Function at 0x577ad0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x258
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x178], rbp
mov qword [rbp + 0x270], rcx
mov qword [rbp + 0x278], rdx
mov qword [rbp + 0x280], r8
mov rcx, qword [rbp + 0x270]
call fcn.0040e540
mov rcx, qword [rbp + 0x280]
call fcn.0040e540
nop
mov rcx, qword [0x004cb648]
mov dl, 1
call fcn.004f6e40
mov qword [rbp + 0x1d0], rax
mov rcx, qword [rbp + 0x1d0]
mov rdx, qword [rbp + 0x280]
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
call qword [rax + 0x78]
mov rcx, qword [rbp + 0x1d0]
lea rdx, [rbp + 0x1f0]
xor r8, r8
call fcn.004f43b0
mov rcx, qword [rbp + 0x1d0]
lea rdx, [rbp + 0x1e0]
xor r8, r8
call fcn.004f5e50
mov rcx, qword [rbp + 0x1d0]
call fcn.0040b010
lea rcx, [rbp + 0x158]
xor rdx, rdx
call fcn.00409350
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x158]
call fcn.0042da40
lea rcx, [rbp + 0x168]
mov rdx, qword [rbp + 0x160]
call fcn.00438800
lea rcx, [rbp + 0x170]
mov rdx, qword [rbp + 0x168]
call fcn.0042da40
lea rcx, [rbp + 0x1c8]
mov rdx, qword [rbp + 0x170]
lea r8, [0x005791d0]
call fcn.0040fe00
mov rcx, qword [rbp + 0x1c8]
mov dl, 1
call fcn.0042d3c0
test al, al
je 0x577e9a
mov rcx, qword [0x00544b98]
mov dl, 1
mov r8, qword [rbp + 0x1c8]
call fcn.00546cd0
mov qword [rbp + 0x1b8], rax
mov rcx, qword [rbp + 0x1b8]
lea rdx, [0x0057920c]
call fcn.00546d70
test al, al
je 0x577e87
mov byte [rbp + 0x1b7], 1
mov rcx, qword [rbp + 0x1b8]
lea rdx, [rbp + 0x148]
lea r8, [0x0057920c]
lea r9, [0x00579244]
lea rax, [0x00579278]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1b8]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [rbp + 0x150]
lea rdx, [0x00579230]
mov r8, qword [rbp + 0x148]
call fcn.0040fe00
mov rcx, qword [rbp + 0x150]
call fcn.0042cbe0
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x1c4]
mov dword [rbp + 0x218], eax
jmp 0x577e8e
mov byte [rbp + 0x1b7], 0
mov rcx, qword [rbp + 0x1b8]
call fcn.0040b010
lea rax, [0x00579290]
cmp rax, qword [rbp + 0x1f0]
jne 0x577eb3
mov byte [rbp + 0x18f], 1
jmp 0x577ef0
lea rax, [0x00579290]
test rax, rax
je 0x577ec9
cmp qword [rbp + 0x1f0], 0
jne 0x577ed2
mov byte [rbp + 0x18f], 0
jmp 0x577ef0
lea rcx, [0x00579290]
mov rdx, qword [rbp + 0x1f0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x18f], al
nop
cmp byte [rbp + 0x18f], 0
je 0x577f1f
mov rcx, qword [rbp + 0x1e0]
call fcn.00567620
mov rbx, rax
lea rcx, [0x005792c0]
call fcn.00567620
cmp rbx, rax
jne 0x577f1f
call fcn.00572480
mov byte [rbp + 0x237], 0
mov byte [rbp + 0x207], 0
lea rcx, [rbp + 0x140]
mov rdx, qword [rbp + 0x270]
lea r8, [0x005792e4]
call fcn.0040fe00
mov rcx, qword [rbp + 0x140]
mov dl, 1
call fcn.0042d3c0
test al, al
je 0x578f42
lea rcx, [rbp + 0x138]
mov rdx, qword [rbp + 0x270]
lea r8, [0x005792e4]
call fcn.0040fe00
mov rcx, qword [0x00544b98]
mov dl, 1
mov r8, qword [rbp + 0x138]
call fcn.00546cd0
mov qword [rbp + 0x228], rax
mov rcx, qword [0x004cb648]
mov dl, 1
call fcn.004f6e40
mov qword [rbp + 0x220], rax
mov rcx, qword [rbp + 0x228]
lea rdx, [0x00579308]
call fcn.00546d70
test al, al
je 0x577fe6
mov rcx, qword [rbp + 0x228]
lea rdx, [0x00579308]
mov r8, qword [rbp + 0x220]
mov rax, qword [rbp + 0x228]
mov rbx, qword [rax]
call qword [rbx + 0xa8]
jmp 0x57800b
mov rcx, qword [rbp + 0x228]
lea rdx, [0x00579334]
mov r8, qword [rbp + 0x220]
mov rax, qword [rbp + 0x228]
mov rbx, qword [rax]
call qword [rbx + 0xa8]
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
sub eax, 1
mov dword [rbp + 0x3c], eax
mov dword [rbp + 0x21c], ecx
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x21c], eax
jg 0x578eff
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
nop
lea rcx, [rbp + 0x207]
call fcn.00575a10
jmp 0x5780de
nop
mov byte [rbp + 0x1b6], 1
lea rcx, [rbp + 0x120]
lea rdx, [0x005793bc]
call fcn.0042b950
lea rcx, [rbp + 0x118]
mov rdx, qword [rbp + 0x280]
call fcn.0042b950
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
mov r8d, 1
call fcn.004101a0
test eax, eax
jle 0x578190
call fcn.0056e930
mov byte [rbp + 0x1b6], al
cmp byte [rbp + 0x1b6], 0
je 0x578163
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578190
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005793d4]
call fcn.00553130
jmp 0x578190
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578190
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579418]
call fcn.00553130
jmp 0x578190
cmp byte [rbp + 0x1b7], 0
jne 0x57820a
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x108]
mov r8d, dword [rbp + 0x21c]
call fcn.004f43b0
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x270]
mov r8, qword [rbp + 0x108]
call fcn.0040fe00
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x100]
mov r8d, dword [rbp + 0x21c]
call fcn.004f5e50
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x100]
lea r8, [rbp + 0x218]
call fcn.005747a0
test al, al
jne 0x57820a
xor rax, rax
jmp 0x57820c
mov al, 1
cmp al, 1
jne 0x578d25
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x57826b
lea rcx, [rbp + 0xf0]
mov edx, dword [rbp + 0x218]
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0xf8]
lea rdx, [0x00579464]
mov r8, qword [rbp + 0xf0]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xf8]
call fcn.00553130
nop
cmp dword [rbp + 0x218], 0
jne 0x5782f0
mov rcx, qword [rbp + 0x1f0]
call fcn.00576790
test al, al
je 0x5782f0
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep_1
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x1f0]
call fcn.00576f10
mov rcx, qword [rbp + 0xe8]
call fcn.00567620
mov rbx, rax
mov rcx, qword [rbp + 0x1e0]
call fcn.00567620
cmp rbx, rax
jae 0x5782f0
mov dword [rbp + 0x218], 0x20150819
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5782f0
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005794c0]
call fcn.00553130
cmp dword [rbp + 0x218], 0
jne 0x5784ac
mov rcx, qword [rbp + 0x1f0]
call fcn.00576440
test al, al
je 0x5784ac
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578334
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579554]
call fcn.00553130
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep_1
mov byte [rbp + 0x197], 0
mov rcx, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x197]
call fcn.005765d0
test al, al
jne 0x578393
mov dword [rbp + 0x218], 0x20151023
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5784ac
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005795b0]
call fcn.00553130
jmp 0x5784ac
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5783b6
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579604]
call fcn.00553130
cmp byte [rbp + 0x197], 0
jne 0x5783fa
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5783e2
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579658]
call fcn.00553130
mov rcx, qword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x1e0]
call fcn.005778e0
jmp 0x5784ac
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5784ac
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005796d4]
call fcn.00553130
jmp 0x5784ac
lea rax, [0x0057978c]
cmp qword [rbp + 0x1f0], rax
jne 0x5784c5
mov byte [rbp + 0x18e], 1
jmp 0x578502
cmp qword [rbp + 0x1f0], 0
je 0x5784db
lea rax, [0x0057978c]
test rax, rax
jne 0x5784e4
mov byte [rbp + 0x18e], 0
jmp 0x578502
mov rcx, qword [rbp + 0x1f0]
lea rdx, [0x0057978c]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x18e], al
nop
cmp byte [rbp + 0x18e], 0
je 0x57851e
cmp dword [rbp + 0x218], 0x17
sete al
mov byte [rbp + 0x18d], al
jmp 0x578525
mov byte [rbp + 0x18d], 0
cmp byte [rbp + 0x18d], 0
je 0x5786e6
lea rcx, [rbp + 0x1e8]
lea rdx, [0x005797c4]
call fcn.0040ea60
lea rcx, [rbp + 0x1e8]
lea rdx, [0x00579820]
call fcn.0040ea60
lea rcx, [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e8]
mov r8b, 1
call fcn.0056ec10
cmp qword [rbp + 0x1d8], 0
jne 0x57858e
lea rcx, [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e8]
xor r8, r8
call fcn.0056ec10
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5785cb
lea rcx, [rbp + 0xd0]
lea rdx, [0x0057987c]
mov r8, qword [rbp + 0x1d8]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xd0]
call fcn.00553130
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578608
lea rcx, [rbp + 0xc8]
lea rdx, [0x005798d4]
mov r8, qword [rbp + 0x1e0]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xc8]
call fcn.00553130
mov rax, qword [rbp + 0x1d8]
cmp rax, qword [rbp + 0x1e0]
jne 0x578621
mov byte [rbp + 0x18c], 1
jmp 0x57865c
cmp qword [rbp + 0x1d8], 0
je 0x578635
cmp qword [rbp + 0x1e0], 0
jne 0x57863e
mov byte [rbp + 0x18c], 0
jmp 0x57865c
mov rcx, qword [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x18c], al
nop
cmp byte [rbp + 0x18c], 0
je 0x5786a6
mov byte [rbp + 0x237], 1
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578d5c
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x0057992c]
call fcn.00553130
jmp 0x578d5c
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578d5c
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579988]
call fcn.00553130
jmp 0x578d5c
cmp dword [rbp + 0x218], 0xbc2
je 0x578717
cmp dword [rbp + 0x218], 0x669
je 0x578717
cmp dword [rbp + 0x218], 0
je 0x578717
cmp dword [rbp + 0x218], 0x240006
jne 0x578b22
mov byte [rbp + 0x237], 1
lea rax, [0x005799e0]
cmp qword [rbp + 0x1f0], rax
jne 0x578737
mov byte [rbp + 0x18b], 1
jmp 0x578774
cmp qword [rbp + 0x1f0], 0
je 0x57874d
lea rax, [0x005799e0]
test rax, rax
jne 0x578756
mov byte [rbp + 0x18b], 0
jmp 0x578774
mov rcx, qword [rbp + 0x1f0]
lea rdx, [0x005799e0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x18b], al
nop
cmp byte [rbp + 0x18b], 0
je 0x578790
cmp dword [rbp + 0x218], 0
sete al
mov byte [rbp + 0x18a], al
jmp 0x578797
mov byte [rbp + 0x18a], 0
cmp byte [rbp + 0x18a], 0
je 0x57894d
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep_1
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5787d2
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579a18]
call fcn.00553130
nop
mov ecx, pe_nt_image_headers64
call fcn.00408c40
mov qword [rbp + 0x1a8], rax
mov rcx, qword [rbp + 0x1a8]
mov edx, pe_nt_image_headers64
xor r8, r8
call fcn.0040a600
mov rcx, qword [rbp + 0x1a8]
mov rdx, qword [rbp + 0x1a0]
call fcn.0056eee0
cmp qword [rbp + 0x1a8], 0
je 0x57891b
lea rcx, [rbp + 0x198]
mov rdx, qword [rbp + 0x1a8]
call fcn.0040fa70
cmp qword [rbp + 0x198], 0
jne 0x578892
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x57892f
lea rcx, [rbp + 0xc0]
lea rdx, [0x00579a74]
mov r8, qword [rbp + 0x198]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xc0]
call fcn.00553130
jmp 0x57892f
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x5788cf
lea rcx, [rbp + 0xb8]
lea rdx, [0x00579a74]
mov r8, qword [rbp + 0x198]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xb8]
call fcn.00553130
mov rcx, qword [rbp + 0x198]
call fcn.00567620
mov rbx, rax
mov rcx, qword [rbp + 0x1e0]
call fcn.00567620
cmp rbx, rax
jb 0x578905
mov byte [rbp + 0x237], 1
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000
jmp 0x57892f
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
jmp 0x57892f
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
mov rcx, qword [rbp + 0x1a8]
call fcn.00408c70
jmp 0x578d5c
mov eax, dword [rbp + 0x218]
and eax, 0xbc2
cmp eax, 0xbc2
jne 0x57896e
mov rax, qword [rbp + 0x278]
or dword [rax], 0x1000000
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000
lea rcx, [rbp + 0x98]
xor rdx, rdx
call fcn.00409350
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
call fcn.0042da40
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
call fcn.00438800
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0xa8]
call fcn.0042da40
lea rcx, [rbp + 0x210]
mov rdx, qword [rbp + 0xb0]
lea r8, [0x00579ac4]
call fcn.0040fe00
mov rcx, qword [0x00544358]
mov dl, 1
mov r8, qword [rbp + 0x210]
call fcn.00548db0
mov qword [rbp + 0x208], rax
lea rax, [0x00579afc]
cmp qword [rbp + 0x1f0], rax
jne 0x578a12
mov byte [rbp + 0x189], 1
jmp 0x578a4f
cmp qword [rbp + 0x1f0], 0
je 0x578a28
lea rax, [0x00579afc]
test rax, rax
jne 0x578a31
mov byte [rbp + 0x189], 0
jmp 0x578a4f
mov rcx, qword [rbp + 0x1f0]
lea rdx, [0x00579afc]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x189], al
nop
cmp byte [rbp + 0x189], 0
je 0x578aef
mov rcx, qword [rbp + 0x1e0]
call fcn.00567620
mov rbx, rax
lea rcx, [0x00579b3c]
call fcn.00567620
cmp rbx, rax
jne 0x578aa6
mov rcx, qword [rbp + 0x208]
lea rdx, [0x00579b68]
lea r8, [0x00579b84]
mov r9d, 1
mov rax, qword [rbp + 0x208]
mov rbx, qword [rax]
call qword [rbx + 0x20]
mov rcx, qword [rbp + 0x1e0]
call fcn.00567620
mov rbx, rax
lea rcx, [0x00579ba4]
call fcn.00567620
cmp rbx, rax
jne 0x578aef
mov rcx, qword [rbp + 0x208]
lea rdx, [0x00579b68]
lea r8, [0x00579bd0]
mov r9d, 1
mov rax, qword [rbp + 0x208]
mov rbx, qword [rax]
call qword [rbx + 0x20]
nop
mov rcx, qword [rbp + 0x208]
mov rax, qword [rbp + 0x208]
mov rbx, qword [rax]
call qword [rbx + 0xc0]
jmp 0x578b11
mov rcx, qword [rbp + 0x208]
call fcn.0040b010
jmp 0x578d5c
cmp dword [rbp + 0x218], 0xfffffff7
jne 0x578c81
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578b52
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579bf0]
call fcn.00553130
mov ecx, 0x7530
call sub.kernel32.dll_Sleep_1
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x88]
mov r8d, dword [rbp + 0x21c]
call fcn.004f43b0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x270]
mov r8, qword [rbp + 0x88]
call fcn.0040fe00
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x80]
mov r8d, dword [rbp + 0x21c]
call fcn.004f5e50
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x80]
lea r8, [rbp + 0x218]
call fcn.005747a0
test al, al
je 0x578d5c
cmp dword [rbp + 0x218], 0xbc2
je 0x578bfa
cmp dword [rbp + 0x218], 0x669
je 0x578bfa
cmp dword [rbp + 0x218], 0
je 0x578bfa
cmp dword [rbp + 0x218], 0x240006
jne 0x578c34
mov byte [rbp + 0x237], 1
mov eax, dword [rbp + 0x218]
and eax, 0xbc2
cmp eax, 0xbc2
jne 0x578c22
mov rax, qword [rbp + 0x278]
or dword [rax], 0x1000000
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000
jmp 0x578d5c
cmp dword [rbp + 0x218], 0xfffffff7
jne 0x578d5c
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578d5c
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579c50]
call fcn.00553130
jmp 0x578d5c
mov ecx, dword [rbp + 0x218]
call fcn.00576000
test al, al
je 0x578d0f
mov rax, qword [rbp + 0x278]
or dword [rax], 0x2000000
lea rcx, [rbp + 0x78]
lea rdx, [0x005c0f5c]
mov r8d, 0x105
call fcn.0040faa0
lea rcx, [rbp + 0x1f8]
mov rdx, qword [rbp + 0x78]
lea r8, [0x00579ccc]
call fcn.0040fe00
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x1f0]
xor r8, r8
call fcn.0040f510
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
call fcn.00554c20
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x70]
call fcn.0040faf0
mov rcx, qword [rbp + 0x1f8]
mov rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x1e0]
call fcn.005762b0
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
jmp 0x578d5c
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578d48
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579d1c]
call fcn.00553130
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
lea rax, [0x00579d68]
cmp rax, qword [rbp + 0x1f0]
jne 0x578d75
mov byte [rbp + 0x188], 1
jmp 0x578db2
lea rax, [0x00579d68]
test rax, rax
je 0x578d8b
cmp qword [rbp + 0x1f0], 0
jne 0x578d94
mov byte [rbp + 0x188], 0
jmp 0x578db2
lea rcx, [0x00579d68]
mov rdx, qword [rbp + 0x1f0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0x188], al
nop
cmp byte [rbp + 0x188], 0
je 0x578de1
cmp dword [rbp + 0x218], 0x669
je 0x578dd4
cmp dword [rbp + 0x218], 0xbc2
jne 0x578de1
mov rax, qword [rbp + 0x278]
or dword [rax], 0x1000000
nop
cmp byte [rbp + 0x1b6], 0
jne 0x578e5a
call fcn.0056e930
mov byte [rbp + 0x1b6], al
cmp byte [rbp + 0x1b6], 0
je 0x578e5a
call fcn.0056ea90
test al, al
je 0x578e2d
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578e5a
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579da4]
call fcn.00553130
jmp 0x578e5a
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578e5a
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00579df8]
call fcn.00553130
jmp 0x578e5a
cmp byte [rbp + 0x207], 0
je 0x578ee9
nop
call fcn.00575dd0
jmp 0x578ee9
add dword [rbp + 0x21c], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x21c], eax
jne 0x578046
nop
mov rcx, qword [rbp + 0x228]
call fcn.0040b010
mov rcx, qword [rbp + 0x220]
call fcn.0040b010
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x270]
lea r8, [0x005792e4]
call fcn.0040fe00
mov rcx, qword [rbp + 0x48]
call fcn.0040f9d0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x578f9f
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x578f8b
lea rcx, [rbp + 0x40]
mov edx, 3
lea r8, [0x00579ea0]
mov r9, qword [rbp + 0x270]
lea rax, [0x00579ec4]
mov qword [rsp + 0x20], rax
call fcn.0040ff20
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x40]
call fcn.00553130
mov byte [rbp + 0x237], 0
mov rax, qword [rbp + 0x278]
or dword [rax], 0x10000100
nop
lea rcx, [rbp + 0x40]
mov edx, 5
call fcn.0040e490
lea rcx, [rbp + 0x68]
mov edx, 2
call fcn.0040e4c0
lea rcx, [rbp + 0x78]
mov edx, 0x20
call fcn.0040e490
lea rcx, [rbp + 0x198]
call fcn.0040e3b0
lea rcx, [rbp + 0x1c8]
call fcn.0040e3b0
lea rcx, [rbp + 0x1d8]
mov edx, 5
call fcn.0040e490
lea rcx, [rbp + 0x210]
call fcn.0040e3b0
lea rcx, [rbp + 0x270]
call fcn.0040e3b0
lea rcx, [rbp + 0x280]
call fcn.0040e3b0
movzx rax, byte [rbp + 0x237]
lea rsp, [rbp + 0x258]
pop rbx
pop rbp
ret