Function at 0x557dc0
Capabilities:
Create process on windows
Self delete

Disassembly:
push rbp
push rbx
sub rsp, 0x258
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
test dword [rax + 1], ecx
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x230], 0
nop
lea rcx, [0x0055a098]
call fcn.0041bdd0
nop
call fcn.0053ccb0
call fcn.00557790
call fcn.00557880
test al, al
je 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5580dc
mov rax, qword [0x00588060]
cmp byte [rax + 0x300], 0
je 0x5580dc
call fcn.00541740
test al, al
je 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x55810f
lea rcx, [0x005598ec]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
lea rcx, [0x00559920]
mov dl, 1
call fcn.00541b60
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
mov edx, 0x80
call sub.kernel32.dll_SetPriorityClass
call fcn.00557710
mov ecx, 0xa
call fcn.00409a10
mov ecx, eax
imul ecx, ecx, 0x3e8
add ecx, 0x3e8
call sub.kernel32.dll_Sleep
call fcn.00435ff0
mov rax, qword [0x00588040]
movsd qword [rax + 0x2b8], xmm0
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558185
lea rcx, [0x00559940]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
call fcn.0053ccd0
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558248
lea rcx, [rbp + 0x240]
mov rax, qword [0x00588040]
movzx rdx, byte [rax + 8]
call fcn.00431670
lea rcx, [rbp + 0x238]
mov rax, qword [0x00588040]
movzx rdx, byte [rax + 9]
call fcn.00431670
lea rcx, [rbp + 0x230]
mov rax, qword [0x00588040]
mov edx, dword [rax + 0xc]
call fcn.004316b0
lea rcx, [rbp + 0x248]
mov edx, 6
lea r8, [0x0055996c]
mov r9, qword [rbp + 0x240]
lea rax, [0x0055998c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x238]
mov qword [rsp + 0x28], rax
lea rax, [0x0055998c]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x230]
mov qword [rsp + 0x38], rax
call fcn.00412ca0
mov rcx, qword [rbp + 0x248]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x55826d
lea rcx, [0x0055999c]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
call fcn.00540a50
test al, al
jne 0x5582a4
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5596e3
lea rcx, [0x005599c4]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5582c2
lea rcx, [0x00559a2c]
mov dl, 1
call fcn.00541b60
call fcn.004098b0
cmp eax, 1
jne 0x558311
lea rcx, [rbp + 0x228]
mov edx, 1
call fcn.00409930
mov rcx, qword [rbp + 0x228]
call fcn.00556bc0
test al, al
jne 0x558311
lea rcx, [rbp + 0x220]
mov edx, 1
call fcn.00409930
mov rcx, qword [0x00587e90]
mov rdx, qword [rbp + 0x220]
call fcn.004128b0
mov dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x218]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x218]
lea rdx, [0x00559a54]
call fcn.00412d80
test eax, eax
jne 0x55836c
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x38]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x210]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x210]
lea rdx, [0x00559a74]
call fcn.00412d80
test eax, eax
jne 0x5583b8
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x60]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x208]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x208]
lea rdx, [0x00559a90]
call fcn.00412d80
test eax, eax
jne 0x558409
mov rax, qword [0x00588040]
mov byte [rax + 0x118], 1
mov rax, qword [0x00588040]
mov byte [rax + 0x110], 0
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x200]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x200]
lea rdx, [0x00559ab0]
call fcn.00412d80
test eax, eax
jne 0x5584a7
add dword [0x00595e80], 1
jmp 0x558494
lea rcx, [rbp + 0x1f8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1f8]
call fcn.00556bc0
test al, al
jne 0x5584a1
lea rcx, [rbp + 0x1f0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x2d8]
mov rcx, rax
mov rdx, qword [rbp + 0x1f0]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x00595e80], 1
call fcn.004098b0
cmp dword [0x00595e80], eax
jle 0x55843b
nop
jmp 0x558d8d
lea rcx, [rbp + 0x1e8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1e8]
lea rdx, [0x00559ac8]
call fcn.00412d80
test eax, eax
jne 0x558545
add dword [0x00595e80], 1
jmp 0x558532
lea rcx, [rbp + 0x1e0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1e0]
call fcn.00556bc0
test al, al
jne 0x55853f
lea rcx, [rbp + 0x1d8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x2d0]
mov rcx, rax
mov rdx, qword [rbp + 0x1d8]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x00595e80], 1
call fcn.004098b0
cmp dword [0x00595e80], eax
jle 0x5584d9
nop
jmp 0x558d8d
lea rcx, [rbp + 0x1d0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1d0]
lea rdx, [0x00559ae8]
call fcn.00412d80
test eax, eax
jne 0x5585e0
add dword [0x00595e80], 1
jmp 0x5585cd
lea rcx, [rbp + 0x1c8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1c8]
call fcn.00556bc0
test al, al
jne 0x5585da
lea rcx, [rbp + 0x1c0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [rbp + 0x1c0]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x00595e80], 1
call fcn.004098b0
cmp dword [0x00595e80], eax
jle 0x558577
nop
jmp 0x558d8d
lea rcx, [rbp + 0x1b8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1b8]
lea rdx, [0x00559afc]
call fcn.00412d80
test eax, eax
jne 0x55862c
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x1b0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1b0]
lea rdx, [0x00559b28]
call fcn.00412d80
test eax, eax
jne 0x55866f
mov rax, qword [0x00588040]
mov byte [rax + 0x106], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x1a8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1a8]
lea rdx, [0x00559b44]
call fcn.00412d80
test eax, eax
jne 0x5586b2
mov rax, qword [0x00588040]
mov byte [rax + 0x110], 0
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x1a0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x1a0]
lea rdx, [0x00559b68]
call fcn.00412d80
test eax, eax
jne 0x5587b2
mov rax, qword [0x00588040]
mov byte [rax + 0x109], 0
mov rax, qword [0x00588040]
mov byte [rax + 0x10a], 0
lea rcx, [rbp + 0x198]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
lea rcx, [rbp + 0x190]
mov rdx, qword [rbp + 0x198]
xor r8, r8
call fcn.00412030
mov rcx, qword [rbp + 0x190]
call fcn.00449880
test al, al
je 0x558788
lea rcx, [rbp + 0x188]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
lea rcx, [rbp + 0x180]
mov rdx, qword [rbp + 0x188]
call fcn.004128b0
mov rcx, qword [rbp + 0x180]
mov edx, 0xa
mov r8d, 1
mov r9d, 0x64
call fcn.00557630
mov rcx, qword [0x00588040]
mov byte [rcx + 0x111], al
mov rax, qword [0x00588040]
cmp byte [rax + 0x111], 0x64
jne 0x5587a6
mov rax, qword [0x00588040]
mov byte [rax + 0x109], 1
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0x178]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x178]
lea rdx, [0x00559b84]
call fcn.00412d80
test eax, eax
jne 0x55887c
mov rax, qword [0x00588040]
mov byte [rax + 0x10f], 1
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x2c8]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
add dword [0x00595e80], 1
jmp 0x558869
lea rcx, [rbp + 0x170]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x170]
call fcn.00556bc0
test al, al
jne 0x558876
lea rcx, [rbp + 0x168]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x2c8]
mov rcx, rax
mov rdx, qword [rbp + 0x168]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [0x00595e80], 1
call fcn.004098b0
cmp dword [0x00595e80], eax
jle 0x558810
nop
jmp 0x558d8d
lea rcx, [rbp + 0x160]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x160]
lea rdx, [0x00559b9c]
call fcn.00412d80
test eax, eax
jne 0x558917
lea rcx, [rbp + 0x158]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x158]
xor r8, r8
call fcn.00412030
mov rcx, qword [rbp + 0x150]
call fcn.00449880
test al, al
je 0x55890b
lea rcx, [rbp + 0x148]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
mov rcx, qword [rbp + 0x148]
call fcn.00431960
mov rcx, qword [0x00588040]
mov dword [rcx + 0x68], eax
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0x140]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00559bb8]
call fcn.00412d80
test eax, eax
jne 0x55894c
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0x138]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x138]
lea rdx, [0x00559bd4]
call fcn.00412d80
test eax, eax
jne 0x558981
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x130]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x130]
lea rdx, [0x00559bf0]
call fcn.00412d80
test eax, eax
jne 0x5589c4
mov rax, qword [0x00588040]
mov byte [rax + 0x10e], 0
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x128]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x128]
lea rdx, [0x00559c18]
call fcn.00412d80
test eax, eax
jne 0x558a07
mov rax, qword [0x00588040]
mov byte [rax + 0x105], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x120]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x120]
lea rdx, [0x00559c34]
call fcn.00412d80
test eax, eax
jne 0x558a4a
mov rax, qword [0x00588040]
mov byte [rax + 0x107], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x118]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x118]
lea rdx, [0x00559c48]
call fcn.00412d80
test eax, eax
jne 0x558a9b
mov rax, qword [0x00588040]
mov byte [rax + 0x109], 1
mov rax, qword [0x00588040]
mov byte [rax + 0x10a], 0
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x110]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x110]
lea rdx, [0x00559c60]
call fcn.00412d80
test eax, eax
jne 0x558aec
mov rax, qword [0x00588040]
mov byte [rax + 0x109], 0
mov rax, qword [0x00588040]
mov byte [rax + 0x10a], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x108]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x108]
lea rdx, [0x00559c78]
call fcn.00412d80
test eax, eax
jne 0x558b2f
mov rax, qword [0x00588040]
mov byte [rax + 0x10b], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0x100]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0x100]
lea rdx, [0x00559c94]
call fcn.00412d80
test eax, eax
jne 0x558b72
mov rax, qword [0x00588040]
mov byte [rax + 0x117], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0xf8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x00559cb8]
call fcn.00412d80
test eax, eax
jne 0x558bf9
mov rax, qword [0x00588040]
cmp byte [rax + 0x117], 0
je 0x558bed
lea rcx, [rbp + 0xf0]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0xf0]
xor r8, r8
call fcn.00412030
mov rcx, qword [rbp + 0xe8]
mov rax, qword [0x00588040]
lea rdx, [rax + 0x50]
call fcn.00449d70
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0xe0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xe0]
lea rdx, [0x00559cd8]
call fcn.00412d80
test eax, eax
jne 0x558c80
mov rax, qword [0x00588040]
cmp byte [rax + 0x117], 0
je 0x558c74
lea rcx, [rbp + 0xd8]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
xor r8, r8
call fcn.00412030
mov rcx, qword [rbp + 0xd0]
mov rax, qword [0x00588040]
lea rdx, [rax + 0x20]
call fcn.00449d70
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0xc8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xc8]
lea rdx, [0x00559cf8]
call fcn.00412d80
test eax, eax
je 0x558cd2
lea rcx, [rbp + 0xc0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xc0]
lea rdx, [0x00559d0c]
call fcn.00412d80
test eax, eax
jne 0x558d06
lea rcx, [rbp + 0xb8]
mov edx, dword [0x00595e80]
add edx, 1
call fcn.00409930
mov rcx, qword [0x00587e90]
mov rdx, qword [rbp + 0xb8]
call fcn.004128b0
add dword [0x00595e80], 2
jmp 0x558d8d
lea rcx, [rbp + 0xb0]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xb0]
lea rdx, [0x00559d24]
call fcn.00412d80
test eax, eax
jne 0x558d46
mov rax, qword [0x00588040]
mov byte [rax + 0x103], 1
add dword [0x00595e80], 1
jmp 0x558d8d
lea rcx, [rbp + 0xa8]
mov edx, dword [0x00595e80]
call fcn.00409930
mov rcx, qword [rbp + 0xa8]
lea rdx, [0x00559d40]
call fcn.00412d80
test eax, eax
jne 0x558d86
mov rax, qword [0x00588040]
mov byte [rax + 0x104], 1
add dword [0x00595e80], 1
jmp 0x558d8d
add dword [0x00595e80], 1
call fcn.004098b0
cmp dword [0x00595e80], eax
jle 0x558320
mov rax, qword [0x00588040]
cmp byte [rax + 0x118], 0
je 0x558dcd
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412680
test eax, eax
jne 0x558dcd
call fcn.00557c60
jmp 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558e24
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412680
test eax, eax
jne 0x558e24
lea rcx, [0x00559d58]
xor edx, edx
call fcn.00541b60
lea rcx, [0x00559df8]
xor edx, edx
call fcn.00541b60
mov rcx, qword [0x00588210]
call fcn.0040c3d0
call fcn.00409580
jmp 0x5596e3
mov rax, qword [0x00588040]
lea rcx, [rax + 0x30]
call fcn.0054e7c0
mov rax, qword [0x00588040]
lea rcx, [rax + 0x30]
call fcn.0054dbd0
mov rax, qword [0x00588040]
lea rcx, [rax + 0x30]
call fcn.0054e020
mov rax, qword [0x00588040]
mov eax, dword [rax + 0x68]
test eax, eax
je 0x558ece
mov rcx, qword [0x00588040]
cmp byte [rcx + 0x10c], 0
je 0x558eb9
lea rcx, [rbp + 0x98]
mov edx, eax
call fcn.00431670
lea rcx, [rbp + 0xa0]
mov edx, 3
lea r8, [0x00559e3c]
mov r9, qword [rbp + 0x98]
lea rax, [0x00559e58]
mov qword [rsp + 0x20], rax
call fcn.00412ca0
mov rcx, qword [rbp + 0xa0]
mov dl, 1
call fcn.00541b60
mov rax, qword [0x00588040]
mov ecx, dword [rax + 0x68]
imul ecx, ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558ef3
lea rcx, [0x00559e94]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x558f07
mov rax, qword [rax - 8]
test rax, rax
jne 0x558f1c
mov rax, qword [0x00588040]
lea rcx, [rax + 0x50]
call fcn.0053d7a0
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412680
test eax, eax
jne 0x558f6a
lea rcx, [rbp + 0x90]
mov rax, qword [0x00588040]
lea rdx, [rax + 0x50]
call fcn.00449d00
mov rax, qword [0x00588040]
lea rcx, [rax + 0xf8]
mov rdx, qword [rbp + 0x90]
call fcn.00449b80
test al, al
jne 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558f88
lea rcx, [0x00559ec4]
mov dl, 1
call fcn.00541b60
call fcn.00554580
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x558fb2
lea rcx, [0x00559efc]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00588040]
cmp byte [rax + 0x10b], 0
jne 0x558fc7
call fcn.00543690
mov rax, qword [0x00588040]
cmp byte [rax + 0x10b], 0
je 0x558fdc
call fcn.0054e750
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x38]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x28]
test eax, eax
je 0x55902c
jmp 0x559000
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00556770]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x558ff6
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x60]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x28]
test eax, eax
je 0x559049
call fcn.00556900
call fcn.00557190
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412680
test eax, eax
je 0x55933f
mov rax, qword [0x00588040]
mov byte [rax + 0x114], 0
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
call fcn.00448f50
test al, al
je 0x5590fa
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5590e6
xor ecx, ecx
mov dl, 1
call fcn.00541b60
lea rcx, [rbp + 0x88]
lea rdx, [0x00559f28]
mov rax, qword [0x00587e90]
mov r8, qword [rax]
call fcn.00412270
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
call fcn.00412880
mov rcx, qword [rbp + 0x80]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
call fcn.00554c30
jmp 0x559269
mov rax, qword [0x00588040]
cmp byte [rax + 0x10b], 0
jne 0x55915e
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
jne 0x55915e
jmp 0x559126
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x005552c0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x55911c
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
jmp 0x55916c
mov rax, qword [0x00588040]
mov byte [rax + 0x114], 1
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5591be
xor ecx, ecx
mov dl, 1
call fcn.00541b60
lea rcx, [rbp + 0x78]
lea rdx, [0x00559f58]
mov rax, qword [0x00587e90]
mov r8, qword [rax]
call fcn.00412270
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
call fcn.00412880
mov rcx, qword [rbp + 0x70]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00587e90]
mov rcx, qword [rax]
call fcn.00554f50
jmp 0x5591d9
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x114], 0
je 0x5591cf
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x559217
xor ecx, ecx
mov dl, 1
call fcn.00541b60
lea rcx, [0x00559f94]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
call fcn.00541d60
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x559269
mov rax, qword [0x00588060]
cmp byte [rax + 0x300], 0
je 0x559269
lea rcx, [0x00559fcc]
xor edx, edx
call fcn.00541b60
lea rcx, [0x00559df8]
xor edx, edx
call fcn.00541b60
mov rcx, qword [0x00588210]
call fcn.0040c3d0
call fcn.00409580
mov rax, qword [0x00588040]
cmp byte [rax + 0x10f], 0
je 0x55927e
call fcn.00555cf0
mov rax, qword [0x00588040]
cmp byte [rax + 0x105], 0
je 0x5592be
xor ecx, ecx
lea rdx, [0x00559fea]
lea r8, [0x00559ff4]
lea r9, [0x0055a006]
lea rax, [0x0055a020]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x00588040]
cmp byte [rax + 0x106], 0
je 0x559330
lea rcx, [rbp + 0x60]
xor edx, edx
call fcn.00409930
lea rcx, [rbp + 0x68]
mov edx, 3
lea r8, [0x0055a040]
mov r9, qword [rbp + 0x60]
lea rax, [0x0055a08c]
mov qword [rsp + 0x20], rax
call fcn.00412ca0
mov rcx, qword [rbp + 0x68]
call fcn.00412750
xor ecx, ecx
lea rdx, [0x00559fea]
lea r8, [0x0055a022]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x005880c8]
mov byte [rax], 0
jmp 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x10b], 0
je 0x5593d4
mov rax, qword [0x00588040]
cmp byte [rax + 0x106], 0
je 0x5593c5
lea rcx, [rbp + 0x50]
xor edx, edx
call fcn.00409930
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x0055a040]
mov r9, qword [rbp + 0x50]
lea rax, [0x0055a08c]
mov qword [rsp + 0x20], rax
call fcn.00412ca0
mov rcx, qword [rbp + 0x58]
call fcn.00412750
xor ecx, ecx
lea rdx, [0x00559fea]
lea r8, [0x0055a022]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x005880c8]
mov byte [rax], 0
jmp 0x5596e3
mov rax, qword [0x00588040]
cmp byte [rax + 0x103], 0
je 0x5593fe
mov rax, qword [0x00588040]
mov byte [rax + 0x114], 1
jmp 0x55942a
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00552580]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x5593f4
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x103], 0
je 0x55945e
mov rax, qword [0x00588040]
mov byte [rax + 0x112], 1
jmp 0x55948a
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00552190]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x559454
mov rax, qword [0x00588040]
cmp byte [rax + 0x104], 0
je 0x5594b4
mov rax, qword [0x00588040]
mov byte [rax + 0x116], 1
jmp 0x5594ec
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00554ba0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x5594aa
jmp 0x5594ec
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x116], 0
je 0x5594e2
mov rax, qword [0x00588040]
cmp byte [rax + 0x104], 0
je 0x559526
mov rax, qword [0x00588040]
mov byte [rax + 0x115], 1
jmp 0x559552
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00554a30]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x55951c
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x104], 0
je 0x559586
mov rax, qword [0x00588040]
mov byte [rax + 0x113], 1
jmp 0x5595be
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00554730]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00587f50]
mov qword [rsp + 0x28], rax
call fcn.00410930
test rax, rax
je 0x55957c
jmp 0x5595be
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00588040]
cmp byte [rax + 0x112], 0
je 0x5595b4
mov rax, qword [0x00588040]
cmp byte [rax + 0x113], 0
je 0x5595b4
mov rax, qword [0x00588040]
cmp byte [rax + 0x114], 0
je 0x5595b4
mov rax, qword [0x00588040]
cmp byte [rax + 0x115], 0
je 0x5595b4
mov rax, qword [0x00588040]
cmp byte [rax + 0x10f], 0
je 0x559613
call fcn.00555cf0
mov rax, qword [0x00588040]
mov rcx, qword [rax + 0xf8]
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00588040]
cmp byte [rax + 0x105], 0
je 0x559666
xor ecx, ecx
lea rdx, [0x00559fea]
lea r8, [0x00559ff4]
lea r9, [0x0055a006]
lea rax, [0x0055a020]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x00588040]
cmp byte [rax + 0x106], 0
je 0x5596d8
lea rcx, [rbp + 0x40]
xor edx, edx
call fcn.00409930
lea rcx, [rbp + 0x48]
mov edx, 3
lea r8, [0x0055a040]
mov r9, qword [rbp + 0x40]
lea rax, [0x0055a08c]
mov qword [rsp + 0x20], rax
call fcn.00412ca0
mov rcx, qword [rbp + 0x48]
call fcn.00412750
xor ecx, ecx
lea rdx, [0x00559fea]
lea r8, [0x0055a022]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x005880c8]
mov byte [rax], 0
nop
lea rcx, [rbp + 0x40]
mov edx, 7
call fcn.00410c10
lea rcx, [rbp + 0x78]
call fcn.00410bd0
lea rcx, [rbp + 0x80]
call fcn.00410b30
lea rcx, [rbp + 0x88]
call fcn.00410bd0
lea rcx, [rbp + 0x90]
call fcn.00410b80
lea rcx, [rbp + 0x98]
mov edx, 7
call fcn.00410c10
lea rcx, [rbp + 0xd0]
call fcn.00410b80
lea rcx, [rbp + 0xd8]
mov edx, 2
call fcn.00410c10
lea rcx, [rbp + 0xe8]
call fcn.00410b80
lea rcx, [rbp + 0xf0]
mov edx, 0xc
call fcn.00410c10
lea rcx, [rbp + 0x150]
call fcn.00410b80
lea rcx, [rbp + 0x158]
mov edx, 5
call fcn.00410c10
lea rcx, [rbp + 0x180]
call fcn.00410bd0
lea rcx, [rbp + 0x188]
call fcn.00410b30
lea rcx, [rbp + 0x190]
call fcn.00410b80
lea rcx, [rbp + 0x198]
mov edx, 0x17
call fcn.00410c10
call fcn.00410690
jmp 0x5597ca
lea rsp, [rbp + 0x258]
pop rbx
pop rbp
ret