Function at 0x140006940
Capabilities:
Encode data using xor
Enumerate gui resources
Generate random numbers using a mersenne twister
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20b0]
mov eax, 0x21b0
call fcn.14000c4a0
sub rsp, rax
mov rax, qword [0x140012028]
xor rax, rsp
mov qword [rbp + 0x20a0], rax
mov qword [rbp + 0x150], rdx
mov rsi, rdx
mov ebx, ecx
test ecx, ecx
je 0x140008a6c
lea rax, [rbp + 0x38]
mov dword [rbp + 0x40], ecx
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
mov rax, qword [0x140012b10]
movabs rdi, 0x476f832a47
xor r12d, r12d
mov qword [rsp + 0x60], 9
mov r9, rdi
mov qword [rbp + 0x38], r12
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
js 0x140008a6c
cmp qword [rbp + 0x38], r12
je 0x140008a6c
mov eax, 0x5a4d
cmp word [rsi], ax
je 0x140006a11
mov ecx, 0xfffffff5
lea edi, [r12 + 0xc]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__DOS_Signature_mismatch__n
jmp 0x140008a8f
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
cmp dword [r13], 0x4550
je 0x140006a4a
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__NT_Signature_mismatch__n
jmp 0x140008a8f
mov rdx, r13
mov rcx, rsi
call fcn.1400046d0
mov ecx, 0xfffffff5
test al, al
jne 0x140006a81
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_pre_initialize_DLL__n
jmp 0x140008a8f
mov r14d, 0xe
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Allocating_memory_for_the_DLL..._n
call fcn.140001fa0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1874], 0xffffffff
lea edx, [r14 - 0xd]
mov dword [rbp + 0x4f4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x4f4], eax
inc rdx
cmp rdx, 0x270
jb 0x140006ac0
lea rax, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], 0x270
mov edx, 0x4cb
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x30]
call fcn.14000aa40
mov edx, dword [r13 + 0x50]
mov r8d, 4
add rdx, 0x3072
mov ecx, ebx
add rdx, rax
call fcn.1400043a0
mov qword [rbp + 0x120], rax
mov r15, rax
test rax, rax
jne 0x140006b55
mov ecx, 0xfffffff5
lea edi, [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_allocate_space_for_the_DLL__n
jmp 0x140008a8f
movzx eax, word [r13 + 0x14]
lea r8, [rsp + 0x58]
mov r9, rdi
mov dword [rbp + 0x20], ebx
xor edx, edx
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rsi
mov ecx, dword [rax + r13 + 0x24]
lea rax, [rbp + 8]
mov qword [rsp + 0x58], rax
mov rax, qword [0x140012b10]
mov qword [rbp + 0x18], rcx
xor ecx, ecx
mov qword [rsp + 0x60], 2
call rax
test eax, eax
jns 0x140006bf8
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov esi, 8
mov qword [rbp - 0x80], rax
mov r9, rdi
mov qword [rbp - 0x78], rsi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], r12
xor ecx, ecx
mov dword [rsp + 0x50], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Writing_PE_header_failed__n
jmp 0x140008a8f
movzx r14d, word [r13 + 0x14]
mov rdi, r12
add r14, 0x18
add r14, r13
cmp r12w, word [r13 + 6]
jae 0x140006c84
nop
mov edx, dword [r14 + 0x10]
test edx, edx
je 0x140006c73
mov ecx, dword [r14 + 8]
lea r8, [rbp - 0x80]
mov eax, dword [r14 + 0xc]
movabs r9, 0x476f832a47
add rax, r15
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x48], rax
mov eax, dword [r14 + 0x14]
add rax, rsi
mov qword [rbp - 0x78], 2
cmp ecx, edx
mov qword [rbp + 0x50], rax
cmovae ecx, edx
xor edx, edx
mov eax, ecx
xor ecx, ecx
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x80], rax
mov rax, qword [0x140012b10]
call rax
test eax, eax
js 0x140006ddc
movzx eax, word [r13 + 6]
inc rdi
add r14, 0x28
cmp rdi, rax
jb 0x140006c10
mov ecx, 0xfffffff5
mov edi, 0xb
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r15
lea rcx, str._MAPPER_LOG__DLL_Mapped_at:_0x_p_n
call fcn.140001fa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, dword [r13 + 0x50]
lea rcx, str._MAPPER_LOG__DLL_Size:_0x_X_n
call fcn.140001fa0
lea rax, [rbp + 0x4d0]
mov qword [rbp + 0xc8], r12
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x390]
lea rax, [rbp - 0x38]
mov qword [rbp + 0xd0], r12
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4d0]
movups xmm0, xmmword [rsp + 0x58]
lea rax, vtable.std::_Func_impl_no_alloc_class__void____ptr64___cdecl_mapper::get_jmp_deref_rdi_stub_class_driver_api_::_2::_lambda_1___bool__unsigned_char____ptr64_.0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x390]
mov qword [rbp + 0x3c8], rax
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
mov byte [rbp + 0x100], r12b
mov dword [rbp + 0x4d0], ebx
mov qword [rbp - 0x38], r12
movups xmmword [rbp + 0x398], xmm0
call fcn.140001090
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0xe8], rcx
test rcx, rcx
jne 0x140006e4d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov esi, 8
mov qword [rsp + 0x58], rax
movabs r9, 0x476f832a47
mov qword [rsp + 0x60], rsi
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_find_a_legit__jmp__rdi___instruction_in_the_target_process__n
jmp 0x140008a8f
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov esi, 8
mov qword [rsp + 0x58], rax
movabs r9, 0x476f832a47
mov qword [rsp + 0x60], rsi
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], r12
xor ecx, ecx
mov dword [rsp + 0x50], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r14
lea rcx, str._MAPPER_LOG__Mapping_section__s_failed__n
call fcn.140001fa0
jmp 0x140008a94
movaps xmm0, xmmword [0x14000d770]
lea r8, str.VirtualAlloc
movaps xmm1, xmmword [0x14000d780]
lea rdx, str.kernel32.dll
movzx eax, word [0x14000d7b0]
movaps xmmword [rbp + 0x1880], xmm0
movaps xmm0, xmmword [0x14000d790]
movaps xmmword [rbp + 0x1890], xmm1
movaps xmm1, xmmword [0x14000d7a0]
mov word [rbp + 0x18c0], ax
movzx eax, byte [0x14000d7b2]
mov qword [rbp + 0x1889], rcx
mov ecx, ebx
movaps xmmword [rbp + 0x18a0], xmm0
movaps xmmword [rbp + 0x18b0], xmm1
mov byte [rbp + 0x18c2], al
mov qword [rbp], r12
call fcn.140003860
lea rcx, [rbp]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
mov rdx, rax
mov qword [rsp + 0x30], 0x40
mov ecx, ebx
mov qword [rsp + 0x28], 0x3000
mov qword [rsp + 0x20], 0x42
call fcn.140003a00
mov esi, 8
test al, al
je 0x1400089ff
mov rdi, qword [rbp]
test rdi, rdi
je 0x1400089ff
lea rax, [rbp + 0x1880]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
lea r8, [rsp + 0x58]
lea rax, [rbp + 8]
mov qword [rbp + 8], rdi
mov qword [rsp + 0x58], rax
movabs r14, 0x476f832a47
mov rax, qword [0x140012b10]
mov r9, r14
xor edx, edx
mov qword [rbp + 0x18], 0x42
xor ecx, ecx
mov qword [rsp + 0x60], 2
call rax
test eax, eax
jns 0x140006f8e
lea rax, [rbp - 0x68]
mov dword [rbp - 0x54], ebx
mov r9, r14
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov qword [rbp - 0x68], rdi
xor edx, edx
mov qword [rbp - 0x60], r12
xor ecx, ecx
mov dword [rbp - 0x58], 0x8000
mov qword [rbp - 0x78], rsi
call qword [0x140012b10]
jmp 0x140008a09
lea rax, [rbp + 0x4c8]
mov qword [rbp + 0xc0], rdi
mov qword [rbp - 0x28], rax
lea rdi, str.kernel32.dll
lea rax, [rbp + 0x1980]
mov dword [rbp + 0x4c8], ebx
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x220]
movups xmm0, xmmword [rbp - 0x28]
lea rax, [rbp + 0x490]
mov byte [rbp + 0x490], r12b
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x4c8]
lea rax, [rbp + 0x110]
mov qword [rbp + 0x110], rdi
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x4b8]
movups xmm1, xmmword [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_unsigned_char____ptr64___cdecl_driver_api::get_module_base_wchar_t_const____ptr64__bool_const___ptr64::_2::_lambda_1___bool__unsigned_char____ptr64_.0
mov qword [rbp + 0x220], rax
lea rax, [rbp + 0x220]
movups xmmword [rbp + 0x228], xmm0
mov qword [rbp + 0x258], rax
movsd xmm0, qword [rbp - 8]
mov qword [rbp + 0x4b8], r12
movups xmmword [rbp + 0x238], xmm1
movsd qword [rbp + 0x248], xmm0
call fcn.140001090
mov rsi, qword [rbp + 0x4b8]
test rsi, rsi
je 0x14000899d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000899d
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000899d
sub rax, rdi
add rax, rsi
mov qword [rbp + 0xc8], rax
je 0x14000899d
lea rax, [rbp + 0x4c0]
mov dword [rbp + 0x4c0], ebx
mov qword [rbp - 0x28], rax
lea rdi, str.kernel32.dll
lea rax, [rbp + 0x1be0]
mov byte [rbp + 0x498], r12b
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x1e0]
movups xmm0, xmmword [rbp - 0x28]
lea rax, [rbp + 0x498]
mov qword [rbp + 0x80], rdi
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x4c0]
lea rax, [rbp + 0x80]
mov qword [rbp + 0x4b0], r12
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x4b0]
movups xmm1, xmmword [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_unsigned_char____ptr64___cdecl_driver_api::get_module_base_wchar_t_const____ptr64__bool_const___ptr64::_2::_lambda_1___bool__unsigned_char____ptr64_.0
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x218], rax
movsd xmm0, qword [rbp - 8]
movups xmmword [rbp + 0x1f8], xmm1
movsd qword [rbp + 0x208], xmm0
call fcn.140001090
mov rsi, qword [rbp + 0x4b0]
test rsi, rsi
je 0x14000893b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000893b
lea rdx, [0x14000e6b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000893b
sub rax, rdi
add rax, rsi
mov qword [rbp + 0xd0], rax
je 0x14000893b
lea rax, [rbp + 0x90]
mov dword [rbp + 0x90], ebx
mov qword [rbp - 0x28], rax
lea rsi, str.kernel32.dll
lea rax, [rbp + 0x1e40]
mov byte [rbp + 0x4a8], r12b
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x160]
movups xmm0, xmmword [rbp - 0x28]
lea rax, [rbp + 0x4a8]
mov qword [rbp + 0xb8], rsi
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x90]
lea rax, [rbp + 0xb8]
mov qword [rbp + 0x4d8], r12
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x4d8]
movups xmm1, xmmword [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_unsigned_char____ptr64___cdecl_driver_api::get_module_base_wchar_t_const____ptr64__bool_const___ptr64::_2::_lambda_1___bool__unsigned_char____ptr64_.0
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x160]
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x198], rax
movsd xmm0, qword [rbp - 8]
movups xmmword [rbp + 0x178], xmm1
movsd qword [rbp + 0x188], xmm0
call fcn.140001090
mov rdi, qword [rbp + 0x4d8]
test rdi, rdi
je 0x1400088d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400088d9
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400088d9
sub rdi, rsi
add rdi, rax
mov qword [rbp + 0xd8], rdi
je 0x1400088d9
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], ebx
mov qword [rbp - 0x28], rax
lea rdi, str.kernel32.dll
lea rax, [rbp + 0x4f0]
mov byte [rbp + 0x4a0], r12b
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x1a0]
movups xmm0, xmmword [rbp - 0x28]
lea rax, [rbp + 0x4a0]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x28]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__public:_unsigned_char____ptr64___cdecl_driver_api::get_module_base_wchar_t_const____ptr64__bool_const___ptr64::_2::_lambda_1___bool__unsigned_char____ptr64_.0
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x1a0]
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1d8], rax
movsd xmm0, qword [rbp - 8]
movups xmmword [rbp + 0x1b8], xmm1
movsd qword [rbp + 0x1c8], xmm0
call fcn.140001090
mov rsi, qword [rbp - 0x30]
test rsi, rsi
je 0x140008877
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140008877
lea rdx, str.RtlAddFunctionTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008877
sub rax, rdi
add rax, rsi
mov qword [rbp + 0xe0], rax
je 0x140008877
mov qword [rbp + 0xf0], r15
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1874], 0xffffffff
mov edx, 1
mov dword [rbp + 0x4f4], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x4f4], eax
inc rdx
cmp rdx, 0x270
jb 0x140007390
lea rcx, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], 0x270
call fcn.14000abf0
mov ecx, eax
mov edi, 0xc28124b1
imul rcx, rdi
cmp ecx, 0x3d7edb4e
ja 0x1400073fa
nop dword [rax + rax]
lea rcx, [rbp + 0x4f0]
call fcn.14000abf0
mov ecx, eax
imul rcx, rdi
cmp ecx, 0x3d7edb4f
jb 0x1400073e0
shr rcx, 0x20
mov dword [rbp + 0xf8], ecx
lea rcx, [0x14000d99c]
call fcn.140001fa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Allocating_memory_for_the_internal_DLL_fixup_code..._n
call fcn.140001fa0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1874], 0xffffffff
mov edx, 1
mov dword [rbp + 0x4f4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x4f4], eax
inc rdx
cmp rdx, 0x270
jb 0x140007450
lea rax, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], 0x270
mov edx, 0xcc8
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
call fcn.14000aa40
lea rdi, [rax + 0x2351]
test rdi, rdi
je 0x1400087df
lea r8, str.VirtualAlloc
mov qword [rbp + 0x28], r12
lea rdx, str.kernel32.dll
mov ecx, ebx
call fcn.140003860
lea rcx, [rbp + 0x28]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
mov rdx, rax
mov qword [rsp + 0x30], 0x40
mov ecx, ebx
mov qword [rsp + 0x28], 0x3000
mov qword [rsp + 0x20], rdi
call fcn.140003a00
test al, al
je 0x1400087df
mov r12, qword [rbp + 0x28]
test r12, r12
je 0x1400087df
lea rax, [0x140002000]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
lea r8, [rsp + 0x58]
lea rax, [rbp + 8]
mov qword [rbp + 8], r12
mov qword [rsp + 0x58], rax
mov r9, r14
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x18], rdi
mov qword [rsp + 0x60], 2
call rax
xor edx, edx
lea r8, [rbp - 0x80]
xor ecx, ecx
mov r9, r14
test eax, eax
jns 0x140007613
mov rax, qword [rbp + 0xc0]
xor edi, edi
mov qword [rsp + 0x40], rax
mov esi, 8
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], 0x8000
mov qword [rbp - 0x78], rsi
call qword [0x140012b10]
lea rax, [rbp - 0x68]
mov dword [rbp - 0x54], ebx
mov r9, r14
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
mov qword [rbp - 0x68], r12
xor edx, edx
mov qword [rbp - 0x60], rdi
xor ecx, ecx
mov dword [rbp - 0x58], 0x8000
mov qword [rsp + 0x60], rsi
call qword [0x140012b10]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov r9, r14
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], rdi
xor ecx, ecx
mov dword [rsp + 0x50], 0x8000
mov qword [rbp - 0x78], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_write_shellcode__n
jmp 0x140008a8f
movaps xmm0, xmmword [rbp + 0xc0]
lea rax, [r12 - 0x48]
movaps xmm1, xmmword [rbp + 0xd0]
add rax, rdi
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x1880]
movaps xmmword [rbp + 0x1880], xmm0
movaps xmm0, xmmword [rbp + 0xe0]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x48]
movaps xmmword [rbp + 0x1890], xmm1
movaps xmm1, xmmword [rbp + 0xf0]
movaps xmmword [rbp + 0x18a0], xmm0
movsd xmm0, qword [rbp + 0x100]
mov qword [rbp - 0x80], rax
mov rax, qword [0x140012b10]
movaps xmmword [rbp + 0x18b0], xmm1
movsd qword [rbp + 0x18c0], xmm0
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x58], 0x48
mov qword [rbp - 0x78], 2
call rax
test eax, eax
jns 0x140007776
mov rax, qword [rbp + 0xc0]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor edi, edi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov esi, 8
mov qword [rsp + 0x58], rax
mov r9, r14
mov qword [rsp + 0x48], rdi
xor edx, edx
mov dword [rsp + 0x50], 0x8000
xor ecx, ecx
mov qword [rsp + 0x60], rsi
call qword [0x140012b10]
lea rax, [rbp - 0x68]
mov dword [rbp - 0x54], ebx
mov r9, r14
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov qword [rbp - 0x68], r12
xor edx, edx
mov qword [rbp - 0x60], rdi
xor ecx, ecx
mov dword [rbp - 0x58], 0x8000
mov qword [rbp - 0x78], rsi
call qword [0x140012b10]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], ebx
mov r9, r14
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], rdi
xor ecx, ecx
mov dword [rsp + 0x50], 0x8000
mov qword [rsp + 0x60], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_write_shellcode_data__n
jmp 0x140008a8f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r12
lea rcx, str._MAPPER_LOG__Internal_DLL_fixup_code:_0x_p_n_n
call fcn.140001fa0
lea rcx, [0x14000e6ec]
call fcn.140001fa0
xor edi, edi
mov dword [0x140012b28], ebx
lea rdx, [rbp - 0x30]
mov qword [rbp + 0x4e0], rdi
lea rcx, [0x140003990]
mov qword [rbp - 0x30], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp - 0x30]
lea esi, [rdi + 8]
mov qword [rbp + 0x80], rax
test rax, rax
je 0x140008703
lea r8, str.TranslateMessage
mov ecx, ebx
lea rdx, str.user32.dll
call fcn.140003860
mov qword [rbp - 0x38], rax
mov r14, rax
test rax, rax
je 0x1400086f9
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1874], 0xffffffff
lea edx, [rdi + 1]
mov dword [rbp + 0x4f4], eax
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x4f4], eax
inc rdx
cmp rdx, 0x270
jb 0x140007830
lea rax, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], 0x270
mov edx, 0x2c
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
call fcn.14000aa40
add rax, 0x10
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x10], rax
lea r8, [rbp + 0x360]
lea rax, [rbp + 8]
mov qword [rbp + 8], rdi
mov qword [rbp + 0x360], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x18], 0x3000
mov dword [rbp + 0x1c], 4
mov qword [rbp + 0x368], 7
call rax
test eax, eax
js 0x1400086f9
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x1400086f9
lea rax, [rbp - 0x70]
mov qword [rbp - 0x70], 0
mov qword [rbp + 0x478], rax
lea r8, [rbp + 0x370]
lea rax, [rbp + 0x470]
mov dword [rbp + 0x488], ebx
mov qword [rbp + 0x370], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x470], rdi
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x378], 2
call rax
test eax, eax
js 0x1400086b4
lea rax, [rdi + 8]
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0x3d0], rax
lea r8, [rbp + 0x2d0]
lea rax, [rbp + 0xb8]
mov dword [rbp + 0x3e8], ebx
mov qword [rbp + 0x3d8], rax
movabs r9, 0x476f832a47
lea rax, [rbp + 0x3d0]
mov qword [rbp + 0x3e0], rsi
mov qword [rbp + 0x2d0], rax
xor edx, edx
mov rax, qword [0x140012b10]
xor ecx, ecx
mov qword [rbp + 0x2d8], 2
call rax
test eax, eax
js 0x1400086b4
mov eax, dword [0x14000d710]
lea r8, [rbp + 0x380]
movaps xmm0, xmmword [0x14000d6a0]
movabs r9, 0x476f832a47
movaps xmm1, xmmword [0x14000d6b0]
xor edx, edx
movaps xmmword [rbp + 0x1900], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x14000d6c0]
mov dword [rbp + 0x1970], eax
movzx eax, word [0x14000d714]
movaps xmmword [rbp + 0x1920], xmm0
movaps xmm0, xmmword [0x14000d6e0]
movaps xmmword [rbp + 0x1910], xmm1
movaps xmm1, xmmword [0x14000d6d0]
mov word [rbp + 0x1974], ax
lea rax, [rbp + 0x110]
movaps xmmword [rbp + 0x1940], xmm0
movaps xmm0, xmmword [0x14000d700]
movaps xmmword [rbp + 0x1930], xmm1
movaps xmm1, xmmword [0x14000d6f0]
mov qword [rbp + 0x380], rax
mov rax, qword [0x140012b10]
movaps xmmword [rbp + 0x1960], xmm0
movaps xmmword [rbp + 0x1950], xmm1
mov dword [rbp + 0x118], ebx
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x388], 9
call rax
mov rcx, qword [rbp + 0x110]
lea r8, [rbp + 0x260]
test eax, eax
mov qword [rbp + 0x191b], rdi
mov rax, qword [rbp + 0x90]
xorps xmm0, xmm0
mov qword [rbp + 0x192d], rax
mov edx, 0
cmovs rcx, rdx
mov qword [rbp + 0x1937], rdx
lea rax, [r12 - 1]
mov qword [rbp + 0x190c], rcx
mov qword [rbp + 0x1955], rax
movabs r9, 0x476f832a47
xor eax, eax
mov qword [rbp + 0x1941], rdx
mov dword [rbp + 0x18f0], eax
xor ecx, ecx
mov byte [rbp + 0x18f4], al
lea rax, [rbp + 0x1880]
mov qword [rbp + 0x3f8], rax
lea rax, [rbp + 0x3f0]
mov qword [rbp + 0x260], rax
mov rax, qword [0x140012b10]
mov qword [rbp + 0x194b], rdx
movups xmmword [rbp + 0x1880], xmm0
mov dword [rbp + 0x408], ebx
movups xmmword [rbp + 0x1890], xmm0
mov qword [rbp + 0x3f0], r14
movups xmmword [rbp + 0x18a0], xmm0
mov qword [rbp + 0x400], 0x75
movups xmmword [rbp + 0x18b0], xmm0
mov qword [rbp + 0x268], 1
movups xmmword [rbp + 0x18c0], xmm0
movups xmmword [rbp + 0x18d0], xmm0
movups xmmword [rbp + 0x18e0], xmm0
call rax
xor edx, edx
xor ecx, ecx
test eax, eax
jns 0x140007bae
mov qword [rbp + 0x68], rdi
lea rax, [rbp + 0x68]
xor edi, edi
mov dword [rbp + 0x7c], ebx
movabs r14, 0x476f832a47
mov qword [rbp + 0x70], rdi
mov r9, r14
mov dword [rbp + 0x78], 0x8000
lea r8, [rbp + 0x270]
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], rsi
call qword [0x140012b10]
jmp 0x140008703
lea rax, [rbp + 0x1900]
mov dword [rbp + 0x428], ebx
mov qword [rbp + 0x418], rax
lea r8, [rbp + 0x280]
lea rax, [rbp + 0x410]
mov qword [rbp + 0x410], r14
mov qword [rbp + 0x280], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
mov qword [rbp + 0x420], 0x75
mov qword [rbp + 0x288], 4
call rax
test eax, eax
setns r14b
cmp r14b, 1
jne 0x140007f6d
mov rcx, qword [rbp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rax, [rbp + 0x498]
mov byte [rbp + 0x498], 0
mov qword [rbp + 0x138], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x130]
mov dword [rbp + 0x148], ebx
movabs r9, 0x476f832a47
mov qword [rbp + 0x38], rax
xor edx, edx
mov qword [rbp + 0x130], rdi
xor ecx, ecx
mov qword [rbp + 0x140], 1
mov r14d, 0xfffffff6
mov qword [rbp + 0x40], 1
call qword [0x140012b10]
cmp byte [rbp + 0x498], 0
jne 0x140007ddc
nop word [rax + rax]
add r14d, 0xa
cmp r14d, 0xbb8
ja 0x140008152
xor eax, eax
mov dword [rbp - 0x78], ebx
mov qword [rbp - 0x80], rax
lea r8, [rbp + 0x290]
lea rax, [rbp - 0x80]
mov qword [rbp + 0x298], 9
mov qword [rbp + 0x290], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [rbp - 0x80]
lea r8, [rbp + 0x2a0]
test eax, eax
mov dword [rbp + 0x448], ebx
mov eax, 0
mov qword [rbp + 0x440], rsi
cmovs rcx, rax
mov qword [rbp + 0x4d8], rax
movabs r9, 0x476f832a47
mov qword [rbp + 0x2a8], 1
xor edx, edx
lea rax, [rcx + 0x10]
xor ecx, ecx
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x4d8]
mov qword [rbp + 0x438], rax
lea rax, [rbp + 0x430]
mov qword [rbp + 0x2a0], rax
call qword [0x140012b10]
cmp qword [rbp + 0x4d8], 0
je 0x140008152
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x498]
mov byte [rbp + 0x498], 0
mov qword [rbp + 0x138], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x130]
mov dword [rbp + 0x148], ebx
movabs r9, 0x476f832a47
mov qword [rbp + 0x38], rax
xor edx, edx
mov qword [rbp + 0x130], rdi
xor ecx, ecx
mov qword [rbp + 0x140], 1
mov qword [rbp + 0x40], 1
call qword [0x140012b10]
cmp byte [rbp + 0x498], 0
je 0x140007ca0
lea rax, [rbp + 0x490]
mov byte [rbp + 0x490], 0
mov qword [rbp + 0x50], rax
lea r8, [rbp + 0x80]
lea rax, [rbp + 0x48]
mov dword [rbp + 0x60], ebx
movabs r9, 0x476f832a47
mov qword [rbp + 0x80], rax
xor edx, edx
mov qword [rbp + 0x48], rdi
xor ecx, ecx
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x88], 1
call qword [0x140012b10]
cmp byte [rbp + 0x490], 2
mov r14b, 1
je 0x140007f6d
xor r12d, r12d
movabs r15, 0x476f832a47
nop dword [rax + rax]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x60], ebx
mov qword [rbp + 0x2b0], rax
lea r8, [rbp + 0x2b0]
mov rax, qword [0x140012b10]
mov r9, r15
xor edx, edx
mov qword [rsp + 0x58], r12
xor ecx, ecx
mov qword [rbp + 0x2b8], 9
call rax
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x2c0]
test eax, eax
mov qword [rbp + 0x4b0], r12
mov r9, r15
mov dword [rbp + 0x468], ebx
cmovs rcx, r12
mov qword [rbp + 0x460], rsi
xor edx, edx
mov qword [rbp + 0x2c8], 1
lea rax, [rcx + 0x10]
xor ecx, ecx
mov qword [rbp + 0x450], rax
lea rax, [rbp + 0x4b0]
mov qword [rbp + 0x458], rax
lea rax, [rbp + 0x450]
mov qword [rbp + 0x2c0], rax
call qword [0x140012b10]
mov rax, qword [rbp + 0x4b0]
test rax, rax
setne r14b
test rax, rax
je 0x140007f62
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x490]
mov byte [rbp + 0x490], r12b
mov qword [rbp + 0x50], rax
lea r8, [rbp + 0x80]
lea rax, [rbp + 0x48]
mov dword [rbp + 0x60], ebx
mov r9, r15
mov qword [rbp + 0x80], rax
xor edx, edx
mov qword [rbp + 0x48], rdi
xor ecx, ecx
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x88], 1
call qword [0x140012b10]
cmp byte [rbp + 0x490], 2
jne 0x140007e50
mov r15, qword [rbp + 0x120]
mov r12, qword [rbp + 0x28]
xor eax, eax
mov dword [rbp + 0x128], ebx
mov qword [rbp + 0x120], rax
lea r8, [rbp + 0x350]
lea rax, [rbp + 0x120]
mov qword [rbp + 0x358], 9
mov qword [rbp + 0x350], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [rbp + 0x120]
lea r8, [rbp + 0x2e0]
test eax, eax
mov dword [rbp + 0x3a8], ebx
mov eax, 0
mov qword [rbp + 0x3a0], rsi
cmovs rcx, rax
mov qword [rbp + 0x4b8], rax
movabs r9, 0x476f832a47
mov qword [rbp + 0x2e8], 1
xor edx, edx
lea rax, [rcx + 0x10]
xor ecx, ecx
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x4b8]
mov qword [rbp + 0x398], rax
lea rax, [rbp + 0x390]
mov qword [rbp + 0x2e0], rax
call qword [0x140012b10]
cmp qword [rbp + 0x4b8], 0
jne 0x1400081a5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r14d, r14d
mov edi, eax
test eax, eax
je 0x14000808b
mov dword [rbp + 0x30], eax
lea r8, [rbp + 0x2f0]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x2f0], rax
movabs r9, 0x476f832a47
mov rax, qword [0x140012b10]
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x2f8], 9
call rax
test eax, eax
js 0x140008088
cmp qword [rbp + 0x28], r14
jne 0x14000808b
mov edi, r14d
lea rax, [rbp]
mov qword [rbp], r14
mov r14, qword [rbp - 0x38]
lea r8, [rbp + 0x300]
mov qword [rbp + 0x1a8], rax
movabs r9, 0x476f832a47
lea rax, [rbp + 0x1a0]
mov dword [rbp + 0x1b8], edi
xor edx, edx
mov qword [rbp + 0x300], rax
xor ecx, ecx
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x308], 1
call qword [0x140012b10]
mov rax, qword [rbp + 0x1900]
cmp qword [rbp], rax
jne 0x14000815a
lea rax, [rbp + 0x1880]
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x168], rax
lea r8, [rbp + 0x310]
lea rax, [rbp + 0x160]
mov dword [rbp + 0x178], edi
movabs r14, 0x476f832a47
mov qword [rbp + 0x310], rax
mov r9, r14
mov qword [rbp + 0x170], 0x75
xor edx, edx
mov qword [rbp + 0x318], 4
xor ecx, ecx
call qword [0x140012b10]
jmp 0x140008164
xor r14b, r14b
jmp 0x140007f6d
movabs r14, 0x476f832a47
xor edi, edi
mov dword [rbp + 0x328], ebx
lea rax, [rbp + 0x320]
mov qword [rbp + 0x320], rdi
mov r9, r14
mov qword [rbp + 0x330], rax
lea r8, [rbp + 0x330]
mov qword [rbp + 0x338], 9
xor edx, edx
xor ecx, ecx
call qword [0x140012b10]
jmp 0x140008703
mov rax, qword [rbp - 0x38]
lea r8, [rbp + 0x340]
mov qword [rbp + 0x1e0], rax
movabs r9, 0x476f832a47
lea rax, [rbp + 0x1880]
mov dword [rbp + 0x1f8], ebx
mov qword [rbp + 0x1e8], rax
xor edx, edx
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1f0], 0x75
xor ecx, ecx
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], 4
call qword [0x140012b10]
test r14b, r14b
je 0x140008270
xor eax, eax
mov dword [rbp + 0x238], ebx
mov qword [rbp - 0x38], rax
lea r8, [rbp + 0xa8]
lea rax, [rdi + 1]
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x220], rax
movabs r9, 0x476f832a47
lea rax, [rbp - 0x38]
mov qword [rbp + 0xb0], 1
mov qword [rbp + 0x228], rax
xor edx, edx
lea rax, [rbp + 0x220]
xor ecx, ecx
mov qword [rbp + 0xa8], rax
call qword [0x140012b10]
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x4e0], rax
mov qword [rbp - 0x50], rdi
lea rax, [rbp - 0x50]
xor edi, edi
mov dword [rbp - 0x3c], ebx
movabs r9, 0x476f832a47
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x68]
mov dword [rbp - 0x40], 0x8000
xor edx, edx
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
test r14b, r14b
movabs r14, 0x476f832a47
je 0x140008703
mov rax, qword [rbp + 0x90]
lea r8, [rbp + 0x90]
mov qword [rbp - 0x28], rax
mov r9, r14
lea rax, [rbp + 0xc0]
mov dword [rbp - 0x10], ebx
mov qword [rbp - 0x20], rax
xor edx, edx
lea rax, [rbp - 0x28]
mov qword [rbp - 0x18], 0x48
mov qword [rbp + 0x90], rax
xor ecx, ecx
mov rax, qword [0x140012b10]
mov qword [rbp + 0x98], 1
call rax
test eax, eax
jns 0x1400083d6
mov rax, qword [rbp + 0xc0]
lea r8, [rbp - 0x68]
mov qword [rbp - 0x50], rax
mov r9, r14
lea rax, [rbp - 0x50]
mov dword [rbp - 0x3c], ebx
xor edx, edx
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rbp - 0x48], rdi
mov dword [rbp - 0x40], 0x8000
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
lea rax, [rbp + 0x68]
mov dword [rbp + 0x7c], ebx
mov r9, r14
mov qword [rbp + 0xa8], rax
lea r8, [rbp + 0xa8]
mov qword [rbp + 0x68], r12
xor edx, edx
mov qword [rbp + 0x70], rdi
xor ecx, ecx
mov dword [rbp + 0x78], 0x8000
mov qword [rbp + 0xb0], rsi
call qword [0x140012b10]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x3c], ebx
mov r9, r14
mov qword [rbp - 0x68], rax
lea r8, [rbp - 0x68]
mov qword [rbp - 0x50], r15
xor edx, edx
mov qword [rbp - 0x48], rdi
xor ecx, ecx
mov dword [rbp - 0x40], 0x8000
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_read_shellcode_response__n
jmp 0x140008a8f
mov r14, qword [rbp + 0x4e0]
lea rax, [r14 - 1]
cmp rax, 6
ja case.default.0x1400083fc
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x8ac8]
add rax, rcx
jmp rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, dword [rbp + 0xfc]
lea rcx, str._MAPPER_LOG__Success__DllMain_returned:__d_n
call fcn.140001fa0
mov dil, 1
jmp 0x1400085b5
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Shellcode_invalid_parameter__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Reallocation_failed__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Missing_import_module__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Missing_import_function__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Virtual_Protecting_the_DLL_failed__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_add_SEH_Exceptions_support__n
call fcn.140001fa0
xor dil, dil
jmp 0x14000857d
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Unknown_shellcode_error_occurred__n
call fcn.140001fa0
cmp r14, 1
sete dil
je 0x1400085b5
xor eax, eax
mov dword [rbp - 0x3c], ebx
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x50], r15
movabs r9, 0x476f832a47
mov qword [rbp - 0x68], rax
xor edx, edx
mov dword [rbp - 0x40], 0x8000
xor ecx, ecx
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
mov rax, qword [rbp + 0xc0]
lea r8, [rbp + 0xa8]
mov qword [rbp + 0x68], rax
movabs r9, 0x476f832a47
xor eax, eax
mov dword [rbp + 0x7c], ebx
mov qword [rbp + 0x70], rax
xor edx, edx
lea rax, [rbp + 0x68]
mov dword [rbp + 0x78], 0x8000
xor ecx, ecx
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rsi
call qword [0x140012b10]
xor eax, eax
mov dword [rbp - 0x3c], ebx
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x50], r12
movabs r9, 0x476f832a47
mov qword [rbp - 0x68], rax
xor edx, edx
mov dword [rbp - 0x40], 0x8000
xor ecx, ecx
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
cmp byte [rbp + 0x100], 0
jne 0x140008661
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__WARNING:_DllMain_wasnt_destroyed__n
call fcn.140001fa0
test dil, dil
je 0x1400086a1
mov rdx, qword [rbp + 0x150]
mov r9, r13
mov r8, r15
mov ecx, ebx
call fcn.1400049b0
test al, al
jne 0x1400086a1
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__WARNING:_Failed_to_post_process_the_dll__n
call fcn.140001fa0
lea rcx, [0x14000e6ec]
call fcn.140001fa0
mov al, 1
jmp 0x140008a96
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x68]
xor edi, edi
mov dword [rsp + 0x7c], ebx
movabs r14, 0x476f832a47
mov qword [rsp + 0x70], rdi
mov r9, r14
mov dword [rsp + 0x78], 0x8000
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rsi
xor ecx, ecx
call qword [0x140012b10]
jmp 0x140008703
movabs r14, 0x476f832a47
mov rax, qword [rbp + 0xc0]
lea r8, [rbp + 0x150]
mov qword [rbp + 0x90], rax
mov r9, r14
lea rax, [rbp + 0x90]
mov dword [rbp + 0xa4], ebx
xor edx, edx
mov qword [rbp + 0x150], rax
xor ecx, ecx
mov qword [rbp + 0x98], rdi
mov dword [rbp + 0xa0], 0x8000
mov qword [rbp + 0x158], rsi
call qword [0x140012b10]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov r9, r14
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], r12
xor edx, edx
mov qword [rsp + 0x70], rdi
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
mov qword [rsp + 0x48], rsi
call qword [0x140012b10]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x3c], ebx
mov r9, r14
mov qword [rbp - 0x68], rax
lea r8, [rbp - 0x68]
mov qword [rbp - 0x50], r15
xor edx, edx
mov qword [rbp - 0x48], rdi
xor ecx, ecx
mov dword [rbp - 0x40], 0x8000
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_execute_internal_DLL_fixup_code__n
jmp 0x140008a8f
mov rax, qword [rbp + 0xc0]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov esi, 8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov r9, r14
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x70], r12
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
mov qword [rsp + 0x48], rsi
call qword [0x140012b10]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x3c], ebx
mov r9, r14
mov qword [rbp - 0x68], rax
lea r8, [rbp - 0x68]
mov qword [rbp - 0x50], r15
xor edx, edx
mov qword [rbp - 0x48], r12
xor ecx, ecx
mov dword [rbp - 0x40], 0x8000
mov qword [rbp - 0x60], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Shellcode_allocation_failed__n
jmp 0x140008a8f
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov esi, 8
mov qword [rsp + 0x40], rax
mov r9, r14
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], r15
xor edx, edx
mov qword [rsp + 0x70], r12
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_get_RtlAddFunctionTable_in_the_target_process__n
jmp 0x140008a8f
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov esi, 8
mov qword [rsp + 0x40], rax
mov r9, r14
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], r15
xor edx, edx
mov qword [rsp + 0x70], r12
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_get_VirtualProtect_in_the_target_process__n
jmp 0x140008a8f
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov esi, 8
mov qword [rsp + 0x40], rax
mov r9, r14
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], r15
xor edx, edx
mov qword [rsp + 0x70], r12
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_get_GetProcAddress_in_the_target_process__n
jmp 0x140008a8f
lea rax, [rsp + 0x68]
mov dword [rsp + 0x7c], ebx
mov esi, 8
mov qword [rsp + 0x40], rax
mov r9, r14
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x68], r15
xor edx, edx
mov qword [rsp + 0x70], r12
xor ecx, ecx
mov dword [rsp + 0x78], 0x8000
call qword [0x140012b10]
mov ecx, 0xfffffff5
lea edi, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_get_LoadLibraryA_in_the_target_process__n
jmp 0x140008a8f
movabs r14, 0x476f832a47
lea rax, [rsp + 0x68]
mov qword [rbp + 0xc0], r12
mov r9, r14
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x7c], ebx
xor edx, edx
mov qword [rsp + 0x68], r15
xor ecx, ecx
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], 0x8000
mov qword [rsp + 0x48], rsi
call qword [0x140012b10]
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Failed_to_find_spoof_call_stub_in_the_target_process__n
jmp 0x140008a8f
mov ecx, 0xfffffff5
mov edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._MAPPER_LOG__Target_process_is_not_running__n
call fcn.140001fa0
xor al, al
mov rcx, qword [rbp + 0x20a0]
xor rcx, rsp
call fcn.14000b560
lea r11, [rsp + 0x21b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret