Function at 0x140044760
Capabilities:
Encode data using xor
Execute command
Hash data using fnv
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 8], cl
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rsp + 0x650], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x30], r14d
test cl, cl
jne 0x14001e546
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 0xe]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Loading_USNJournal_into_memory..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, ds:[r14 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rsp + 0x610], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x620], xmm1
mov r8d, 0x55
lea rdx, str.fsutil_usn_readjournal_c:_csv__findstr__i__c:0x80000200__c:0x00001000____journal.txt
lea rcx, [rsp + 0x610]
call fcn.140006c60
nop
lea rcx, [rsp + 0x610]
cmp qword [rsp + 0x628], 7
cmova rcx, qword [rsp + 0x610]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
test eax, eax
je 0x14001e5f1
mov rdx, qword [rsp + 0x628]
cmp rdx, 7
jbe 0x14001ec65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e5e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e5e7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
jmp 0x14001ec65
lea rcx, [rsp + 0x120]
call fcn.1400084e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x5b0], xmm0
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
movups xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
movups xmmword [rsp + 0x5d0], xmm0
mov qword [rsp + 0x5e0], 0xb
mov qword [rsp + 0x5e8], 0xf
movsd xmm0, qword [0x140057ff8]
movsd qword [rsp + 0x5d0], xmm0
movzx eax, word [0x140058000]
mov word [rsp + 0x5d8], ax
movzx eax, byte [0x140058002]
mov byte [rsp + 0x5da], al
mov byte [rsp + 0x5db], 0
lea rdx, str.Dump_the__csrss.exe__process_with_the_MOST_private_bytes_using_System_Informer_and_save_the_results_to_any_directory._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x560], xmm1
mov r8d, 0x99
lea rdx, str.After_doing_this__enter_here_the_full_path_of_the_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x550]
call fcn.140006c60
nop
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x570]
call fcn.14001de00
mov rbx, rax
lea rax, [rsp + 0x5b0]
cmp rax, rbx
je 0x14001e79f
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 7
jbe 0x14001e75b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e756
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x5b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x5c0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov r8, qword [rsp + 0x588]
cmp r8, 7
jbe 0x14001e7ba
mov rdx, qword [rsp + 0x570]
call fcn.1400064c0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword ds:[rsp + 0x580], xmm0
mov word [rsp + 0x570], r14w
mov rdx, qword [rsp + 0x568]
cmp rdx, 7
jbe 0x14001e82c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e827
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e827
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword [rsp + 0x560], xmm0
mov word [rsp + 0x550], r14w
cmp qword [rsp + 0x5c0], 0
jne 0x14001e9d1
lea rax, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 0xf
cmova rax, qword [rsp + 0x5d0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x5e0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x570]
call fcn.140022ee0
nop
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 7
cmova rcx, qword [rsp + 0x570]
call fcn.140048c30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020813
lea rcx, [rsp + 0x570]
call fcn.140005dc0
nop
mov rdx, qword [rsp + 0x5e8]
cmp rdx, 0xf
jbe 0x14001e91b
inc rdx
mov rcx, qword [rsp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002080c
call fcn.1400493f0
mov qword ds:[rsp + 0x5e0], r14
mov qword [rsp + 0x5e8], 0xf
mov byte [rsp + 0x5d0], 0
mov r8, qword [rsp + 0x5a8]
cmp r8, 7
jbe 0x14001e953
mov rdx, qword [rsp + 0x590]
call fcn.1400064c0
mov qword ds:[rsp + 0x5a0], r14
mov qword ds:[rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 7
jbe 0x14001ec1e
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e9c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e9c7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
jmp 0x14001ec1e
lea rdx, str.Now__repeat_the_same_process_again__but_now_dump_the__csrss.exe__process_with_the_LESS_private_bytes._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.140006a60
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x560], xmm1
mov r8d, 0x8e
lea rdx, str.Enter_here_the_full_path_of_the_second_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x550]
call fcn.140006c60
nop
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x570]
call fcn.14001de00
mov rbx, rax
lea rax, [rsp + 0x590]
cmp rax, rbx
je 0x14001ea9b
mov r8, qword [rsp + 0x5a8]
cmp r8, 7
jbe 0x14001ea57
mov rdx, qword [rsp + 0x590]
call fcn.1400064c0
mov qword [rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x590], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x5a0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rsp + 0x570]
call fcn.140005dc0
nop
mov r8, qword [rsp + 0x568]
cmp r8, 7
jbe 0x14001eac5
mov rdx, qword ds:[rsp + 0x550]
call fcn.1400064c0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword [rsp + 0x560], xmm0
mov word [rsp + 0x550], r14w
cmp qword [rsp + 0x5a0], 0
jne 0x14001ec92
lea rax, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 0xf
cmova rax, qword [rsp + 0x5d0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x5e0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x570]
call fcn.140022ee0
nop
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 7
cmova rcx, qword [rsp + 0x570]
call fcn.140048c30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14002082c
lea rcx, [rsp + 0x570]
call fcn.140005dc0
nop
mov rdx, qword [rsp + 0x5e8]
cmp rdx, 0xf
jbe 0x14001ebaf
inc rdx
mov rcx, qword [rsp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ebaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002080c
call fcn.1400493f0
mov byte [rsp + 0x5d0], 0
mov qword [rsp + 0x5e8], 0xf
mov qword [rsp + 0x5e0], r14
mov r8, qword [rsp + 0x5a8]
cmp r8, 7
jbe 0x14001ebe6
mov rdx, qword [rsp + 0x590]
call fcn.1400064c0
mov word [rsp + 0x590], r14w
mov qword [rsp + 0x5a8], 7
mov qword [rsp + 0x5a0], r14
mov r8, qword [rsp + 0x5c8]
cmp r8, 7
jbe 0x14001ec1e
mov rdx, qword [rsp + 0x5b0]
call fcn.1400064c0
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
lea rcx, [rsp + 0x120]
call fcn.140008460
nop
mov r8, qword [rsp + 0x628]
cmp r8, 7
jbe 0x14001ec65
mov rdx, qword ds:[rsp + 0x610]
call fcn.1400064c0
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1400493d0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 7
cmova rdx, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x310]
call fcn.140021460
nop
lea rdx, [rsp + 0x590]
cmp qword [rsp + 0x5a8], 7
cmova rdx, qword [rsp + 0x590]
lea rcx, [rsp + 0x420]
call fcn.140021460
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x570], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x580], xmm1
mov r8d, 0xb
lea rdx, str.journal.txt
lea rcx, [rsp + 0x570]
call fcn.140006c60
nop
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x160]
call fcn.14001db40
nop
lea rcx, [rsp + 0x570]
call fcn.140005dc0
lea rdx, str.___._.exe.dll.dll...config.exe.config____A_Z_:...
lea rcx, [rsp + 0x260]
call fcn.140020900
nop
lea rdx, str._A_Za_z_:._.dll
lea rcx, [rsp + 0x1c0]
call fcn.140020900
nop
lea rdx, str._A_Za_z_:._.exe
lea rcx, [rsp + 0x238]
call fcn.140020900
nop
lea rdx, str._A_Za_z_:__:_.___.__
lea rcx, [rsp + 0x210]
call fcn.140020900
nop
lea rdx, str.____:_.___.__
lea rcx, [rsp + 0x1e8]
call fcn.140020900
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x5f0], xmm0
mov qword [rsp + 0x600], r14
mov qword [rsp + 0x608], 7
mov word [rsp + 0x5f0], r14w
xor bl, bl
mov byte [rsp + 0x34], bl
lea r12, [0x14006c0c8]
movabs r13, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop
test bl, bl
jne 0x14002070d
nop dword [rax + rax]
cmp byte [rsp + 0x690], bl
jne 0x14001ee8c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_DLL_Injections..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, str._Memory_Scanner__Scanning_executed_files_with_modified_extensions..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_extension..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_name..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop dword [rax]
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x310]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x310]
call fcn.1400224e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
nop dword [rax + rax]
test al, al
je 0x14001feee
mov r8, qword [rsp + 0x600]
cmp r8, 0x190
ja 0x14001ee90
lea rdx, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 7
cmova rdx, qword [rsp + 0x5f0]
test r8, r8
je 0x14001ee90
mov rax, r8
mov rcx, rdx
mov rdi, r14
cmp word [rdx], 0x3a
je 0x14001ef43
nop dword [rax + rax]
cmp rax, 1
je 0x14001ef46
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14001ef30
mov rdi, rcx
test rdi, rdi
je 0x14001ee90
sub rdi, rdx
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001ee90
lea rcx, [rdi + 2]
cmp rcx, r8
jae 0x14001ee90
xorps xmm0, xmm0
movups xmmword [rsp + 0x530], xmm0
mov qword [rsp + 0x540], r14
mov qword [rsp + 0x548], r14
ja 0x140020846
lfence
mov rax, qword [rsp + 0x600]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 7
cmova rax, qword [rsp + 0x5f0]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x530]
call fcn.140006c60
mov r15d, dword [rsp + 0x30]
or r15d, 0x10
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov rax, qword [rsp + 0x540]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x260]
call fcn.1400226c0
nop dword [rax]
test al, al
je 0x14001f745
lea r8, [rsp + 0x530]
mov rdi, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x548]
cmp rsi, 7
cmova r8, rdi
movabs rdx, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x540]
lea r9, [rbx + rbx]
mov rcx, r14
test r9, r9
je 0x14001f085
nop word [rax + rax]
movzx eax, byte ds:[r8 + rcx]
xor rdx, rax
imul rdx, r13
inc rcx
cmp rcx, r9
jb 0x14001f070
mov rcx, qword [rsp + 0x150]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsp + 0x138]
mov r9, qword [rax + rcx*8 + 8]
mov r10, qword [rsp + 0x128]
cmp r9, r10
je 0x14001f111
mov r11, qword [rax + rcx*8]
lea rcx, ds:[r9 + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 7
jbe 0x14001f0c5
mov rcx, qword [rcx]
lea r8, [rsp + 0x530]
cmp rsi, 7
cmova r8, rdi
cmp rbx, rax
jne 0x14001f108
mov rdx, rbx
test rbx, rbx
je 0x14001f114
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001f108
add rcx, 2
sub rdx, 1
jne 0x14001f0f0
jmp 0x14001f114
cmp r9, r11
jne 0x14001f73b
mov r9, r14
mov rax, r10
test r9, r9
cmovne rax, r9
cmp rax, r10
jne 0x14001f473
lea rdx, ds:[rsp + 0x530]
cmp rsi, 7
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, rbx
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0xc000
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x1a0]
call fcn.140004e80
movsd xmm0, qword ds:[rax]
movsd qword [rsp + 0xf0], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x88], r12
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x40], xmm0
mov eax, dword [rsp + 0xf0]
test eax, eax
je 0x14001f345
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
sete bl
lea rcx, [rsp + 0x550]
call fcn.140005dc0
test bl, bl
je 0x14001f45b
lea rax, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rax, qword [rsp + 0x530]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140004f80
test al, al
jne 0x14001f45b
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov qword [rsp + 0x20], 3
lea r9, [0x1400530f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x540]
call fcn.140008f80
nop dword [rax]
cmp rax, 0xffffffffffffffff
jne 0x14001f354
lea rcx, ds:[rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov qword [rsp + 0x20], 3
lea r9, [0x1400588d0]
xor r8d, r8d
mov rdx, qword [rsp + 0x540]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
jne 0x14001f354
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x298]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
nop dword [rax + rax]
jmp 0x14001f45b
mov bl, 1
test ecx, ecx
jne 0x14002084c
jmp 0x14001f1d8
lea rdx, [rsp + 0x530]
mov rdi, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x548]
cmp rsi, 7
cmova rdx, rdi
movabs r9, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x540]
lea r8, [rbx + rbx]
mov rcx, r14
test r8, r8
je 0x14001f3a5
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14001f392
lea r8, ds:[rsp + 0x530]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x160]
call fcn.140007180
mov rcx, qword ds:[rax + 8]
mov rax, qword [rsp + 0x168]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x168]
je 0x14001f473
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x2b8]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
mov rdi, qword [rsp + 0x530]
mov rbx, qword [rsp + 0x540]
mov rsi, qword [rsp + 0x548]
lea rdx, [rsp + 0x530]
cmp rsi, 7
cmova rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, rbx
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0xc00
or r15d, 1
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rcx, qword [rsp + 0x550]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0x570]
call fcn.1400488b0
mov r8d, eax
test eax, eax
jne 0x14001f549
mov edx, dword [rsp + 0x580]
test dl, 1
mov ecx, 0x1ff
mov edi, 0x16d
cmovne ecx, edi
mov dword [rsp + 0x44], ecx
bt edx, 0xa
jae 0x14001f53b
mov eax, dword [rsp + 0x584]
cmp eax, 0xa000000c
jne 0x14001f52d
lea eax, [r8 + 4]
jmp 0x14001f572
cmp eax, 0xa0000003
jne 0x14001f53b
mov eax, 0xa
jmp 0x14001f572
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14001f572
mov dword [rsp + 0x44], 0xffff
sub eax, 2
je 0x14001f56d
sub eax, 1
je 0x14001f56d
nop dword [rax + rax]
sub eax, 0x32
je 0x14001f56d
cmp eax, 0x46
mov eax, r14d
jne 0x14001f572
mov eax, 1
mov dword [rsp + 0xa0], r8d
mov qword [rsp + 0xa8], r12
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x14001f5ed
mov dword ds:[rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
je 0x14001f5f6
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x14001f5f6
lea rdx, ds:[rsp + 0x530]
call fcn.1400477e0
test al, al
jne 0x14001f5f6
mov bl, 1
jmp 0x14001f5f8
test r8d, r8d
jne 0x14002085f
xor bl, bl
test r15b, 1
je 0x14001f642
and r15d, 0xfffffffe
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x568]
cmp r8, 7
jbe 0x14001f625
mov rdx, qword ds:[rsp + 0x550]
call fcn.1400064c0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], 7
mov word [rsp + 0x550], r14w
test bl, bl
je 0x14001f695
lea rdx, str.___Executed__Unsigned_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, ds:[rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0x120]
call fcn.1400067e0
nop
mov rdx, qword [rsp + 0x548]
cmp rdx, 7
jbe 0x14001f70f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f70a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001febe
call fcn.1400493f0
mov qword [rsp + 0x540], r14
mov qword [rsp + 0x548], 7
mov word [rsp + 0x530], r14w
movabs rsi, 0xcbf29ce484222325
jmp 0x14001ee90
mov r9, qword ds:[r9 + 8]
jmp 0x14001f0b1
lea rcx, ds:[rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov rax, qword [rsp + 0x540]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x1c0]
call fcn.1400226c0
test al, al
je 0x14001f92b
lea rax, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rax, qword [rsp + 0x530]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140004f80
test al, al
jne 0x14001f92b
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
xorps xmm0, xmm0
movups xmmword [rsp + 0x570], xmm0
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], r14
mov r8, qword [rsp + 0x540]
lea rcx, [rsp + 0x570]
call fcn.140006c60
or r15d, 0x600000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x570]
call fcn.140004e10
movzx ebx, al
lea rcx, [rsp + 0x570]
call fcn.140005dc0
test bl, bl
je 0x14001f8c2
lea rdx, [rsp + 0x530]
call fcn.1400477e0
test al, al
jne 0x14001f90f
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x14001f90f
lea rdx, [0x1400588d8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x2d8]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
lea rax, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rax, qword [rsp + 0x530]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140004f80
test al, al
jne 0x14001fe7c
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov rax, qword [rsp + 0x540]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x210]
call fcn.1400226c0
test al, al
jne 0x14001f9ff
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov rax, qword [rsp + 0x540]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x1e8]
call fcn.1400226c0
test al, al
je 0x14001fe5f
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, qword [rsp + 0x540]
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0x180000
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x1b0]
call fcn.140004e80
movsd xmm0, qword ds:[rax]
movsd qword [rsp + 0x70], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0x70]
test edx, edx
je 0x14001fa92
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x140020872
cmp ecx, 3
je 0x14001fb0d
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
xorps xmm0, xmm0
movups xmmword [rsp + 0x570], xmm0
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], r14
mov r8, qword [rsp + 0x540]
lea rcx, [rsp + 0x570]
call fcn.140006c60
or r15d, 0x3000000
or r15d, 4
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x570]
call fcn.140004e10
test al, al
je 0x14001fb0d
mov bl, 1
jmp 0x14001fb0f
xor bl, bl
test r15b, 4
je 0x14001fb2c
and r15d, 0xfffffffb
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x570]
call fcn.140005dc0
nop
test r15b, 2
je 0x14001fb73
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x568]
cmp r8, 7
jbe 0x14001fb56
mov rdx, qword [rsp + 0x550]
call fcn.1400064c0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], 7
mov word [rsp + 0x550], r14w
test bl, bl
je 0x14001fbc6
lea rdx, str.___Executed_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, qword [rsp + 0x540]
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0x60000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x550]
call fcn.140004e10
movzx ebx, al
mov r8, qword [rsp + 0x568]
cmp r8, 7
jbe 0x14001fc47
mov rdx, qword [rsp + 0x550]
call fcn.1400064c0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], 7
mov word [rsp + 0x550], r14w
test bl, bl
jne 0x14001fe5f
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov qword [rsp + 0x20], 3
lea r9, [0x1400530f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x540]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
jne 0x14001fd8b
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
mov qword [rsp + 0x20], 3
lea r9, [0x1400588d0]
xor r8d, r8d
mov rdx, qword [rsp + 0x540]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
jne 0x14001fd8b
lea rcx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rcx, qword [rsp + 0x530]
lea r8, [rdi + 1]
mov qword [rsp + 0x20], 1
lea r9, [0x140052380]
mov rdx, qword [rsp + 0x540]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
je 0x14001fe5f
lea rdx, str.___Executed__Deleted_file_without_extension__false_flags_here_cant_be_fixed_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14001fe5f
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r9, rsi
mov rax, qword [rsp + 0x540]
lea r8, [rax + rax]
mov rcx, r14
test r8, r8
je 0x14001fdd3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14001fdc0
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x160]
call fcn.140007180
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0x168]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x168]
je 0x14001fe5f
lea rdx, str.___Executed__Deleted_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.140006a60
lea rdx, [rsp + 0x530]
cmp qword [rsp + 0x548], 7
cmova rdx, qword [rsp + 0x530]
mov r8, qword [rsp + 0x540]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x530]
lea rdx, [rsp + 0x2f8]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
nop
mov rdx, qword [rsp + 0x548]
cmp rdx, 7
jbe 0x14001fecc
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fec7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
mov qword [rsp + 0x540], r14
mov qword [rsp + 0x548], 7
mov word [rsp + 0x530], r14w
jmp 0x14001ee90
lea rcx, [rsp + 0x320]
call fcn.140021ba0
nop dword [rax + rax]
test rax, rax
jne 0x14001ff29
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x310]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
lea rdx, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 7
cmova rdx, qword [rsp + 0x5b0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, qword [rsp + 0x5c0]
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0xc0
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rcx, qword [rsp + 0x550]
call fcn.140048c30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140020887
lea rcx, [rsp + 0x550]
call fcn.140005dc0
lea rdi, [0x140057ff8]
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], 0xb
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x570]
call fcn.140022ee0
or r15d, 0x20
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 7
cmova rcx, qword [rsp + 0x570]
call fcn.140048c30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400208a0
lea rcx, [rsp + 0x570]
call fcn.140005dc0
nop
jmp 0x14002005b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_executed_and_unsigned_files..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop word [rax + rax]
mov rax, qword [rsp + 0x420]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x420]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x420]
call fcn.1400224e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
nop dword [rax + rax]
test al, al
je 0x140020625
mov r9, qword [rsp + 0x600]
cmp r9, 0x190
ja 0x1400200b0
lea r8, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 7
cmova r8, qword [rsp + 0x5f0]
test r9, r9
je 0x1400200b0
mov rax, r9
mov rcx, r8
mov rdx, r14
cmp word [r8], 0x3a
je 0x140020163
nop dword [rax]
cmp rax, 1
je 0x140020166
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x140020150
mov rdx, rcx
test rdx, rdx
je 0x1400200b0
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x1400200b0
add rdx, 2
cmp rdx, r9
jae 0x1400200b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
ja 0x1400208b9
lfence
mov rax, qword [rsp + 0x600]
sub rax, rdx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 7
cmova rax, qword [rsp + 0x5f0]
lea rdx, [rax + rdx*2]
lea rcx, [rsp + 0x550]
call fcn.140006c60
mov r15d, dword [rsp + 0x30]
or r15d, 8
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rdx, qword [rsp + 0x550]
xorps xmm0, xmm0
movups xmmword [rsp + 0x630], xmm0
mov qword [rsp + 0x640], r14
mov qword [rsp + 0x648], r14
mov r8, qword [rsp + 0x560]
lea rcx, [rsp + 0x630]
call fcn.140006c60
lea r8, ds:[rsp + 0x630]
mov r10, qword [rsp + 0x630]
mov r11, qword [rsp + 0x648]
cmp r11, 7
cmova r8, r10
mov rcx, rsi
mov rbx, qword [rsp + 0x640]
lea r9, [rbx + rbx]
mov rdx, r14
test r9, r9
je 0x1400202a5
nop word [rax + rax]
movzx eax, byte ds:[rdx + r8]
xor rcx, rax
imul rcx, r13
inc rdx
cmp rdx, r9
jb 0x140020290
and rcx, qword [0x14006f920]
add rcx, rcx
mov rax, qword [0x14006f908]
mov r9, qword [rax + rcx*8 + 8]
mov rsi, qword [0x14006f8f8]
cmp r9, rsi
je 0x140020329
mov rdi, qword [rax + rcx*8]
nop dword [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400202e2
mov rax, qword [rax]
lea r8, [rsp + 0x630]
cmp r11, 7
cmova r8, r10
cmp rbx, rcx
jne 0x140020318
mov rdx, rbx
test rbx, rbx
je 0x14002032c
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140020318
add rax, 2
sub rdx, 1
jne 0x140020302
jmp 0x14002032c
nop dword [rax + rax]
cmp r9, rdi
jne 0x140020618
mov r9, r14
mov rbx, rsi
test r9, r9
cmovne rbx, r9
cmp r11, 7
jbe 0x140020375
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14002036d
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002036d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.1400493f0
mov qword [rsp + 0x640], r14
mov qword [rsp + 0x648], 7
mov word [rsp + 0x630], r14w
cmp rbx, rsi
jne 0x14002059c
lea rcx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rcx, qword [rsp + 0x550]
mov rax, qword [rsp + 0x560]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x238]
call fcn.1400226c0
test al, al
je 0x14002059c
lea rdx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rdx, qword [rsp + 0x550]
xorps xmm0, xmm0
movups xmmword [rsp + 0x570], xmm0
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], r14
mov r8, qword [rsp + 0x560]
lea rcx, [rsp + 0x570]
call fcn.140006c60
or r15d, 0x3000
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x60]
call fcn.140004e80
movsd xmm0, qword ds:[rax]
movsd qword [rsp + 0x100], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xe0], ecx
mov qword [rsp + 0xe8], r12
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x40], xmm0
mov eax, dword [rsp + 0x100]
test eax, eax
je 0x140020517
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], r12
cmp eax, 1
setne bl
lea rcx, [rsp + 0x570]
call fcn.140005dc0
test bl, bl
je 0x14002052d
lea rdx, [rsp + 0x550]
call fcn.1400477e0
nop word [rax + rax]
test al, al
jne 0x14002057f
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rdx, qword [rsp + 0x550]
mov r8, qword [rsp + 0x560]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14002057f
xor bl, bl
test ecx, ecx
jne 0x1400208bf
jmp 0x140020498
lea rdx, [0x1400588d8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.140006a60
lea rdx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rdx, qword [rsp + 0x550]
mov r8, qword [rsp + 0x560]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x550]
lea rdx, [rsp + 0x288]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
nop
mov rdx, qword [rsp + 0x568]
cmp rdx, 7
jbe 0x1400205ec
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400205e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400205e7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], 7
mov word [rsp + 0x550], r14w
movabs rsi, 0xcbf29ce484222325
jmp 0x1400200b0
mov r9, qword ds:[r9 + 8]
jmp 0x1400202d0
lea rcx, [rsp + 0x430]
call fcn.140021ba0
test rax, rax
jne 0x14002065b
mov rax, qword [rsp + 0x420]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x420]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov bl, 1
mov byte [rsp + 0x34], bl
lea rdx, [rsp + 0x590]
cmp qword [rsp + 0x5a8], 7
cmova rdx, qword [rsp + 0x590]
xorps xmm0, xmm0
movups xmmword [rsp + 0x550], xmm0
mov qword [rsp + 0x560], r14
mov qword [rsp + 0x568], r14
mov r8, qword [rsp + 0x5a0]
lea rcx, [rsp + 0x550]
call fcn.140006c60
or r15d, 0x300
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x550]
cmp qword [rsp + 0x568], 7
cmova rcx, qword [rsp + 0x550]
call fcn.140048c30
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400208d2
lea rcx, [rsp + 0x550]
call fcn.140005dc0
nop
jmp 0x14001edf0
mov r8, qword [rsp + 0x608]
cmp r8, 7
jbe 0x140020728
mov rdx, qword [rsp + 0x5f0]
call fcn.1400064c0
mov qword [rsp + 0x600], r14
mov qword [rsp + 0x608], 7
mov word [rsp + 0x5f0], r14w
lea rcx, [rsp + 0x1e8]
call fcn.140016720
nop
lea rcx, [rsp + 0x210]
call fcn.140016720
nop
lea rcx, [rsp + 0x238]
call fcn.140016720
nop
lea rcx, [rsp + 0x1c0]
call fcn.140016720
nop
lea rcx, [rsp + 0x260]
call fcn.140016720
nop
lea rcx, [rsp + 0x160]
call fcn.140008460
nop
lea rcx, [rsp + 0x420]
call fcn.14001dd80
nop
lea rcx, [rsp + 0x310]
call fcn.14001dd80
nop
mov rdx, qword [rsp + 0x5e8]
cmp rdx, 0xf
jbe 0x14001ebaf
inc rdx
mov rcx, qword [rsp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ebaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ebaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
shr rdx, 0x20
lea r8, [rsp + 0x570]
lea rcx, [0x140057ca0]
call fcn.14000a0c0
nop
shr rdx, 0x20
lea r8, [rsp + 0x570]
lea rcx, [0x140057ca0]
call fcn.14000a0c0
nop
call fcn.1400088c0
nop
lea r8, [rsp + 0x550]
lea rdx, [rsp + 0x40]
call fcn.140004db0
nop
lea r8, [rsp + 0x550]
lea rdx, [rsp + 0x40]
call fcn.140004db0
nop
lea r8, [rsp + 0x550]
lea rcx, str.status
call fcn.14000a0c0
nop
shr rdx, 0x20
lea r8, [rsp + 0x550]
lea rcx, [0x140057ca0]
call fcn.14000a0c0
nop
shr rdx, 0x20
lea r8, [rsp + 0x570]
lea rcx, [0x140057ca0]
call fcn.14000a0c0
nop
call fcn.1400088c0
nop
lea r8, [rsp + 0x570]
lea rdx, [rsp + 0x40]
call fcn.140004db0
nop
shr rdx, 0x20
lea r8, [rsp + 0x550]
lea rcx, [0x140057ca0]
call fcn.14000a0c0
int3
movzx ecx, dl
jmp 0x14001e4c0