Function at 0x140044d40
Capabilities:
Encode data using xor
Execute command
Hash data using fnv
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 8], cl
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x30], r14d
test cl, cl
jne 0x14001e9a6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 0xe]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Loading_USNJournal_into_memory..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, ds:[r14 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rsp + 0x620], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x630], xmm1
mov r8d, 0x55
lea rdx, str.fsutil_usn_readjournal_c:_csv__findstr__i__c:0x80000200__c:0x00001000____journal.txt
lea rcx, [rsp + 0x620]
call fcn.140006ca0
nop
lea rcx, [rsp + 0x620]
cmp qword [rsp + 0x638], 7
cmova rcx, qword [rsp + 0x620]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
test eax, eax
je 0x14001ea51
mov rdx, qword [rsp + 0x638]
cmp rdx, 7
jbe 0x14001f0e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ea47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ea47
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
jmp 0x14001f0e5
lea rcx, [rsp + 0x110]
call fcn.1400084a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x5a0], xmm0
mov qword [rsp + 0x5b0], r14
mov qword [rsp + 0x5b8], 7
mov word [rsp + 0x5a0], r14w
movups xmmword [rsp + 0x580], xmm0
mov qword [rsp + 0x590], r14
mov qword [rsp + 0x598], 7
mov word [rsp + 0x580], r14w
movups xmmword [rsp + 0x5c0], xmm0
mov qword [rsp + 0x5d0], 0xb
mov qword [rsp + 0x5d8], 0xf
movsd xmm0, qword [0x1400581b0]
movsd qword [rsp + 0x5c0], xmm0
movzx eax, word [0x1400581b8]
mov word [rsp + 0x5c8], ax
movzx eax, byte [0x1400581ba]
mov byte [rsp + 0x5ca], al
mov byte [rsp + 0x5cb], 0
lea rdx, str.Dump_the__csrss.exe__process_with_the_MOST_private_bytes_using_System_Informer_and_save_the_results_to_any_directory._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x550], xmm1
mov r8d, 0x99
lea rdx, str.After_doing_this__enter_here_the_full_path_of_the_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x540]
call fcn.140006ca0
nop
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x560]
call fcn.14001e260
mov rbx, rax
lea rax, [rsp + 0x5a0]
cmp rax, rbx
je 0x14001ebfc
mov rdx, qword [rsp + 0x5b8]
cmp rdx, 7
jbe 0x14001ebb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ebb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ec3e
call fcn.1400499d0
mov qword [rsp + 0x5b0], r14
mov qword [rsp + 0x5b8], 7
mov word [rsp + 0x5a0], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x5a0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x5b0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rsp + 0x578]
cmp rdx, 7
jbe 0x14001ec4c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ec47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ec47
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rsp + 0x570], xmm0
mov word [rsp + 0x560], r14w
mov rdx, qword [rsp + 0x558]
cmp rdx, 7
jbe 0x14001ecb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x540]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ecad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ecad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rsp + 0x550], xmm0
mov word [rsp + 0x540], r14w
cmp qword [rsp + 0x5b0], 0
jne 0x14001ee51
lea rax, [rsp + 0x5c0]
cmp qword [rsp + 0x5d8], 0xf
cmova rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x5d0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x540]
call fcn.1400235e0
nop
lea rcx, [rsp + 0x540]
cmp qword [rsp + 0x558], 7
cmova rcx, qword [rsp + 0x540]
call fcn.140049210
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020c91
lea rcx, [rsp + 0x540]
call fcn.140005e20
nop
mov rdx, qword [rsp + 0x5d8]
cmp rdx, 0xf
jbe 0x14001ed9b
inc rdx
mov rcx, qword [rsp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ed96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020c8a
call fcn.1400499d0
mov qword ds:[rsp + 0x5d0], r14
mov qword [rsp + 0x5d8], 0xf
mov byte [rsp + 0x5c0], 0
mov r8, qword [rsp + 0x598]
cmp r8, 7
jbe 0x14001edd3
mov rdx, qword [rsp + 0x580]
call fcn.140006500
mov qword ds:[rsp + 0x590], r14
mov qword ds:[rsp + 0x598], 7
mov word [rsp + 0x580], r14w
mov rdx, qword [rsp + 0x5b8]
cmp rdx, 7
jbe 0x14001f09e
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x5a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ee47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ee47
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
jmp 0x14001f09e
lea rdx, str.Now__repeat_the_same_process_again__but_now_dump_the__csrss.exe__process_with_the_LESS_private_bytes._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.140006aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x550], xmm1
mov r8d, 0x8e
lea rdx, str.Enter_here_the_full_path_of_the_second_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x540]
call fcn.140006ca0
nop
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x640]
call fcn.14001e260
mov rbx, rax
lea rax, [rsp + 0x580]
cmp rax, rbx
je 0x14001ef1b
mov r8, qword [rsp + 0x598]
cmp r8, 7
jbe 0x14001eed7
mov rdx, qword [rsp + 0x580]
call fcn.140006500
mov qword [rsp + 0x590], r14
mov qword [rsp + 0x598], 7
mov word [rsp + 0x580], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x580], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x590], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rsp + 0x640]
call fcn.140005e20
nop
mov r8, qword [rsp + 0x558]
cmp r8, 7
jbe 0x14001ef45
mov rdx, qword ds:[rsp + 0x540]
call fcn.140006500
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rsp + 0x550], xmm0
mov word [rsp + 0x540], r14w
cmp qword [rsp + 0x590], 0
jne 0x14001f112
lea rax, [rsp + 0x5c0]
cmp qword [rsp + 0x5d8], 0xf
cmova rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x5d0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x540]
call fcn.1400235e0
nop
lea rcx, [rsp + 0x540]
cmp qword [rsp + 0x558], 7
cmova rcx, qword [rsp + 0x540]
call fcn.140049210
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020caa
lea rcx, [rsp + 0x540]
call fcn.140005e20
nop
mov rdx, qword [rsp + 0x5d8]
cmp rdx, 0xf
jbe 0x14001f02f
inc rdx
mov rcx, qword [rsp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f02a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020c8a
call fcn.1400499d0
mov byte [rsp + 0x5c0], 0
mov qword [rsp + 0x5d8], 0xf
mov qword [rsp + 0x5d0], r14
mov r8, qword [rsp + 0x598]
cmp r8, 7
jbe 0x14001f066
mov rdx, qword [rsp + 0x580]
call fcn.140006500
mov word [rsp + 0x580], r14w
mov qword [rsp + 0x598], 7
mov qword [rsp + 0x590], r14
mov r8, qword [rsp + 0x5b8]
cmp r8, 7
jbe 0x14001f09e
mov rdx, qword [rsp + 0x5a0]
call fcn.140006500
mov qword [rsp + 0x5b0], r14
mov qword [rsp + 0x5b8], 7
mov word [rsp + 0x5a0], r14w
lea rcx, [rsp + 0x110]
call fcn.140008420
nop
mov r8, qword [rsp + 0x638]
cmp r8, 7
jbe 0x14001f0e5
mov rdx, qword ds:[rsp + 0x620]
call fcn.140006500
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400499b0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [rsp + 0x5a0]
cmp qword [rsp + 0x5b8], 7
cmova rdx, qword [rsp + 0x5a0]
lea rcx, [rsp + 0x300]
call fcn.1400218e0
nop
lea rdx, [rsp + 0x580]
cmp qword [rsp + 0x598], 7
cmova rdx, qword [rsp + 0x580]
lea rcx, [rsp + 0x410]
call fcn.1400218e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x550], xmm1
mov r8d, 0xb
lea rdx, str.journal.txt
lea rcx, [rsp + 0x540]
call fcn.140006ca0
nop
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x150]
call fcn.14001dfa0
nop
lea rcx, [rsp + 0x540]
call fcn.140005e20
lea rdx, str.___._.exe.dll.dll...config.exe.config____A_Z_:...
lea rcx, [rsp + 0x240]
call fcn.140020d80
nop
lea rdx, str._A_Za_z_:._.dll
lea rcx, [rsp + 0x1a0]
call fcn.140020d80
nop
lea rdx, str._A_Za_z_:._.exe
lea rcx, [rsp + 0x218]
call fcn.140020d80
nop
lea rdx, str._A_Za_z_:__:_.___.__
lea rcx, [rsp + 0x1f0]
call fcn.140020d80
nop
lea rdx, str.____:_.___.__
lea rcx, [rsp + 0x1c8]
call fcn.140020d80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x5e0], xmm0
mov qword [rsp + 0x5f0], r14
mov qword [rsp + 0x5f8], 7
mov word [rsp + 0x5e0], r14w
xor bl, bl
mov byte [rsp + 0x34], bl
lea r12, [0x14006c0c8]
movabs r13, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
test bl, bl
jne 0x140020b7d
nop word [rax + rax]
cmp byte [rsp + 0x6a0], bl
jne 0x14001f30c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_DLL_Injections..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, str._Memory_Scanner__Scanning_executed_files_with_modified_extensions..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_extension..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_name..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop dword [rax]
mov rax, qword [rsp + 0x300]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x300]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x300]
call fcn.140022be0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
nop dword [rax + rax]
test al, al
je 0x14002034e
mov r8, qword [rsp + 0x5f0]
cmp r8, 0x190
ja 0x14001f310
lea rdx, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], 7
cmova rdx, qword [rsp + 0x5e0]
test r8, r8
je 0x14001f310
mov rax, r8
mov rcx, rdx
mov rdi, r14
cmp word [rdx], 0x3a
je 0x14001f3c3
nop dword [rax + rax]
cmp rax, 1
je 0x14001f3c6
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14001f3b0
mov rdi, rcx
test rdi, rdi
je 0x14001f310
sub rdi, rdx
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001f310
lea rcx, [rdi + 2]
cmp rcx, r8
jae 0x14001f310
xorps xmm0, xmm0
movups xmmword [rsp + 0x520], xmm0
mov qword [rsp + 0x530], r14
mov qword [rsp + 0x538], r14
ja 0x140020cc6
lfence
mov rax, qword [rsp + 0x5f0]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], 7
cmova rax, qword [rsp + 0x5e0]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x520]
call fcn.140006ca0
mov r15d, dword [rsp + 0x30]
or r15d, 0x10
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov rax, qword [rsp + 0x530]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x240]
call fcn.140022dc0
nop dword [rax]
test al, al
je 0x14001fba5
lea r8, [rsp + 0x520]
mov rdi, qword [rsp + 0x520]
mov rsi, qword [rsp + 0x538]
cmp rsi, 7
cmova r8, rdi
movabs rdx, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x530]
lea r9, [rbx + rbx]
mov rcx, r14
test r9, r9
je 0x14001f505
nop word [rax + rax]
movzx eax, byte ds:[r8 + rcx]
xor rdx, rax
imul rdx, r13
inc rcx
cmp rcx, r9
jb 0x14001f4f0
mov rcx, qword [rsp + 0x140]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsp + 0x128]
mov r9, qword [rax + rcx*8 + 8]
mov r10, qword [rsp + 0x118]
cmp r9, r10
je 0x14001f591
mov r11, qword [rax + rcx*8]
lea rax, ds:[r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14001f545
mov rax, qword [rax]
lea r8, [rsp + 0x520]
cmp rsi, 7
cmova r8, rdi
cmp rbx, rcx
jne 0x14001f588
mov rdx, rbx
test rbx, rbx
je 0x14001f594
sub r8, rax
nop dword [rax + rax]
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x14001f588
add rax, 2
sub rdx, 1
jne 0x14001f570
jmp 0x14001f594
cmp r9, r11
jne 0x14001fb9b
mov r9, r14
mov rax, r10
test r9, r9
cmovne rax, r9
cmp rax, r10
jne 0x14001f8e4
lea rdx, ds:[rsp + 0x520]
cmp rsi, 7
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r14
mov qword [rsp + 0x558], r14
mov r8, rbx
lea rcx, [rsp + 0x540]
call fcn.140006ca0
or r15d, 0xc000
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x190]
call fcn.140004f60
movsd xmm0, qword ds:[rax]
movsd qword [rsp + 0xf0], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x88], r12
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x40], xmm0
mov eax, dword [rsp + 0xf0]
test eax, eax
je 0x14001f7b2
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
sete bl
lea rcx, [rsp + 0x540]
call fcn.140005e20
test bl, bl
je 0x14001f8cc
lea rax, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rax, qword [rsp + 0x520]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140005060
test al, al
jne 0x14001f8cc
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov qword [rsp + 0x20], 3
lea r9, [0x1400530f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x530]
call fcn.140008f40
nop dword [rax]
cmp rax, 0xffffffffffffffff
jne 0x14001f7c5
lea rcx, ds:[rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov qword [rsp + 0x20], 3
lea r9, [0x1400587e0]
xor r8d, r8d
mov rdx, qword [rsp + 0x530]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
jne 0x14001f7c5
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x520]
lea rdx, [rsp + 0x288]
call fcn.140006820
jmp 0x14001f8cc
mov bl, 1
test ecx, ecx
jne 0x140020ccc
nop dword [rax]
jmp 0x14001f658
lea rdx, ds:[rsp + 0x520]
mov rdi, qword [rsp + 0x520]
mov rsi, qword [rsp + 0x538]
cmp rsi, 7
cmova rdx, rdi
movabs r9, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x530]
lea r8, [rbx + rbx]
mov rcx, r14
test r8, r8
je 0x14001f825
nop word [rax + rax]
movzx eax, byte ds:[rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14001f810
lea r8, ds:[rsp + 0x520]
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x150]
call fcn.1400097a0
mov rcx, qword ds:[rax + 8]
mov rax, qword [rsp + 0x158]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x158]
je 0x14001f8e4
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x520]
lea rdx, [rsp + 0x2a8]
call fcn.140006820
mov rdi, qword [rsp + 0x520]
mov rbx, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x538]
lea rdx, [rsp + 0x520]
cmp rsi, 7
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], r14
mov r8, rbx
lea rcx, [rsp + 0x560]
call fcn.140006ca0
or r15d, 0xc00
or r15d, 1
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rcx, qword [rsp + 0x560]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0x540]
call fcn.140048e90
mov r8d, eax
test eax, eax
jne 0x14001f9be
mov edx, dword [rsp + 0x550]
test dl, 1
mov ecx, 0x1ff
mov edi, 0x16d
cmovne ecx, edi
mov dword [rsp + 0x44], ecx
bt edx, 0xa
jae 0x14001f9b0
mov eax, dword [rsp + 0x554]
cmp eax, 0xa000000c
jne 0x14001f9a2
lea eax, ds:[r8 + 4]
jmp 0x14001f9e2
cmp eax, 0xa0000003
jne 0x14001f9b0
mov eax, 0xa
jmp 0x14001f9e2
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14001f9e2
mov dword [rsp + 0x44], 0xffff
sub eax, 2
je 0x14001f9dd
sub eax, 1
je 0x14001f9dd
sub eax, 0x32
je 0x14001f9dd
cmp eax, 0x46
mov eax, r14d
jne 0x14001f9e2
mov eax, 1
mov dword [rsp + 0xa0], r8d
mov qword [rsp + 0xa8], r12
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x14001fa59
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
je 0x14001fa69
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
nop dword [rax]
test eax, eax
je 0x14001fa69
lea rdx, [rsp + 0x520]
call fcn.140047dc0
test al, al
jne 0x14001fa69
mov bl, 1
jmp 0x14001fa6b
nop dword [rax]
test r8d, r8d
jne 0x140020cdf
xor bl, bl
test r15b, 1
je 0x14001fab2
and r15d, 0xfffffffe
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x578]
cmp r8, 7
jbe 0x14001fa95
mov rdx, qword [rsp + 0x560]
call fcn.140006500
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], 7
mov word [rsp + 0x560], r14w
test bl, bl
je 0x14001fb06
lea rdx, str.___Executed__Unsigned_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, ds:[rsp + 0x520]
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x110]
call fcn.140022600
nop
mov rdx, qword [rsp + 0x538]
cmp rdx, 7
jbe 0x14001fb6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fb6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002031e
call fcn.1400499d0
mov qword [rsp + 0x530], r14
mov qword [rsp + 0x538], 7
mov word [rsp + 0x520], r14w
movabs rsi, 0xcbf29ce484222325
jmp 0x14001f310
mov r9, qword ds:[r9 + 8]
jmp 0x14001f531
lea rcx, ds:[rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov rax, qword [rsp + 0x530]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x1a0]
call fcn.140022dc0
test al, al
je 0x14001fd85
lea rax, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rax, qword [rsp + 0x520]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140005060
test al, al
jne 0x14001fd85
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r14
mov qword [rsp + 0x558], r14
mov r8, qword [rsp + 0x530]
lea rcx, [rsp + 0x540]
call fcn.140006ca0
or r15d, 0x600000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
call fcn.140004ef0
movzx ebx, al
lea rcx, [rsp + 0x540]
call fcn.140005e20
test bl, bl
je 0x14001fd22
lea rdx, [rsp + 0x520]
call fcn.140047dc0
test al, al
jne 0x14001fd6f
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x14001fd6f
lea rdx, [0x1400589b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, ds:[rsp + 0x520]
lea rdx, [rsp + 0x2c8]
call fcn.140006820
lea rax, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rax, qword [rsp + 0x520]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140005060
test al, al
jne 0x1400202d5
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov rax, qword [rsp + 0x530]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x1f0]
call fcn.140022dc0
test al, al
jne 0x14001fe59
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov rax, qword [rsp + 0x530]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x1c8]
call fcn.140022dc0
test al, al
je 0x1400202bf
lea rdx, ds:[rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], r14
mov r8, qword [rsp + 0x530]
lea rcx, [rsp + 0x560]
call fcn.140006ca0
or r15d, 0x180000
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x560]
lea rcx, [rsp + 0x60]
call fcn.140004f60
movsd xmm0, qword [rax]
movsd qword [rsp + 0x70], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0x70]
test edx, edx
je 0x14001feeb
lea eax, ds:[rcx - 1]
test eax, 0xfffffff7
jne 0x140020cf2
cmp ecx, 3
je 0x14001ff63
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r14
mov qword [rsp + 0x558], r14
mov r8, qword [rsp + 0x530]
lea rcx, [rsp + 0x540]
call fcn.140006ca0
or r15d, 0x3000000
or r15d, 4
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
call fcn.140004ef0
test al, al
je 0x14001ff63
mov bl, 1
jmp 0x14001ff65
xor bl, bl
test r15b, 4
je 0x14001ff86
and r15d, 0xfffffffb
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
call fcn.140005e20
nop
test r15b, 2
je 0x14001ffd0
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x578]
cmp r8, 7
jbe 0x14001ffb3
mov rdx, qword [rsp + 0x560]
call fcn.140006500
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], 7
mov word [rsp + 0x560], r14w
test bl, bl
je 0x140020026
lea rdx, str.___Executed_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], r14
mov r8, qword [rsp + 0x530]
lea rcx, [rsp + 0x560]
call fcn.140006ca0
or r15d, 0x60000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x560]
call fcn.140004ef0
movzx ebx, al
mov r8, qword [rsp + 0x578]
cmp r8, 7
jbe 0x1400200a7
mov rdx, qword [rsp + 0x560]
call fcn.140006500
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], 7
mov word [rsp + 0x560], r14w
test bl, bl
jne 0x1400202bf
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov qword [rsp + 0x20], 3
lea r9, [0x1400530f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x530]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
jne 0x1400201eb
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
mov qword [rsp + 0x20], 3
lea r9, [0x1400587e0]
xor r8d, r8d
mov rdx, qword [rsp + 0x530]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
jne 0x1400201eb
lea rcx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rcx, qword [rsp + 0x520]
lea r8, [rdi + 1]
mov qword [rsp + 0x20], 1
lea r9, [0x140052380]
mov rdx, qword [rsp + 0x530]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
je 0x1400202bf
lea rdx, str.___Executed__Deleted_file_without_extension__false_flags_here_cant_be_fixed_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400202bf
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r9, rsi
mov rax, qword [rsp + 0x530]
lea r8, [rax + rax]
mov rcx, r14
test r8, r8
je 0x140020233
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x140020220
lea r8, [rsp + 0x520]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x150]
call fcn.1400097a0
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0x158]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x158]
je 0x1400202bf
lea rdx, str.___Executed__Deleted_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.140006aa0
lea rdx, [rsp + 0x520]
cmp qword [rsp + 0x538], 7
cmova rdx, qword [rsp + 0x520]
mov r8, qword [rsp + 0x530]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x520]
lea rdx, [rsp + 0x2e8]
call fcn.140006820
nop
mov rdx, qword ds:[rsp + 0x538]
cmp rdx, 7
jbe 0x14002032c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020327
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
mov qword [rsp + 0x530], r14
mov qword [rsp + 0x538], 7
mov word [rsp + 0x520], r14w
jmp 0x14001f310
lea rcx, [rsp + 0x310]
call fcn.140022020
nop dword [rax + rax]
test rax, rax
jne 0x140020389
mov rax, qword [rsp + 0x300]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x300]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
lea rdx, [rsp + 0x5a0]
cmp qword [rsp + 0x5b8], 7
cmova rdx, qword [rsp + 0x5a0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], r14
mov r8, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x560]
call fcn.140006ca0
or r15d, 0xc0
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rcx, qword [rsp + 0x560]
call fcn.140049210
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020d07
lea rcx, [rsp + 0x560]
call fcn.140005e20
lea rdi, [0x1400581b0]
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], 0xb
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x540]
call fcn.1400235e0
or r15d, 0x20
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
cmp qword [rsp + 0x558], 7
cmova rcx, qword [rsp + 0x540]
call fcn.140049210
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020d20
lea rcx, [rsp + 0x540]
call fcn.140005e20
nop
jmp 0x1400204b1
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_executed_and_unsigned_files..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop word [rax + rax]
mov rax, qword [rsp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x410]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x410]
call fcn.140022be0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140020a8e
mov r9, qword ds:[rsp + 0x5f0]
nop
cmp r9, 0x190
ja 0x140020500
lea r8, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], 7
cmova r8, qword [rsp + 0x5e0]
test r9, r9
je 0x140020500
mov rax, r9
mov rcx, r8
mov rdx, r14
cmp word [r8], 0x3a
je 0x1400205b3
nop dword [rax]
cmp rax, 1
je 0x1400205b6
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x1400205a0
mov rdx, rcx
test rdx, rdx
je 0x140020500
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140020500
add rdx, 2
cmp rdx, r9
jae 0x140020500
xorps xmm0, xmm0
movups xmmword [rsp + 0x560], xmm0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], r14
ja 0x140020d39
lfence
mov rax, qword [rsp + 0x5f0]
sub rax, rdx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], 7
cmova rax, qword [rsp + 0x5e0]
lea rdx, [rax + rdx*2]
lea rcx, [rsp + 0x560]
call fcn.140006ca0
mov r15d, dword [rsp + 0x30]
or r15d, 8
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rdx, qword [rsp + 0x560]
xorps xmm0, xmm0
movups xmmword [rsp + 0x600], xmm0
mov qword [rsp + 0x610], r14
mov qword [rsp + 0x618], r14
mov r8, qword [rsp + 0x570]
lea rcx, [rsp + 0x600]
call fcn.140006ca0
mov rdi, r14
lea rbx, [rsp + 0x600]
cmp qword [rsp + 0x618], 7
seta r8b
cmova rbx, qword [rsp + 0x600]
lea rcx, [rsp + 0x600]
test r8b, r8b
cmovne rcx, qword [rsp + 0x600]
mov rax, qword [rsp + 0x610]
lea rsi, [rcx + rax*2]
cmp rbx, rsi
je 0x140020705
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsxd rcx, eax
imul rdi, rdi, 0x1f
add rdi, rcx
add rbx, 2
cmp rbx, rsi
jne 0x1400206e5
mov r9, rdi
lea r8, [rsp + 0x600]
lea rdx, [rsp + 0x268]
call fcn.140007100
mov rcx, qword ds:[rax + 8]
mov rdi, qword [0x14006f918]
mov rbx, rdi
test rcx, rcx
cmovne rbx, rcx
mov rdx, qword [rsp + 0x618]
cmp rdx, 7
jbe 0x14002078c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020787
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020787
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
mov qword [rsp + 0x610], r14
mov qword [rsp + 0x618], 7
mov word [rsp + 0x600], r14w
cmp rbx, rdi
jne 0x140020a20
lea rcx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rcx, qword [rsp + 0x560]
mov rax, qword [rsp + 0x570]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x218]
call fcn.140022dc0
test al, al
je 0x140020a20
lea rdx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rdx, qword [rsp + 0x560]
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r14
mov qword [rsp + 0x558], r14
mov r8, qword [rsp + 0x570]
lea rcx, [rsp + 0x540]
call fcn.140006ca0
or r15d, 0x3000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
cmp qword [rsp + 0x558], 7
cmova rcx, qword [rsp + 0x540]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0x640]
call fcn.140048e90
mov r8d, eax
test eax, eax
jne 0x1400208dc
mov edx, dword [rsp + 0x650]
test dl, 1
mov ecx, 0x1ff
mov eax, 0x16d
cmovne ecx, eax
mov dword [rsp + 0x44], ecx
bt edx, 0xa
jae 0x1400208ce
mov eax, dword [rsp + 0x654]
cmp eax, 0xa000000c
jne 0x1400208ba
lea eax, [r8 + 4]
jmp 0x140020900
nop word [rax + rax]
cmp eax, 0xa0000003
jne 0x1400208ce
mov eax, 0xa
jmp 0x140020900
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x140020900
mov dword [rsp + 0x44], 0xffff
sub eax, 2
je 0x1400208fb
sub eax, 1
je 0x1400208fb
sub eax, 0x32
je 0x1400208fb
cmp eax, 0x46
mov eax, r14d
jne 0x140020900
mov eax, 1
mov dword ds:[rsp + 0xe0], r8d
mov qword [rsp + 0xe8], r12
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x1400209ad
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
setne bl
lea rcx, [rsp + 0x540]
call fcn.140005e20
test bl, bl
je 0x1400209bd
lea rdx, [rsp + 0x560]
call fcn.140047dc0
test al, al
jne 0x140020a0a
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rdx, qword [rsp + 0x560]
mov r8, qword [rsp + 0x570]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140020a0a
xor bl, bl
test r8d, r8d
jne 0x140020d3f
jmp 0x140020938
lea rdx, [0x1400589b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, [rsp + 0x560]
cmp qword [rsp + 0x578], 7
cmova rdx, qword [rsp + 0x560]
mov r8, qword [rsp + 0x570]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x560]
lea rdx, [rsp + 0x278]
call fcn.140006820
nop
mov rdx, qword [rsp + 0x578]
cmp rdx, 7
jbe 0x140020a6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020a67
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
mov qword [rsp + 0x570], r14
mov qword [rsp + 0x578], 7
mov word [rsp + 0x560], r14w
jmp 0x140020500
lea rcx, [rsp + 0x420]
call fcn.140022020
nop dword [rax + rax]
test rax, rax
jne 0x140020ac9
mov rax, qword [rsp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x410]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov bl, 1
mov byte [rsp + 0x34], bl
lea rdx, [rsp + 0x580]
cmp qword [rsp + 0x598], 7
cmova rdx, qword [rsp + 0x580]
xorps xmm0, xmm0
movups xmmword [rsp + 0x540], xmm0
mov qword [rsp + 0x550], r14
mov qword [rsp + 0x558], r14
mov r8, qword [rsp + 0x590]
lea rcx, [rsp + 0x540]
call fcn.140006ca0
or r15d, 0x300
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x540]
cmp qword [rsp + 0x558], 7
cmova rcx, qword [rsp + 0x540]
call fcn.140049210
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020d52
lea rcx, ds:[rsp + 0x540]
call fcn.140005e20
nop
jmp 0x14001f265
mov r8, qword [rsp + 0x5f8]
cmp r8, 7
jbe 0x140020b98
mov rdx, qword [rsp + 0x5e0]
call fcn.140006500
mov qword ds:[rsp + 0x5f0], r14
mov qword [rsp + 0x5f8], 7
mov word [rsp + 0x5e0], r14w
lea rcx, [rsp + 0x1c8]
call fcn.140016b80
nop
lea rcx, [rsp + 0x1f0]
call fcn.140016b80
nop
lea rcx, [rsp + 0x218]
call fcn.140016b80
nop
lea rcx, [rsp + 0x1a0]
call fcn.140016b80
nop
lea rcx, [rsp + 0x240]
call fcn.140016b80
nop
lea rcx, [rsp + 0x150]
call fcn.140008420
nop
lea rcx, [rsp + 0x410]
call fcn.14001e1e0
nop
lea rcx, [rsp + 0x300]
call fcn.14001e1e0
nop
mov rdx, qword [rsp + 0x5d8]
cmp rdx, 0xf
jbe 0x14001f02f
inc rdx
mov rcx, qword [rsp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f02a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f02a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
shr rdx, 0x20
lea r8, [rsp + 0x540]
lea rcx, [0x140057cc0]
call fcn.14000a560
nop
shr rdx, 0x20
lea r8, [rsp + 0x540]
lea rcx, [0x140057cc0]
call fcn.14000a560
nop
call fcn.140008880
nop
lea r8, [rsp + 0x540]
lea rdx, [rsp + 0x40]
call fcn.140004e90
nop
lea r8, [rsp + 0x560]
lea rdx, [rsp + 0x40]
call fcn.140004e90
nop
lea r8, [rsp + 0x560]
lea rcx, str.status
call fcn.14000a560
nop
shr rdx, 0x20
lea r8, [rsp + 0x560]
lea rcx, [0x140057cc0]
call fcn.14000a560
nop
shr rdx, 0x20
lea r8, [rsp + 0x540]
lea rcx, [0x140057cc0]
call fcn.14000a560
nop
call fcn.140008880
nop
lea r8, [rsp + 0x540]
lea rdx, [rsp + 0x40]
call fcn.140004e90
nop
shr rdx, 0x20
lea r8, [rsp + 0x540]
lea rcx, [0x140057cc0]
call fcn.14000a560
int3
movzx ecx, dl
jmp 0x14001e920