call fcn.140004428
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003d50
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Uninstall_Shadow_Defender.lnk
lea rdx, [0x140056a20]
lea rcx, [rsp + 0x120]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003d9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x40]
mov rdx, qword [0x140056a00]
mov rcx, qword [0x140056a18]
call fcn.14000234c
mov r9d, esi
mov r8d, 0x10
lea rdx, [rsp + 0x490]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x490]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x40]
call fcn.140004a5c
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.140004384
xor eax, eax
mov rcx, r13
lea rdi, str.Shadow_Defender.lnk
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rdx, str.Shadow_Defender.lnk
lea rcx, [rsp + 0x40]
call fcn.1400045b8
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140051cfc], 0
je 0x140003f30
lea r8, str.Defender.exe
mov rdx, r12
lea rcx, [rsp + 0x130]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [0x140056a18]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003e99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, esi
mov r8d, 0x19
lea rdx, [rsp + 0x490]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x490]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x40]
call fcn.140004a5c
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.140004384
xor eax, eax
mov rcx, r13
lea rdi, str.Shadow_Defender.lnk
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rdx, str.Shadow_Defender.lnk
lea rcx, [rsp + 0x40]
call fcn.1400045b8
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov rdx, qword [0x140056a00]
mov rcx, qword [0x140056a18]
call fcn.14000234c
cmp dword [0x140051d00], 0
je 0x14000401c
lea r8, str.Defender.exe
mov rdx, r12
lea rcx, [rsp + 0x140]
call fcn.140004428
nop
mov rdx, rax
lea rcx, [0x140056a18]
call fcn.1400047b4
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140003f89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, esi
mov r8d, 0x1a
lea rdx, [rsp + 0x490]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x490]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x40]
call fcn.140004a5c
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.140004384
xor eax, eax
mov rcx, r13
lea rdx, str.MicrosoftInternet_ExplorerQuick_LaunchShadow_Defender.lnk
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
mov r8d, ecx
lea rcx, [rsp + 0x40]
call fcn.1400045b8
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov rdx, qword [0x140056a00]
mov rcx, qword [0x140056a18]
call fcn.14000234c
test ebp, ebp
jne 0x140004059
xor r9d, r9d
mov edx, 0x402
lea r8d, [rbp + 0x62]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Registering_production_information...
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.140002890
call fcn.1400015f8
test ebp, ebp
jne 0x140004089
xor r9d, r9d
mov edx, 0x402
lea r8d, [rbp + 0x64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400040a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400040c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400040e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.14001cb20
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret