Function at 0x140001ea0
Capabilities:
Create directory
Create thread
Enumerate gui resources
Enumerate process modules
Enumerate processes
Get common file path
Inject thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x22c8
call fcn.14001ec90
sub rsp, rax
mov dword [rsp + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov dword [rsp + 0xd8], 7
mov qword [rsp + 0xdc], 0
mov word [rsp + 0xe4], 0
mov byte [rsp + 0xe1], 1
mov byte [rsp + 0xe4], 1
mov byte [rsp + 0xe3], 1
lea rdx, str.icon.ico_v
lea rcx, [rsp + 0xc0]
mov r8d, 8
call fcn.140008aa0
test al, 1
jne 0x140002f9f
mov qword [rsp + 0x20c0], rdx
lea rdx, [0x140021668]
lea rcx, [rsp + 0x20c0]
mov r8d, 0x654400
call fcn.140004140
test rax, rax
jne 0x140002fb0
mov rcx, qword [rsp + 0x20c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x20c0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x104
mov rdx, rsi
call sub.KERNEL32.dll_GetTempPathW
mov ecx, 0x208
mov edx, 2
call fcn.1400059b0
test rax, rax
je 0x140002f90
mov rsi, rax
lea rax, [0x140675e0b]
mov qword [rsp + 0xc0], rax
lea rax, [0x140675e2f]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x20c0]
mov rcx, rsi
mov r8, rdi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000201f
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
test rbx, rbx
jne 0x14000204c
mov edx, 0x208
mov r8d, 2
mov rcx, rsi
call fcn.140005990
nop
add rsp, 0x22c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
call sub.KERNEL32.dll_GetCurrentThreadId
lea rdx, [0x140001cf0]
mov ecx, 5
xor r8d, r8d
mov r9d, eax
call sub.USER32.dll_SetWindowsHookExW
test rax, rax
je 0x140002085
mov byte [0x140683120], 1
mov qword [0x140683128], rax
mov rbx, rsi
add rbx, 0x208
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], 1
lea rdi, [rsp + 0x38]
mov r8d, 0x82
mov r9d, 1
mov rcx, rdi
xor edx, edx
call fcn.14001f800
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rbx
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0xc0]
mov rdx, rdi
call fcn.140005490
mov r13, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x98]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140002540
mov r14, rax
lea rdi, [rsp + 0xc0]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xc0], 0x238
mov rcx, r14
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140002540
mov qword [rsp + 0x70], r13
lea r12, [rsp + 0x38]
lea r13, [rsp + 0x58]
jmp 0x1400021b8
test ebp, ebp
je 0x140002532
mov eax, 0x208
xor r8d, r8d
cmp word [rsp + r8*2 + 0xec], 0
je 0x140002230
cmp word [rsp + r8*2 + 0xee], 0
je 0x14000220e
cmp word [rsp + r8*2 + 0xf0], 0
je 0x140002213
cmp word [rsp + r8*2 + 0xf2], 0
je 0x140002219
cmp word [rsp + r8*2 + 0xf4], 0
je 0x14000221f
add r8, 5
add rax, 0xfffffffffffffff6
jne 0x1400021c0
mov r8d, 0x104
jmp 0x140002230
inc r8
jmp 0x140002230
add r8, 2
jmp 0x140002230
add r8, 3
jmp 0x140002230
add r8, 4
nop word cs:[rax + rax]
mov rcx, r12
lea rdx, [rsp + 0xec]
call fcn.14000a4d0
mov rcx, r12
call fcn.140010370
mov r8, rdx
mov rcx, r13
mov rdx, rax
call fcn.140010380
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, r15
neg rax
mov rbp, qword [rsp + 0x68]
jno 0x1400022b9
test rbp, rbp
js 0x140002fe4
je 0x1400022a0
movzx eax, byte [0x140683141]
mov r15d, 1
mov edx, 1
mov rcx, rbp
call fcn.140005980
test rax, rax
je 0x140002ff2
mov rbx, rax
jmp 0x1400022a5
mov ebx, 1
mov rcx, rbx
mov rdx, rdi
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov r15, rbp
mov rdi, rbx
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400022d3
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.140005990
mov rcx, r12
mov rdx, rdi
mov r8, rbp
call fcn.140019090
mov rcx, qword [rsp + 0x40]
cmp qword [rsp + 0x48], 0xc
jne 0x14000231b
mov rax, qword [rcx]
movabs rdx, 0x7265726f6c707865
xor rax, rdx
mov edx, dword [rcx + 8]
xor rdx, 0x6578652e
or rdx, rax
sete bpl
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x140002327
jmp 0x140002332
xor ebp, ebp
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002332
mov r8d, 1
call fcn.140005990
test bpl, bpl
jne 0x140002368
mov rcx, r14
lea rdx, [rsp + 0xc0]
call sub.KERNEL32.dll_Process32NextW
mov ebp, eax
test r15, r15
je 0x1400021b0
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call fcn.140005990
jmp 0x1400021b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0xc8]
test r15, r15
je 0x14000238e
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call fcn.140005990
mov ecx, 0x1fffff
xor edx, edx
mov r8d, ebx
call sub.KERNEL32.dll_OpenProcess
test rax, rax
mov r13, qword [rsp + 0x70]
je 0x1400026a0
mov rbp, rax
lea rdi, [rsp + 0xc0]
mov r8d, 0x2000
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x84], 0
lea r9, [rsp + 0x84]
mov rcx, rbp
mov rdx, rdi
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14000240b
mov eax, dword [rsp + 0x84]
mov qword [rsp + 0x88], rax
cmp eax, 8
jae 0x1400026fa
mov r13, qword [rsp + 0x70]
lea rax, str.__g_
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_get_Shell32.dll_base_address_in_explorer.exeCould_not_find_explorer.exe_n
mov qword [rsp + 0xc0], rax
lea rax, [0x140675dbe]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x60]
lea rax, [0x140675afb]
mov qword [rsp + 0xc0], rax
lea rax, [0x140675b00]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call sub.USER32.dll_MessageBoxW
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002509
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140002524
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002659
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x70]
lea rax, [0x140675de0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Could_not_find_explorer.exece2a946b_2451_4e5f_a828_41cbde5bfc18EditButtonfailed_to_spawn_thread_rustc_8d6b88b168e45ee1624699c19443c49665322a91library_std_src_threadmod.rs
mov qword [rsp + 0xc0], rax
lea rax, [0x140675e0b]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x60]
lea rax, [0x140675afb]
mov qword [rsp + 0xc0], rax
lea rax, [0x140675b00]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call sub.USER32.dll_MessageBoxW
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000263e
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140002659
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x14000267c
mov rcx, qword [rsp + 0xa0]
add rdx, rdx
mov r8d, 2
call fcn.140005990
test r13, r13
je 0x140002024
mov r8d, 1
mov rcx, qword [rsp + 0xb8]
mov rdx, r13
call fcn.140005990
jmp 0x140002024
lea rax, str.Failed_to_open_explorer.exe_n
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_open_explorer.exeErrorShell32.dllFailed_to_load_Shell32.dll_into_the_current_process._n_v_g_
mov qword [rsp + 0xc0], rax
lea rax, [0x140675afb]
jmp 0x140002595
mov rax, qword [rsp + 0x88]
shr eax, 3
mov qword [rsp + 0x88], rax
lea r15, [rsp + 0x58]
xor edi, edi
mov qword [rsp + 0x78], rbp
jmp 0x14000274f
mov edx, 0x208
mov r8d, 2
mov rcx, qword [rsp + 0x90]
call fcn.140005990
mov rax, qword [rsp + 0xb0]
mov rdi, rax
cmp qword [rsp + 0x88], rax
mov r15, r13
je 0x140002406
mov ecx, 0x208
mov edx, 2
call fcn.1400059b0
test rax, rax
je 0x140002f90
cmp rdi, 0x400
je 0x14000300e
mov r13, rax
lea rax, [rdi + 1]
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + rdi*8 + 0xc0]
mov rcx, rbp
mov r8, r13
mov r9d, 0x104
call sub.PSAPI.DLL_GetModuleFileNameExW
mov r8d, 0x104
lea r14, [rsp + 0x38]
mov rcx, r14
mov rdx, r13
call fcn.14000a4d0
mov rcx, r14
call fcn.140010370
mov r8, rdx
mov rcx, r15
mov rdx, rax
call fcn.140010380
mov r12, qword [rsp + 0x68]
test r12, r12
js 0x140003000
mov rbx, qword [rsp + 0x60]
je 0x140002805
movzx eax, byte [0x140683141]
mov r14d, 1
mov edx, 1
mov rcx, r12
call fcn.140005980
test rax, rax
je 0x140003024
mov r14, rax
jmp 0x14000280b
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x58]
lea rax, [rdx*2]
test rax, rax
je 0x140002839
mov r8d, 1
mov rcx, rbx
call fcn.140005990
mov qword [rsp + 0x90], r13
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000285b
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.140005990
mov r13, r15
mov rcx, r15
mov r15, r14
mov rdx, r14
mov r8, r12
call fcn.140019090
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov r8d, 0xb
lea rcx, [rsp + 0x38]
lea rdx, [0x140675b00]
call fcn.140019090
mov r14, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, r14
mov r8, rbx
mov r9, rbp
call fcn.1400010b0
test al, al
jne 0x140002903
mov rdx, qword [rsp + 0x38]
test rdx, rdx
mov rbp, qword [rsp + 0x78]
je 0x1400028c9
mov r8d, 1
mov rcx, r14
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400028e1
mov r8d, 1
mov rcx, rbx
call fcn.140005990
test r12, r12
mov rbx, r15
je 0x14000271b
mov r8d, 1
mov rcx, rbx
mov rdx, r12
call fcn.140005990
jmp 0x14000271b
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000291b
mov r8d, 1
mov rcx, r14
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov r14, qword [rsp + 0x90]
je 0x14000293b
mov r8d, 1
mov rcx, rbx
call fcn.140005990
mov rbp, qword [rsp + rdi*8 + 0xc0]
test r12, r12
je 0x140002959
mov r8d, 1
mov rcx, r15
mov rdx, r12
call fcn.140005990
mov edx, 0x208
mov r8d, 2
mov rcx, r14
call fcn.140005990
lea rax, [0x140675b00]
mov qword [rsp + 0xc0], rax
lea r14, [0x140675b0b]
mov qword [rsp + 0xc8], r14
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_LoadLibraryW
mov rbx, rax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400029dc
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
test rbx, rbx
mov r13, qword [rsp + 0x70]
je 0x140002c2e
lea rax, [0x140675b00]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r14
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_GetModuleHandleW
mov rdi, rax
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002a53
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140005990
lea rdx, [0x140675b84]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140002c88
mov r15, rax
mov r14, qword [rsp + 0xa8]
add r14, r14
mov dword [rsp + 0x20], 4
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
xor edx, edx
mov r8, r14
mov r9d, 0x3000
call sub.KERNEL32.dll_VirtualAllocEx
test rax, rax
je 0x140002cdf
mov r12, rax
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rax
mov r8, r13
mov r9, r14
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140002e0b
sub r15, rdi
add r15, rbp
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
mov r9, r15
call sub.KERNEL32.dll_CreateRemoteThread
test rax, rax
je 0x140002e62
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdi
mov rcx, rbx
call rdi
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x140002b33
add rdx, rdx
mov r8d, 2
mov rcx, r13
call fcn.140005990
cmp byte [0x140683100], 0
jne 0x140002b56
lea rdi, [0x140001900]
mov rcx, rdi
xor edx, edx
call sub.USER32.dll_EnumWindows
cmp byte [0x140683100], 1
jne 0x140002b43
mov rdi, qword [0x140683108]
lea rdx, [0x140001a90]
mov rcx, rdi
xor r8d, r8d
call sub.USER32.dll_EnumChildWindows
cmp byte [0x140683110], 1
mov r13, qword [rsp + 0x70]
jne 0x14000267c
mov rbx, qword [0x140683118]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
lea r9, [rsp + 0xc0]
mov r8d, 4
mov rcx, rbx
mov edx, 0x130a
call sub.USER32.dll_SendMessageW
mov eax, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
add eax, dword [rsp + 0xc0]
mov edx, eax
shr edx, 0x1f
add edx, eax
add ecx, dword [rsp + 0xc4]
sar edx, 1
mov eax, ecx
shr eax, 0x1f
add eax, ecx
and eax, 0xfffffffe
shl eax, 0xf
or eax, edx
movsxd r14, eax
mov rcx, rbx
mov edx, 0x201
xor r8d, r8d
mov r9, r14
call sub.USER32.dll_PostMessageW
mov rcx, rbx
mov edx, 0x202
xor r8d, r8d
mov r9, r14
call sub.USER32.dll_PostMessageW
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.140007e30
lea rdx, [0x140001b90]
mov rcx, rdi
xor r8d, r8d
call sub.USER32.dll_EnumChildWindows
jmp 0x14000267c
lea rax, [0x140675b40]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_load_Shell32.dll_into_the_current_process.SHObjectProperties
mov qword [rsp + 0xc0], rax
lea rax, [0x140675b84]
jmp 0x140002595
lea rax, str.Failed_to_get_SHObjectProperties_address_locally_n
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_get_SHObjectProperties_address_locallyFailed_to_allocate_memory_in_explorer.exe_n
mov qword [rsp + 0xc0], rax
lea rax, [0x140675c08]
jmp 0x140002d34
lea rax, str._bg_
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_allocate_memory_in_explorer.exeFailed_to_write_memory_in_explorer.exe_nqg_
mov qword [rsp + 0xc0], rax
lea rax, [0x140675c71]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x60]
lea rax, [0x140675afb]
mov qword [rsp + 0xc0], rax
lea rax, [0x140675b00]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call sub.USER32.dll_MessageBoxW
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002ddd
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rbx, qword [rsp + 0x78]
je 0x140002dfd
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002659
lea rax, [0x140675c98]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_write_memory_in_explorer.exeFailed_to_create_remote_thread_in_explorer.exe_n
mov qword [rsp + 0xc0], rax
lea rax, [0x140675cce]
jmp 0x140002eb7
lea rax, [0x140675d00]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rcx, [rsp + 0xc0]
call fcn.140009bd0
lea rax, str.Failed_to_create_remote_thread_in_explorer.exeFailed_to_get_Shell32.dll_base_address_in_explorer.exe_n
mov qword [rsp + 0xc0], rax
lea rax, [0x140675d3e]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rdi, qword [rsp + 0x60]
lea rax, [0x140675afb]
mov qword [rsp + 0xc0], rax
lea rax, [0x140675b00]
mov qword [rsp + 0xc8], rax
mov word [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.140003bb0
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call sub.USER32.dll_MessageBoxW
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140002f60
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140005990
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140002f7b
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005990
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x70]
jmp 0x140002659
mov ecx, 2
mov edx, 0x208
call fcn.140020525
mov qword [rsp + 0xc0], rdx
lea rax, [0x140021650]
jmp 0x140002fbf
mov qword [rsp + 0xc0], rax
lea rax, [0x140675a68]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021590]
lea r9, [0x140021550]
lea r8, [rsp + 0xc0]
mov edx, 0x2b
call fcn.140020940
xor r15d, r15d
mov rcx, r15
mov rdx, rbx
call fcn.140020525
mov rbx, rbp
mov rcx, r15
mov rdx, rbx
call fcn.140020525
mov rdx, rbx
xor r14d, r14d
mov rcx, r14
call fcn.140020525
lea r8, [0x140675a98]
mov ecx, 0x400
mov edx, 0x400
call fcn.140020774
mov rdx, r12
mov rcx, r14
call fcn.140020525
int3